Overview
Banking runs lighter on WAF than almost any other surveyed sector
| Value | |
|---|---|
| WAF | 86% |
| Antibot | 19% |
| CAPTCHA | 10% |
| JavaScript | 36% |
| Rate Limiting | 12% |
| TLS | 11% |
WAF covers 86% of Banking sites — around 7 points below the global norm. JavaScript (36%) and antibot (19%) lead the secondary layer. CAPTCHA (10%), Rate Limiting (12%) and TLS (11%) all sit low, reflecting a sector that relies on network-layer defences over active bot challenges.
Barrier Landscape
JavaScript and antibot carry Banking's secondary barrier load
| Value | |
|---|---|
| WAF | 86% |
| Antibot | 19% |
| CAPTCHA | 10% |
| JavaScript | 36% |
| Rate Limiting | 12% |
| TLS | 11% |
| Has robots.txt | 72% |
| Blocks AI crawlers | 4% |
WAF leads at 86%, with JavaScript (36%) and antibot (19%) as the main secondary barriers. CAPTCHA (10%), Rate Limiting (12%) and TLS (11%) remain low — Banking concentrates its defences in WAF and selective active challenges rather than broad stacking.
Two-barrier stacks are Banking's most common security posture
| % of sites | |
|---|---|
| 0 barriers | 8% |
| 1 barrier | 35% |
| 2 barriers | 41% |
| 3 barriers | 10% |
| 4 barriers | 3% |
| 5 barriers | 3% |
| 6 barriers | 0% |
41% of Banking sites carry exactly two barriers — the modal count. 35% carry one, and 8% carry none. Just 16% stack three or more barriers. Banking stacks fewer defences per site than most sectors.
Half of Banking sites are Simple to access — but Easy tiers are common too
| Mean recommended tier | |
|---|---|
| All sites | 1.66 |
A mean recommended tier of 1.66 and a median of Easy place Banking around the middle of the sectors surveyed. 49% of sites are Simple to access; 12% require Moderate or above.
Simple and Easy tiers cover nine in ten Banking sites
| % of sites | |
|---|---|
| 1 - Simple | 49% |
| 2 - Easy | 39% |
| 3 - Moderate | 9% |
| 4 - Complex | 3% |
| 5 - Advanced | 0% |
Simple (49%) is the most common tier. Simple and Easy together account for 88% of sites, while 9% land at Moderate and 3% at Complex or Advanced.
robots.txt
Nearly a third of Banking sites publish no robots.txt at all
| % of sites | |
|---|---|
| Publish a valid robots.txt | 72% |
72% of Banking sites publish a valid robots.txt. The remaining 28% leave crawl policy entirely undefined — a higher gap than most sectors.
Most Banking sites name just one bot or none in their robots.txt
| % of sites | |
|---|---|
| 0 | 32% |
| 1 | 43% |
| 2–4 | 15% |
| 5–9 | 6% |
| 10–15 | 0% |
| 16+ | 4% |
43% of Banking sites name exactly one bot agent; 32% name none. A mean of 5.7 named agents is pulled upward by a small number of sites with comprehensive agent lists, while the median stays at 1.
Traditional search crawlers draw more attention than AI agents in Banking robots.txt
| % of sites | |
|---|---|
| AI crawlers | 6% |
| SEO / search indexing | 9% |
| SEO audit tools | 4% |
| Commercial scrapers | 0% |
| Social / content scrapers | 1% |
| Archive / research crawlers | 5% |
| Monitoring / uptime bots | 0% |
No bot category exceeds 9% mention rate in Banking robots.txt files. Search indexing bots lead at 9%, just ahead of AI crawlers at 6%. Commercial scrapers draw zero explicit mentions.
Path-level mixed rules dominate Banking robots.txt posture
| % of sites | |
|---|---|
| Uniform per-agent rules | 27% |
| Path-level mixed rules | 41% |
| Allow-only (no Disallow rules) | 4% |
| Mixed AI posture | 0% |
| Blanket Disallow: / | 0% |
Of the 72% of Banking sites with robots.txt, path-level mixed rules lead at 41%, with uniform per-agent rules at 27%. No Banking site maintains a mixed AI posture or issues a blanket Disallow.
Banking robots.txt targets Googlebot and Yandex, not AI crawlers
| Disallowed | Allowed (whitelisted) | |
|---|---|---|
| * | 63% | 45% |
| Googlebot | 7% | 5% |
| Yandex | 6% | 6% |
| Googlebot-Mobile | 4% | 1% |
| Googlebot-Image | 2% | 1% |
| ia_archiver | 3% | — |
| EmailSiphon | 3% | — |
| EmailWolf | 3% | — |
| ExtractorPro | 3% | — |
| NetAnts | 3% | — |
| SiteSnagger | 3% | — |
| WebAuto | 3% | — |
| WebCopier | 3% | — |
| WebSauger | 3% | — |
| WebStripper | 3% | — |
| Zeus | 3% | — |
| larbin | 3% | — |
| GPTBot | 3% | — |
| Adsbot-Google | 2% | — |
| Bingbot | 1% | 1% |
| AhrefsBot | 2% | — |
| OmniExplorer_Bot | 2% | — |
| Gigabot | 2% | — |
| HTTrack | 2% | — |
| MJ12bot | 2% | — |
Values are percentages of all 100 Banking sites surveyed. The wildcard (*) dominates at 63% Disallow. Named rules focus on traditional search bots — Googlebot and Yandex appear most. GPTBot appears among the top named agents but at a modest rate, reflecting Banking's limited engagement with AI-specific crawl policy.
Industry Cohort
Banking sits mid-table within Financial Services on barrier adoption
| WAF | Antibot | CAPTCHA | JavaScript | Rate Limit | TLS | robots.txt | Blocks AI | Tier | |
|---|---|---|---|---|---|---|---|---|---|
| Accounting & Auditing | 93% | 15% | 13% | 40% | 8% | 10% | 63% | 1% | Tier 1 |
| Banking | 86% | 19% | 10% | 36% | 12% | 11% | 72% | 4% | Tier 2 |
| Finance | 88% | 27% | 15% | 36% | 22% | 16% | 82% | 13% | Tier 2 |
| Insurance | 86% | 26% | 19% | 37% | 17% | 13% | 71% | 3% | Tier 2 |
| Investment | 94% | 23% | 14% | 41% | 19% | 9% | 76% | 5% | Tier 1 |
| Venture Capital | 92% | 15% | 14% | 33% | 20% | 15% | 79% | 2% | Tier 1 |
Across Financial Services sub-categories, Banking's 86% WAF rate is among the lower end of the cohort. JavaScript (36%) and antibot (19%) are consistent with sector peers. AI-blocking via robots.txt (4%) is notably low relative to the cohort.