Security posture snapshot for June 2026 across 818920 monitored European websites.
41.3/100
Average score
100%
Email spoofable
84%
No DNSSEC
53%
Missing security headers
Security posture by industry — sorted by average score. Click an industry to see its detailed breakdown.
| Industry | Sites | Score ▲ | Unprotected | Spoofable | Insecure | Grade distribution |
|---|---|---|---|---|---|---|
| Real Estate | 11975 |
39.5
|
47% | 100% | 75% | |
| Hospitality | 110109 |
40.1
|
54% | 100% | 73% | |
| Automotive | 35929 |
40.7
|
52% | 100% | 72% | |
| NGO & Nonprofit | 11819 |
40.7
|
51% | 100% | 76% | |
| construction | 13348 |
41.0
|
56% | 100% | 72% | |
| Sports | 46248 |
41.0
|
54% | 100% | 71% | |
| pets | 3478 |
41.1
|
51% | 100% | 73% | |
| home-garden | 27074 |
41.2
|
52% | 100% | 71% | |
| Travel | 23253 |
41.2
|
53% | 100% | 71% | |
| Media | 4111 |
41.3
|
40% | 100% | 76% | |
| culture | 29842 |
41.4
|
56% | 100% | 71% | |
| Education | 96785 |
41.4
|
47% | 100% | 72% | |
| Food & Delivery | 230277 |
41.4
|
57% | 100% | 70% | |
| Logistics | 2218 |
41.4
|
46% | 100% | 75% | |
| beauty | 30126 |
41.6
|
59% | 100% | 70% | |
| Adult | 328 |
41.8
|
44% | 100% | 81% | |
| Fashion | 28259 |
41.8
|
45% | 100% | 71% | |
| Pharma | 13710 |
41.8
|
46% | 100% | 72% | |
| Healthcare | 51492 |
41.9
|
54% | 100% | 72% | |
| professional-services | 15471 |
41.9
|
55% | 100% | 72% | |
| Technology | 17810 |
42.5
|
50% | 100% | 72% | |
| Insurance | 2987 |
42.9
|
40% | 100% | 76% | |
| Energy | 1777 |
43.0
|
38% | 100% | 77% | |
| Transport | 490 |
43.6
|
30% | 99% | 78% | |
| E-Commerce | 4365 |
44.1
|
33% | 100% | 74% | |
| Gambling | 325 |
44.3
|
31% | 99% | 81% | |
| Telecom | 371 |
44.5
|
24% | 100% | 78% | |
| Government | 1616 |
44.8
|
25% | 99% | 83% | |
| Regulatory | 346 |
45.7
|
25% | 100% | 79% | |
| Banking | 2980 |
45.9
|
20% | 100% | 79% |
Click a column header to sort. Column explanations: Unprotected = missing 3+ critical HTTP headers. Spoofable = no or weak DMARC. Insecure = no HTTPS redirect.
The most common security gaps across 818920 European websites — and the regulations they violate.
53%
Visitors are exposed to clickjacking, XSS, and content injection because critical HTTP headers are missing.
100%
Emails from these domains can be spoofed — invoices, password resets, anything. No DMARC enforcement.
84%
DNS responses are unsigned. Attackers can redirect visitors to fake sites without detection.
Run a free security scan — no account needed. See your score, grade, and how you compare to your industry.
Scan your website nowThis data is also available as JSON via the Benchmark API.