City website security rankings
Project ScanGov security rankings for U.S. city websites, with the most common failures.
A 93
Average security score of 216 fully scanned city sites
216 of 267
City sites fully scanned. We couldn't fully scan 51, so they're listed without grades
54%
Fully scanned city sites earning an A for security (116 sites)
1%
Fully scanned city sites earning a D or F for security (2 sites)
How U.S. city security scores are distributed
Smoothed distribution of the 216 fully scanned U.S. city sites, score 0 to 100. Height shows how many sites score near each value.
Distribution of 216 scores. The data table lists counts by score range.
- Average
View the data table
| Score range | Sites |
|---|---|
| 0 to 9 | 0 |
| 10 to 19 | 0 |
| 20 to 29 | 0 |
| 30 to 39 | 0 |
| 40 to 49 | 0 |
| 50 to 59 | 0 |
| 60 to 69 | 2 |
| 70 to 79 | 15 |
| 80 to 89 | 83 |
| 90 to 100 | 116 |
City sites by security grade
One dot per city site, colored by its security grade. Select a dot to open that site's report. The table lists every site.
- A (90 to 100)
- B to C (70 to 89)
- D to F (below 70)
- Not fully scanned
11 city sites have no map location yet and appear only in the table.
U.S. city sites by security grade
Share of the 216 fully scanned U.S. city sites in each grade band
- A (90 to 100)
- B to C (70 to 89)
- D to F (below 70)
View the data table
| Group | A (90 to 100) | B to C (70 to 89) | D to F (below 70) |
|---|---|---|---|
| All U.S. city sites | 54% (116) | 45% (98) | 1% (2) |
What each check means
- Errors in the console. The page loads without JavaScript or network errors. Site may have hidden bugs that break features.
- Sponsored top-level domain (sTLD). The site uses a government-issued domain (.gov, .edu, or .mil). People cannot tell if your site is real government.
- X-Content-Type-Options. The site tells browsers not to guess the type of files it serves. Browsers might run dangerous files by mistake.
- Security.txt. The site has a security.txt file so researchers know how to report issues. Security researchers cannot report problems to you.
- Paste preventing inputs. The page lets users paste content into form fields. Users cannot use password managers safely.
All city sites by security score
Page 1 of 3
About security
Secure your site and protect users with proper security practices.
Why it's important
Strong defenses prevent hackers from stealing personal information and other confidential data.
Risks
- Hackers can steal private information from your site.
Guidance
What we use to grade security:
- CISA Website Security
- 21st Century Integrated Digital Experience Act (IDEA)
- CISA Cybersecurity Performance Goals
- RFC 9116
- OWASP Top 10
- U.S. Federal Website Standards
Standards
- Content security policy (CSP)
- HTTP Strict Transport Security (HSTS)
- security.txt
- X-Content-Type-Options
- Errors in the console
- Clickjacking mitigation
- Paste preventing inputs
- Hypertext Transfer Protocol Secure (HTTPS)
- Sponsored top-level domain (sTLD)
Grades/scores
ScanGov
About this ranking
About this data
ScanGov scans the homepage of the main website of each city on our city list. Scores come from the checks in the ScanGov standards. Sites were scanned between 7/21/2026 and 10/25/2026. Each site's report shows its own scan date. A site counts as fully scanned when its homepage loaded and sent us its page content. Averages, grade shares, failure rates, and ranks use fully scanned sites only. We could not fully scan 51 sites. They did not respond, blocked the scanner, or sent no page content. They appear in the table without grades, with their scan status, and are left out of every figure. Grades follow the ScanGov grade scale. Rank follows the ScanGov ranking method. The full dataset, with every county's raw results, is in the ScanGov data repository.