regione.umbria.it, comune.firenze.it and others), two Bulgarian city portals, an opera house, a speech therapist and a news agency. The exclusion rules filtered directories, marketplaces and social networks, but not organisations that simply rank for “web agency” queries.Recomputed without them, the headline figures move very little and no conclusion changes: no CSP 80.7% → 81.3%, no HSTS 62.9% → 63.5%, DMARC enforcing 27.7% → 27.7%, at least one high-severity finding 25.3% → 23.7%. The tables below are the figures as originally published; treat the percentages as carrying roughly a point of slack on that account. Later editions classify the organisation before it enters the sample, rather than trusting the query that found it.
Why look at web agencies?
Agencies are the multiplier. One agency builds and maintains dozens of client sites, and whatever it does — or skips — on its own homepage is a fair proxy for what it ships. If the agency's own site doesn't enforce HTTPS, sends no security headers and can be spoofed by email, the client sites usually look the same. We wanted a number for that, in the two markets we work in.
What we measured, and how
- Sample: 376 unique agency domains — 161 in Bulgaria, 215 in Italy — taken from the top-100 Google results for 20 agency-intent queries (изработка на сайтове, дигитална агенция, web agency Milano, realizzazione siti web and similar) on 18 September 2026. Directories, marketplaces, social networks and news sites were filtered out.
- Checks: the same passive checks as our free Website Security Score — one normal GET of the homepage (headers, cookies, mixed content, HTTP→HTTPS behaviour), a TLS handshake (certificate validity, legacy protocol support), a technology fingerprint (INFO only, no CVE inference) and DNS lookups for SPF, DMARC, DKIM and MX. No login, no crawling, no active testing — exactly what your browser does when you visit a page.
- Severity: our calibrated scale. A missing
SameSiteis informational, not a finding; platform-managed edge headers are down-ranked; nothing here is a “vulnerability” claim. These are configuration facts. - Excluded: the exposed-files category (
.git,.env, backups) hit run-time limits on most hosts in this batch, so it is left out entirely rather than reported from a small subset.
The headline numbers
| Check (homepage, passive) | All | Bulgaria | Italy |
|---|---|---|---|
| No Content-Security-Policy | 80.7% (285/353) | 79.6% | 81.6% |
| CSP present but weak ('unsafe-inline' / wildcard) | 11.0% | 13.8% | 9.0% |
| No HSTS | 62.9% (222/353) | 64.5% | 61.7% |
| No X-Frame-Options / frame-ancestors | 60.3% | 61.2% | 59.7% |
| No X-Content-Type-Options | 58.1% | 59.2% | 57.2% |
| None of the four core headers | 45.6% (161/353) | — | — |
| All four core headers present | 11.0% (39/353) | — | — |
| Plain HTTP still serves content or doesn't redirect | 14.7% | 12.5% | 16.4% |
| Mixed content on the HTTPS homepage | 28.6% | 27.0% | 29.9% |
| Session-like cookie without Secure or HttpOnly | 10.8% | 16.4% | 6.5% |
| Server / framework version disclosed | 19.0% | 17.8% | 19.9% |
| Legacy TLS 1.0/1.1 accepted | 0.0% (0/372) | 0% | 0% |
| Certificate problem (expired / untrusted / mismatch) | 1.3% | 1.2% | 1.4% |
| No SPF record | 8.3% (31/374) | 6.2% | 9.9% |
| No DMARC record | 28.3% | 37.3% | 21.6% |
| DMARC present but p=none (monitor only) | 44.4% | 32.3% | 53.5% |
| DMARC actually enforcing (quarantine / reject) | 27.3% (102/374) | 30.4% | 24.9% |
| Runs WordPress | 41.5% | 38.1% | 44.1% |
| At least one HIGH-severity finding | 25.3% (95/376) | 28.0% | 23.3% |
Grade distribution on our A–F model (exposure category excluded): A 17 %, B 44 %, C 30 %, D 8 %, F 1 %; median score 83/100. Findings per site: a median of three HIGH or MEDIUM findings on the homepage alone — only 4 of 353 header-checked sites had none.
Bulgaria and Italy land within a few points of each other on nearly every metric. This is an industry pattern, not a national one.
Five things the numbers say
1. The transport layer is solved; the browser layer isn't
Not one site in the sample accepted TLS 1.0 or 1.1, and barely one in a hundred had a broken certificate. Free automated certificates and CDNs won that war. But 63 % never tell the browser to insist on HTTPS (HSTS, RFC 6797), 15 % still serve or fail to redirect plain HTTP, and 29 % pull at least one resource over HTTP into an HTTPS page. The padlock is there; the policy around it isn't.
2. CSP is effectively absent from the industry
Four in five agency homepages send no Content-Security-Policy at all, and among the fifth that do, half weaken it with 'unsafe-inline' or a wildcard script-src. The split by platform is stark: on WordPress-built agency sites the no-CSP share is 91 %, against 73 % everywhere else. A plugin ecosystem makes a strict policy genuinely harder — and most teams don't attempt it. Ours doesn't score perfectly here either; see the note at the end.
3. Email is the biggest gap that costs nothing to close
Only 27 % of these domains enforce DMARC. 28 % publish no DMARC record at all and 44 % publish p=none, which reports spoofing and blocks none of it. An agency domain that anyone can send mail as is a phishing tool pointed at every client who trusts its invoices and project updates. Italy is worse on policy strength (54 % on p=none), Bulgaria worse on having no record at all (37 %).
4. The “none of the above” group is large
46 % of sites send none of the four headers every hardening guide opens with — HSTS, CSP, X-Frame-Options, X-Content-Type-Options (see the OWASP Secure Headers Project). Only 11 % send all four. These are one-line changes at the server or CDN. A site missing all four isn't making a trade-off; nobody has looked.
5. A quarter carry a HIGH finding on the homepage alone
Usually a session cookie readable by scripts, an SSL-strip condition (plain HTTP served with no HSTS), or a script-src that allows any host. That is before anyone looks at subdomains, admin panels or the client portfolio — the parts of the attack surface this study didn't touch.
script-src still allows 'unsafe-inline' — a deliberate trade against per-response nonces on a statically rendered site, explained in the CSP guide. We publish the finding rather than quietly exclude ourselves from the sample.If you hire an agency
Ask three questions before signing, all answerable in about a minute:
- What do the security headers on your own site look like?
- What is your DMARC policy —
reject,quarantine, ornone? - In the projects you deliver, who owns security headers and email authentication: you, the host, or nobody?
The answers predict what you are about to be handed.
If you run an agency
Everything this study measured is the cheapest work in web security: a handful of headers at the server or CDN, one DNS change for DMARC, an audit of third-party scripts. Fixing your own site is an afternoon. Offering the same as a service to clients is recurring revenue with near-zero delivery cost — start from the reduction checklist, run the free checkers on each client domain, and let the Domain Monitor tell you when one of them gets cloned or typosquatted.
Limitations
- Homepage only. No subdomains, admin panels or client sites. The real surface is larger than what we measured.
- Passive and point-in-time. Each site was read once on 18 September 2026 from Bulgaria, the way a browser would. Sites change; some numbers will already have moved.
- Sampling bias. “Ranks in Google for agency queries” over-represents agencies that invest in SEO and says nothing about those that don't market themselves online.
- Exposed files excluded because of run-time limits in this batch, not because nothing was found: 2 of the 21 hosts where that category completed had an exposed sensitive file.
- Calibration is ours. Missing
SameSiteis informational, platform-managed headers are down-ranked, version disclosure is INFO. Stricter tools would report higher numbers; that is a choice about honesty, not about the data. - No site is named. The point is the pattern, not a pillory. Any agency can run the same checks on itself, free, in seconds.
Method note
Domains: Google SERP API, top-100 organic results, 8 Bulgarian and 12 Italian queries, aggregator domains removed by pattern. Checks: the MySecScan engine's website-security-score check set, a 22-second budget per host, six hosts in parallel. Aggregation: each percentage is a share of the hosts on which that category completed, which is why the denominators differ slightly by row. How the checks themselves work is documented in How we scan. If you are a researcher or journalist and want the aggregate dataset, ask us.
This is the first edition of a recurring series. The method, the citation terms and every edition as it publishes live on MySecScan Research; the next one measures consumer online stores ahead of the November shopping peak.