Government web census · gap lists · census 2026-09-30 · pricing · x402 manifest
Gap lists: which .gov domains are missing which control
8 lists computed from the census of 2026-09-30: 16,783 .gov domains, 13,060 reachable over HTTPS. Each list is the .gov domains whose record lacks one control. Every row is public data already in the CC BY 4.0 dumps; the lists are the filtered, state-sliceable, refreshed files a sales or compliance tool can import.
Census refresh: 2026-09-30 (counts change only when the census is rebuilt). Live re-checks: 225 .gov domains re-checked since 2026-10-01, last run 2026-10-01 06:27 UTC, 86 changes recorded; each list's feed names who entered or left it.
| List | .gov domains | Of the list | Who buys this | Free | Full list |
|---|---|---|---|---|---|
| .gov domains without a security.txt security.txt (RFC 9116) | 12,717 | 75.8% | Security teams, vulnerability-disclosure and attack-surface vendors, MSPs serving state and local government. | top 50 · feed | 1.00 USDC |
| .gov domains with an expired security.txt security.txt Expires line (RFC 9116) | 63 | 0.4% | Security teams and vulnerability-disclosure vendors: a lapsed file is a specific, verifiable conversation opener. | top 50 · feed | 1.00 USDC |
| .gov domains without an accessibility statement on the homepage Accessibility statement linked from the homepage | 7,400 | 44.1% | Accessibility vendors and agencies (audits, remediation, statements) and government web platform vendors with WCAG offerings, while the ADA Title II deadlines run. | top 50 · feed | 1.00 USDC |
| .gov domains without a privacy policy link on the homepage Privacy policy linked from the homepage | 8,559 | 51.0% | Privacy-compliance vendors and agencies that write notices for public bodies. | top 50 · feed | 1.00 USDC |
| .gov domains without HSTS HTTP Strict Transport Security header | 8,322 | 49.6% | Security teams, MSPs and hosting or CDN vendors serving government sites. | top 50 · feed | 1.00 USDC |
| .gov domains blocking both ChatGPT-User and Claude-User robots.txt verdicts for ChatGPT-User and Claude-User | 365 | 2.2% | AI-visibility vendors and digital agencies: these sites are closed to ChatGPT and Claude users. | top 50 · feed | 1.00 USDC |
| .gov domains answering only over plain HTTP HTTPS | 739 | 4.4% | MSPs, hosting and web agencies serving small governments: sites still without working HTTPS. | top 50 · feed | 1.00 USDC |
| .gov domains whose homepage redirects to another domain Homepage served on the listed domain | 1,492 | 8.9% | Web agencies and domain-consolidation vendors, security teams checking .gov names that point elsewhere. | top 50 · feed | 1.00 USDC |
All lists in one file: GET https://gov.agentexchange.work/leads/all.json, 5.00 USDC via x402 (8 lists, 7,458 KB).
What you get
- Free: each list page shows the first 50 rows (alphabetical) with links to every domain's record and counts by state; the same as JSON at
/leads/<list>.top.json(CORS open); an Atom feed at/leads/<list>.xmlof .gov domains that entered or left the list on the live re-checks. - Paid, 1.00 USDC per file (x402 on Base, no account):
GET /leads/<list>.csvor.json, the full list with 18 columns (domain, name, type, city, state, reachable, http_only, https_status, final_host, hsts, security_txt, privacy_link, accessibility_link, robots_gptbot, robots_chatgpt_user, robots_claude_user, llms_txt, title). One state:GET /leads/<list>/state/<code>.csv, 0.25 USDC. - How the lists are made: one rule per list over the census records (each list page names its rule); a control that exists but was not found where the census looked counts as missing.
Card checkout for these lists is not open yet; the x402 routes work now.
Data licence CC BY 4.0; cite Agent Exchange. Not legal advice.