Every week, our robot checks the websites of a panel of organisations from the outside, like any visitor would. Three scores out of 100 — the higher, the better: compliance with security good practice, resistance to known vulnerabilities, and speed.
Measurements made by our robot on the date shown, following our published method. Our method · Ask for an explanation or contest a result · Ask for a re-test
This week’s update is in progress: the figures below are those of the last edition.
Method updated on October 11, 2026: published administration consoles and remote access, and DNS servers that no longer answer, now count. Part of the change since last week comes from the method, not from the websites, so this edition shows no week-on-week arrows. Our method
The website whose lowest of the three scores is the highest, with at least 80 in each: it is its balance that wins.
Measured from the outside, at a given time, following our published method — neither an audit nor a certification. Our method
It is striking to see one of the smaller organisations lead this ranking, ahead of far larger players. None of its three scores falls below 93 out of 100. It finishes 27 points above the average of the websites measured.
Average of the others 73
Average of the others 69.7
A website is named only for a good result: at least 80 out of 100 on that score, measured this week. A podium can therefore have fewer than three names.
Is your website among the best of its sector? Check where it stands — then aim higher: Europe, the world. Check your website
Want to climb? Our report tells you what to fix, and our experts can do it for you. Get a report · Have it fixed
Compliance score of each website of the selection, by level:
| Group | Sites | Compliance | Resistance | Speed |
|---|---|---|---|---|
| Banking and insurance | 182 | 78.5 | 78.5 | 66.6 |
| Technology and software | 230 | 77.2 | 73.1 | 74.1 |
| Consulting and business services | 400 | 74.5 | 70.5 | 69.5 |
| Retail and e-commerce | 295 | 74.4 | 69.9 | 71.7 |
| Transport and logistics | 64 | 74.1 | 71.3 | 66.2 |
| Tourism, hotels and restaurants | 35 | 73.9 | 68.2 | 66.5 |
| Construction and real estate | 63 | 73.5 | 69.7 | 70.5 |
| Education and research | 258 | 73.5 | 68.7 | 62.7 |
| Industry, energy and agriculture | 340 | 73.1 | 69.1 | 66.8 |
| Health and social care | 205 | 72.1 | 68.4 | 60.4 |
| Media, publishing and culture | 456 | 71.6 | 67 | 65.6 |
| Public administration | 938 | 71.2 | 67.3 | 57.9 |
| Non-profits and other services | 632 | 70 | 64.8 | 62.3 |
| All websites of this selection | 4716 | 73 | 69.8 | 66 |
Not enough websites yet (fewer than 20): Telecommunications (10).
| Group | Sites | Compliance | Resistance | Speed |
|---|---|---|---|---|
| Very large companies | 406 | 77.9 | 79.7 | 69.6 |
| Large companies | 862 | 74.6 | 71.8 | 65.5 |
| Medium-sized companies | 1499 | 71.9 | 66.2 | 61.6 |
| Small companies | 1342 | 70.8 | 65.9 | 65.9 |
| All websites of this selection | 4716 | 73 | 69.8 | 66 |
Sector and size are known for 4109 of the 4716 websites, from the official company register (Sirene for French organisations). The other websites count in the overall averages only.
Who maintains the server depends on the hosting. The “server base” score only counts what is configured on the server itself (web server, PHP, TLS, packages, mail), not the website’s own code nor its DNS.
4716 websites
605 websites
On shared hosting, the server base is maintained by the host.
183 websites
On a dedicated server or a cloud, the host provides power, network, physical security and anti-DDoS; the system and applications are maintained by its customer.
136 websites are behind a CDN (Cloudflare or similar): their origin server is hidden from us, so they count in “All websites” only.
Number of websites of the panel by domain extension:
Free to quote, with the source and a link: Source: Top-Secured security barometer, top-secured.com/barometer (2026-W42).
One e-mail a week: the new barometer and our analyses of the attacks and flaws that matter. Free, one-click unsubscribe.
The barometer is calculated on Wednesday evening and published on Thursday morning. A group is shown only from 20 websites measured, and no website is ever named for a weakness. Every organisation can contest a result or ask to be removed from the panel.