Government web census · gap lists · census 2026-09-30 · JSON (top 50) · feed
.gov domains without a security.txt
12,717 of the 16,783 .gov domains in the census list (75.8%; 97.4% of the 13,060 reachable over HTTPS), as fetched on 2026-09-30.
On this list
12,717
of 16,783 .gov domains
Share of the list
75.8%
97.4% of reachable sites
States
56
largest: New York (1,158)
Full list
1.00 USDC
x402, per file; first 50 rows free
What this gap means
No security.txt was found at /.well-known/security.txt or /security.txt on the final host, so a researcher who finds a vulnerability has no published contact.
Control: security.txt (RFC 9116). Rule: no_security_txt over the census record (reachable sites only). Who buys this: Security teams, vulnerability-disclosure and attack-surface vendors, MSPs serving state and local government.
The obligation it maps to
CISA BOD 20-01: vulnerability disclosure policy and security.txt: Federal civilian executive-branch agencies must publish a vulnerability disclosure policy and a security.txt file on their .gov domains (Binding Operational Directive 20-01, September 2020). The census reads /.well-known/security.txt and /security.txt and checks the Contact and Expires lines that RFC 9116 requires. Source
By state
56 states with at least one .gov domain on this list; "of the state" is the share of its .gov domains in the census list. One state as CSV: 0.25 USDC (x402).
| State | On this list | Of the state | CSV (x402) |
|---|---|---|---|
| New York (report) | 1,158 | 84.7% | https://gov.agentexchange.work/leads/no-security-txt/state/NY.csv · card $9 |
| District of Columbia (report) | 650 | 69.4% | https://gov.agentexchange.work/leads/no-security-txt/state/DC.csv · card $9 |
| Wisconsin (report) | 644 | 79.4% | https://gov.agentexchange.work/leads/no-security-txt/state/WI.csv · card $9 |
| California (report) | 634 | 73.0% | https://gov.agentexchange.work/leads/no-security-txt/state/CA.csv · card $9 |
| Texas (report) | 544 | 78.8% | https://gov.agentexchange.work/leads/no-security-txt/state/TX.csv · card $9 |
| Minnesota (report) | 519 | 86.4% | https://gov.agentexchange.work/leads/no-security-txt/state/MN.csv · card $9 |
| Michigan (report) | 492 | 78.0% | https://gov.agentexchange.work/leads/no-security-txt/state/MI.csv · card $9 |
| Ohio (report) | 452 | 70.3% | https://gov.agentexchange.work/leads/no-security-txt/state/OH.csv · card $9 |
| Florida (report) | 402 | 75.3% | https://gov.agentexchange.work/leads/no-security-txt/state/FL.csv · card $9 |
| Utah (report) | 354 | 88.5% | https://gov.agentexchange.work/leads/no-security-txt/state/UT.csv · card $9 |
| Illinois (report) | 317 | 73.0% | https://gov.agentexchange.work/leads/no-security-txt/state/IL.csv · card $9 |
| North Carolina (report) | 305 | 78.0% | https://gov.agentexchange.work/leads/no-security-txt/state/NC.csv · card $9 |
| Pennsylvania (report) | 286 | 75.3% | https://gov.agentexchange.work/leads/no-security-txt/state/PA.csv · card $9 |
| Massachusetts (report) | 282 | 80.6% | https://gov.agentexchange.work/leads/no-security-txt/state/MA.csv · card $9 |
| Georgia (report) | 270 | 78.3% | https://gov.agentexchange.work/leads/no-security-txt/state/GA.csv · card $9 |
| Tennessee (report) | 259 | 73.8% | https://gov.agentexchange.work/leads/no-security-txt/state/TN.csv · card $9 |
| New Jersey (report) | 237 | 76.0% | https://gov.agentexchange.work/leads/no-security-txt/state/NJ.csv · card $9 |
| Missouri (report) | 231 | 70.0% | https://gov.agentexchange.work/leads/no-security-txt/state/MO.csv · card $9 |
| Oregon (report) | 221 | 76.2% | https://gov.agentexchange.work/leads/no-security-txt/state/OR.csv · card $9 |
| Arkansas (report) | 210 | 56.1% | https://gov.agentexchange.work/leads/no-security-txt/state/AR.csv · card $9 |
| Virginia (report) | 210 | 68.0% | https://gov.agentexchange.work/leads/no-security-txt/state/VA.csv · card $9 |
| Maryland (report) | 203 | 82.2% | https://gov.agentexchange.work/leads/no-security-txt/state/MD.csv · card $9 |
| Colorado (report) | 202 | 72.7% | https://gov.agentexchange.work/leads/no-security-txt/state/CO.csv · card $9 |
| Washington (report) | 192 | 77.1% | https://gov.agentexchange.work/leads/no-security-txt/state/WA.csv · card $9 |
| Arizona (report) | 190 | 83.0% | https://gov.agentexchange.work/leads/no-security-txt/state/AZ.csv · card $9 |
| Alabama (report) | 177 | 70.2% | https://gov.agentexchange.work/leads/no-security-txt/state/AL.csv · card $9 |
| Kansas (report) | 168 | 74.0% | https://gov.agentexchange.work/leads/no-security-txt/state/KS.csv · card $9 |
| Kentucky (report) | 163 | 73.4% | https://gov.agentexchange.work/leads/no-security-txt/state/KY.csv · card $9 |
| New Hampshire (report) | 161 | 78.9% | https://gov.agentexchange.work/leads/no-security-txt/state/NH.csv · card $9 |
| Oklahoma (report) | 152 | 57.6% | https://gov.agentexchange.work/leads/no-security-txt/state/OK.csv · card $9 |
| Connecticut (report) | 142 | 78.0% | https://gov.agentexchange.work/leads/no-security-txt/state/CT.csv · card $9 |
| Iowa (report) | 130 | 61.6% | https://gov.agentexchange.work/leads/no-security-txt/state/IA.csv · card $9 |
| Nebraska (report) | 121 | 80.1% | https://gov.agentexchange.work/leads/no-security-txt/state/NE.csv · card $9 |
| South Carolina (report) | 111 | 77.6% | https://gov.agentexchange.work/leads/no-security-txt/state/SC.csv · card $9 |
| Maine (report) | 108 | 83.7% | https://gov.agentexchange.work/leads/no-security-txt/state/ME.csv · card $9 |
| Indiana (report) | 105 | 70.9% | https://gov.agentexchange.work/leads/no-security-txt/state/IN.csv · card $9 |
| West Virginia (report) | 103 | 66.5% | https://gov.agentexchange.work/leads/no-security-txt/state/WV.csv · card $9 |
| Montana (report) | 97 | 71.9% | https://gov.agentexchange.work/leads/no-security-txt/state/MT.csv · card $9 |
| New Mexico (report) | 92 | 86.0% | https://gov.agentexchange.work/leads/no-security-txt/state/NM.csv · card $9 |
| Louisiana (report) | 84 | 67.7% | https://gov.agentexchange.work/leads/no-security-txt/state/LA.csv · card $9 |
| Vermont (report) | 79 | 87.8% | https://gov.agentexchange.work/leads/no-security-txt/state/VT.csv · card $9 |
| Mississippi (report) | 73 | 57.0% | https://gov.agentexchange.work/leads/no-security-txt/state/MS.csv · card $9 |
| Idaho (report) | 63 | 64.9% | https://gov.agentexchange.work/leads/no-security-txt/state/ID.csv · card $9 |
| Wyoming (report) | 56 | 70.9% | https://gov.agentexchange.work/leads/no-security-txt/state/WY.csv · card $9 |
| South Dakota (report) | 48 | 75.0% | https://gov.agentexchange.work/leads/no-security-txt/state/SD.csv · card $9 |
| Rhode Island (report) | 46 | 79.3% | https://gov.agentexchange.work/leads/no-security-txt/state/RI.csv · card $9 |
| Alaska (report) | 45 | 72.6% | https://gov.agentexchange.work/leads/no-security-txt/state/AK.csv · card $9 |
| Nevada (report) | 38 | 77.6% | https://gov.agentexchange.work/leads/no-security-txt/state/NV.csv · card $9 |
| North Dakota (report) | 33 | 64.7% | https://gov.agentexchange.work/leads/no-security-txt/state/ND.csv · card $9 |
| Delaware (report) | 18 | 78.3% | https://gov.agentexchange.work/leads/no-security-txt/state/DE.csv · card $9 |
| HI | 6 | — | https://gov.agentexchange.work/leads/no-security-txt/state/HI.csv · card $9 |
| VI | 6 | — | https://gov.agentexchange.work/leads/no-security-txt/state/VI.csv · card $9 |
| AS | 5 | — | https://gov.agentexchange.work/leads/no-security-txt/state/AS.csv · card $9 |
| PR | 4 | — | https://gov.agentexchange.work/leads/no-security-txt/state/PR.csv · card $9 |
| GU | 2 | — | https://gov.agentexchange.work/leads/no-security-txt/state/GU.csv · card $9 |
| MP | 2 | — | https://gov.agentexchange.work/leads/no-security-txt/state/MP.csv · card $9 |
Free: the first 50 of 12,717 (alphabetical)
| Domain | Level of government | State | Census record |
|---|---|---|---|
| 9-11commission.gov National Archives and Records Administration | Federal - Executive | MD | HTTP 200 · HSTS no · security.txt none · privacy no · accessibility no · GPTBot partly blocked |
| 911.gov Department of Transportation | Federal - Executive | DC | HTTP 403 · HSTS yes · security.txt none · privacy no · accessibility no |
| 911commission.gov National Archives and Records Administration | Federal - Executive | MD | HTTP 200 · HSTS no · security.txt none · privacy no · accessibility no · GPTBot partly blocked |
| 988.gov Department of Health and Human Services | Federal - Executive | MD | HTTP 200 via 988lifeline.org · HSTS no · security.txt none · privacy no · accessibility no · GPTBot partly blocked |
| aanhpiheritage.gov Department of Health and Human Services | Federal - Executive | DC | HTTP 403 via www.hhs.gov · HSTS yes · security.txt none · privacy no · accessibility no |
| abilityone.gov United States AbilityOne Commission | Federal - Executive | DC | HTTP 200 · HSTS yes · security.txt none · privacy yes · accessibility yes |
| abmc.gov American Battle Monuments Commission | Federal - Executive | VA | HTTP 403 · HSTS no · security.txt none · privacy no · accessibility no |
| accedeainternet.gov Federal Communications Commission | Federal - Executive | DC | HTTP 403 · HSTS yes · security.txt none · privacy no · accessibility no |
| access-board.gov Access Board | Federal - Executive | DC | HTTP 200 · HSTS yes · security.txt none · privacy yes · accessibility yes · GPTBot allowed |
| acf.gov Department of Health and Human Services | Federal - Executive | DC | HTTP 202 · HSTS no · security.txt none · privacy no · accessibility no |
| achp.gov Advisory Council on Historic Preservation | Federal - Executive | DC | HTTP 200 · HSTS no · security.txt none · privacy yes · accessibility no · GPTBot partly blocked |
| acl.gov Department of Health and Human Services | Federal - Executive | DC | HTTP 200 · HSTS no · security.txt none · privacy no · accessibility yes · GPTBot partly blocked |
| acquisition.gov General Services Administration | Federal - Executive | DC | HTTP 200 · HSTS yes · security.txt none · privacy yes · accessibility yes · GPTBot partly blocked |
| acquisitiongateway.gov General Services Administration | Federal - Executive | DC | HTTP 200 · HSTS yes · security.txt none · privacy no · accessibility no · GPTBot allowed |
| acus.gov Administrative Conference of the United States | Federal - Executive | DC | HTTP 403 · HSTS no · security.txt none · privacy no · accessibility no |
| acwi.gov Department of the Interior | Federal - Executive | VA | HTTP 200 · HSTS yes · security.txt none · privacy yes · accessibility yes |
| ada.gov Department of Justice | Federal - Executive | DC | HTTP 200 · HSTS yes · security.txt none · privacy yes · accessibility yes · GPTBot allowed |
| adams.gov Adams Memorial Commission | Federal - Legislative | DC | HTTP 200 · HSTS yes · security.txt none · privacy no · accessibility no · GPTBot partly blocked |
| afadvantage.gov General Services Administration | Federal - Executive | DC | HTTP 200 · HSTS yes · security.txt none · privacy no · accessibility no · GPTBot partly blocked |
| aff.gov Department of Agriculture | Federal - Executive | DC | HTTP 200 · HSTS yes · security.txt none · privacy no · accessibility yes · GPTBot partly blocked |
| afrh.gov Armed Forces Retirement Home | Federal - Executive | DC | HTTP 200 · HSTS yes · security.txt none · privacy yes · accessibility yes · GPTBot partly blocked |
| africanamericanhistorymonth.gov Library of Congress | Federal - Legislative | DC | HTTP 200 via www.blackhistorymonth.gov · HSTS no · security.txt none · privacy no · accessibility no |
| aging.gov Department of Health and Human Services | Federal - Executive | DC | HTTP 403 via www.hhs.gov · HSTS yes · security.txt none · privacy no · accessibility no |
| agingstats.gov Department of Health and Human Services | Federal - Executive | DC | HTTP 200 · HSTS yes · security.txt none · privacy yes · accessibility yes |
| ahcpr.gov Department of Health and Human Services | Federal - Executive | MD | HTTP 403 via www.ahrq.gov · HSTS no · security.txt none · privacy no · accessibility no · GPTBot blocked |
| ahrq.gov Department of Health and Human Services | Federal - Executive | MD | HTTP 403 · HSTS no · security.txt none · privacy no · accessibility no · GPTBot blocked |
| ai.gov Executive Office of the President | Federal - Executive | DC | HTTP 200 · HSTS yes · security.txt none · privacy yes · accessibility yes · GPTBot allowed |
| aicenter.gov Department of Commerce | Federal - Executive | DC | HTTP 401 · HSTS yes · security.txt none · privacy no · accessibility no |
| aids.gov Department of Health and Human Services | Federal - Executive | DC | HTTP 200 via www.hiv.gov · HSTS yes · security.txt none · privacy no · accessibility no · GPTBot partly blocked |
| aiexports.gov Department of Commerce | Federal - Executive | DC | HTTP 200 · HSTS yes · security.txt none · privacy yes · accessibility no |
| airknowledge.gov Environmental Protection Agency | Federal - Executive | DC | HTTP 200 · HSTS yes · security.txt none · privacy no · accessibility no |
| airnow.gov Environmental Protection Agency | Federal - Executive | DC | HTTP 200 · HSTS yes · security.txt none · privacy no · accessibility yes |
| aiworkforcehub.gov Department of Labor | Federal - Executive | DC | HTTP 404 via beta.dol.gov · HSTS yes · security.txt none · privacy yes · accessibility yes · GPTBot partly blocked |
| alertaenlinea.gov Federal Trade Commission | Federal - Executive | DC | HTTP 200 via consumidor.ftc.gov · HSTS yes · security.txt none · privacy yes · accessibility yes · GPTBot partly blocked |
| alien.gov Executive Office of the President | Federal - Executive | DC | HTTP 200 via www.whitehouse.gov · HSTS yes · security.txt none · privacy yes · accessibility no · GPTBot partly blocked |
| aliens.gov Executive Office of the President | Federal - Executive | DC | HTTP 200 via www.whitehouse.gov · HSTS yes · security.txt none · privacy yes · accessibility no · GPTBot partly blocked |
| alzheimers.gov Department of Health and Human Services | Federal - Executive | Bethesda | HTTP 405 · HSTS yes · security.txt none · privacy no · accessibility no |
| america.gov Department of State | Federal - Executive | DC | HTTP 403 · HSTS yes · security.txt none · privacy no · accessibility no · GPTBot blocked |
| america250.gov U.S. Semiquincentennial Commission | Federal - Legislative | VA | HTTP 403 via america250.org · HSTS no · security.txt none · privacy no · accessibility no · GPTBot allowed |
| americorps.gov Corporation for National and Community Service | Federal - Executive | DC | HTTP 403 · HSTS no · security.txt none · privacy no · accessibility no |
| americorpsoig.gov Corporation for National and Community Service | Federal - Executive | DC | HTTP 200 · HSTS yes · security.txt none · privacy yes · accessibility no · GPTBot partly blocked |
| ameslab.gov Department of Energy | Federal - Executive | IA | HTTP 200 · HSTS yes · security.txt none · privacy yes · accessibility no · GPTBot partly blocked |
| amtrakoig.gov "National Railroad Passenger Corporation | Federal - Executive | Washington | HTTP 200 · HSTS yes · security.txt none · privacy no · accessibility no · GPTBot partly blocked |
| anchorit.gov Consumer Product Safety Commission | Federal - Executive | MD | HTTP 200 · HSTS yes · security.txt none · privacy yes · accessibility yes |
| anl.gov Department of Energy | Federal - Executive | IL | HTTP 403 · HSTS yes · security.txt none · privacy no · accessibility no |
| aoa.gov Department of Health and Human Services | Federal - Executive | DC | HTTP 200 via acl.gov · HSTS no · security.txt none · privacy no · accessibility yes · GPTBot partly blocked |
| aoc.gov Architect of the Capitol | Federal - Legislative | DC | HTTP 200 · HSTS yes · security.txt none · privacy yes · accessibility no · GPTBot partly blocked |
| aocoig.gov "Architect of the Capitol | Federal - Legislative | Washington | HTTP 200 · HSTS yes · security.txt none · privacy yes · accessibility yes · GPTBot partly blocked |
| ap.gov Department of Commerce | Federal - Executive | DC | HTTP 200 via www.bis.gov · HSTS yes · security.txt none · privacy yes · accessibility yes · GPTBot allowed |
| app.gov Executive Office of the President | Federal - Executive | DC | HTTP 200 via www.whitehouse.gov · HSTS yes · security.txt none · privacy yes · accessibility no · GPTBot partly blocked |
The same rows as JSON: no-security-txt.top.json (CORS open, cached one day).
Get the full list: 12,717 rows, 1.00 USDC
x402 on Base, paid per file, no account or key. GET https://gov.agentexchange.work/leads/no-security-txt.csv or GET https://gov.agentexchange.work/leads/no-security-txt.json answers 402 Payment Required with the terms (scheme exact, USDC on Base, maxAmountRequired 1000000, payTo 0xc91cE6291eDC0713ec753BAFBA002506ffb2b95c); an x402 client signs the EIP-3009 authorization and resends the same request with X-PAYMENT; the file comes back with a PAYMENT-RESPONSE header. HEAD gets the same 402. One state: GET https://gov.agentexchange.work/leads/no-security-txt/state/<code>.csv, 0.25 USDC (codes in the table above).
curl -sS -D - https://gov.agentexchange.work/leads/no-security-txt.csv # 402 with the x402 terms; pay and resend with X-PAYMENT
Columns (18): domain, name, type, city, state, reachable, http_only, https_status, final_host, hsts, security_txt, privacy_link, accessibility_link, robots_gptbot, robots_chatgpt_user, robots_claude_user, llms_txt, title. CSV: header row, every cell quoted, yes/no for booleans. JSON: { list, title, count, by_state, columns, rows[][] }. Sizes: CSV 2.3 MB, JSON 2.4 MB. The same facts are in the free CC BY 4.0 dumps: the price buys the filtered, state-sliceable file built from the 2026-09-30 census, not exclusive data. Settlement is final; no refunds. Prices in /.well-known/x402 equal the challenges. Terms · pricing.
Card checkout
Pay with a card through Stripe and get the file on the next page: Full list CSV, $29 · JSON, $29 · one state $9 (links in the table below) · all 8 lists, $79. Agents pay less with x402 (see above).
Monitor this list (free)
Atom feed: .gov domains that entered or left this list according to the live re-checks (every 6 hours a rotating slice, each domain at most once per 14 days; each entry says which way it moved and which field changed). no-security-txt.top.json: the first 50 rows and the counts by state as JSON, CORS open. Fields watched: security_txt.
Membership reflects the homepage and well-known files as fetched on 2026-09-30: a control that exists but was not found where the census looked counts as missing, and sites answering 403 to our one polite request count as reachable. Every domain links to its record with what to fix, a JSON twin, a badge and a changes feed. Data licence CC BY 4.0. Not legal advice.