Arizona restaurant cybersecurity statistics
We picked 400 independent restaurants, cafes and bars across Arizona at random and ran the same passive checks as our free scanner on each one. This page shows what we found, without naming any business.
- Median score
- 73/100
- Enforce DMARC
- 13%
- Have working HTTPS
- 94%
- Send all six security headers
- 6%
How does your website compare?
Run the same free check. Your report shows where you land among these 400 sites.
What's the typical security score for Arizona restaurants?
The median score was 73 out of 100. The middle half of the 400 sites scored between 65 and 81, and 13% scored 85 or higher. Scores use the same formula as every CyberVigil report, so you can compare yours directly. How scoring works
- 13%Strong (85+)
- 55%Good (70 to 84)
- 27%Needs work (50 to 69)
- 5%At risk (under 50)
Key findings
67% have no DMARC record
Without DMARC, anyone can send email that looks like it came from the business. Only 13% of Arizona restaurants tell inboxes to quarantine or reject fakes. Our DMARC generator builds a starter record in a minute.
28% of email domains skip SPF
Of the Arizona restaurants that receive email on their own domain, 28% don't publish an SPF record listing who may send for them. That makes spoofed invoices and fake order emails easier to pull off. The SPF checker shows what yours says.
94% have working HTTPS
Most sites load over HTTPS with a valid certificate, and 90% send visitors from the old http:// address to the https:// version. The SSL checker confirms your certificate and its expiry date.
Only 6% send all key security headers
Security headers tell browsers to block common attacks such as clickjacking. 36% of the sites we could check sent none of the six we look for. Many hosts let you add them in a few clicks. The security headers checker lists what's missing.
How many Arizona restaurants use SPF and DMARC?
33% publish a DMARC record, and 13% set it to quarantine or reject fake email. 54% publish a valid SPF record. SPF and DMARC are DNS records that help inboxes spot email pretending to come from your domain. DMARC set to monitor only (p=none) collects reports but doesn't stop fakes. Email security guides
- Receive email on their own domain74%
295 of 400 sites. Based on MX records
- Publish a valid SPF record54%
217 of 400 sites
- Publish a DMARC record33%
130 of 400 sites
- DMARC set to monitor only20%
80 of 400 sites
- DMARC set to quarantine or reject13%
50 of 400 sites
How many Arizona restaurants use HTTPS and security headers?
94% load over HTTPS with a valid certificate, but only 6% send all six browser security headers we check. These checks look at the homepage and its certificate. When a site blocked our automated request, we left it out of that check rather than counting it as a problem, so totals vary a little.
Connection
- HTTPS with a valid certificate94%
377 of 400 sites
- Redirect http:// to https://90%
356 of 397 sites
- Turn off old TLS 1.0 and 1.189%
346 of 390 sites
- Hide software version numbers69%
251 of 362 sites
Security headers sent
- Strict-Transport-Security (HSTS)43%
157 of 362 sites
- Content-Security-Policy22%
79 of 362 sites
- X-Content-Type-Options45%
163 of 362 sites
- Clickjacking protection (X-Frame-Options or frame-ancestors)33%
118 of 362 sites
- Referrer-Policy18%
65 of 362 sites
- Permissions-Policy11%
41 of 362 sites
Do Arizona restaurants use DNSSEC, and are any on blocklists?
4% have DNSSEC turned on and 1% publish a CAA record. None of the sites appeared on the malware and phishing blocklists we check.
- DNSSEC turned on4%
14 of 400 sites
- CAA record limiting who can issue certificates1%
3 of 400 sites
None of the sites appeared on the malware and phishing blocklists we check.
Which website and email platforms do Arizona restaurants use?
WordPress was the most common website platform we could identify, on 28% of sites. For email, 27% use Google Workspace and 20% use Microsoft 365. We detect platforms from public signals like page markup and MX records. Median scores only appear for groups of 25 sites or more.
| Platform | Share | Median score |
|---|---|---|
| Custom or not detected | 39% | 73 |
| WordPress | 28% | 74 |
| Squarespace | 10% | 69 |
| Wix | 9% | 74 |
| Shopify | 4% | – |
| GoDaddy Website Builder | 4% | – |
| Others | 7% | – |
| Provider | Share | Median score |
|---|---|---|
| Another email provider | 27% | 71 |
| Google Workspace | 27% | 71 |
| No email on the domain | 26% | 75 |
| Microsoft 365 | 20% | 81 |
How did we collect this data?
- We pulled every business matching this filter from OpenStreetMap as of October 24, 2026: amenity = restaurant, cafe, fast_food, bar, pub or ice_cream, inside the Arizona state boundary. Only listings with a website counted. That gave 5,009 listings.
- We left out websites shared by three or more listings, which usually means a chain or franchise (3,224 listings). We also dropped pages on sites the business doesn't control, like Facebook or Yelp (76), and public-sector sites (10). That left 1,568 independent websites.
- We shuffled that list with a fixed random seed and scanned sites in order until 400 had loaded. Along the way we skipped 29 sites that were offline or whose domain no longer worked.
- Each site got the same passive checks as our free scanner on October 24, 2026: public DNS records, the homepage over ports 80 and 443, and the TLS certificate. We didn't log in, probe for weaknesses or change anything. What we check
Limits to keep in mind
- OpenStreetMap is mapped by volunteers. It doesn't list every business, and the ones it lists may not match the wider population.
- DKIM uses selectors we can only guess from outside, so we don't report it here.
- A good score here means the public settings we check look right. It doesn't mean a business can't be attacked.
- We don't publish business names or any single site's results. Business owners can run a free scan to see their own report.
Business listings © OpenStreetMap contributors, available under the Open Database License.
Cite this data
You're welcome to quote these numbers in articles, slides and reports. They're licensed under CC BY 4.0, so please credit CyberVigil and link to this page.
CyberVigil. "Arizona restaurant cybersecurity statistics." October 2026. https://www.cybervigil.ai/benchmarks/arizona-restaurants
Related guides and tools
See how you stack up against Arizona restaurants
Run the same free check on your site. Your report shows your score next to the 400 sites in this benchmark.