We scan 814434 European websites every week — banking, pharma, e-commerce, government, tech. No individual sites are named. The question isn't who failed. It's which industries are exposed.
43.5/100
Average score
86%
Email spoofable
84%
No DNSSEC
58%
Missing security headers
Security posture by industry — sorted by average score. Click an industry to see its detailed breakdown.
| Industry | Sites | Score ▲ | Unprotected | Spoofable | Pre-Consent | Grade distribution |
|---|---|---|---|---|---|---|
| Hospitality | 109378 |
|
61% | 89% | 17% |
D
F
|
| Real Estate | 11928 |
|
55% | 85% | 23% |
D
F
|
| beauty | 29981 |
|
60% | 89% | 12% |
D
F
|
| Food & Delivery | 228753 |
|
62% | 89% | 13% |
D
F
|
| construction | 13310 |
|
57% | 84% | 13% |
D
F
|
| Automotive | 35720 |
|
56% | 85% | 16% |
D
F
|
| NGO & Nonprofit | 11758 |
|
55% | 84% | 19% |
D
F
|
| pets | 3452 |
|
60% | 87% | 16% |
D
F
|
| Sports | 45996 |
|
59% | 86% | 16% |
D
F
|
| culture | 29704 |
|
60% | 86% | 17% |
D
F
|
| Education | 96448 |
|
53% | 84% | 20% |
D
F
|
| Travel | 23124 |
|
60% | 86% | 18% |
D
F
|
| Healthcare | 51220 |
|
55% | 84% | 15% |
D
F
|
| home-garden | 26937 |
|
57% | 85% | 15% |
D
F
|
| professional-services | 15383 |
|
56% | 80% | 16% |
D
F
|
| Fashion | 28105 |
|
49% | 86% | 19% |
D
F
|
| Logistics | 2212 |
|
50% | 78% | 16% |
D
F
|
| Pharma | 13678 |
|
51% | 82% | 15% |
D
F
|
| Adult | 327 |
|
40% | 80% | 11% |
D
F
|
| Technology | 17721 |
|
54% | 73% | 17% |
D
F
|
| Insurance | 2978 |
|
43% | 77% | 14% |
D
F
|
| Media | 4099 |
|
53% | 72% | 25% |
D
F
|
| Energy | 1767 |
|
45% | 70% | 17% |
C
D
F
|
| Gambling | 322 |
|
31% | 61% | 11% |
C
D
F
|
| Regulatory | 345 |
|
23% | 61% | 34% |
C
D
F
|
| Transport | 488 |
|
36% | 60% | 18% |
C
D
F
|
| Telecom | 370 |
|
27% | 56% | 21% |
C
D
|
| Government | 1607 |
|
36% | 60% | 23% |
C
D
F
|
| E-Commerce | 4352 |
|
43% | 57% | 16% |
C
D
|
| Banking | 2970 |
|
23% | 65% | 14% |
C
D
F
|
Click a column header to sort. Column explanations: Unprotected = missing 3+ critical HTTP headers. Spoofable = no or weak DMARC.
Average security score by country — hover for details, click to explore.
/100 · sites
Security posture by country — click a country to see its detailed breakdown.
Austria
33536 sites
Belgium
23330 sites
Bulgaria
3904 sites
Croatia
5698 sites
Cyprus
1250 sites
Czech Republic
17369 sites
Denmark
15339 sites
Estonia
3274 sites
European Union
191 sites
Finland
12458 sites
France
86882 sites
Germany
224849 sites
Greece
7709 sites
Hungary
7408 sites
Iceland
1203 sites
Ireland
10155 sites
Italy
52708 sites
Latvia
2143 sites
Liechtenstein
179 sites
Lithuania
3691 sites
Luxembourg
1646 sites
Malta
759 sites
Netherlands
57136 sites
Norway
9393 sites
Poland
42273 sites
Portugal
7182 sites
Romania
6222 sites
Slovakia
10649 sites
Slovenia
3090 sites
Spain
35729 sites
Sweden
10983 sites
Switzerland
28463 sites
United Kingdom
87632 sites
Run a free security scan — no account needed. See your score, grade, and how you compare to your industry.
Scan your website nowThe most common security gaps across 814434 European websites — and the regulations they violate.
58%
Visitors are exposed to clickjacking, XSS, and content injection because critical HTTP headers are missing.
86%
Emails from these domains can be spoofed — invoices, password resets, anything. No DMARC enforcement.
84%
DNS responses are unsigned. Attackers can redirect visitors to fake sites without detection.
Explore specific dimensions of Europe's web landscape in detail.
How we scan, what we measure, how scores are computed.
Every site is scanned weekly across these security dimensions. Scores are computed on a 100-point scale.
HSTS, CSP, X-Frame-Options, X-Content-Type, Referrer-Policy, Permissions-Policy
Key strength, signature algorithm, chain depth, TLS version, forward secrecy
HTTP-to-HTTPS redirect for all visitors
SPF, DKIM (key strength), DMARC (policy enforcement)
DNSSEC signing, CAA records, DoH consistency, DANE/TLSA
Vulnerability disclosure contact per RFC 9116
Inbound email TLS enforcement (enforce vs. testing mode)
SMTP TLS failure reporting endpoint
No server version disclosure, no X-Powered-By, restricted CORS
Data based on automated weekly scans of publicly accessible websites.
No individual site names are disclosed. All statistics are anonymised by industry.
Regulatory references indicate which requirements relate to each finding. They do not assert non-compliance of any specific organisation.
Run a free security scan and see your score, your grade, and how you compare — in 30 seconds, no account needed.
This data is also available as JSON via the Benchmark API.