2026 edition - data collection complete

Comparative European
barometer of the French web

The first comparative barometer of the French web. 25,763 sites measured across seven countries, on 17 technical indicators: HTTP security, SEO, mobile support, CMS presence and exposure. The French web (8,391 .fr sites from the Tranco Top list) is compared with six neighbours (.de, .es, .be, .ch, .it, .pt) to map its strengths and blind spots. Published on Tuesday 16 June 2026, freely accessible: results, methodology and downloadable data below.

Measured panel 25,763 measurable sites across seven European panels

.fr 8,391 · .de 3,593 · .es 3,808 · .be 2,604 · .ch 3,046 · .it 2,985 · .pt 1,336. French panel queried: 12,701 .fr domains, of which 8,391 measurable. Unreachable domains (WAF, DNS, timeout) are excluded from the statistics. Scans run on 14 and 15 October 2026.

Why this barometer?

There is currently no recent public study precisely measuring the technical state of French websites: adoption of HTTP security best practices, CMS distribution, WordPress exposure, accessibility, GDPR compliance, SEO quality.

Orilyt has built an automated scanning infrastructure to produce, once a year, an aggregated, non-nominative statistical snapshot of the most visible .fr websites (Tranco Top panel).

Goal: to give agencies, freelancers, decision-makers and journalists a reliable basis for comparison, and to measure year-on-year change.

What we measure

HTTP security

  • HTTPS and SSL validity
  • HSTS, CSP, X-Frame-Options
  • Content-Type, Referrer-Policy
  • Permissions-Policy
  • Server stack exposure

WordPress

  • Detection and version
  • Readme.html exposure
  • Reachable XML-RPC
  • Page builder in use
  • Third-party tool traces

CMS and platforms

  • WordPress, Drupal, Joomla
  • Shopify, PrestaShop, Magento
  • Wix, Squarespace, Webflow
  • Next.js, Ghost, Hugo
  • Distribution by TLD

Technical SEO

  • Title tag and meta description
  • Canonical and Open Graph
  • robots.txt and sitemap.xml
  • Meta robots
  • Declared language

Performance

  • Server response time
  • Homepage weight
  • Compression enabled
  • Redirect chains

Accessibility

  • Images without alt attribute
  • Meta viewport
  • Semantic navigation (main, nav)
  • Skip link
  • H1 tag

GDPR compliance

  • Google Fonts loaded externally
  • Third-party scripts detected
  • Basic GDPR indicators

Methodology

  • Population source: the Tranco list (an aggregation of public web rankings maintained by the Universite catholique de Louvain and Stanford University), filtered on .fr. The overseas TLDs (.pm, .tf, .wf, .yt) are too rare to feature in the ranking, and .re (Reunion) was taken out of the French panel in October 2026: 136 domains for 100 measurable sites, too little to justify aggregating two TLDs. October 2026 reading: 12,701 .fr domains queried, of which 8,391 measurable. The comparison covers six neighbouring European panels: .de (Germany, 3,593 measurable sites), .es (Spain, 3,808), .be (Belgium, 2,604), .ch (Switzerland, 3,046), .it (Italy, 2,985) and .pt (Portugal, 1,336), all drawn from the Tranco Top 5,000 per TLD.
  • Panel scope: this panel represents the .fr subset of the Tranco Top 1M ranking (12,701 domains, roughly 0.3% of the total .fr base, which holds more than 4 million registered domains). The study covers the most visible French websites, not the entire base. It complements, and does not replace, the portfolio studies published by institutional players.
  • Scan: standard public HTTP requests. Transparent User-Agent: OrilytBarometer/1.0.
  • No intrusive testing: no login attempts, no fuzzing, no port scanning, no access to non-public resources. Only data accessible to any visitor is analysed.
  • robots.txt respected: sites that explicitly block robots are excluded from the in-depth scan.
  • Aggregated publication only: no site is named in the public statistics. Individual data stays internal.
  • Transparency on failures: the share of unreachable sites (WAF, timeout, network errors) is documented in the publication.
  • Reproducibility: the list of scanned domains is archived for each edition to allow a year-by-year comparison.
  • Positioning vs international studies: complementing recent global studies such as the Security Headers Adoption Study 2026 (AppSecSanta, 7,510 sites from the global Tranco Top 10,000) and the Web Almanac 2025 by HTTP Archive (17.2 million sites worldwide), which do not break their results down by country. This barometer provides the exact complement: a focus on the .fr subset of the Tranco Top 1M, with a scope broadened to GDPR compliance (Google Fonts), CMS hygiene (WordPress, Drupal), technical SEO and accessibility, metrics absent from global studies focused on HTTP security alone.

The 17 indicators compared

The 17 indicators below are measured identically across the 7 panels. Four of them (marked ↓ better) are exposure criteria: a lower percentage is better. Definitions published openly.

  • HTTP compression: response compressed (gzip, brotli or zstd).
  • Fonts loaded from Google (↓ better): the page calls fonts.googleapis.com or fonts.gstatic.com, which hands the visitor IP address to a third party.
  • <title> tag: title tag present and non-empty.
  • Meta description: meta description tag present.
  • Canonical tag: <link rel="canonical"> present.
  • Main heading (h1): at least one <h1> tag on the page.
  • XML sitemap: a sitemap.xml is reachable.
  • Sharing data (Open Graph): og: tags present. Without them a shared link shows up with no title and no image.
  • Effective HTTPS: the site responds over HTTPS with a valid certificate.
  • HSTS header: Strict-Transport-Security header present (forces HTTPS).
  • CSP header: Content-Security-Policy header present.
  • X-Frame-Options header: anti-clickjacking protection present.
  • Exposed WordPress version (↓ better): WordPress version number publicly readable.
  • Reachable XML-RPC (↓ better): xmlrpc.php reachable (attack surface).
  • Meta viewport: mobile-support declaration present.
  • WordPress site (open source): WordPress identified via technical signatures.
  • Site on a closed platform (↓ better): Wix, Squarespace, Shopify, Webflow or Ghost. The site cannot be moved elsewhere as it stands.
Indicator .fr .de .es .be .ch .it .pt FR rank
Active HTTP compression 93.1% 90.5% 89.9% 89.1% 91.1% 90.5% 83.0% 1/7
Fonts loaded from Google (↓ better) 33.5% 5.4% 39.6% 29.6% 25.4% 36.9% 38.4% 4/7
<title> tag 97.2% 97.7% 96.8% 96.2% 97.3% 97.8% 96.4% 4/7
Meta description 77.8% 78.3% 76.3% 70.2% 72.8% 75.8% 75.7% 2/7
Canonical tag 72.1% 73.4% 74.2% 65.9% 66.9% 71.6% 65.1% 3/7
Main heading (h1) 74.5% 74.1% 72.1% 68.8% 70.7% 65.4% 64.2% 1/7
XML sitemap 53.9% 53.5% 53.1% 53.0% 54.5% 51.9% 53.8% 2/7
Sharing data (Open Graph) 65.0% 61.8% 65.6% 60.0% 61.7% 68.8% 69.3% 4/7
Effective HTTPS 95.8% 95.8% 95.0% 96.0% 94.7% 95.9% 97.2% 4/7
HSTS header 49.3% 63.7% 47.3% 52.8% 52.9% 43.1% 52.5% 5/7
CSP header 26.8% 38.1% 26.5% 27.6% 26.0% 20.9% 31.3% 4/7
X-Frame-Options header 48.4% 49.3% 46.6% 52.5% 48.2% 39.4% 47.7% 3/7
Exposed WP version (↓ better) 10.4% 5.8% 10.8% 6.7% 7.9% 14.1% 13.3% 4/7
Exposed XML-RPC (↓ better) 5.5% 1.8% 4.6% 4.1% 2.6% 5.1% 7.2% 6/7
Mobile meta viewport 93.4% 92.5% 92.8% 90.4% 90.4% 91.9% 91.5% 1/7
WordPress site (open source) 26.5% 15.1% 24.0% 15.1% 16.2% 31.7% 26.9% 3/7
Site on a closed platform (↓ better) 5.3% 2.2% 4.1% 2.6% 2.8% 0.6% 1.0% 7/7

Reading from the scans of 14 and 15 October 2026: 7 panels, 25,763 measurable sites, 17 indicators. Sample sizes (n) per panel and per indicator in the downloadable CSV. The four ↓ better criteria are exposure indicators: a lower percentage is preferable.
Comparing over time: these values are not comparable on a constant perimeter with the June 2026 edition (April-May, 5 panels, 19,901 sites). The October rescan reached sites that failed in spring, and .re has left the French panel. The June data remains available: CSV of the June edition.

And your site: where does it stand?

These averages hide wide gaps. Run a free audit of your own site: 80+ checks (security, performance, SEO, compliance), external analysis, no plugin to install and no admin access required.

Audit my site for free

Open data

The per-panel aggregated results (percentage and sample size n for each of the 7 panels) are published in open access, under a CC-BY licence, with no sign-up. The Tranco source list is public and the methodology above is fully documented, so the study is reproducible and verifiable.

Download the report (PDF, June 2026 edition) Aggregated data (CSV - 7 panels x 17 indicators, October 2026 reading)

Frequently asked questions

Do you name individual sites?

No. All publications are strictly aggregated. We do not identify any site by name, either in the main publication or in the annexes.

How can I tell if my site was scanned?

The source list is public (Tranco) and documented in the methodology. If your site is not on it, it was not scanned. In any case, no nominative data is published.

My site blocks robots. Does it appear in the study?

No. Sites that block our User-Agent or return an error are counted in the failure rate but excluded from the core statistics.

Is the data resold?

No. The raw data never leaves our servers. Only the aggregated publication is made public, free of charge.

Can I cite the barometer in an article?

Yes, the aggregated data may be freely cited (CC-BY licence) with attribution to Orilyt and a link to this page.

When will the next edition be published?

The barometer is annual. The first edition was published on Tuesday 16 June 2026, with subsequent editions at the same time each year. Between two editions the same panel is rescanned: the results table always shows the most recent reading, with its date, while the PDF report and the press kit remain those of the published edition.