Zyte reports 92.4% of top websites run untuned WAFs

Zyte published a blog post stating that Web Application Firewalls are present on 92.4% of the top websites, but most were bundled with a CDN and never configured to block automated access.

Markdown twin JSON

Anti-bot & Blocking Primary source analysis / significance 3

Briefing

Zyte: Zyte published a blog post stating that Web Application Firewalls are present on 92.4% of the top websites, but most were bundled with a CDN and never configured to block automated access.

Why it matters

This finding highlights a widespread gap between security infrastructure and its actual effectiveness against bots and scrapers. For practitioners, it means many sites are protected by a false sense of security, while anti-bot vendors may overstate the threat posed by WAFs. The data suggests that tuning, not just deployment, is the critical factor in blocking automated traffic.

Sources

Primary source · Zyte · 2026-09-14 — Firewalls run the web, just not on purpose

Watch next

Will this data prompt more website operators to tune their WAFs, or will it lead to a rise in specialized anti-bot solutions?

Topics: Zyte, web-application-firewall, cdn, automated-access, bot-detection, security-misconfiguration