We Checked 1,000 Public Websites: 86% Had HTTPS, Half Had Nothing Else

The padlock in your address bar answers exactly one question: is the connection between you and this server encrypted? People read it as a much broader statement about the site behind it. We wanted to know how wide that gap actually is, so we measured it.

What we did

We took the official register of French local administrations published by the DILA, the French Prime Minister's information service, under an open licence, in its version dated 31 July 2026. It contains 86,051 records, of which 58,563 list at least one website. After normalising the hostnames that leaves 26,922 distinct domains.

From those we drew 1,000 at random with a fixed seed, then sent exactly one GET request to each home page, recording whether it answered over HTTPS and which of six standard security headers came back.

We did not scan ports, probe paths or enumerate subdomains. Each domain was contacted once, which is what your browser does when you open a page.

What came back

862 of the 1,000 domains answered over HTTPS, or 86.2%. The remaining 138 did not answer at all: 135 connection errors, 2 timeouts and 1 dropped connection.

Every figure below is expressed as a share of those 862 that answered, never of the full thousand. Mixing the two would blur "does not send this header" together with "did not respond at all", and those are different facts.

Two numbers describe the shape of it better than the table does:

• 412 responding sites, 47.8%, sent none of the six.
• 48, or 5.6%, sent all six.

So roughly half the sites that successfully served a page over an encrypted connection had nothing else configured, and about one in eighteen had the full set.

A lock being present and a door being secured are different observations. That is the whole finding, really.

What this does and does not mean

We are deliberately careful here, because this kind of measurement is easy to overstate.

A missing header is an observed fact, not a vulnerability. Several of these headers only do useful work in combination with other choices, and their absence can be entirely harmless on a simple static page with no forms, no logins and no third-party scripts. A town hall serving opening hours is not running a bank.

We measured home pages only. A site may set different headers elsewhere.

It is a snapshot. The values are those of 2 August 2026 and say nothing about the day before or after.

We name no one. The dataset contains domains because it has to be reproducible, but it grades nobody, ranks nobody and calls no site unsafe.

We do not extrapolate. The sample is random, which makes an estimate for the other 25,922 domains statistically possible, but we do not offer one and it should not be inferred as a certainty.

Why this matters for what a VPN actually does

This is the part we would rather say plainly than let a reader assume.

A VPN encrypts the link between your device and the VPN server. That protects you against someone watching the network you are on, which is the real threat on shared and public Wi-Fi. It is genuinely useful, and it is narrow.

It does nothing at all about how the destination site is configured. If a website sends no Content-Security-Policy, it sends none whether you reach it through a VPN or not. If it does not set Strict-Transport-Security, your VPN does not add one. The headers we measured are decisions taken by the site, on the site, and no client-side tool overrides them.

The two protect against different things, and the padlock encourages people to merge them into a single feeling of safety. What our numbers show is that transport encryption has become close to universal, at 86% here, while everything else has not followed at the same pace. The first problem is largely solved. The second one is a configuration question that only the site operator can answer.

The data

The raw results, the aggregated figures and the collection script are published together, so the numbers above can be checked rather than believed. The sample is drawn with the fixed seed 20260802 on the sorted list of domains, which makes it identical on any machine.

If you run it and get different figures, the difference is real change on those sites, not a difference in method. That is the point of publishing the script alongside the numbers.

The short version

Of 1,000 French public-sector websites drawn at random from the official register, 86.2% answered over HTTPS. Among those, 47.8% sent none of the six standard security headers and 5.6% sent all six.

Encryption in transit is close to solved. Configuration is not, and the padlock does not distinguish between the two. Neither does a VPN, which protects the path to the server and never the server's own settings.

The population comes from the register of French local administrations published by the DILA under an open licence, version of 31 July 2026. The measurements are our own, collected on 2 August 2026 with the script published alongside this dataset, one GET request per home page. Figures describe the 862 domains that answered and are not extrapolated to the rest of the register. Commercial links carry the rel="sponsored nofollow" attribute; an affiliate commission may apply at no extra cost to you.