EU Industry Benchmark
E-Commerce
Anonymized security posture data for the e-commerce sector across the EU. Based on 4378 monitored sites.
47.0
Avg. Score /100
D
Avg. Grade
4378
Sites Tracked
+8.0
vs. EU Average
Critical findings in this industry
1963 of 4378 without HTTPS redirect
4264 of 4378 with unencrypted email (no STARTTLS)
4372 of 4378 without DMARC protection (spoofable)
1566 of 4378 missing 3+ critical security headers
3741 of 4378 without DNSSEC (vulnerable to DNS spoofing)
3833 of 4378 without CAA records (unrestricted certificate issuance)
4235 of 4378 without MTA-STS (email downgrade attacks possible)
Grade Distribution
Security across Europe
Average security score by country — hover for details, click to explore.
/100 · sites
Score by Country
Hosting & Data Residency
16%
EU-headquartered provider
84%
Non-EU provider (CLOUD Act / Schrems II)
Server location via IP geolocation (MaxMind GeoLite2). Company HQ from ASN registry. A site may be physically hosted in the EU but use a US-headquartered provider subject to the CLOUD Act — per Schrems II (CJEU C-311/18), this requires SCCs with supplementary measures. · GDPR Art. 44–49
All data is anonymized. No individual sites are identified. Statistics updated weekly.