Skip to main content
9396 sites analysed

State of EU Web Security

A deep technical analysis of 9396 European websites. TLS configuration, email authentication, security headers, accessibility, cookie consent, and pre-consent data transfers — measured, not estimated.

81.5%

TLS 1.3

30.7%

DMARC reject

62%

HSTS

35%

CSP

22%

DNSSEC

64.0%

A11y score

72%

Cookie banner

20%

High-risk transfers

TLS & Certificates

4791 sites scanned

TLS Version Distribution

TLSv1.3
81.5%
TLSv1.2
13.6%
Unknown
4.9%

Certificate Features

14%

Forward Secrecy

100%

Certificate Transparency

70%

OCSP Stapling

44%

Wildcard Certs

0%

Deprecated TLS

HTTP Security Headers

8975 sites scanned

Header Adoption Rates

Strict-Transport-Security (HSTS)
62%
X-Content-Type-Options
58%
X-Frame-Options
54%
Referrer-Policy
35%
Content-Security-Policy (CSP)
35%
Permissions-Policy
16%

96%

HTTPS Redirect

11%

security.txt

18%

Open CORS

Email Security

4786 sites scanned

DMARC Policy Distribution

30.7%
21.1%
26.4%
21.8%
Reject 30.7% Quarantine 21.1% None (monitor only) 26.4% No DMARC 21.8%

Email Authentication

90%

SPF

64%

DKIM

78%

DMARC

85%

STARTTLS

84%

Modern SMTP TLS

0%

Blacklisted

DKIM Key Size Distribution

1024-bit 31.9%
2048-bit 67.8%
4096-bit 0.2%
768-bit 0.1%

DNS Security

4781 sites scanned

DNSSEC Signing
22%
CAA Records
17%
DANE/TLSA
7%
BIMI
7%
TLS-RPT
6%
MTA-STS
4%

MTA-STS Mode Breakdown

enforce (100)
testing (68)
unknown (19)
none (3)

Accessibility (WCAG 2.2 AA)

9164 sites scanned · EAA / EN 301 549

64.0/100

Average score

5.2

Avg violations / site

7140

Critical violations

18264

Serious violations

Most Common Violations

Violation Impact Sites affected

region

Ensure all page content is contained by landmarks

moderate 5848

color-contrast

Ensure the contrast between foreground and background colors meets WCAG 2 AA minimum contrast ratio thresholds

serious 4735

link-name

Ensure links have discernible text

serious 3894

landmark-unique

Ensure landmarks are unique

moderate 3245

heading-order

Ensure the order of headings is semantically correct

moderate 2869

target-size

Ensure touch targets have sufficient size and space

serious 2560

image-alt

Ensure <img> elements have alternative text or a role of none or presentation

critical 2125

button-name

Ensure buttons have discernible text

critical 1653

landmark-one-main

Ensure the document has a main landmark

moderate 1345

aria-allowed-role

Ensure role attribute has an appropriate value for the element

minor 1130

Cookie Compliance

9170 sites scanned · ePrivacy / TTDSG

72%

Banner detected

30%

Reject option

0%

Consent withdraw

0%

Google Consent Mode

5.3

Avg cookies / site

0.5

Avg third-party

5.3

Avg pre-consent

7.5

Avg issues

Core Web Vitals

9145 sites scanned

89.9

Perf score

1.8s

LCP

1.3s

FCP

0.072

CLS

342ms

TBT

250ms

TTFB

LCP Distribution

82%
12%
Good (≤2.5s) Needs work Poor (>4s)

CLS Distribution

83%
Good (≤0.1) Needs work Poor (>0.25)

Methodology

How this data was collected and what it represents.

All data is collected through automated, non-intrusive scans of publicly accessible websites. No login credentials are used, no forms are submitted, and no private data is accessed.

Sites are scanned across multiple dimensions: HTTP headers, TLS certificates, DNS records, email authentication (SPF/DKIM/DMARC), accessibility (WCAG 2.2 AA via automated testing), cookie consent mechanisms, pre-consent data transfers, and Core Web Vitals.

No individual sites are named. All statistics are aggregated and anonymised. Regulatory references indicate which requirements relate to each finding — they do not assert non-compliance of any specific organisation.

Where does your website stand?

Run a free security scan and see how you compare — TLS, headers, email, DNS, accessibility, cookies — in 30 seconds, no account needed.

Based on automated scans of 9396 European websites. Updated continuously.