How safe are tax-office websites? We checked 13,481.

By Known Good IT. Scan run October 28, 2026.

About 1 in 30 tax-office websites we checked has a form that can send a visitor's typing without encryption. That is 458 of 13,481 sites, or 3.4%. On 204 of them (1.5%) the form's own address starts with http://, so the browser is told to send the data in the clear.

The other 254 have a form on a page served over plain http, and 125 of them also offer working https. On 97 of the 204, the homepage loaded over https with a valid certificate, so a visitor sees the lock icon while a form on the page still points at an unencrypted address. We submitted nothing. We read the page code any browser downloads.

What else we saw

Certificates are the most fixable item. About 1 in 16 sites had no working https or a certificate our checker could not validate (some may open fine in a browser), and another 44 had under 10 days left. Many of those will have renewed since October 28.

Half the sites send the HSTS header, which tells browsers to always use https. Missing it is common on well-run sites and is a hardening gap, not a breach. Likewise, 7,197 sites announce their site software, and 230 (1.7% of all sites) announce a release more than two years old or past end of life. That tag is what the site says about itself. It does not show that the site is vulnerable.

Overall, 1,911 sites (14.2%) triggered a flag other than a certificate inside its normal renewal window. Regional differences were small. Across metro areas with 100 or more reachable sites, the form share ran from 1.2% to 5.8%, but with a few hundred sites per city that spread is mostly noise, so we do not rank cities.

What this means for your office

The website is one small part of what the law covers. Paid tax preparers are required to have a written information security plan, known as a WISP. The FTC Safeguards Rule (16 CFR Part 314) sets the requirement, and IRS Publication 5708 is the IRS's sample plan for preparers. The PTIN application (Form W-12, line 11) asks you to confirm you know about it. PTIN renewals for 2027 are open now, and a paid preparer needs a valid 2027 PTIN before preparing returns.

Fixing the items above does not make an office compliant. Here is what to do about the website itself:

• Open your own contact page and check that the address starts with https and the browser shows no warning.
• Ask whoever built the site to send every form to an https address and to redirect http visitors to https.
• Turn on automatic certificate renewal, and set a calendar reminder if your host cannot do it.
• Do not ask clients to type Social Security numbers into a contact form. Use a secure portal or a phone call.

Then write the plan. It covers how you protect client data, who is responsible, and what you do if something goes wrong. Publication 5708 is a free start.

How we did it

The site list comes from our own files of tax-preparation and accounting websites found through a places search of 35 U.S. metro areas. We removed offices we had already contacted and businesses that were clearly something else, such as realty or law. The full run covered 13,771 sites on October 28, 2026, and 13,481 of them (97.9%) answered.

For each site we fetched the http and https versions of the homepage, the site's own contact page if it linked one, and the public security.txt file. We made at most one request per second to any site, identified our tool in the user agent, and never logged in, tried admin paths or probed a port. A form counts only if it has a visible input.

We recomputed the three headline numbers a second way and they matched. The scan and this write-up were done with AI tools and checked by us.

Limits

This is not a random sample of all U.S. tax offices. It is every site on our list, which leans toward metro areas and toward offices a search can find. We looked at one moment from one connection. A site that blocked us counts as unreachable. We saw the homepage and one contact page, so forms elsewhere and portals hosted on other sites were missed, and a form that scripts rebuild after the page loads would not show up. A form action on http:// shows where a browser would send data. It does not show that anyone intercepted it. Nothing here shows that any office was hacked, and we name none. This is not legal or tax advice.