Skip to main content
All Industries

EU Industry Benchmark

Travel

Anonymized security posture data for the travel sector across the EU. Based on 23343 monitored sites.

40.2

Avg. Score /100

D

Avg. Grade

23343

Sites Tracked

0.0

vs. EU Average

Critical findings in this industry

16836 of 23343 without HTTPS redirect

72.0%

22946 of 23343 with unencrypted email (no STARTTLS)

98.0%

23304 of 23343 without DMARC protection (spoofable)

100.0%

7478 of 23343 missing 3+ critical security headers

32.0%

19084 of 23343 without DNSSEC (vulnerable to DNS spoofing)

82.0%

22666 of 23343 without CAA records (unrestricted certificate issuance)

97.0%

23229 of 23343 without MTA-STS (email downgrade attacks possible)

100.0%

Grade Distribution

A
0 (0.0%)
B
2 (0.0%)
C
493 (2.0%)
D
11767 (50.0%)
F
11081 (47.0%)

Security across Europe

Average security score by country — hover for details, click to explore.

Austria: 40.5/100 (697 sites) Belgium: 41.1/100 (417 sites) Bulgaria: 39.2/100 (104 sites) Croatia: 40.4/100 (204 sites) Cyprus: 42.1/100 (26 sites) Czech Republic: 42.1/100 (562 sites) Denmark: 42.4/100 (688 sites) Estonia: 44.8/100 (172 sites) Finland: 41.1/100 (468 sites) France: 37.8/100 (2771 sites) Germany: 40.2/100 (5604 sites) Greece: 39.6/100 (206 sites) Hungary: 38.5/100 (333 sites) Ireland: 41.2/100 (172 sites) Italy: 38.2/100 (1852 sites) Latvia: 43.4/100 (109 sites) Lithuania: 41.2/100 (209 sites) Luxembourg: 46.2/100 (34 sites) Netherlands: 42.5/100 (1655 sites) Norway: 42.5/100 (360 sites) Poland: 39.1/100 (1216 sites) Portugal: 39.4/100 (289 sites) Romania: 38.5/100 (245 sites) Slovakia: 42.5/100 (253 sites) Slovenia: 39.8/100 (125 sites) Spain: 39.1/100 (1125 sites) Sweden: 43.0/100 (605 sites) Switzerland: 42.7/100 (835 sites) United Kingdom: 39.8/100 (1918 sites)
Worse
Better

Score by Country

🇦🇹 Austria
40.5 697 🇧🇪 Belgium
41.1 417 🇧🇬 Bulgaria
39.2 104 🇭🇷 Croatia
40.4 204 🇨🇾 Cyprus
42.1 26 🇨🇿 Czech Republic
42.1 562 🇩🇰 Denmark
42.4 688 🇪🇪 Estonia
44.8 172 🇫🇮 Finland
41.1 468 🇫🇷 France
37.8 2771 🇩🇪 Germany
40.2 5604 🇬🇷 Greece
39.6 206 🇭🇺 Hungary
38.5 333 🇮🇸 Iceland
46.0 61 🇮🇪 Ireland
41.2 172 🇮🇹 Italy
38.2 1852 🇱🇻 Latvia
43.4 109 🇱🇮 Liechtenstein
40.5 2 🇱🇹 Lithuania
41.2 209 🇱🇺 Luxembourg
46.2 34 🇲🇹 Malta
45.0 26 🇳🇱 Netherlands
42.5 1655 🇳🇴 Norway
42.5 360 🇵🇱 Poland
39.1 1216 🇵🇹 Portugal
39.4 289 🇷🇴 Romania
38.5 245 🇸🇰 Slovakia
42.5 253 🇸🇮 Slovenia
39.8 125 🇪🇸 Spain
39.1 1125 🇸🇪 Sweden
43.0 605 🇨🇭 Switzerland
42.7 835 🇬🇧 United Kingdom
39.8 1918

Hosting & Data Residency

64%

EU-headquartered provider

36%

Non-EU provider (CLOUD Act / Schrems II)

Cloudflare (US) 2026 19.6%
IONOS (1&1) (DE) 1655 16.0%
OVHcloud (FR) 1556 15.1%
Hetzner (DE) 1472 14.2%
Amazon Web Services (US) 858 8.3%

Server location via IP geolocation (MaxMind GeoLite2). Company HQ from ASN registry. A site may be physically hosted in the EU but use a US-headquartered provider subject to the CLOUD Act — per Schrems II (CJEU C-311/18), this requires SCCs with supplementary measures. · GDPR Art. 44–49

How does your site compare?

Run a free security scan and see your grade instantly.

Scan your site

All data is anonymized. No individual sites are identified. Statistics updated weekly.