Nine in ten websites run a WAF — it is the universal first line of defence
| of sites have WAF detected | |
|---|---|
| WAF Adoption | 92.4% |
WAF detection runs at 92.4% across all 11,100 landing pages — making it by far the most ubiquitous access barrier in the dataset. Unlike CAPTCHA or antibot systems, which require deliberate procurement decisions, WAF capability is often bundled invisibly into CDN and cloud hosting infrastructure, which helps explain why even sites in low-risk industries almost always register one.
The vendor market
WAF fingerprinting identifies 18 distinct vendors — but one in three sites defeats attribution
| Value | |
|---|---|
| Cloudflare | Share: 34.6% of WAF sites |
| Generic / Unidentified | Share: 31.6% of WAF sites |
| Amazon CloudFront | Share: 9.6% of WAF sites |
| Akamai Kona SiteDefender | Share: 4.9% of WAF sites |
| AWS Elastic Load Balancer | Share: 4.3% of WAF sites |
| Varnish | Share: 1.7% of WAF sites |
| F5 BIG-IP | Share: 1.6% of WAF sites |
| Imperva (Incapsula) | Share: 1.4% of WAF sites |
| Azure Front Door | Share: 1.3% of WAF sites |
| Google Cloud Armor | Share: 1.3% of WAF sites |
| Envoy | Share: 1.2% of WAF sites |
| WordFence | Share: 0.5% of WAF sites |
| Sucuri CloudProxy | Share: 0.3% of WAF sites |
| Azure App Gateway | Share: 0.3% of WAF sites |
| DDoS-GUARD | Share: 0.2% of WAF sites |
| Citrix NetScaler | Share: 0.2% of WAF sites |
| Qrator | Share: 0.2% of WAF sites |
| LiteSpeed | Share: 0.2% of WAF sites |
Orange bar: Cloudflare, the dominant named vendor. Blue bars: cloud platform and CDN vendors — Amazon CloudFront, AWS Elastic Load Balancer, Azure, Google Cloud Armor, Envoy, Varnish — where WAF capability ships as part of hosting infrastructure, not as a deliberate security product. Purple bars: dedicated security WAF vendors ranging from enterprise platforms (Akamai, Imperva, F5) to application-layer tools (WordFence, Sucuri). One in three detections return no attribution at all — a true fingerprinting blind spot.
Security posture
WAF-protected sites deploy every other barrier at dramatically higher rates
| WAF sites | All other sites | |
|---|---|---|
| JavaScript | 43.3% | 7.9% |
| CAPTCHA | 24.4% | 0.8% |
| Rate Limiting | 23.7% | 3% |
| Antibot | 19.7% | 3.5% |
| TLS | 13.3% | 19.7% |
CAPTCHA is nearly exclusive to WAF-protected sites — WAF+ sites deploy it at 24.4% versus just 0.8% for sites without a WAF. Rate Limiting and Antibot show similarly stark gaps. TLS fingerprinting is the sole exception: WAF-free sites record a higher rate (19.7% vs 13.3%), consistent with TLS fingerprinting serving as a fallback layer for sites that lack other active defences.
By industry
Service industries and niche sectors cluster at near-universal WAF coverage
| Value | |
|---|---|
| Customer Services | 100% |
| Veterinary | 100% |
| Graphic Design | 99% |
| Design | 99% |
| TV & Movies | 99% |
| Crafts | 98% |
| Plastics & Polymers | 98% |
| Education | 98% |
| Sports | 98% |
| Printing | 98% |
| Tobacco | 98% |
| Writing & Editing | 98% |
| Visual Art | 98% |
| Warehousing | 98% |
| Wellness | 98% |
Customer services and veterinary both reach 100% — likely driven by high platform consolidation around a small number of WAF-enabled cloud providers. All 15 top industries meet or exceed 98%, suggesting WAF has become a platform default rather than a deliberate security investment in these sectors.
Even the least-protected industries exceed three-quarters coverage
| Value | |
|---|---|
| Hospitality | 86% |
| Consumer Electronics | 86% |
| Insurance | 86% |
| Pharmaceuticals | 84% |
| Public Utilities | 83% |
| Events & Services | 83% |
| Chemicals | 83% |
| Legal | 83% |
| Jewelry & Luxury | 83% |
| Travel & Tourism | 81% |
| Reference | 81% |
| Government | 80% |
| Transportation & Logistics | 78% |
| Military | 77% |
| Airlines | 76% |
Airlines at 76% and military at 77% are the furthest below the 92.4% global average — a 16-point gap driven by specialist hosting infrastructure predating the modern cloud WAF era. The no industry in the bottom 15 falls below 76%, underlining that there is no major industry where WAF is genuinely rare. The floor has risen.
By geography
WAF is near-universal globally — Japan stands as the clear exception
| WAF | |
|---|---|
| Afghanistan | 93.8% |
| Åland Islands | 93.9% |
| Albania | 93.4% |
| Algeria | 92.9% |
| American Samoa | 95% |
| Andorra | 92.8% |
| Angola | 91.4% |
| Anguilla | 93.6% |
| Antigua and Barbuda | 94.1% |
| Argentina | 92.9% |
| Armenia | 93.6% |
| Aruba | 93.1% |
| Australia | 92.9% |
| Austria | 93.6% |
| Azerbaijan | 92.8% |
| Bahamas | 92.9% |
| Bahrain | 93.5% |
| Bangladesh | 93.2% |
| Barbados | 92.7% |
| Belarus | 93.7% |
| Belgium | 92.8% |
| Belize | 91.7% |
| Benin | 93.6% |
| Bermuda | 93% |
| Bhutan | 93.7% |
| Bolivia | 92.9% |
| Bosnia-Herzegovina | 93% |
| Botswana | 91.9% |
| Brazil | 92.6% |
| British Indian Ocean Terr. | 85.4% |
| British Virgin Islands | 93% |
| Brunei | 93.1% |
| Bulgaria | 92.4% |
| Burkina Faso | 93.8% |
| Burundi | 93.2% |
| Cabo Verde | 93.9% |
| Cambodia | 92.4% |
| Cameroon | 93% |
| Canada | 92.9% |
| Cayman Islands | 94.5% |
| Central African Republic | 94.8% |
| Chad | 91.8% |
| Chile | 92.8% |
| China | 92.2% |
| Colombia | 93.1% |
| Comoros | 90.9% |
| Congo | 92.5% |
| Cook Islands | 93.1% |
| Costa Rica | 93% |
| Côte d'Ivoire | 93.5% |
| Croatia | 93.2% |
| Curaçao | 95.1% |
| Cyprus | 93.4% |
| Czechia | 93.4% |
| Denmark | 93.6% |
| Djibouti | 91.5% |
| Dominica | 93.3% |
| Dominican Republic | 93.5% |
| DR Congo | 93.6% |
| Ecuador | 93.2% |
| Egypt | 92.1% |
| El Salvador | 93.9% |
| Equatorial Guinea | 93.6% |
| Eritrea | 93.5% |
| Estonia | 93% |
| Eswatini | 94.5% |
| Ethiopia | 92.1% |
| Falkland Islands | 95.3% |
| Faroe Islands | 94.9% |
| Fiji | 92.4% |
| Finland | 93.5% |
| France | 92.3% |
| French Polynesia | 94% |
| Gabon | 93.3% |
| Gambia | 93.4% |
| Georgia | 93.2% |
| Germany | 93.5% |
| Ghana | 92.8% |
| Greece | 93.2% |
| Greenland | 94.5% |
| Grenada | 92.8% |
| Guam | 92.3% |
| Guatemala | 93.4% |
| Guernsey | 94.6% |
| Guinea | 93.3% |
| Guinea-Bissau | 94.1% |
| Guyana | 92.8% |
| Haiti | 92.7% |
| Honduras | 92.8% |
| Hong Kong SAR | 91.8% |
| Hungary | 92.9% |
| Iceland | 93.6% |
| India | 92.7% |
| Indonesia | 91.9% |
| Iraq | 92.8% |
| Ireland | 92.6% |
| Isle of Man | 93.8% |
| Israel | 93.3% |
| Italy | 93.1% |
| Jamaica | 92% |
| Japan | 86.4% |
| Jersey | 93.2% |
| Jordan | 92.6% |
| Kazakhstan | 93.1% |
| Kenya | 93.3% |
| Kiribati | 93% |
| Kuwait | 93% |
| Kyrgyzstan | 92.7% |
| Laos | 92.9% |
| Latvia | 93.1% |
| Lebanon | 93.1% |
| Lesotho | 93.5% |
| Liberia | 92.9% |
| Liechtenstein | 94.3% |
| Lithuania | 93.1% |
| Luxembourg | 93.6% |
| Macao SAR | 90.8% |
| Madagascar | 92.6% |
| Malawi | 92.2% |
| Malaysia | 92.6% |
| Maldives | 92.4% |
| Mali | 92.8% |
| Malta | 93.9% |
| Marshall Islands | 92.6% |
| Mauritania | 95.2% |
| Mauritius | 92.8% |
| Mexico | 92.5% |
| Micronesia | 93.1% |
| Moldova | 93.6% |
| Monaco | 94.5% |
| Mongolia | 92.7% |
| Montenegro | 94.3% |
| Montserrat | 93.6% |
| Morocco | 93.1% |
| Mozambique | 92.9% |
| Nauru | 93.5% |
| Nepal | 93.1% |
| Netherlands | 93.5% |
| New Caledonia | 93% |
| New Zealand | 93% |
| Nicaragua | 93.9% |
| Niger | 93.1% |
| Nigeria | 93.7% |
| Niue | 100% |
| Norfolk Island | 93.7% |
| North Macedonia | 93.3% |
| Northern Mariana Islands | 93.9% |
| Norway | 93.3% |
| Oman | 92.3% |
| Pakistan | 93.1% |
| Palau | 93.9% |
| Palestine | 92.5% |
| Panama | 93.1% |
| Papua New Guinea | 92.2% |
| Paraguay | 92.6% |
| Peru | 92.9% |
| Philippines | 92.8% |
| Poland | 94% |
| Portugal | 92.8% |
| Puerto Rico | 92.7% |
| Qatar | 92.6% |
| Romania | 93.7% |
| Russia | 93.2% |
| Rwanda | 92.5% |
| Saint Barthélemy | 92.4% |
| Saint Helena | 93.2% |
| Saint Kitts and Nevis | 94.7% |
| Saint Lucia | 93.8% |
| Saint Martin | 93.6% |
| Saint Pierre-Miquelon | 96.6% |
| Saint Vincent | 94.4% |
| Samoa | 93.2% |
| San Marino | 93% |
| São Tomé and Príncipe | 91.3% |
| Saudi Arabia | 92.8% |
| Senegal | 92.5% |
| Serbia | 92.4% |
| Seychelles | 92.1% |
| Sierra Leone | 93.2% |
| Singapore | 92.3% |
| Sint Maarten | 94.5% |
| Slovakia | 93.9% |
| Slovenia | 92.9% |
| Solomon Islands | 93.6% |
| Somalia | 94.3% |
| South Africa | 93.2% |
| South Korea | 92.4% |
| South Sudan | 93.5% |
| Spain | 92.6% |
| Sri Lanka | 92.3% |
| Suriname | 94% |
| Sweden | 94.1% |
| Switzerland | 92.9% |
| Taiwan | 90.9% |
| Tajikistan | 93% |
| Tanzania | 93% |
| Thailand | 91.9% |
| Timor-Leste | 91% |
| Togo | 93% |
| Tonga | 94.2% |
| Trinidad and Tobago | 94.2% |
| Tunisia | 93.8% |
| Turkey | 93.2% |
| Turkmenistan | 93.7% |
| Turks and Caicos | 93.6% |
| Uganda | 92.4% |
| Ukraine | 93.4% |
| United Arab Emirates | 92.4% |
| United Kingdom | 93.4% |
| United States | 93.2% |
| Uruguay | 92.8% |
| US Virgin Islands | 93.7% |
| Uzbekistan | 93.1% |
| Vanuatu | 94.3% |
| Vatican City | 92.4% |
| Venezuela | 93.6% |
| Vietnam | 91.4% |
| Wallis and Futuna | 92.8% |
| Yemen | 92.4% |
| Zambia | 92.8% |
| Zimbabwe | 92.3% |
All six world regions cluster between 92.5% and 93.4% — a spread of less than one percentage point. Japan is the global outlier at 86%, reflecting a domestic web ecosystem built around local CDN and hosting providers that sit largely outside the Western WAF stack. Taiwan and Macao also trail the global average. Almost every other country in the sample exceeds 91%.