In 2011, the White House’s Office of Management and Budget released a list of all domains owned and operated by federal executive agencies. At the time, I used a tool I wrote called Site Inspector to sniff out information about each government domain’s technology and capabilities. I also conducted subsequent scans in 2014 and 2015. Now, nearly ten years (!) after that first crawl, I conducted a fourth analysis of federal .gov domains to capture the state of government technology ahead of the incoming Biden administration.
You can browse the full results, download the raw data, or see details for an individual domain within the report itself, but here are the highlights.
Highlights
- Overall. The federal government manages 1,121 .gov domains. That’s about 250 fewer than there were five years ago after a targeted push to reduce domain sprawl. Of those domains, 926 (82.6%) are live. That’s about the same percentage as we saw in 2014 and 2015, and has gone up about 10% over the past 10 years.
- Redirects. 264 (28.51%) domains redirect to another domain.
- www. Of those live domains, 845 (91.25%) are reachable without the
www.prefix. That’s about 40 fewer than in 2015, but about a 16% increase. - Security. Security has seen the biggest wins since 2015. 883 (95.36%) domains support HTTPS, a 2.5x increase since the last analysis, and an incredible jump from the one in four we last saw. 849 (91.68%) enforce HTTPS, up from one in 10 last time. 770 (68.69%) support HSTS, with 497 (44.34%) .govs on the HSTS preload list. And 844 (75.29%) domains returned a DNSSEC record.
- IPv6. 669 (72.25%) domains returned an AAAA record, indicating they supported IPv6 traffic. That represents about 50 fewer than 2015, but a 20% increase overall.
- CMS. Of those live, non-redirected domains, 305 (32.94%) had a detectable CMS (up from 13% in 2015). Of them, 251 (82.3%) relied on an open source content management system (CMS). 202 (30.51%) domains use the Drupal CMS, up from 10% in 2015. Usage of WordPress doubled in percentage going from 29 to 37 (4.0%) sites since 2015. Joomla usage went from 8 to 5 (0.54%) domains.
- Open source. 541 (58.42%) of live domains used detectable open source software (an operating system, server, or framework). Across all federal domains, that’s 2.8 open source projects on average. Among domains that use any, it’s just shy of five.
- Analytics. 479 (72.36%) unique domains use Google Analytics. Up from about one in four in 2014 and just 86 ten years ago.
- Host. It’s not always possible to detect the hosting provider, but at least 109 (11.77%) live domains use AWS (up from just 10 in 2011), 5 (0.54%) use Azure, and 1 (0.11%) uses GitHub Pages.
- Email. Among detectable third-party email providers, 105 (9.37%) use Office 365 and 34 (3.03%) use GSuite.
- Common files. 501 (75.68%) domains return proper 404s, making it possible to check for the existence of certain files. Of them, 11 (2.2%) have a vulnerability disclosure policy and 46 (9.18%) have a data.json file.
- CDN. At least 41 (6.19%) domains use the Akamai content distribution network (CDN) and 74 (11.18%) use Amazon Cloudfront.
Be sure to read the fine print. As I’ve said in years past, math’s never been my strong point, so please check my work. If you find a mistake, please submit a pull request. This is a personal passion project and doesn’t represent the views of my employer.