2026 edition - data collection complete

Comparative European
barometer of the French web

The first comparative barometer of the French web. 19,901 sites measured across five countries, on 12 technical indicators: HTTP security, SEO, mobile support, CMS presence and exposure. The French web (7,505 .fr and .re sites from the Tranco Top list) is compared with four neighbours (.de, .es, .be, .ch) to map its strengths and blind spots. Published on Tuesday 16 June 2026, freely accessible: results, methodology and downloadable data below.

Measured panel 19,901 measurable sites across five European panels

.fr + .re 7,505 · .de 3,502 · .es 3,509 · .be 2,476 · .ch 2,909. French panel queried: 11,976 domains, of which 7,505 measurable. Unreachable domains (WAF, DNS, timeout) are excluded from the statistics.

Why this barometer?

There is currently no recent public study precisely measuring the technical state of French websites: adoption of HTTP security best practices, CMS distribution, WordPress exposure, accessibility, GDPR compliance, SEO quality.

Orilyt has built an automated scanning infrastructure to produce, once a year, an aggregated, non-nominative statistical snapshot of the most visible .fr and .re websites (Tranco Top panel).

Goal: to give agencies, freelancers, decision-makers and journalists a reliable basis for comparison, and to measure year-on-year change.

What we measure

HTTP security

  • HTTPS and SSL validity
  • HSTS, CSP, X-Frame-Options
  • Content-Type, Referrer-Policy
  • Permissions-Policy
  • Server stack exposure

WordPress

  • Detection and version
  • Readme.html exposure
  • Reachable XML-RPC
  • Page builder in use
  • Third-party tool traces

CMS and platforms

  • WordPress, Drupal, Joomla
  • Shopify, PrestaShop, Magento
  • Wix, Squarespace, Webflow
  • Next.js, Ghost, Hugo
  • Distribution by TLD

Technical SEO

  • Title tag and meta description
  • Canonical and Open Graph
  • robots.txt and sitemap.xml
  • Meta robots
  • Declared language

Performance

  • Server response time
  • Homepage weight
  • Compression enabled
  • Redirect chains

Accessibility

  • Images without alt attribute
  • Meta viewport
  • Semantic navigation (main, nav)
  • Skip link
  • H1 tag

GDPR compliance

  • Google Fonts loaded externally
  • Third-party scripts detected
  • Basic GDPR indicators

Methodology

  • Population source: the Tranco list (an aggregation of public web rankings maintained by the Universite catholique de Louvain and Stanford University), filtered on metropolitan .fr and overseas TLDs (.re, .pm, .tf, .wf, .yt). In practice, only .re (Reunion) appears in Tranco at a meaningful volume; the other overseas TLDs are too rare to feature in the ranking. 2026 edition: 11,976 .fr and .re domains queried, of which 7,505 measurable. This 2026 edition adds a comparison with four neighbouring European panels: .de (Germany, 3,502 sites measured), .es (Spain, 3,509), .be (Belgium, 2,476) and .ch (Switzerland, 2,909), all drawn from the Tranco Top 5,000 per TLD.
  • Panel scope: this panel represents the .fr and .re subset of the Tranco Top 1M ranking (about 11,976 domains, roughly 0.3% of the total .fr base, which holds more than 4 million registered domains). The study covers the most visible French websites, not the entire base. It complements, and does not replace, the portfolio studies published by institutional players.
  • Scan: standard public HTTP requests. Transparent User-Agent: OrilytBarometer/1.0.
  • No intrusive testing: no login attempts, no fuzzing, no port scanning, no access to non-public resources. Only data accessible to any visitor is analysed.
  • robots.txt respected: sites that explicitly block robots are excluded from the in-depth scan.
  • Aggregated publication only: no site is named in the public statistics. Individual data stays internal.
  • Transparency on failures: the share of unreachable sites (WAF, timeout, network errors) is documented in the publication.
  • Reproducibility: the list of scanned domains is archived for each edition to allow a year-by-year comparison.
  • Positioning vs international studies: complementing recent global studies such as the Security Headers Adoption Study 2026 (AppSecSanta, 7,510 sites from the global Tranco Top 10,000) and the Web Almanac 2025 by HTTP Archive (17.2 million sites worldwide), which do not break their results down by country. This barometer provides the exact complement: a focus on the .fr and .re subset of the Tranco Top 1M, with a scope broadened to GDPR compliance (Google Fonts), CMS hygiene (WordPress, Drupal), technical SEO and accessibility, metrics absent from global studies focused on HTTP security alone.

The 12 indicators compared

The 12 indicators below are measured identically across the 5 panels. Two of them (marked ↓ better) are exposure criteria: a lower percentage is better. Definitions published openly.

  • Effective HTTPS: the site responds over HTTPS with a valid certificate.
  • HSTS header: Strict-Transport-Security header present (forces HTTPS).
  • CSP header: Content-Security-Policy header present.
  • X-Frame-Options header: anti-clickjacking protection present.
  • HTTP compression: response compressed (gzip, brotli or zstd).
  • WordPress site: WordPress identified via technical signatures.
  • Exposed WordPress version (↓ better): WordPress version number publicly readable.
  • Reachable XML-RPC (↓ better): xmlrpc.php reachable (attack surface).
  • <title> tag: title tag present and non-empty.
  • Meta description: meta description tag present.
  • Canonical tag: <link rel="canonical"> present.
  • Meta viewport: mobile-support declaration present.
Indicator .fr+.re .de .es .be .ch FR rank
Effective HTTPS 95.6% 95.7% 94.7% 95.6% 95.2% 2/5
HSTS header 48.3% 62.9% 42.7% 51.9% 51.6% 4/5
CSP header 25.5% 36.1% 22.3% 25.9% 23.6% 3/5
X-Frame-Options header 47.7% 48.7% 43.9% 51.2% 47.0% 3/5
Active HTTP compression 93.2% 91.0% 89.8% 89.5% 91.2% 1/5
WordPress site 26.9% 15.5% 24.8% 15.6% 16.8% 1/5
Exposed WP version (↓ better) 10.9% 6.2% 11.7% 7.1% 8.7% 4/5
Exposed XML-RPC (↓ better) 6.0% 2.2% 5.9% 4.7% 3.3% 5/5
<title> tag 97.5% 97.9% 97.0% 96.4% 97.3% 2/5
Meta description 78.5% 78.2% 75.9% 69.1% 72.7% 1/5
Canonical tag 71.8% 72.1% 71.8% 64.2% 65.6% 2/5
Mobile meta viewport 93.0% 92.1% 92.6% 90.3% 89.7% 1/5

Sample sizes (n) per panel and per indicator in the downloadable CSV. The two ↓ better criteria are exposure indicators: a lower percentage is preferable.

And your site: where does it stand?

These averages hide wide gaps. Run a free audit of your own site: 80+ checks (security, performance, SEO, compliance), external analysis, no plugin to install and no admin access required.

Audit my site for free

Open data

The per-panel aggregated results (percentage and sample size n for each of the 5 panels) are published in open access, under a CC-BY licence, with no sign-up. The Tranco source list is public and the methodology above is fully documented, so the study is reproducible and verifiable.

Download the report (PDF) Aggregated data (CSV - 5 panels x 12 indicators)

Frequently asked questions

Do you name individual sites?

No. All publications are strictly aggregated. We do not identify any site by name, either in the main publication or in the annexes.

How can I tell if my site was scanned?

The source list is public (Tranco) and documented in the methodology. If your site is not on it, it was not scanned. In any case, no nominative data is published.

My site blocks robots. Does it appear in the study?

No. Sites that block our User-Agent or return an error are counted in the failure rate but excluded from the core statistics.

Is the data resold?

No. The raw data never leaves our servers. Only the aggregated publication is made public, free of charge.

Can I cite the barometer in an article?

Yes, the aggregated data may be freely cited (CC-BY licence) with attribution to Orilyt and a link to this page.

When will the next edition be published?

The barometer is annual. The first edition was published on Tuesday 16 June 2026, with subsequent editions at the same time each year.