About
About the survey behind this guide
What we looked at
In October 2026 Wroot Labs looked at the public web addresses of 157 churches in one United Methodist annual conference. 144 were working websites listed in the denomination's church directory. The other 13 were still listed but no longer loaded; we kept them in because an unwatched domain can still be impersonated. We name neither the conference nor any church.
How
Passive checks only: the things any visitor or search engine can already see.
- Public DNS records: SPF, DMARC and mail servers.
- One ordinary request for each homepage, as a browser would make, to read the security certificate, the headers the server sends, and which platform the site runs on.
- Each site's published robots.txt and security.txt files.
No logins, no guessed addresses, no port scans, no testing for weaknesses. Sites on a free platform subdomain were left out because their records belong to the platform.
What we did not measure
Personal data in search results. We ran a search for church documents already indexed by search engines that might hold personal information (directories, prayer lists, giving records) but we are not reporting the result. A title and web address can't tell a blank form from a real directory, and checking would mean opening the files. Treat it as an open question, not a clean result. See people's data.
Caveats
- The sample is one conference, and it only includes churches that have a web address on file. Other conferences may differ.
- "Can be impersonated" means nothing published tells receivers to reject forged mail. Receivers differ in what they do with it.
- Platform and version detection come from what a site volunteers. Sites that hide their software appear as "unidentified."