Security posture snapshot for July 2026 across 821884 monitored European websites.
39.0/100
Average score
100%
Email spoofable
84%
No DNSSEC
17%
Missing security headers
Security posture by industry — sorted by average score. Click an industry to see its detailed breakdown.
| Industry | Sites | Score ▲ | Unprotected | Spoofable | Insecure | Grade distribution |
|---|---|---|---|---|---|---|
| Real Estate | 12003 |
37.3
|
13% | 100% | 90% | |
| NGO & Nonprofit | 11901 |
38.3
|
14% | 100% | 89% | |
| Automotive | 36047 |
38.4
|
16% | 100% | 87% | |
| Hospitality | 110540 |
38.4
|
19% | 100% | 86% | |
| Fashion | 28353 |
38.5
|
15% | 100% | 87% | |
| Logistics | 2218 |
38.7
|
15% | 100% | 88% | |
| Media | 4120 |
38.8
|
15% | 100% | 86% | |
| pets | 3489 |
38.8
|
19% | 100% | 85% | |
| Sports | 46431 |
38.8
|
17% | 100% | 87% | |
| construction | 13384 |
38.9
|
16% | 100% | 89% | |
| Education | 97017 |
38.9
|
17% | 100% | 84% | |
| home-garden | 27148 |
38.9
|
18% | 100% | 86% | |
| Travel | 23327 |
39.0
|
18% | 100% | 86% | |
| culture | 29962 |
39.1
|
18% | 100% | 86% | |
| Food & Delivery | 231331 |
39.1
|
18% | 100% | 87% | |
| beauty | 30219 |
39.2
|
17% | 100% | 88% | |
| Pharma | 13752 |
39.2
|
13% | 100% | 88% | |
| Adult | 331 |
39.4
|
14% | 100% | 83% | |
| Healthcare | 51635 |
39.6
|
16% | 100% | 88% | |
| professional-services | 15522 |
39.6
|
16% | 100% | 89% | |
| Technology | 17869 |
39.8
|
17% | 100% | 86% | |
| Insurance | 2991 |
39.9
|
11% | 100% | 89% | |
| Energy | 1780 |
40.4
|
15% | 100% | 85% | |
| Transport | 490 |
40.6
|
11% | 100% | 87% | |
| E-Commerce | 4376 |
40.9
|
13% | 100% | 86% | |
| Gambling | 325 |
41.3
|
14% | 100% | 86% | |
| Government | 1618 |
41.8
|
8% | 100% | 89% | |
| Regulatory | 348 |
42.2
|
8% | 100% | 88% | |
| Telecom | 372 |
42.3
|
11% | 100% | 84% | |
| Banking | 2984 |
43.1
|
8% | 100% | 88% |
Click a column header to sort. Column explanations: Unprotected = missing 3+ critical HTTP headers. Spoofable = no or weak DMARC. Insecure = no HTTPS redirect.
The most common security gaps across 821884 European websites — and the regulations they violate.
17%
Visitors are exposed to clickjacking, XSS, and content injection because critical HTTP headers are missing.
100%
Emails from these domains can be spoofed — invoices, password resets, anything. No DMARC enforcement.
84%
DNS responses are unsigned. Attackers can redirect visitors to fake sites without detection.
Run a free security scan — no account needed. See your score, grade, and how you compare to your industry.
Scan your website nowThis data is also available as JSON via the Benchmark API.