I analyzed half a million federal contractor websites. Here's what's broken.
BareFirms now tracks 916,521 federal contractors and has analyzed 498,082 of their websites. Every percentage below is a real, specific reason to reach out to a business, so I figured the numbers were worth sharing. A few that stood out: Security - 97.5% are missing key security headers - 2.8% have no SSL certificate at all Email trust (the stuff that quietly kills deliverability) - 52.1% have no DKIM record - 45% have no DMARC record - 28.1% have DMARC set to "none" (so it's not actually enforced) Accessibility (Section 508 / WCAG, which matters a lot for gov work) - 36.5% have critical violations - 52.8% have 3 or more serious violations SEO and basics - 57.7% have a low SEO score - 64.1% have no sitemap - 51.6% have no robots.txt Other bits: - WordPress runs 164k of them, Wix 44k, Squarespace 34k - 544,285 have no email on file at all - Of the ones that do, 26.5% are using a personal address like gmail or yahoo The point of all this is simple. There is a huge amount of work sitting in plain sight, and most of these businesses have no idea. If you sell web, security, or accessibility services, this is your pipeline. Stats refresh once a day. You can search and filter the live data at https://barefirms.com.
Wow no wonder I've had HR people (at a massive company!) complaining about their emails getting flagged as spam. I think that's the biggest pain point here and there are so many people who won't ever figure out why it's happening by themselves.
The Section 508 numbers are the most actionable part here -- 36.5% with critical violations on contracts where accessibility compliance is literally a requirement. These businesses are not failing on purpose. They just lack visibility into what is expected.
The harder version of this problem is what happens when the requirements themselves change. Section 508 gets updated, NIST cybersecurity frameworks shift, procurement mandates evolve -- and small contractors typically find out at renewal time when it is already too late.
Building something adjacent to this (billwatch-landing.vercel.app) -- legislative tracking for small businesses so they catch regulatory changes before they affect their contracts. Your dataset maps exactly to the audience that needs it.
That's an interesting point. One thing I've noticed while analyzing contractor websites is that many of the issues aren't intentional. Most companies simply don't know they have accessibility, security, or compliance gaps until someone points them out. Tracking changes to requirements before they become a problem is definitely part of the bigger picture.
The email deliverability stats are shocking — 52% missing DKIM. That's a huge blind spot for businesses that rely on email communication. Did you find that contractors were receptive when you reached out with specific issues found on their site?
I haven't done much direct outreach yet. Most of my focus so far has been on building the dataset and validating the analysis. The email authentication numbers surprised me too, especially given how common impersonation and deliverability issues have become.
This is strong because the data is not just interesting, it is directly tied to agency outreach.
The risk I’d watch is making BareFirms feel like a giant contractor database instead of a ready-to-use pipeline tool for specific service sellers.
A security agency, accessibility consultant, SEO freelancer, and email deliverability expert should probably not see the same product story. The value is in turning these gaps into a clear “who to contact and why now” workflow.
Small hint: the strongest angle may be less “search 900k contractors” and more “find contractors with one urgent, provable problem your service fixes.”
Happy to put the tighter agency-facing positioning path in writing if useful.
I think that's a fair observation. The database is really just the raw material. The more interesting part is helping someone quickly identify a specific problem they can solve, whether that's accessibility, email security, SEO, or GovCon readiness. I'm still figuring out which use cases resonate most.
I'd definitely be interested. One thing I've been wrestling with is whether BareFirms is fundamentally a contractor intelligence database or a prospecting tool for agencies and consultants. Curious how you'd frame it from the agency side.
Exactly. That’s the real positioning decision.
BareFirms probably gets stronger if agencies see it less as a contractor database and more as a way to find contractors with a specific, provable problem they can solve.
Send me your email and I’ll put the tighter agency-facing positioning path together properly.