Industry benchmark · SaaS
SaaS website security benchmarks — how cloud apps score
SaaS marketing sites have a lower bar than the apps they fund — the marketing site is usually static-rendered Next.js or similar, light on third-party scripts, and easy to harden. The app subdomain (app.example.com) often diverges sharply, since CSP needs careful tuning for embedded iframes, customer-uploaded content, and analytics. Mature SaaS companies tend to score well on the marketing site and treat the app domain as its own hardening project.
Typical saas score range
78–92/ 100
Approximate range based on common findings in this sector. For live data, scan any of the representative sites listed below.
What they tend to get right
TLS is consistently modern. HSTS is widely deployed with includeSubDomains and increasingly preload. Marketing-site CSP is typically tight because there's no third-party tag-manager pressure. Email auth (SPF + DKIM + DMARC) is mature because transactional mail is a first-class concern.
Where they fall short
X-Frame-Options / frame-ancestors are inconsistent — many SaaS sites need to embed in customer dashboards but haven't tightened the policy to specific allowed parents. App subdomains often score lower than marketing domains because the CSP allowlist drifts as features ship. CORS misconfigurations on API subdomains are common.
Common findings in this sector
Findings that show up frequently across saas sites we’ve scanned, ranked by approximate prevalence.
- ~55% of sites
App-domain CSPs accumulate cruft as integrations are added
- ~30% of sites
Embed-friendly products often skip framing controls entirely
- ~65% of sites
Rarely set on either marketing or app domains
- ~25% of sites
Vercel/Cloudflare-fronted sites obscure this; self-hosted leaks
- ~55% of sites
HSTS deployed but not yet preload-eligible
Scan a representative saas site
Click any host below to run a free scan and see how it actually scores today.
Regulatory context
SaaS vendors selling into regulated industries inherit their customers' compliance scope. SOC 2 Type II is table-stakes for B2B; the public-facing posture is one observable input auditors sample.
Where does your site fall?
Run a free scan to see how your site compares to others in the saas sector. The full 0–100 hardening score takes ~10 seconds.