Security posture snapshot for August 2026 across 822291 monitored European websites.
40.3/100
Average score
100%
Email spoofable
84%
No DNSSEC
33%
Missing security headers
Security posture by industry — sorted by average score. Click an industry to see its detailed breakdown.
| Industry | Sites | Score ▲ | Unprotected | Spoofable | Insecure | Grade distribution |
|---|---|---|---|---|---|---|
| Real Estate | 12005 |
38.7
|
28% | 100% | 74% | |
| Hospitality | 110589 |
39.4
|
34% | 100% | 72% | |
| Automotive | 36073 |
39.8
|
32% | 100% | 72% | |
| NGO & Nonprofit | 11915 |
39.8
|
29% | 100% | 73% | |
| construction | 13398 |
40.0
|
31% | 100% | 74% | |
| Fashion | 28371 |
40.0
|
29% | 100% | 72% | |
| pets | 3492 |
40.0
|
33% | 100% | 71% | |
| Sports | 46456 |
40.0
|
33% | 100% | 72% | |
| Food & Delivery | 231422 |
40.2
|
34% | 100% | 72% | |
| home-garden | 27165 |
40.2
|
33% | 100% | 70% | |
| culture | 29976 |
40.3
|
33% | 100% | 72% | |
| beauty | 30235 |
40.4
|
33% | 100% | 73% | |
| Travel | 23343 |
40.4
|
34% | 100% | 70% | |
| Education | 97056 |
40.6
|
31% | 100% | 68% | |
| professional-services | 15529 |
40.8
|
31% | 100% | 74% | |
| Healthcare | 51656 |
40.9
|
32% | 100% | 71% | |
| Logistics | 2220 |
40.9
|
34% | 100% | 66% | |
| Pharma | 13766 |
41.0
|
28% | 100% | 71% | |
| Technology | 17881 |
41.9
|
34% | 100% | 66% | |
| Media | 4117 |
42.0
|
38% | 100% | 57% | |
| Insurance | 2990 |
42.6
|
26% | 100% | 70% | |
| Energy | 1782 |
43.4
|
30% | 100% | 61% | |
| Adult | 330 |
45.0
|
62% | 100% | 26% | |
| Government | 1623 |
47.0
|
27% | 99% | 56% | |
| E-Commerce | 4378 |
47.2
|
43% | 100% | 39% | |
| Banking | 2985 |
47.7
|
17% | 100% | 64% | |
| Transport | 490 |
47.8
|
42% | 100% | 37% | |
| Gambling | 327 |
49.1
|
52% | 99% | 28% | |
| Telecom | 372 |
50.7
|
40% | 100% | 31% | |
| Regulatory | 348 |
52.2
|
39% | 100% | 26% |
Click a column header to sort. Column explanations: Unprotected = missing 3+ critical HTTP headers. Spoofable = no or weak DMARC. Insecure = no HTTPS redirect.
The most common security gaps across 822291 European websites — and the regulations they violate.
33%
Visitors are exposed to clickjacking, XSS, and content injection because critical HTTP headers are missing.
100%
Emails from these domains can be spoofed — invoices, password resets, anything. No DMARC enforcement.
84%
DNS responses are unsigned. Attackers can redirect visitors to fake sites without detection.
Run a free security scan — no account needed. See your score, grade, and how you compare to your industry.
Scan your website nowThis data is also available as JSON via the Benchmark API.