A deep technical analysis of 820169 European websites. TLS configuration, email authentication, security headers, and DNS security — measured, not estimated.
92.2%
TLS 1.3
0.7%
DMARC reject
11%
HSTS
5%
CSP
15%
DNSSEC
13%
HTTPS
20%
IPv6 ready
3%
HTTP/3
88%
NS redundancy
0%
sec.txt CRA
4%
Mixed content
3%
CSP reporting
More reports
786939 sites scanned
TLS encrypts data in transit. TLS 1.3 is the current standard — older versions have known vulnerabilities. Required by GDPR Art. 32 (encryption of personal data), NIS2 Art. 21 (state of the art security measures), and PCI DSS 4.0 (TLS 1.2+ mandatory since March 2025).
100%
Forward Secrecy
100%
Certificate Transparency
30%
OCSP Stapling
33%
Wildcard Certs
0%
Deprecated TLS
864618 sites scanned
HTTP security headers instruct browsers to enable protections like XSS filtering, clickjacking prevention, and content type enforcement. OWASP recommends all six headers. NIS2 Art. 21 and ISO 27001 A.8.9 require appropriate technical measures — missing headers indicate gaps.
13%
HTTPS Redirect
4%
HSTS Preload Ready
1%
security.txt
80%
Open CORS
1%
HSTS < 6 months
1%
Unsafe Referrer-Policy
1%
COOP Enabled
6%
Server Misconfigs
847604 sites scanned
SPF, DKIM, and DMARC prevent email spoofing and phishing. Without DMARC enforcement, attackers can send emails that appear to come from your domain. Required by NIS2 Art. 21 (supply chain security), DORA Art. 9 (ICT risk management), and BSI IT-Grundschutz APP.5.3.
4%
SPF
1%
DKIM
2%
DMARC
5%
STARTTLS
5%
Modern SMTP TLS
0%
Blacklisted
Percentage of sites without effective DMARC policy (spoofable via email)
864986 sites scanned
DNS security features protect against cache poisoning, domain hijacking, and man-in-the-middle attacks. DNSSEC is recommended by ENISA and required under NIS2 for essential entities. CAA prevents unauthorized certificate issuance (RFC 8659). MTA-STS enforces TLS for inbound email.
Zone Transfer (AXFR) open on 1% of domains — full DNS zone data is publicly accessible.
How this data was collected and what it represents.
All data is collected through automated, non-intrusive scans of publicly accessible websites. No login credentials are used, no forms are submitted, and no private data is accessed.
Sites are scanned across multiple dimensions: HTTP headers, TLS certificates, DNS records, and email authentication (SPF/DKIM/DMARC). Privacy, accessibility, and technology data are available in dedicated reports.
No individual sites are named. All statistics are aggregated and anonymised. Regulatory references indicate which requirements relate to each finding — they do not assert non-compliance of any specific organisation.
Run a free security scan and see how you compare — TLS, headers, email, DNS — in 30 seconds, no account needed.
Based on automated scans of 820169 European websites. Updated continuously.