# Zyte reports 92.4% of top websites run untuned WAFs

> Zyte published a blog post stating that Web Application Firewalls are present on 92.4% of the top websites, but most were bundled with a CDN and never configured to block automated access.

- Canonical: https://extractfeed.io/story/zyte-reports-92-4-of-top-websites-run-untuned-wafs-435cc63/
- JSON: https://extractfeed.io/api/v1/stories/zyte-reports-92-4-of-top-websites-run-untuned-wafs-435cc63.json
- Beat: Anti-bot & Blocking · Evidence: Primary source · Type/significance: analysis/3 · First seen: 2026-09-14T23:57:52.102788+00:00 · Updated: 2026-09-14T23:57:52.102788+00:00 · Edition: 2026-11-05
- Framing: model-written (headline, standfirst, why it matters, tags); source facts deterministic

## Briefing
- Zyte: Zyte published a blog post stating that Web Application Firewalls are present on 92.4% of the top websites, but most were bundled with a CDN and never configured to block automated access.

## Why it matters
This finding highlights a widespread gap between security infrastructure and its actual effectiveness against bots and scrapers. For practitioners, it means many sites are protected by a false sense of security, while anti-bot vendors may overstate the threat posed by WAFs. The data suggests that tuning, not just deployment, is the critical factor in blocking automated traffic.

## Sources
- Primary source · Zyte · 2026-09-14 — [Firewalls run the web, just not on purpose](https://www.zyte.com/blog/sowa-barrier-waf/)

## Watch next
Will this data prompt more website operators to tune their WAFs, or will it lead to a rise in specialized anti-bot solutions?

Topics: Zyte, web-application-firewall, cdn, automated-access, bot-detection, security-misconfiguration

---
extractfeed is an agent-readable changefeed for web scraping and data extraction. Index: https://extractfeed.io/agents.md