Restaurant cybersecurity statistics

What's the typical security score for US restaurants?

The median score was 73 out of 100. The middle half of the 1,500 sites scored between 64 and 78, and 7% scored 85 or higher. Scores use the same formula as every CyberVigil report, so you can compare yours directly. How scoring works

Key findings

How many US restaurants use SPF and DMARC?

24% publish a DMARC record, and 7% set it to quarantine or reject fake email. 49% publish a valid SPF record. SPF and DMARC are DNS records that help inboxes spot email pretending to come from your domain. DMARC set to monitor only (p=none) collects reports but doesn't stop fakes. Email security guides

How many US restaurants use HTTPS and security headers?

90% load over HTTPS with a valid certificate, but only 3% send all six browser security headers we check. These checks look at the homepage and its certificate. When a site blocked our automated request, we left it out of that check rather than counting it as a problem, so totals vary a little.

Do US restaurants use DNSSEC, and are any on blocklists?

3% have DNSSEC turned on and 1% publish a CAA record. 1 of 1,500 sites appeared on a blocklist we check.

How do US restaurants compare by state?

In the 12 states with enough sites, median scores ranged from 68 in Pennsylvania to 75 in New York, against 73 nationally. The share of sites with a DMARC record ranged from 17% in North Carolina to 37% in Michigan. With 40 to 196 sites per state, gaps of a few points can be down to chance. States with fewer sites are still part of the national numbers above, but too small to show on their own.

Which website and email platforms do US restaurants use?

WordPress was the most common website platform we could identify, on 21% of sites. For email, 20% use Google Workspace and 12% use Microsoft 365. We detect platforms from public signals like page markup and MX records. Median scores only appear for groups of 25 sites or more.

How did we collect this data?

1. We pulled every place in the October 21, 2026 release of Overture Maps' open places data that is a restaurant, cafe, bar or other food and drink place with an address in one of the 50 states or Washington, DC. Only listings with a website, marked open and rated at least 70% likely to exist by Overture, counted. That gave 1,132,106 listings.
2. We left out websites listed in three or more cities anywhere in the US, or tied to a known brand, which usually means a chain or franchise (520,519 listings). We also dropped pages on sites the business doesn't control, like Facebook or Yelp (56,173), and public-sector sites (2,059). That left 470,094 independent websites.
3. We put that list in a fixed random order and scanned sites in order until 1,500 had loaded. Along the way we skipped 462 sites that were offline or whose domain no longer worked.
4. Each site got the same passive checks as our free scanner on October 24, 2026: public DNS records, the homepage over ports 80 and 443, and the TLS certificate. We didn't log in, probe for weaknesses or change anything. What we check

Limits to keep in mind

• Overture builds its places data from sources like Meta, Microsoft and Foursquare. It doesn't list every business, some listings are out of date, and businesses with a website may not match those without one.
• DKIM uses selectors we can only guess from outside, so we don't report it here.
• A good score here means the public settings we check look right. It doesn't mean a business can't be attacked.
• We don't publish business names or any single site's results. Business owners can run a free scan to see their own report.

Business listings from Overture Maps Foundation places data, release 2026-10-21.0, with data from Meta, Microsoft and others under CDLA Permissive 2.0 and from Foursquare under Apache 2.0.