It has 3 HIGH RISK issues because
- DNSSEC is not configured
- Few cookies are send and (ALERT!) Google marketing cookie
- Missing ROA
The thing though is that this is purely informational website (that's defunct under Safari :D) and all actual interaction goes through specialized portal (e.g. gov.pl, for which only complain is cipher order).I get it, it's aggregator but showing red maps is at leals sensationalists
Seems that results are taken from internet.nl, which has WAY better UI than page posted.
GDPR was adopted more than a decade ago and our governments still can't do it right, yet they expect everyone else to get it right. Amazing regulation.
1. Countries with strong e-government and HIGH understanding of its requirements rank LOW (good!)
2. Countries with evolving e-government practices and LOW understanding of the implications rank HIGH (bad!)
3. Countries FAR BEHIND in e-government practices rank LOW (...good?)
Goes to show that globally we need more tech-literate people on the forefront of politics, so that the proper priorities are also set in execution...
https[:]//erasmus-plus.ec.europa.eu/sites/default/files/2026-05/mortal-kombat-2-cs.pdf
Headlines: 3.000 governmental sites use tracking cookies illegally, over 1.000 database management interfaces are publicly reachable, 99% of governmental email is poorly encrypted.
When the GDPR became active eight or so years ago, we got a few GDPR related requests to our service. Basically strongly worded requests to remove their data and account, which we of course honored. All of these came from Germany. Nobody else really cared. But it was kind of curious quickly that happened. What was interesting is that we had zero such requests before that law came into power. And it's not like we were misbehaving or would have denied such a request. This was more a matter of principle: "I now finally have the right to ask this, so I'm going to."
Germany is a big reason GDPR got so complicated and why, hopefully soon, it will be updated to not be fixated on just cookies so much. It never really was about the cookies but about data handling and sharing.
Any mobile app you install might track you without setting cookies and you can't install an ad blocker in those either. That's why Google loves apps so much. You don't actually need cookies for those. There usually is no cookie screen when you install one usually (unless it's a web app packaged up as an app). But sharing personal data with a third party provider is still problematic under GDPR. If you read the actual law, it barely mention cookies at all. The "must have consent screen for cookies" is just the common (mis)-interpretation for laymen; because it's the most visible impact that this has had on them. When it comes to date removal and other requests, it's less about features you have and more about processes you use for complying with legal requests. That can be a person answering emails and doing things manually. Doesn't scale if you get a lot of requests but it would be fine legally.
I have been working on similar project, focusing on lithuanian-only "goverment" sites, but it's not perfectly obvious how to recognise public vs private websites, as at least half of those are managed privatelly, used publically. (Mostly due that was cheaper and/or because lack of requirements and/or other weird situations.)
But yeah, I can confirm that stats are same-ish in Lithuanian web too. I just havent finished gathering data yet, it will take a while.
A nice addition would be to add who is hosting their email. First handful I've looked at are all outlook.com, which seems a much bigger privacy & security risk than not using DNSSEC.
For example, I'd be more than happy to pentest some govt websites here in Germany, if the very act of visiting them with a non-standard browser couldn't somehow already be misconstrued as breaking various hacking laws. No thanks! Keep your security vulnerabilities.
VirusTotal claims the PDF file is clean, but I don't think I'd fully trust it anyway. If you do find malicious content, could be worth submitting the URLs to VirusTotal so that the domain is flagged by browsers (eg Google SafeBrowsing) and people can't accidentally visit ec.europa.eu domains until it has been cleaned.
But for real, Italian public administration digitalization isn’t as bad as people think when compared to other big countries. SPID (an electronic identity system, now deprecated) was years ahead of many other European countries (and easily, the US), and PEC (a certified email standard for official communications established in 2005, that can be used with standard email clients) is still more advanced than the often more complicated and closed systems used in many other places. The Italian standard also deeply influenced the EU standard: https://dl.acm.org/doi/fullHtml/10.1145/3560107.3560256
(Only noticed because I have a tiny indie search engine that can only index English right now, and the "nl-NL" is causing the page to be misclassified.)
Weird niche bug report aside though - love to see this project, congratulations for working on this. I think it's a great idea.
I'd personally love to see a closer look on government sites that drop cookies before the consent banner has asked permission to do so. I'm not worried about cookies, but if we're going to ignore the consent banner anyway, why waste everyone's time with asking in the first place.
Because these requests would be 100% ignored. And the law gave people the power they wanted.
I'm mentally and legally far from Germany and I'm not a big supporter of GDPR, but this law is indeed a step in the right direction.
Perhaps a freedom of information request might also work, but that will take a lot of time to write correctly and does not scale across all governments.
> Germany is pretty hopelessly behind on everything except GDPR enforcement.
Are you sure? I see major outlets in Germany blatantly violating the GDPR by forcing visitors to pay with their privacy or pay with their money. That is not allowed. It is perfectly fine to have a paywall, but you can never have people pay with their privacy.In what way is GDPR focused on cookies?
In my experience, developers in online discussions make it seem all about cookies, pretending other ways of tracking don't exist, while the law does not. But it has been a while since I looked into it and I might remember that wrong.
> There usually is no cookie screen when you install one usually (unless it's a web app packaged up as an app).
A lot of games provide opt-in screens, as they heavily rely on ad networks.
> If you read the actual law, it barely mention cookies at all
Now I am confused, didn't you just say it was focused on cookies?
there are quite a few like this, that on close inspection, are just fine
Something like this? https://livenson.github.io/mxmap/
A few countries have those, here's a Github repo of the Swiss one (has a list of forks in there too): https://github.com/davidhuser/mxmap
We already have some privacy metrics in addition to tracking cookies, and there will be more. All are important at the same time.
Just to be safe, couldn't we globally disable BGP and internet transit in general in the meantime? In case someone tries to visit it by other means?
It seems weird that a system would eventually settle on just full stops and commas, yet not settle on where to put them. If your system is going to converge strongly on two symbols, finish the job!
The data was removed, and tomorrow's reports will reflect that.
Given the fact lots of sites like that have Wordpress 'databases' of form submissions full of people's personal data, absolutely definitely emphatically yes.
And I do think that security research should have some regulation about it, but it should be more about responsible handling of the privileged access you gained, or a responsibility to disclose found vulnerabilities in private and/or to a government entity. You know, "If you have gained access to a system, and you saw a button <Turn off cooling pump 2> and you pressed it, you are on the hook for the damages". That is common practice with paid pentesters already.
But we're at a point where a court had do decide if discovering an endpoint on an API without authorization is a "circumvention of a security boundary" or not. Luckily, we now have a ruling that accessing API endpoints without authorization logic is no circumvention of a security boundary, due to a lack of a security boundary like authorization.
That's the level we are at. I don't want to know what happens if foreign nation state actors start acting on this seriously.
Although a narrower approach might just be to MITM SSL connections of the general European public. Then you can check if any of those visits are to ec.europa.eu, and either block it outright, or keep a record of people who visited the website. You've already got their IP from the tracking cookies europa.eu drops before asking cookie permission, and you want to make sure you inform them of compromise. It shouldn't be too hard to lookup the citizen's postal address, it's probably in one of those ec.europa.eu databases that was left in a public AWS bucket. [1]
[1] https://www.bleepingcomputer.com/news/security/european-comm...
Same reason why there are different date formats, weeks start on Sundays/Mondays (or Saturdays), long/short scale numbers, drives on left/right, different wall sockets and plugs, different train gauges, and of course metric/imperial.
It's a mix of tradition, conventions, inertia.
It just reflects the spoken language. And having the unused symbol then be the thousand separator is natural.
and the reason i ask is that some of the findings, i have seen, would apply to google.com, yet no one would consider them "high risk", so why do this to other services?
this effort would be better served by raising attention to truly important issues, or defects, than to try to identify as many problems as possible, and for lack of a better word, presenting the results in a away that's unnecessarily dramatic
And while URL obscurity alone is weak evidence of "special protection" of a resource, I'm sure some legal team would love to try to argue otherwise.
On May 13, 2026, the website SecurityBaseline.eu was launched. It is a spin-off from the Dutch “Basisbeveiliging”, which has monitored baseline security for over a decade and is part of governmental policy. Three months ago we sent tens of thousands of e-mails to European governments indicating the new site would launch, giving them time to review the results and act on them in advance of publication.
This article details what SecurityBaseline monitors, how we visualize risks with maps, and dives into three worrisome metrics:
This data makes the web transparent and complies with tried-and-tested publication, measurement, and code-of-conduct policy. We target our findings at governments so they can protect their citizens. They can impose requirements on themselves and on the rest of the country.
Do you value transparency, security, sovereignty, accessibility, and privacy? Then ask us to do research or become a member of the Internet Cleanup Foundation and support our mission to improve the internet. We already monitor over 80,000 organisations and 500,000 addresses and make this information available to everyone. Find out more about membership or contact us.
Web Security Map, our software which powers Security Baseline, has been in development for over a decade. We believe that transparency is fundamental to a secure internet. Transparency includes being able to understand easily whether there is a problem. That’s why we show results on maps: maps for every country and every metric.
We measure all EU member states but also include countries inside the European Economic Area. For administrative purposes, we treat the European Union as a country as well; this helps with plotting pan-European initiatives, Computer Security Incident Response Teams (CSIRT), for example. This totals 32 countries, including the EU, Switzerland, Norway, Iceland, and Liechtenstein. The United Kingdom is not included.
Countries divide themselves into all kinds of regions. Every country takes a different approach. Germany, for example, has a lot of structure. In fact, it has so much structure that it becomes confusing and hard to make maps that can be validated easily as correct. Other countries such as Sweden, are much simpler in that respect. In the end, the 32 countries result in 87 different maps with various types of regions: municipalities, cities, provinces, and so on.
Each of these maps is layered into 21 metrics, which we will dive into shortly. Every night we rebuild all 1827 maps based on the latest metrics we have. Metrics are gathered day and night over all 200.000 internet domains, accross the massive total of 67.000 local governments. Nearly 200.000 seems like a high number, but in fact it is very low.
In reality, the true number of government domains is tenfold but finding those requires a lot of effort. We mostly are missing ‘project’ domains, targeted at tourism, housing, infrastructure, festivals, and anything else the government produces. Some governments, like the Netherlands, have multiple official registries for governmental websites. Yet our Dutch initiative has found thousands of additional domains missing from those registries.
The domains we do measure are the most important ones for each government: their homepage and all subdomains below it. For the Dutch municipality of Amsterdam this includes 700 additional addresses like bikecity.amsterdam.nl and stemmen.amsterdam.nl – those are typical project sites but placed on a subsection of amsterdam.nl.
To alter data on our site; sign up and use change requests. For large change requests, please get in touch.
Maps are colored with the colors of a traffic light. Red means there is a security issue, orange means a warning toward a pending security issue that still needs attention, and green means no issues. Only one issue is needed to make something orange or red. This means it can be challenging to be shown as green. We do not use relative grading, as there is no such thing as relative security. Gray means that we have not found online addresses for that region.
In the galleries below you might recognize your country, and you’ll see a lot of red. It shows the default map for a country, which combines all 21 metrics into one. As you’ll see in the worrisome metrics, there are very large differences between countries.
There are big differences between countries that warrant further analysis. For now, we pick a few highlights:
Map data by OpenStreetMap, metrics and coloring by us.
Security Baseline measures 21 metrics; these were developed in the past decade for our Dutch site. This number is slowly increasing. We’re using well-established, carefully considered quality tools such as internet.nl and Zonemaster.
From these metrics, we’ve chosen three that cause us the most worry. One of them shows an illegal practice, and the other two show very dangerous practices. These issues need to change not by a single burst of activity but by establishing change processes and continuously upgrading and improving our online footprint. Using a process means you can adapt to future changes we know will come: stronger encryption, quantum cryptography, additional metrics, and new research. Fixing it once does not lead to resilience.
3.081 European government sites place tracking cookies without consent. This is illegal, as the GDPR mandates informed consent. The law states: “Consent must be freely given, specific, informed and unambiguous. In order to obtain freely given consent, it must be given on a voluntary basis.” Additionally, there is no reason for a government to use surveillance tech on its citizens in the first place.
Yet, as we’ve seen in the Netherlands, the reason for this tracking is benign and can be replaced by using different technologies and approaches. Mostly it’s a side effect of integrating modern technologies that are simple to use but have a hidden advertising cost. This booklet, written by the EDRi foundation, can help web developers create more privacy-friendly websites.
There are substantial differences in tracking between countries. There is no correlation between the number of inhabitants, nor the number of sites. For example; Germany and France differ greatly, with 0,59% versus 3,88% respectively.
What’s missing in these numbers are the tracking cookies of the earlier-mentioned “project” websites for tourism, construction, etc. These are particularly prone to tracking technologies, as they are often made by hip web agencies. Our cookie research in the Netherlands, which did include project websites, showed that in 2023, 4% of governmental sites placed tracking cookies. To protect citizens, it is valuable to have overviews and monitoring of project websites. If we could find them, we’d add them in a heartbeat.
This metric ignores any cookie prompt or banner. Some sites that place these tracking cookies may have a banner like that, but we know from prior research that at least 30% of those banners are ineffective and still leak tracking cookies.
During measurement, we found a total of 357.000 cookies. Just a fraction of these are tracking cookies, and we can say for certain they are in just 10 distinct cases. We found that during prior cookie research in the Netherlands: only large vendors clearly state the intent and purpose of each cookie. Smaller advertising firms do not, so it’s not always clear what every cookie is used for.
For cookies we have a special tracking cookie dashboard on SecurityBaseline. Maps and metrics can also be filtered for tracking cookies with ease.
Below is a number graph of which countries place tracking cookies in order of frequency; source data is at the end of the article. We’ve excluded duplicates from ‘www’ domains.

Percentage graph showing how many European governmental sites place tracking cookies without consent. Slovakia leads with nearly 10%, Greece with 8%, and Portugal with 7,6%. Only Cyprus and Liechtenstein do not place any.
YouTube is the biggest source of tracking cookies, with 2077 cookies placed in total. Google Ads(!) follows with 842 tracking cookies. This might be a side effect of misconfiguration of Google Analytics, which should also not be used; however, that is measured in another metric not mentioned in this article. Then we see 293 Facebook cookies, probably for website analytics as well. Last but not least, we see 20 TikTok cookies.

Number graph showing how tracking cookies are divided. YouTube: 2.077; Google Ads: 842; Facebook: 293; TikTok: 20. A site can have multiple different tracking cookies: the total number of unique sites is 3.081 but the total number of tracking cookie placements is 3.232.
Here are some maps that show that placement of tracking cookies happens infrequently. Map data by OpenStreetMap.

Map showing 72 municipalities in Greece placing tracking cookies without consent.

Map showing 13 municipalities in the Netherlands placing tracking cookies without consent.

Map showing 913 communes in France placing tracking cookies without consent. The communes are sprinkled evenly throughout the country.
The second worrisome metric is the exposure of admin panels that should not be reachable over the public internet. These types of panels are also prone to security incidents. On April 30th this year, a similar popular product, cPanel, was discovered to have a very severe vulnerability. If those panels are not reachable over the internet, they will cause less harm when vulnerabilities like these are discovered.
SecurityBaseline currently measures only one panel. In the future there will be more, including the aforementioned cPanel. For now, we only measure phpMyAdmin. This particular panel is used for database management purposes. It is a very capable tool for this type of administrative work, which is precisely the reason it should not be exposed on the internet for anything serious.
We found a total of 1.070 phpMyAdmin portals on 3.529 different domains. Many domains share the same panel; they share the same service provider for example. phpMyAdmin is an open-source tool, yet we found no financial contributions from European governments to this software project. This means they are depending on software, yet are not willing or mandated to pay for it; we see this as an unwillingness to invest in their own online security. We urge governments to pay for open source for their own sake.
Two of these panels are present at addresses of Computer Security Incident Response Teams, which is a double offense. It might require some trickery to see these addresses in the browser.
The chart below shows the division of phpMyAdmin panels per country. Again, all www duplicates have been removed.

Number graph of publicly reachable phpMyAdmin installations at EU governmental sites. France leads with 513 instances, Poland with 499, Hungary with 368, Germany with 300, Czechia with 258, Italy with 232, and then there is a sharp drop-off. The source table contains all data.
Last but not least, the most shocking discovery of our research: the encryption quality of e-mail to European governments is poor. And not just any form of poor: as 99% does not follow up-to-date security practices. Only the Netherlands and Denmark show somewhat promising numbers.
Encryption quality is measured with the latest release of internet.nl. Their 1.11 update, released in April 2026, implements the Dutch governmental guidelines for Transport Layer Security. These guidelines were published in May 2025. In short, they state how encryption should work to prevent eavesdropping or tampering with the e-mail message.
This metric consists of 18 submetrics, but not all count toward the category score. Each of these metrics also comes with technical results, for example which version of encryption is supported. These warrant further investigation, as it is interesting why this security baseline is only partially met by the Netherlands and Denmark.
Internet.nl provides ad-hoc tests to see the current status of a particular domain. This is faster than our cycle to update these metrics.
There are no TLS-standards at the European level yet. Other countries, such as Germany and France, wrote other guidelines which are clearly not compatible. Neither do they have simple testing tools available. Instead they point to less convenient open-source command-line tools intended for professionals.

Percentage graph of sufficient encryption of e-mail at European governments. The Netherlands has 58%, Denmark 44%, Portugal 8%, EU/CSIRT 5%, Sweden 4%, then a bunch of 2%, 1%, and mainly 0%.

Poorly encrypted e-mail at Computer Emergency Response Team organizations throughout Europe. While seven are doing all right, 35 do not. Note that we included the main website of the country as part of the CSIRTs to level the playing field between different CSIRTS in Europe. This means that the Dutch NCSC will also measure “Rijksoverheid.nl” and all subdomains. Map data by OpenStreetMap.
| Country | Sites with marketing cookies | Percentage of all domains |
|---|---|---|
| SK (Slovakia) | 8 | 9,88% |
| GR (Greece) | 83 | 8,16% |
| PT (Portugal) | 40 | 7,63% |
| MT (Malta) | 4 | 5,19% |
| FR (France) | 1220 | 3,88% |
| PL (Poland) | 621 | 3,61% |
| IE (Ireland) | 3 | 3,00% |
| HU (Hungary) | 247 | 2,78% |
| BG (Bulgaria) | 32 | 2,47% |
| HR (Croatia) | 36 | 2,41% |
| IS (Iceland) | 9 | 2,30% |
| FI (Finland) | 40 | 2,25% |
| EE (Estonia) | 8 | 2,23% |
| CZ (Czechia) | 226 | 2,21% |
| LV (Latvia) | 7 | 1,80% |
| SI (Slovenia) | 8 | 1,63% |
| ES (Spain) | 10 | 1,52% |
| CH (Switzerland) | 76 | 1,38% |
| BE (Belgium) | 62 | 1,10% |
| RO (Romania) | 7 | 0,99% |
| LU (Luxembourg) | 3 | 0,96% |
| AT (Austria) | 38 | 0,74% |
| EU (European CSIRTS) | 22 | 0,62% |
| DE (Germany) | 136 | 0,59% |
| SE (Sweden) | 17 | 0,59% |
| NO (Norway) | 9 | 0,58% |
| LT (Lithuania) | 2 | 0,56% |
| IT (Italy) | 75 | 0,45% |
| NL (Netherlands) | 36 | 0,39% |
| DK (Denmark) | 1 | 0,08% |
| CY (Cyprus) | 0 | 0,00% |
| LI (Liechtenstein) | 0 | 0,00% |
| Grand Total | 3081 | 2,25% |
| Country | YouTube | Google Ads | TikTok | |
|---|---|---|---|---|
| FR | 684 | 534 | 33 | 6 |
| PL | 500 | 81 | 80 | 6 |
| HU | 211 | 40 | 12 | |
| CZ | 135 | 42 | 54 | |
| DE | 91 | 35 | 14 | 3 |
| GR | 69 | 15 | 1 | |
| CH | 53 | 10 | 17 | |
| IT | 57 | 17 | 7 | |
| BE | 34 | 19 | 12 | |
| FI | 21 | 8 | 13 | 1 |
| PT | 35 | 1 | 6 | 1 |
| AT | 31 | 6 | 2 | |
| HR | 27 | 9 | 3 | |
| NL | 22 | 4 | 14 | 2 |
| BG | 28 | 3 | 1 | |
| EU | 21 | 1 | ||
| SE | 10 | 5 | 2 | |
| ES | 7 | 3 | 2 | |
| IS | 2 | 1 | 7 | |
| NO | 5 | 1 | 4 | |
| EE | 4 | 2 | 2 | 1 |
| SI | 7 | 1 | 1 | |
| SK | 6 | 2 | 2 | |
| LV | 6 | 1 | 1 | |
| RO | 7 | |||
| MT | 4 | |||
| IE | 3 | |||
| LU | 1 | 2 | ||
| LT | 1 | 1 | ||
| DK | 1 | |||
| Grand Total | 2077 | 842 | 293 | 20 |
| Country | Domain |
|---|---|
| FR | 513 |
| PL | 499 |
| HU | 368 |
| DE | 300 |
| CZ | 258 |
| IT | 232 |
| AT | 64 |
| BE | 48 |
| NL | 27 |
| CH | 20 |
| BG | 17 |
| GR | 14 |
| FI | 13 |
| HR | 8 |
| SI | 7 |
| LT | 6 |
| LV | 6 |
| EU | 5 |
| PT | 4 |
| RO | 4 |
| EE | 2 |
| IS | 2 |
| SE | 2 |
| DK | 1 |
| LU | 1 |
| SK | 1 |
| Grand Total | 2419 |
| Country | Passed test | Domains with mail | Percentage |
|---|---|---|---|
| NL | 220 | 382 | 58% |
| DK | 44 | 99 | 44% |
| PT | 21 | 275 | 8% |
| EU | 18 | 384 | 5% |
| SE | 12 | 294 | 4% |
| CZ | 104 | 5252 | 2% |
| CH | 38 | 2046 | 2% |
| BE | 10 | 576 | 2% |
| NO | 6 | 363 | 2% |
| IS | 1 | 64 | 2% |
| GR | 3 | 328 | 1% |
| DE | 102 | 12338 | 1% |
| FR | 113 | 15339 | 1% |
| HR | 1 | 427 | 0% |
| AT | 2 | 1776 | 0% |
| PL | 2 | 2596 | 0% |
| HU | 1 | 2658 | 0% |
| BG | 351 | 0% | |
| CY | 9 | 0% | |
| EE | 47 | 0% | |
| ES | 85 | 0% | |
| FI | 330 | 0% | |
| IE | 38 | 0% | |
| IT | 933 | 0% | |
| LI | 11 | 0% | |
| LT | 60 | 0% | |
| LU | 96 | 0% | |
| LV | 49 | 0% | |
| MT | 61 | 0% | |
| RO | 125 | 0% | |
| SI | 200 | 0% | |
| SK | 9 | 0% | |
| Grand Total | 698 | 47601 | 1% |