Skip to main content
All Industries

EU Industry Benchmark

Hospitality

Anonymized security posture data for the hospitality sector across the EU. Based on 111491 monitored sites.

43.2

Avg. Score /100

D

Avg. Grade

111491

Sites Tracked

-2.0

vs. EU Average

Critical findings in this industry

66369 of 111491 without HTTPS redirect

60.0%

95111 of 111491 with unencrypted email (no STARTTLS)

85.0%

104724 of 111491 without DMARC protection (spoofable)

94.0%

50029 of 111491 missing 3+ critical security headers

45.0%

96119 of 111491 without DNSSEC (vulnerable to DNS spoofing)

86.0%

108799 of 111491 without CAA records (unrestricted certificate issuance)

98.0%

111321 of 111491 without MTA-STS (email downgrade attacks possible)

100.0%

Grade Distribution

A
2 (0.0%)
B
171 (0.0%)
C
4777 (4.0%)
D
67022 (60.0%)
F
39519 (35.0%)

Security across Europe

Average security score by country — hover for details, click to explore.

Austria: 42.6/100 (7209 sites) Belgium: 41.4/100 (1734 sites) Bulgaria: 40.0/100 (792 sites) Croatia: 40.7/100 (1015 sites) Cyprus: 41.8/100 (203 sites) Czech Republic: 40.6/100 (3178 sites) Denmark: 43.2/100 (1236 sites) Estonia: 44.4/100 (351 sites) Finland: 41.7/100 (897 sites) France: 43.7/100 (13697 sites) Germany: 48.4/100 (25421 sites) Greece: 39.5/100 (2619 sites) Hungary: 40.1/100 (1290 sites) Ireland: 40.7/100 (1099 sites) Italy: 41.2/100 (14721 sites) Latvia: 41.4/100 (227 sites) Lithuania: 39.7/100 (478 sites) Luxembourg: 43.7/100 (122 sites) Netherlands: 42.3/100 (4670 sites) Norway: 43.2/100 (1370 sites) Poland: 37.3/100 (6380 sites) Portugal: 40.7/100 (1462 sites) Romania: 41.1/100 (1223 sites) Slovakia: 41.8/100 (1522 sites) Slovenia: 39.5/100 (519 sites) Spain: 39.6/100 (7234 sites) Sweden: 42.1/100 (1520 sites) Switzerland: 44.8/100 (2793 sites) United Kingdom: 44.5/100 (6067 sites)
Worse
Better

Score by Country

🇦🇹 Austria
42.6 7209 🇧🇪 Belgium
41.4 1734 🇧🇬 Bulgaria
40.0 792 🇭🇷 Croatia
40.7 1015 🇨🇾 Cyprus
41.8 203 🇨🇿 Czech Republic
40.6 3178 🇩🇰 Denmark
43.2 1236 🇪🇪 Estonia
44.4 351 🇫🇮 Finland
41.7 897 🇫🇷 France
43.7 13697 🇩🇪 Germany
48.4 25421 🇬🇷 Greece
39.5 2619 🇭🇺 Hungary
40.1 1290 🇮🇸 Iceland
42.9 298 🇮🇪 Ireland
40.7 1099 🇮🇹 Italy
41.2 14721 🇱🇻 Latvia
41.4 227 🇱🇮 Liechtenstein
47.4 13 🇱🇹 Lithuania
39.7 478 🇱🇺 Luxembourg
43.7 122 🇲🇹 Malta
42.5 131 🇳🇱 Netherlands
42.3 4670 🇳🇴 Norway
43.2 1370 🇵🇱 Poland
37.3 6380 🇵🇹 Portugal
40.7 1462 🇷🇴 Romania
41.1 1223 🇸🇰 Slovakia
41.8 1522 🇸🇮 Slovenia
39.5 519 🇪🇸 Spain
39.6 7234 🇸🇪 Sweden
42.1 1520 🇨🇭 Switzerland
44.8 2793 🇬🇧 United Kingdom
44.5 6067

Hosting & Data Residency

61%

EU-headquartered provider

39%

Non-EU provider (CLOUD Act / Schrems II)

Cloudflare (US) 10260 18.4%
IONOS (1&1) (DE) 8490 15.2%
OVHcloud (FR) 7210 12.9%
Hetzner (DE) 7167 12.9%
Amazon Web Services (US) 5991 10.8%

Server location via IP geolocation (MaxMind GeoLite2). Company HQ from ASN registry. A site may be physically hosted in the EU but use a US-headquartered provider subject to the CLOUD Act — per Schrems II (CJEU C-311/18), this requires SCCs with supplementary measures. · GDPR Art. 44–49

How does your site compare?

Run a free security scan and see your grade instantly.

Scan your site

All data is anonymized. No individual sites are identified. Statistics updated weekly.