Overview
Government's WAF coverage is unusually low — active barriers carry the load
| Value | |
|---|---|
| WAF | 80% |
| Antibot | 10% |
| CAPTCHA | 8% |
| JavaScript | 33% |
| Rate Limiting | 15% |
| TLS | 12% |
WAF covers only 80% of Government sites, well below the global norm. JavaScript (33%) and Rate Limiting (15%) absorb the defensive weight in a sector that leans on active challenge layers over firewall coverage.
Barrier Landscape
WAF leads Government at 80% — JavaScript is the main secondary layer
| Value | |
|---|---|
| WAF | 80% |
| Antibot | 10% |
| CAPTCHA | 8% |
| JavaScript | 33% |
| Rate Limiting | 15% |
| TLS | 12% |
| Has robots.txt | 64% |
| Blocks AI crawlers | 10% |
WAF dominates at 80%. JavaScript (33%) leads active secondary barriers, followed by Rate Limiting (15%). The remaining three barriers all sit at or below 12% — a concentrated rather than broadly stacked profile.
One in 6 Government sites carries no access barriers at all
| % of sites | |
|---|---|
| 0 barriers | 17% |
| 1 barrier | 33% |
| 2 barriers | 32% |
| 3 barriers | 12% |
| 4 barriers | 5% |
| 5 barriers | 1% |
| 6 barriers | 0% |
17% of Government sites deploy zero barriers — higher than most sectors. Single-barrier configurations are the modal count. Only 18% of sites stack three or more barriers.
Government is predominantly Simple to access, with a significant Easy minority
| Mean recommended tier | |
|---|---|
| All sites | 1.69 |
A mean recommended tier of 1.69 and a median of Easy place Government around the middle of the sectors surveyed. 48% of sites are Simple to access; 11% require Moderate or above.
Simple is the dominant tier in Government, but Easy accounts for a significant share
| % of sites | |
|---|---|
| 1 - Simple | 48% |
| 2 - Easy | 41% |
| 3 - Moderate | 6% |
| 4 - Complex | 4% |
| 5 - Advanced | 1% |
Simple (48%) is the most common tier. Simple and Easy together account for 89% of sites, while 6% land at Moderate and 5% at Complex or Advanced.
robots.txt
Nearly two-thirds of Government sites publish a robots.txt
| % of sites | |
|---|---|
| Publish a valid robots.txt | 64% |
Only 64% of Government sites have a valid robots.txt. Nearly 36% leave crawl policy undefined — one of the lower coverage rates across surveyed sectors.
Most Government sites name one bot or none in their robots.txt
| % of sites | |
|---|---|
| 0 | 43% |
| 1 | 37% |
| 2–4 | 9% |
| 5–9 | 5% |
| 10–15 | 2% |
| 16+ | 4% |
43% of Government sites name zero agents and 37% name one. A mean of 2.9 is pulled up by a small number of sites with extensive policies, while the median stays at 1.
AI crawlers draw the most robots.txt attention in Government
| % of sites | |
|---|---|
| AI crawlers | 10% |
| SEO / search indexing | 4% |
| SEO audit tools | 4% |
| Commercial scrapers | 3% |
| Social / content scrapers | 5% |
| Archive / research crawlers | 3% |
| Monitoring / uptime bots | 0% |
AI crawlers are named in 10% of Government robots.txt files, followed by Social / content scrapers at 5%. All figures are percentages of all 100 sites including those with no robots.txt.
Uniform per-agent rules dominate Government robots.txt files
| % of sites | |
|---|---|
| Uniform per-agent rules | 32% |
| Path-level mixed rules | 26% |
| Allow-only (no Disallow rules) | 5% |
| Mixed AI posture | 0% |
| Blanket Disallow: / | 1% |
Uniform per-agent rules lead at 32%, with path-level mixed rules at 26%. Mixed AI posture (0%) and blanket Disallow (1%) are minimal.
AI crawlers are among the most-targeted agents in Government robots.txt
| Disallowed | Allowed (whitelisted) | |
|---|---|---|
| * | 51% | 31% |
| GPTBot | 9% | — |
| ClaudeBot | 6% | — |
| Google-Extended | 6% | — |
| PerplexityBot | 6% | — |
| Amazonbot | 6% | — |
| CCBot | 6% | — |
| ChatGPT-User | 6% | — |
| meta-externalagent | 6% | — |
| Twitterbot | 3% | 3% |
| Bytespider | 5% | — |
| OAI-SearchBot | 5% | — |
| Applebot-Extended | 4% | — |
| FacebookBot | 4% | — |
| anthropic-ai | 4% | — |
| cohere-ai | 4% | — |
| omgili | 4% | — |
| Googlebot | 4% | — |
| Claude-Web | 3% | — |
| DeepSeekBot | 3% | — |
| DuckAssistBot | 3% | — |
| Timpibot | 3% | — |
| meta-externalfetcher | 3% | — |
| Slurp | 3% | — |
| AwarioSmartBot | 2% | — |
Values are percentages of all 100 Government sites surveyed. The wildcard (*) leads at 51% Disallow. Among named agents, GPTBot, ClaudeBot lead the Disallow list — reflecting direct targeting of AI training and indexing bots.
Industry Cohort
Government leads the Public Sector cohort on AI-blocking policy
| WAF | Antibot | CAPTCHA | JavaScript | Rate Limit | TLS | robots.txt | Blocks AI | Tier | |
|---|---|---|---|---|---|---|---|---|---|
| Government | 80% | 10% | 8% | 33% | 15% | 12% | 64% | 10% | Tier 2 |
| Military | 77% | 11% | 16% | 21% | 19% | 17% | 62% | 7% | Tier 1 |
| Political Organizations | 97% | 13% | 23% | 47% | 16% | 9% | 79% | 6% | Tier 1 |
| Public Policy | 96% | 9% | 9% | 28% | 11% | 9% | 86% | 8% | Tier 1 |
| Public Safety | 94% | 12% | 25% | 44% | 18% | 14% | 74% | 6% | Tier 1 |
Government's 10% AI-blocking rate in robots.txt is the highest in the Public Sector cohort. WAF (80%) and JavaScript (33%) sit mid-table in the cohort on technical barriers.