Every week, the barometer measures what the websites of a panel of organisations show to anyone on the Internet, and compares them by sector, company size and country. Its aim: show progress, and help buyers assess their suppliers.
The barometer covers only a panel: lists of organisations built from public sources (popularity rankings of websites, public company registers, lists of public bodies, stock-market indices). The lists are refreshed every month around a stable core, so that changes can be followed week after week. Tests run by visitors on our free checks are never mixed into the barometer.
Organisations are grouped by sector, by size (very large, large, medium, small — so that small companies can be noticed by buyers too), by country of their head office, and by zone (European Union, United States, world). A group is published only from 20 websites measured. For French organisations, sector and size come from INSEE’s Sirene register, using the SIREN number the organisation publishes (Wikidata or the website’s legal notice); the other websites count in the overall averages only. An organisation is named only for a score of at least 80/100.
Compliance and resistance come from the same non-intrusive checks as our free website check. Speed is an estimate: the home page is loaded 3 times on new connections, from a computer profile and a mobile profile, and we keep the median. The display time is then estimated from these real network measurements under two simulated networks (computer: 40 ms latency, 10 Mbit/s; mobile: 150 ms, 1.6 Mbit/s), as PageSpeed does. We also measure how stable the response time is.
Each score has its own ranking: an organisation can be very compliant and slow. There is no ranking on the average of the three scores. Instead, the website with the best overall result of the week is the one whose lowest of the three scores is the highest, with at least 80/100 on each: a very well protected but slow website cannot win it.
Each result describes what our robot observed on the date of the measurement. A website changes, and so does the network: another tool, or a measurement made at another moment, can give a different result. Only results obtained with this method can be compared with ours.
Think a result is wrong? Ask us for an explanation or contest it: we check the domain again and answer within 30 days. Fixed something? Ask for a re-test.
We note how each website is hosted: shared hosting, dedicated server or cloud, or behind a CDN. A “server base” score counts only what is configured on the server itself — web server, PHP, TLS, packages, mail — not the website’s code nor its DNS.
The calculation runs on Wednesday evening and the results are published on Thursday morning.
The checks are made by our robot, which identifies itself as TopSecuredScanner with a link to our method. It only reads public information: no password tried, no exploit, no injection. It never runs more than 2 checks at a time on the same server, always uses the same outgoing address for a given domain, and does not retry from another address when it is blocked. To have a domain excluded, use the removal form.