County election websites across the United States continue to exhibit security weaknesses, including the use of non-.gov domains, inadequate email authentication and excessive third-party tracking, as first reported by Security Affairs.
A recent census of 2,081 county election websites reveals that while security has improved since 2024, significant risks remain. Approximately 42% of these sites still operate on non-.gov domains, which can lead to voter confusion and potential impersonation. Furthermore, email security remains a concern; 51% of county-controlled domains lack an enforced Domain-based Message Authentication, Reporting and Conformance policy, increasing the risk of spoofing. Technical audits also identified issues with encrypted connections, as 28 websites failed to maintain working HTTPS services and many others lacked HTTP Strict Transport Security headers. Additionally, 84% of tested pages initiated connections to third-party trackers, often without clear necessity. While these findings do not indicate that voting machines or ballot-counting systems have been compromised, researchers emphasize that these vulnerabilities could expose voters to misleading information or data collection. Experts recommend that election offices prioritize migrating to .gov domains, enforcing email authentication and auditing third-party scripts to better protect the integrity of public-facing election information.
Source: Security Affairs
