Overview
JavaScript leads Public Utility's secondary barrier stack above the norm
| Value | |
|---|---|
| WAF | 83% |
| Antibot | 19% |
| CAPTCHA | 13% |
| JavaScript | 37% |
| Rate Limiting | 17% |
| TLS | 10% |
WAF at 83% is the dominant barrier. JavaScript (37%) leads secondary coverage. The remaining barriers sit materially lower, giving Public Utility a narrow but defined secondary layer.
Barrier Landscape
WAF leads Public Utility at 83% — JavaScript is the main secondary layer
| Value | |
|---|---|
| WAF | 83% |
| Antibot | 19% |
| CAPTCHA | 13% |
| JavaScript | 37% |
| Rate Limiting | 17% |
| TLS | 10% |
| Has robots.txt | 53% |
| Blocks AI crawlers | 3% |
WAF dominates at 83%. JavaScript (37%) leads active secondary barriers, followed by Antibot (19%). The remaining three barriers all sit at or below 17% — a concentrated rather than broadly stacked profile.
Two-barrier stacks are Public Utility's most common security posture
| % of sites | |
|---|---|
| 0 barriers | 16% |
| 1 barrier | 26% |
| 2 barriers | 37% |
| 3 barriers | 11% |
| 4 barriers | 4% |
| 5 barriers | 6% |
| 6 barriers | 0% |
37% of Public Utility sites carry exactly 2 barriers. 21% stack three or more. 16% carry none — a moderate share of unprotected sites for this sector.
Simple is the dominant access tier across Public Utility
| Mean recommended tier | |
|---|---|
| All sites | 1.56 |
A mean recommended tier of 1.56 and a median of Simple place Public Utility toward the easier end of the sectors surveyed. 60% of sites are Simple to access; 8% require Moderate or above.
Simple is the dominant tier in Public Utility, but Easy accounts for a significant share
| % of sites | |
|---|---|
| 1 - Simple | 60% |
| 2 - Easy | 32% |
| 3 - Moderate | 2% |
| 4 - Complex | 4% |
| 5 - Advanced | 2% |
Simple (60%) is the most common tier. Simple and Easy together account for 92% of sites, while 2% land at Moderate and 6% at Complex or Advanced.
robots.txt
Around half of Public Utility sites publish any robots.txt
| % of sites | |
|---|---|
| Publish a valid robots.txt | 53% |
Only 53% of Public Utility sites have a valid robots.txt. Nearly 47% leave crawl policy undefined — one of the lower coverage rates across surveyed sectors.
More than half of Public Utility sites name no bot agents in robots.txt
| % of sites | |
|---|---|
| 0 | 51% |
| 1 | 41% |
| 2–4 | 5% |
| 5–9 | 0% |
| 10–15 | 2% |
| 16+ | 1% |
51% of Public Utility sites name zero bot agents; 41% name exactly one. A mean of 2.2 named agents and median of 0 reflect minimal engagement with named bot policy across the sector.
All bot categories receive minimal attention in Public Utility robots.txt files
| % of sites | |
|---|---|
| AI crawlers | 4% |
| SEO / search indexing | 3% |
| SEO audit tools | 4% |
| Commercial scrapers | 0% |
| Social / content scrapers | 0% |
| Archive / research crawlers | 1% |
| Monitoring / uptime bots | 0% |
No bot category exceeds 4% mention rate across Public Utility sites. AI crawlers and SEO audit tools lead at 4%, with all other categories at 3% or below.
Uniform per-agent rules dominate Public Utility robots.txt files
| % of sites | |
|---|---|
| Uniform per-agent rules | 28% |
| Path-level mixed rules | 17% |
| Allow-only (no Disallow rules) | 7% |
| Mixed AI posture | 1% |
| Blanket Disallow: / | 0% |
Uniform per-agent rules lead at 28%, with path-level mixed rules at 17%. Mixed AI posture (1%) and blanket Disallow (0%) are minimal.
MJ12bot leads named Disallow rules in Public Utility robots.txt
| Disallowed | Allowed (whitelisted) | |
|---|---|---|
| * | 41% | 22% |
| Googlebot | 1% | 2% |
| AhrefsBot | 1% | 1% |
| MJ12bot | 2% | — |
| SemrushBot | 2% | — |
| GPTBot | 2% | — |
| Pinterestbot | 1% | 1% |
| ZyBORG | 1% | 1% |
| facebookexternalhit | 1% | — |
| *bot* | 1% | — |
| BLEXBot | 1% | — |
| DotBot | 1% | — |
| ClaudeBot | 1% | — |
| CCBot | 1% | — |
| Google-Extended | 1% | — |
| 008 | 1% | — |
| Alexibot | 1% | — |
| Aqua_Products | 1% | — |
| BackDoorBot/1.0 | 1% | — |
| Bookmark search tool | 1% | — |
| BotALot | 1% | — |
| BotRightHere | 1% | — |
| BuiltBotTough | 1% | — |
| Bullseye/1.0 | 1% | — |
| BunnySlippers | 1% | — |
Values are percentages of all 100 Public Utility sites surveyed. The wildcard (*) leads at 41% Disallow. Among named agents, MJ12bot, SemrushBot, GPTBot are the most frequently targeted — focused on non-AI crawlers.
Industry Cohort
Public Utility has the lowest WAF coverage in the Energy & Utilities cohort
| WAF | Antibot | CAPTCHA | JavaScript | Rate Limit | TLS | robots.txt | Blocks AI | Tier | |
|---|---|---|---|---|---|---|---|---|---|
| Oil & Gas | 86% | 15% | 17% | 38% | 15% | 12% | 59% | 4% | Tier 1 |
| Public Utility | 83% | 19% | 13% | 37% | 17% | 10% | 53% | 3% | Tier 1 |
| Renewable Energy | 89% | 14% | 16% | 38% | 15% | 11% | 78% | 5% | Tier 1 |
WAF at 83% is the lowest in the Energy & Utilities cohort. JavaScript (37%) compensates as the leading active barrier. Tier difficulty (mean 1.43) sits above the cohort median.