Quickscan Benchmark · August 2026
Web security benchmark: how do public websites score?
We ran the Guardian360 Quickscan against 12,914 public domains across the Netherlands, Belgium, Germany, France and beyond. Each domain gets a score from 0 to 100 based on its security headers, Content Security Policy, common misconfigurations, SPF and SSL/TLS setup. The average is 68.6: a reasonable baseline, but with the same high-value gaps turning up almost everywhere.
The biggest gaps are also the cheapest to close: security headers, a Content Security Policy and TLS hardening give the most security for the least effort.
Download the full benchmark
The complete report: the overall score distribution, a country comparison (NL, BE, DE, FR), a full breakdown per theme, and concrete recommendations for MSPs, partners and organisations.
Download report (PDF)No registration required. The report is free to download.
Key findings
- Missing security headers are the rule, not the exception: around 60% of domains have no X-Frame-Options header and about half lack a correct HSTS setting.
- A Content Security Policy is missing on 73.2% of domains, the single most common shortcoming across every country.
- Three quarters of domains (75.6%) have at least one SSL/TLS vulnerability, such as outdated protocols or weak ciphers.
- The basics are largely in order: serious misconfigurations like an exposed PHPinfo page (1.6%) or an active HTTP TRACE method (0.9%) are rare.
- Clear country differences: Belgium leads with 72.7, the Netherlands (68.9) and Germany (68.4) track the average, and France trails at 64.3.
About this benchmark
The Quickscan is an automated, non-intrusive scan of the publicly accessible side of a website. This benchmark aggregates 12,914 successfully completed scans into a market picture, so distributors, partners and clients can see how a single domain compares to the wider market and to other countries. Domains are attributed to a country by the country code in their top-level domain; generic extensions such as .com and .eu are counted in the overall benchmark. Curious how your own domain scores? Run a free Quickscan.
How does your own domain score?
Run a free Quickscan for an instant score and a concrete list of findings. Would you like a hand interpreting the results or improving your score? Leave your details and we will get in touch.