Open dataset · updated daily · public sources only
Swiss Public-Sector Security Census
How secure is the Swiss public sector?
Summary
The census measures the email and website security of every Swiss municipality, canton and federal office, every day. It uses only information that anyone can see on the internet. Each body receives a score from 0 to 100.
- Median score
- 56of 100
- Bodies on the list
- 2,210
- Bodies with a score
- 2,202
- Latest measurement
- 25 Oct 2026
Half of the bodies score below 56, half above. 2,202 bodies have a score. The other 8 could not be measured enough, mostly because their website did not answer.
1How the score works
Each body gets 0 to 100 points from 17 measurements in five areas. A measurement that does not apply, or could not be taken, is left out of the total.
Share of points obtained on average, by area
Email sender
Can someone else send email in the body’s name?
Email encryption
Must email to the body travel encrypted?
Website encryption
Is the website reached only over a secure connection?
Website hardening
Does the homepage send the recommended security headers?
DNS and contact
Are DNS records signed, and is there a contact for security reports?
Bodies per score band
- Median score: 56
All 17 measurements and their points
- Email sender · 30 points
- DMARC 16 points
- SPF 8 points
- DMARC reports 3 points
- Website domain protected from forged email 3 points
- Email encryption · 10 points
- DANE or MTA-STS 8 points
- TLS-RPT 2 points
- Website encryption · 30 points
- TLS 15 points
- HSTS 12 points
- Certificate valid for more than 14 days 3 points
- Website hardening · 15 points
- Content-Security-Policy 5 points
- X-Frame-Options 3 points
- X-Content-Type-Options 3 points
- Referrer-Policy 2 points
- Secure cookie attributes 2 points
- DNS and contact · 15 points
- DNSSEC 8 points
- CAA 2 points
- security.txt 5 points
2Six key checks
Together they are worth 64 of the 100 points. Each bar covers all 2,210 bodies.
bodies pass DMARC
- 1,001 passed
- 472 partly
- 735 failed
- 2 not measured
DMARC
Forged email in the body’s name is rejected or quarantined.
- 1,001 passed
- 472 partly
- 735 failed
- 2 not measured
TLS
The website accepts only TLS 1.2 or newer, with a valid certificate.
- 2,107 passed
- 0 partly
- 95 failed
- 8 not measured
HSTS
Browsers are told to use only HTTPS, for at least a year.
- 650 passed
- 837 partly
- 715 failed
- 8 not measured
DNSSEC
DNS records are signed, so answers cannot be forged.
- 730 passed
- 0 partly
- 1,476 failed
- 4 not measured
SPF
The domain lists the servers allowed to send its email.
- 2,076 passed
- 95 partly
- 34 failed
- 5 not measured
security.txt
The website names a contact for security reports.
- 998 passed
- 15 partly
- 1,178 failed
- 19 not measured
3By canton
Median score of each canton’s administration and municipalities. Cantons with fewer than 20 bodies are combined into one group.
- 36–43
- 44–51
- 52–59
- 60–67
- 68–75
- Group
| Canton | Bodies | Score | DMARC | TLS | HSTS | DNSSEC | SPF | security.txt |
|---|---|---|---|---|---|---|---|---|
| Aargau AG | 197 | 66 | 65% | 98% | 52% | 21% | 97% | 67% |
| Appenzell Ausserrhoden AR | 21 | 71 | 48% | – | 33% | 24% | 81% | 76% |
| Basel-Landschaft BL | 87 | 65 | 66% | 87% | 52% | 31% | 94% | 41% |
| Bern / Berne BE | 335 | 58 | 60% | 96% | 39% | 37% | 95% | 40% |
| Fribourg / Freiburg FR | 120 | 47 | 37% | 94% | 12% | 39% | 94% | 23% |
| Genève GE | 46 | 46 | – | – | 15% | 9% | – | 46% |
| Graubünden / Grigioni / Grischun GR | 101 | 44 | 23% | 93% | 14% | 30% | 96% | 26% |
| Jura JU | 52 | 62 | 54% | 90% | 42% | 75% | 85% | 8% |
| Luzern LU | 80 | 63 | 70% | – | 42% | 12% | – | 66% |
| Neuchâtel NE | 25 | 37 | – | – | – | – | – | – |
| Schaffhausen SH | 27 | 36 | – | – | 22% | 63% | – | 26% |
| Schwyz SZ | 31 | 58 | 71% | – | 35% | 16% | – | 68% |
| Solothurn SO | 105 | 55 | 38% | – | 37% | 28% | 95% | 64% |
| St. Gallen SG | 76 | 61 | 37% | – | 18% | 14% | – | 76% |
| Thurgau TG | 81 | 58 | 16% | – | 58% | 9% | 91% | 75% |
| Ticino TI | 101 | 42 | 16% | 97% | 11% | 19% | 94% | – |
| Uri UR | 20 | 42 | 20% | – | – | – | – | 25% |
| Valais / Wallis VS | 123 | 50 | 33% | 91% | 18% | 65% | 89% | 20% |
| Vaud VD | 301 | 57 | 59% | 91% | 17% | 65% | 88% | 22% |
| Zürich ZH | 161 | 58 | 13% | 98% | 33% | 11% | 96% | 86% |
| Other cantons Combined: AI, BS, GL, NW, OW, ZG | 46 | 53 | 30% | 93% | 37% | 20% | – | 74% |
– means too few bodies to show without identifying them.
4Most common gaps
Number of bodies with each gap. Each check has a guide to fix it.
5Day by day
Share of all bodies that passed each check. A website that does not answer counts as not passed, so a dip can mean an outage rather than a weaker setup.
DMARC
45%TLS
95%HSTS
29%DNSSEC
33%SPF
94%security.txt
45%6Download the data
The figures on this page are open data. They may be reused freely, including commercially, provided the source is cited.
Suggested citation
Webcracy.ch, Swiss Public-Sector Security Census, measured on 2026-10-25, https://census.webcracy.ch/, CC BY 4.0. Licence: Creative Commons Attribution 4.0 (CC BY 4.0). Results for individual bodies are not published.
7About the census
The census is an independent research project of Webcracy.ch, carried out by Liam Giannini. It has no commercial purpose, and no result can be bought.
For each body the census reads public DNS records, the security.txt file and the homepage. It sends at most one request per second, with no logins and no forms.
Corrections to a domain or a result can be sent to contact@webcracy.ch. They are applied before the next measurement.