I build DeployVet, a free tool that does a website security and bug check from the outside and grades the site A to F. I wanted to share what the numbers look like after the first week, and be clear about what they do not prove.
The short version
- Oct 20 to 26, 2026: 645 checks on 633 unique domains (our own test domains excluded).
- Using each domain's latest grade: 260 domains (about 41%) scored A or B, and 372 (about 59%) scored C, D or F. One had no grade.
- The public counter read 650 total checks as of Mon Oct 26, 2026, about 11:55 AM Central.
- On the public board, the 20 lowest results were 4 F, 9 D and 7 C. The 20 highest were all A (19 scored 100, one scored 95).
These sites are ones people chose to type in, not a random sample. Read the method notes before you quote any of this.
Grade tables
All domains checked, Oct 20 to 26, 2026 (latest grade per domain, 633 domains):
| Grade group | Domains | Share of 633 |
|---|---|---|
| A or B | 260 | about 41% |
| C, D or F | 372 | about 59% |
| No grade | 1 | under 1% |
The query reports A/B and C/D/F as groups, so I am not giving a count for each single letter.
Newest 10 on the public board:
| Grade | Count |
|---|---|
| A | 5 |
| B | 2 |
| C | 1 |
| D | 2 |
| F | 0 |
Scores in this slice run from 46 to 100.
20 lowest on the board:
| Grade | Count | Score range |
|---|---|---|
| F | 4 | 11 to 39 |
| D | 9 | 46 to 56 |
| C | 7 | 61 to 71 |
20 highest on the board:
| Grade | Count | Score range |
|---|---|---|
| A | 20 | 95 to 100 |
The board tables are a small, opt-in slice. Do not read them as the overall picture; the first table is the overall one.
How grading works
- A is 90 and up, B is 75 and up, C is 60 and up, D is 40 and up, and F is below 40.
- Each problem takes points off based on how serious it is. A serious problem also caps the grade. One critical finding keeps a site at F. One high-severity finding keeps it at D or below.
- The free check shows only the worst problem it found, with a plain-English fix. It does not list everything.
What the checker looks at
It only reads what any visitor can already see. It does not log in, guess passwords or try to break anything, and it follows robots.txt.
- Does the padlock (HTTPS) work, and does http redirect to https?
- Are the usual browser safety settings (security headers) set?
- Are private files like /.env or other sensitive paths reachable from the outside?
- Do the pages load?
This is not a penetration test. It cannot see behind a login and it cannot judge your business logic.
Method notes and limits
- Source: a read-only query of the free check results table in our database.
- Window: Oct 20 to 26, 2026.
- Latest grade per domain: if a domain was checked more than once, only its most recent grade is counted in the A/B vs C/D/F split. The 645 figure counts every check, including repeats.
- Exclusions: our own test domains, deployvet.com and example.com. Some other test-looking domains may remain in the data, so treat the counts as approximate.
- Not a random sample. These are sites people typed in themselves. Sites whose owners care about security, or who suspect a problem, may be more likely to run it, and I cannot tell which way that pushes the numbers.
- The 650 total on the public counter and the 645 in the query are different counts (different filters and time of day). I am using the query for the split and the counter only as a running total.
- The public board shows only 50 rows at a time (20 highest, 20 lowest, 10 newest), opt-in, with masked domains. I cannot tell you what kinds of sites they were, and I will not name anyone.
- Not every site checked was made with an AI or no-code tool. I do not have a clean way to tell, so I will not make claims about "AI-built sites" as a group.
- Scores can change as the scanner changes. A grade is a snapshot from the day it was run.
- Automated checks make mistakes, both missing things and flagging things that are fine.
What I do not know yet
I do not have a verified breakdown of which problems come up most often, so I am not going to guess at one. If I get that checked properly, I will post it.
Your turn
If you have shipped something built with an AI tool, what is the last thing you check before you share the link?
I build DeployVet. If you want to try the free check: https://deployvet.com/?utm_source=devto&utm_campaign=datapost
Top comments (0)