Security Directory

The PETRA-E Network website serves as an educational platform dedicated to literary translation, connecting institutions and individuals across Europe. It offers a professional framework for literary translation competences and fosters collaboration through resource sharing and events. The network is positioned as a niche educational entity with partnerships across multiple European universities and organizations. Technically, the website is built on WordPress with common web technologies such as jQuery and Bootstrap, hosted likely by Utrecht University. While the site provides good content quality and user experience, it lacks critical security implementations such as a valid SSL certificate and proper HTTPS configuration. Privacy and cookie policies are absent, which impacts compliance with GDPR standards. The site includes minimal user tracking via a lightweight analytics plugin and provides contact primarily through email and social media channels. Overall, the website is functional and professional but requires significant improvements in security and privacy compliance to enhance trust and protect users.

M

M.M.Warburg & CO (AG & Co.) KGaA

mmwarburg.com

50

M.M.Warburg & CO is a well-established independent private bank in Germany with a history dating back to 1798. The bank offers a broad range of financial services including private banking, asset management, corporate and investment banking, and institutional client services. The website targets private clients, business customers, and institutional investors, emphasizing personalized service and long-term client relationships. Technically, the website uses modern web technologies such as Apache server, UserCentrics consent management, Google Analytics, and Google Tag Manager, and is built on OpenCms. However, a critical security issue is the absence of a valid SSL certificate and HTTPS support, which severely impacts the security posture. Privacy compliance is strong with a comprehensive privacy policy and cookie consent mechanism. The website is professionally designed with consistent branding and rich content, including reports and multimedia. Overall, the site reflects a reputable financial institution but urgently needs to address its SSL/TLS configuration to ensure secure communications.

U

Universal Cables Limited

unistar.co.in

23

Universal Cables Limited is a well-established Indian manufacturing company specializing in cables and capacitors, founded in 1962 and part of the M.P. Birla Group. The company serves industrial and energy sectors with a broad product portfolio including XLPE, PVC, and elastomeric cables, as well as capacitors and EPC services. The website reflects a traditional manufacturing business with a focus on corporate overview, product details, and investor relations. Technically, the website uses common web technologies such as Bootstrap, jQuery, and Google Fonts but suffers from slow performance and lacks modern security implementations. Critically, the absence of HTTPS and a valid SSL certificate exposes visitors to security risks and undermines trust. Privacy and compliance documentation such as privacy policy and cookie policy are missing, indicating gaps in regulatory adherence. Overall, the site presents a moderate level of professionalism but requires significant improvements in security and privacy to meet modern standards.

M

M.M.Warburg & CO (AG & Co.) KGaA

bankhaus-plump.de

34

M.M.Warburg & CO is an established independent private bank in Germany, founded in 1798, offering a broad range of financial services including private banking, asset management, corporate finance, and institutional client services. The website reflects a mature digital presence with professional design, comprehensive content, and strong branding consistency. Technically, the site uses Apache server, OpenCms CMS, and integrates modern marketing and analytics tools with user consent management. However, the absence of a valid SSL certificate and HTTPS support is a critical security flaw that undermines user trust and data protection. The security posture is weak due to lack of TLS protocols and incomplete security headers. Privacy compliance is well addressed through UserCentrics CMP and a comprehensive privacy policy. Overall, the site is credible and professional but requires urgent security improvements.

B

Budget Sport

budgetsport.fi

40

Budget Sport is a Finnish-based large retail e-commerce platform specializing in affordable sportswear and equipment. It operates under the parent company Intersport Finland Oy and targets Finnish consumers with a broad product range including running, cycling, football, and golf gear. The website is well-structured with clear navigation, multiple product categories, and a consistent brand presence. Technical infrastructure includes modern web technologies such as lazy loading and templating, hosted via Cloudflare with integration of Google Tag Manager and Google Maps API. However, the site currently suffers from a critical security issue: the SSL certificate is invalid or missing, and TLS protocols are disabled, severely impacting the security posture. Despite this, privacy and cookie policies are comprehensive and GDPR compliant, and contact information is clearly provided. Overall, the site scores well on content quality and business credibility but requires urgent remediation of SSL/TLS configuration to improve security and trust.

B

Brookfield Real Estate Income Trust

brookfieldreit.com

64

Brookfield Real Estate Income Trust (Brookfield REIT) is a large-scale real estate investment trust providing individual investors access to private real estate opportunities focused on income generation and capital appreciation. The company leverages a global network of experts and a partnership with Brookfield Oaktree Wealth Solutions to deliver diversified real estate investment products. The website is professionally designed, content-rich, and targets both individual investors and financial advisors with clear calls to action and comprehensive disclosures. Technically, the site is built on Drupal 10, hosted on Pantheon infrastructure, and employs modern web technologies including Google Tag Manager and OneTrust for cookie consent. The site is mobile optimized, accessible, and SEO friendly with structured data enhancing search visibility. Performance is fast with no blocking or WAF detected. Security posture is solid with HTTPS enforced and key security headers present, though improvements are recommended in HSTS configuration and DNS security (DNSSEC, CAA). No critical vulnerabilities or exposed sensitive data were found. Privacy compliance is well addressed with clear privacy and cookie policies and consent mechanisms. Overall, the site demonstrates a mature digital presence with strong business credibility and trust indicators. Strategic recommendations include enhancing DNS security, strengthening HSTS policies, and publishing explicit security and incident response policies to further improve trust and compliance.

T

Tower Hill Insurance Group, LLC

thig.com

54

Tower Hill Insurance Group, LLC is a well-established insurance provider specializing in residential and commercial property insurance in Florida and select other states. Founded in 1972, the company offers a broad range of insurance products including homeowners, renters, flood, commercial, and cyber insurance through a network of agencies. The website reflects a mature digital presence built on WordPress with common industry plugins and integrations such as Google Tag Manager and OneSignal for push notifications. However, the site suffers from a critical security weakness due to the absence of a valid SSL certificate, which undermines user trust and data security. Privacy and cookie policies are present with consent mechanisms, indicating some compliance awareness. The site is content-rich with good navigation and branding consistency, targeting homeowners and commercial property owners primarily in Florida. Social media and trust signals such as BBB accreditation enhance credibility.

C

Center for Technology & Society

cts.wien

50

The Center for Technology & Society (CTS) is an inter-university and interdisciplinary cooperation platform based in Vienna, Austria, involving prominent academic institutions such as TU Wien, FH Campus Wien, FH Technikum Wien, and Universität Wien. It focuses on research, teaching, and societal engagement addressing technological and social challenges like climate change and digital transformation. The platform supports researchers, students, and societal stakeholders through networking, coordination, and participatory approaches. Technically, the website is built using the Hugo static site generator and leverages multiple JavaScript libraries including jQuery, Bootstrap, and Leaflet for interactive maps. However, the site suffers from a lack of HTTPS security, with no valid SSL certificate and no modern TLS protocols enabled, which significantly impacts its security posture. The site also lacks privacy and cookie policies, which affects compliance with data protection regulations. Performance is slow with a high load time and large page size, though mobile responsiveness and navigation are well implemented. Overall, the site presents a professional academic presence but requires urgent improvements in security and privacy compliance to enhance trust and protect users.

I

Intermines

inter-mines.org

40

Intermines is a French alumni network platform serving graduates from Mines Paris, Mines Saint-Etienne, and Mines Nancy engineering schools. It provides career services, networking opportunities, publications, and group activities to its members. The website is primarily in French and targets alumni and recruiters associated with these institutions. The platform is built on the AlumnForce CMS and uses various JavaScript libraries and APIs including Backbone.js, YUI, Google Maps, and Google Charts. While the site offers rich content and a consistent brand experience, it suffers from technical issues such as an invalid SSL certificate and slow page load times, which impact its security posture and user experience. Privacy and cookie policies are present with consent mechanisms, but no explicit security or incident response policies are found. Social media presence is strong, enhancing community engagement.

Inria Alumni operates as a professional network dedicated to current and former members of Inria, a French national research institution. The platform facilitates community engagement, career development, and information sharing through features such as a member directory, job board, events calendar, and news articles. The website targets researchers, alumni, and partners within the technology and education sectors in France. The business model centers on membership with free registration and partner accounts, positioning itself as a niche network within the research community. The site branding is consistent and leverages official Inria identity elements, enhancing trust and recognition.

C

Coastal Community Bank

coastalbank.com

59

Coastal Community Bank is a regional community bank serving Northwest Washington with a comprehensive suite of business and personal banking services including checking, savings, loans, treasury management, and credit card processing. The website is professionally designed on WordPress, featuring rich content, clear navigation, and mobile optimization. The bank maintains a strong online presence with social media integration and detailed contact information. However, the site lacks a valid SSL certificate and modern security headers, which are critical vulnerabilities that reduce the overall security posture. Privacy and cookie policies are present with consent mechanisms, but GDPR compliance is limited. The site uses multiple third-party analytics and marketing tools, indicating extensive user tracking. Overall, the website is functional and credible but requires urgent security improvements to protect user data and enhance trust.

S

Sciences Po Alumni

sciencespo-alumni.fr

39

Sciences Po Alumni is a well-established alumni association serving the students and graduates of Sciences Po in France. The website offers a comprehensive platform for networking, career services, events, and publications, targeting alumni, students, and recruiters. The platform leverages a custom CMS likely provided by AlumnForce and integrates modern web technologies including Vue.js, Backbone.js, and Google services. Despite a rich content offering and good user experience, the website suffers from a critical security flaw due to the absence of a valid SSL certificate, severely impacting its security posture. Privacy and cookie policies are present and GDPR compliance is indicated, but could be enhanced. Overall, the site is professional and functional but requires urgent security improvements to protect user data and trust.

N

Niort Séminaires

niort-seminaires.com

47

Niort Séminaires is a regional hospitality and event facilitation service focused on professional and corporate events in the Niort and Marais Poitevin area of France. The website positions itself as a destination marketing platform offering seminars, congresses, team building, and other corporate event services. The business targets companies and event organizers seeking turnkey or customized event solutions. The site demonstrates a moderate level of digital maturity with a WordPress CMS, modern JavaScript libraries, and structured data for SEO. However, the absence of a valid SSL certificate and HTTPS support is a critical security weakness, exposing visitors to potential risks and undermining trust. The site includes basic privacy and cookie policies but lacks explicit security or incident response documentation. Contact information and social media presence are clearly provided, supporting business credibility. Overall, the website is functional and professionally designed but requires urgent security improvements to meet modern standards.

M

MAIF

maif-evenements.fr

40

MAIF Evénements is a French event listing platform affiliated with the MAIF insurance group, focusing on promoting local community events across France. The website provides an interactive map and search functionality for users to find events by department and date. It leverages WordPress CMS with a variety of plugins and scripts to deliver a responsive and SEO-optimized user experience. However, the site lacks a valid SSL certificate and does not serve content over HTTPS, which significantly impacts its security posture. While privacy and cookie policies are referenced, they reside on the main MAIF domain rather than this subdomain. Social media links connect to official MAIF accounts, enhancing trust. Overall, the site is functional and professionally designed but requires urgent security improvements to protect user data and ensure compliance.

A

Agence Locale Pour la Coopération Européenne (ALPC)

europe-en-nouvelle-aquitaine.eu

40

The website europe-en-nouvelle-aquitaine.eu serves as the official digital presence of the Europe office for the Nouvelle-Aquitaine region in France. It provides comprehensive information and support related to European funding, project submission, and regional development initiatives. The site targets a diverse audience including regional businesses, public entities, associations, and individual beneficiaries seeking European aid and partnership opportunities. The business model is that of a public regional agency facilitating access to European funds and promoting regional cooperation. Technically, the website is built on the Drupal CMS platform, utilizing common web technologies such as Bootstrap, jQuery, Google Fonts, and Google Maps API. While the site is mobile-optimized and offers good navigation and content relevance, its performance is slow with a page load time exceeding 12 seconds. SEO and accessibility are basic but functional. From a security perspective, the site lacks a valid SSL/TLS certificate, resulting in no HTTPS protection. No security headers or DNS security features like DNSSEC or CAA records are implemented. Cookie consent is present, but privacy and security policies are basic. The absence of HTTPS and security headers significantly lowers the security posture, posing risks to user data confidentiality and integrity. Overall, the website is professionally designed and serves its informational purpose well but requires urgent improvements in security infrastructure, especially SSL implementation and security headers. Enhancing performance and accessibility would also benefit user experience and trustworthiness.

S

Stelliant

stelliant.com

55

Stelliant is a large French company specializing in comprehensive insurance-related services including risk prevention, expertise, client relations, post-claim solutions, crisis management, and innovation through dedicated campuses and labs. With approximately 3000 employees, it positions itself as a major player offering agile and personalized services to insurance professionals and clients. The website is built on WordPress with modern plugins and SEO optimizations, providing a professional and user-friendly experience with clear navigation and multilingual support. However, the technical infrastructure shows weaknesses in security, notably the absence of a valid SSL certificate and lack of HTTPS enforcement, which significantly impacts the security posture. Security headers are partially implemented but insufficient to compensate for the missing TLS security. Privacy compliance is weak, with no visible privacy or cookie policies and no GDPR compliance indicators. Contact information is available via email and contact forms, and social media presence is established on major platforms. Overall, the site is functional and professional but requires urgent improvements in security and privacy compliance to meet modern standards.

N

Nucleus

nucleus.com.au

61

Nucleus is a small Australian creative agency specializing in branding, design, digital communications, video production, and strategic marketing services. The company operates primarily in the media sector with offices in Adelaide and Melbourne, targeting businesses seeking comprehensive creative solutions. Their website reflects a professional and consistent brand image with clear service offerings and contact information. Technically, the site leverages modern web technologies including Google Analytics, LinkedIn Insight, Vimeo embeds, and Cloudflare hosting, ensuring good performance and mobile optimization. Security posture is solid with HTTPS enabled and CSRF protections, though improvements such as HSTS and cookie consent mechanisms are recommended. Privacy compliance is basic with a privacy policy present but lacking detailed GDPR adherence indicators. Overall, the site is functional, trustworthy, and professionally maintained, scoring well across content, technical, and business credibility metrics.

All Channels Communication Austria GmbH is a medium-sized marketing and communication agency operating primarily in Austria and the CEE region. The company offers a comprehensive range of services including campaign management, brand management, PR, digital strategies, and social media marketing. Positioned as one of the fastest growing and most awarded agencies in its region, it targets businesses seeking integrated multi-channel marketing solutions. The website content is well-structured and professionally presented in German, with clear navigation and mobile optimization. Technically, the site uses a modern tech stack including Bootstrap, jQuery, and Google Analytics, but suffers from a lack of a valid SSL certificate, impacting security and trust. Security posture is basic with no advanced headers or policies implemented, and privacy compliance is minimal with only a basic disclaimer modal and cookie consent banner. Contact information is clearly provided including phone, email, physical address, and a contact form. Overall, the website is functional and professional but requires significant improvements in security and privacy compliance to meet modern standards.

DZ PRIVATBANK S.A. is a specialized private banking and asset servicing institution operating primarily within the cooperative banking group Genossenschaftliche FinanzGruppe Volksbanken Raiffeisenbanken. The company offers a broad range of financial services including private banking, fund services, currency loans, and wealth management solutions. With headquarters in Luxembourg and multiple locations in Germany and Switzerland, it combines local presence with international expertise. The website reflects a professional business model targeting private banking clients, fund initiators, and institutional investors. Technically, the site employs modern JavaScript libraries and integrates consent management and tracking tools, but suffers from slow load times and lacks a valid SSL certificate, resulting in no HTTPS support. Security posture is weak due to missing HTTPS and security headers, though privacy compliance is supported by a comprehensive privacy policy and cookie consent mechanism. Overall, the site is functional and professional but requires urgent security improvements to protect user data and enhance trust.

G

GLS Canada

gls-canada.com

60

GLS Canada is a large transportation and logistics company providing parcel, freight, warehousing, and logistics services primarily in Canada with a strong connection to the GLS Group. The website offers comprehensive information about their services, including shipment tracking, shipping tools, and customer support. The company maintains a professional online presence with consistent branding and active social media channels. Technically, the website uses modern JavaScript libraries and analytics tools but suffers from slow load times and lacks a valid SSL certificate, which impacts security and user trust. Privacy compliance is well addressed with clear privacy and cookie policies and consent mechanisms. However, the absence of HTTPS and security headers represents a significant security risk. Overall, the site is functional and informative but requires urgent security improvements to protect user data and enhance trust.

A

Agritech Lavrale S.A. - Divisão Lavrale

lavrale.com.br

40

Agritech Lavrale S.A. - Divisão Lavrale is a Brazilian manufacturing company specializing in agricultural machinery and components, with a legacy of approximately 50 years. The company offers a broad range of products including agricultural implements, cabines, military trailers, and spare parts, targeting agricultural workers and farmers. Their market position is established with a consistent brand presence and active social media engagement. Technically, the website is built on a custom or unknown CMS, served by an Apache server, and uses common web technologies such as JavaScript, Google Fonts, and Google Maps API. However, the site lacks HTTPS, which severely impacts its security posture. Security headers are minimal and some are disabled, indicating a need for significant improvements in security practices. Privacy and cookie policies are absent, which raises compliance concerns. Overall, the website provides good content quality and user experience but suffers from critical security and privacy shortcomings.

T

TÜV NORD

tuev-nord.de

40

TÜV NORD is a well-established enterprise-level company specializing in safety, certification, and training services across multiple sectors including energy, transportation, real estate, healthcare, and technology. The website presents a professional and consistent brand image with comprehensive content targeting both private and business customers. The technical infrastructure is based on TYPO3 CMS with integration of modern marketing and analytics tools, though performance metrics indicate room for improvement. Security posture is weakened by the absence of a valid SSL certificate and HTTPS, which is a critical issue. Privacy compliance is well addressed with consent management and GDPR-aligned policies. Overall, the site is trustworthy but requires urgent security enhancements to protect user data and improve trust.

R

Redinter

redinter.cl

69

Redinter is a medium-sized energy company operating primarily in northern Chile, specializing in electrical transmission infrastructure. It is part of the larger Redeia group, which enhances its market position and credibility. The company focuses on ensuring secure and continuous electricity supply through its regional concessions and partnerships. The website reflects a professional corporate presence with clear business descriptions, contact information, and social media engagement. Technically, the site is built on Drupal 10, uses modern web technologies, and is hosted behind Imperva CDN, ensuring good performance and availability. Security posture is solid with HTTPS, OCSP stapling, and secure cookies, though improvements like full HSTS enablement and DNSSEC could be made. Privacy compliance is basic with a privacy policy and cookie consent implemented via Cookiebot. Overall, the site is trustworthy and well-maintained, supporting Redinter's business objectives effectively.

R

Redinter

redinter.pe

70

Redinter is a medium-sized energy sector company operating in Peru, specializing in the design, construction, operation, and maintenance of high voltage electrical transmission infrastructure. It is part of the Redeia group, a recognized leader in the energy transmission industry. The website presents a professional and well-structured digital presence with content primarily in Spanish, targeting energy sector clients and stakeholders in Peru. Technically, the site is built on Drupal CMS, uses modern web technologies, and is hosted behind Imperva Incapsula CDN/WAF, ensuring good performance and security. The SSL configuration is robust with OCSP stapling and no known vulnerabilities. Privacy compliance is basic but includes a cookie consent mechanism via Cookiebot. Contact information is clearly provided, enhancing business credibility. Overall, the site demonstrates a good balance of content quality, technical implementation, and security posture.

B

BG Kliniken – Klinikverbund der gesetzlichen Unfallversicherung gGmbH

bg-kliniken.de

40

BG Kliniken is a large non-profit healthcare organization in Germany specializing in acute care and rehabilitation for severely injured and occupationally ill patients. It operates one of the largest trauma center networks in the country, offering comprehensive medical services, research, and professional training through its BG Kliniken Akademie. The website is professionally designed with clear navigation targeting patients, insurance carriers, referring physicians, and job applicants. Technically, the site is built on TYPO3 CMS and integrates modern tools such as Usercentrics for cookie consent and Google Tag Manager for analytics. However, the site suffers from a critical security deficiency due to the absence of a valid SSL certificate and HTTPS support, exposing visitors to potential risks. DNS records show well-configured SPF and DMARC policies, enhancing email security. Overall, the site demonstrates strong business credibility and privacy compliance but requires urgent security improvements.

M

McCourt Partners

mccourtpartners.com

51

McCourt Partners is a family-owned real estate development, investment, and management company with a strong focus on community impact and innovative projects. The company positions itself as a visionary leader blending financial results with social responsibility, operating primarily in the United States with projects also internationally. Their website reflects a professional and consistent brand image with clear business messaging and multiple contact channels including forms and social media. Technically, the website is built on WordPress with modern frontend libraries such as Swiper.js and uses LiteSpeed Cache for performance optimization. However, the site suffers from a lack of a valid SSL certificate and does not serve content over HTTPS, which is a critical security and trust issue. Performance is moderate to slow, with a load time of over 7 seconds, and accessibility is basic but mobile optimization is good. From a security perspective, the site has SPF and DMARC records configured properly for email protection but lacks HTTPS, HSTS, OCSP stapling, and other important security headers. No advanced security policies or incident response information is publicly available. Privacy compliance is minimal with a privacy policy present but no cookie consent mechanism. Overall, the site is functional and professional but requires urgent security improvements to protect user data and enhance trust. Strategic recommendations include implementing HTTPS, adding security headers, and improving privacy compliance mechanisms.

A

AGRALE S.A

agrale.com.br

45

Agrale S.A is a well-established Brazilian manufacturer specializing in tractors, trucks, buses, utility vehicles, and engines with over 50 years of market presence. The company operates primarily in the transportation sector, serving agricultural, commercial, and industrial clients through a broad dealer and service network. Their website reflects a solid business model focused on manufacturing and after-sales services, targeting national and regional markets in Brazil. The site content is relevant and professionally presented, supporting the company's market position as a national leader. Technically, the website uses an older technology stack including jQuery 1.7.1 and Apache server on Ubuntu, hosted via Embratel Cloud DNS infrastructure. While the site includes Google Maps integration and FontAwesome icons, it lacks modern CMS or frameworks and shows signs of technical debt such as outdated libraries and missing HTTPS support. Performance and mobile optimization are basic, with room for improvement in SEO and accessibility. From a security perspective, the site lacks a valid SSL certificate and does not support HTTPS, severely impacting its security posture. No advanced security headers or mechanisms like HSTS or OCSP stapling are implemented. The site uses standard security headers but misses critical protections and vulnerability disclosures. Privacy and cookie policies are present with a consent mechanism, but GDPR compliance is uncertain. No incident response or security policy pages were found. Overall, the website is functional and business-credible but requires urgent security improvements, especially enabling HTTPS and updating outdated technologies. Strategic recommendations include implementing a valid SSL certificate, enhancing security headers, publishing vulnerability disclosure policies, and modernizing the technical stack to improve performance, security, and compliance.

I

Incepa

banheirosincepa.com.br

38

Incepa is a Brazilian manufacturing company specializing in bathroom and kitchen sanitary products, including ceramic sanitary ware, accessories, and complementary items. The company has recently integrated with the Roca brand, enhancing its market position. The website serves as a product catalog and brand promotion platform targeting residential customers, hotels, construction companies, and public environments. Technically, the site uses an Apache server with PHP 7.3.33 and integrates multiple marketing and analytics tools such as Google Tag Manager, Google Analytics, Facebook Pixel, and OneTrust for cookie consent. However, the site lacks a valid SSL certificate, serving content over HTTP only, which significantly impacts its security posture. The website content is well-structured and professionally designed, but privacy and security policies are missing or not clearly presented. Overall, the site demonstrates moderate digital maturity but requires urgent improvements in security and privacy compliance.

R

Redinter

redinter.company

73

Redinter is a well-established energy infrastructure company specializing in the construction and management of high voltage electricity transmission networks across Latin America, primarily in Peru, Chile, and Brazil. As a subsidiary of Redeia, it benefits from strong corporate backing and a significant regional presence managing thousands of kilometers of transmission circuits. The company focuses on ensuring reliable and secure electricity supply, contributing to sustainable development in the regions it serves. Technically, the website is built on Drupal CMS, uses modern web technologies, and is hosted behind Imperva CDN/WAF, ensuring good performance and security. The site is well-structured, mobile-optimized, and includes comprehensive privacy and cookie policies with consent mechanisms. Security posture is strong with HTTPS enforcement, security headers, and no detected vulnerabilities. However, explicit security policies and incident response information are not publicly available. Overall, the website and business demonstrate a mature digital presence with good compliance and security practices.

R

Reintel

reintel.es

40

Reintel is the largest neutral operator of dark fiber infrastructure in Spain, operating as a subsidiary of Grupo Red Eléctrica (redeia). The company provides critical telecommunications infrastructure services including long-distance fiber networks, dedicated cables, equipment hosting, and customized connectivity solutions. Their market position is strong within the Spanish energy and telecommunications sectors, serving businesses requiring extensive fiber optic connectivity. The website reflects a mature digital presence built on Drupal 10, integrating modern technologies such as Google Tag Manager, Cookiebot for consent management, and Google Maps API. Despite a slow page load time, the site offers excellent content quality, clear navigation, and good mobile optimization. Security posture is solid with HTTPS, valid SSL certificates, and OCSP stapling, though improvements are recommended in DNS security and HTTP security headers. Privacy compliance is robust with comprehensive privacy and cookie policies and active consent mechanisms. Overall, Reintel demonstrates a professional and trustworthy online presence aligned with its business stature.

C

CyberForum e.V.

cyberlab-karlsruhe.de

40

CyberLab Karlsruhe is a well-established startup accelerator and community hub operating under CyberForum e.V. It offers comprehensive services including founding consulting, accelerator programs, coworking spaces, mentoring, coaching, and investment facilitation. The website targets startups and entrepreneurs primarily in Germany, positioning itself as a key regional player with over 28 years of experience and a large active network. Technically, the site is built on TYPO3 CMS, uses modern TLS protocols, and integrates various frontend libraries and APIs, though performance is hindered by a high number of resources and slow load times. Security posture is adequate with HTTPS and SPF records but lacks advanced features such as HSTS, OCSP stapling, DMARC, DNSSEC, and certificate transparency compliance. Privacy compliance is good with a clear privacy policy and cookie consent mechanism. Overall, the site is professional, trustworthy, and content-rich, but could improve technical and security aspects to enhance user experience and protection.

T

The Luxury Collection

lc.com

61

The Luxury Collection website represents a premium luxury hospitality brand under Marriott International, offering curated boutique hotels and resorts worldwide. The site targets affluent travelers seeking unique cultural and luxury experiences. The business is positioned as a high-end brand within the global hospitality industry, leveraging Marriott's extensive portfolio and brand recognition. Technically, the site is built on WordPress with React components, hosted on WP Engine and served via Cloudflare CDN. It employs modern SEO practices including structured data and Yoast SEO plugin, and integrates multimedia content such as Brightcove videos and Google Maps. However, the site lacks a valid SSL certificate and does not enforce HTTPS, which is a critical security gap. Security headers are partially implemented but could be enhanced with additional controls. The site shows GDPR compliance through DMARC and SPF records but lacks visible cookie consent mechanisms. Overall, the security posture is moderate with room for improvement in encryption and security best practices. Strategic recommendations include immediate SSL implementation, enabling modern TLS protocols, and enhancing security headers to protect user data and improve trust. The site demonstrates excellent design, content quality, and user experience, reflecting its luxury market positioning.

E

Ersparniskasse Speicher

ersparniskassespeicher.ch

53

Ersparniskasse Speicher is a small, regional banking institution based in Switzerland, founded in 1819, serving the local community of Speicher and surrounding areas. It offers traditional banking services such as savings accounts, mortgage lending, and e-banking. The website reflects a well-established local bank with a strong historical presence and community focus. Technically, the website is built on WordPress with standard web technologies including jQuery and Google Maps integration. However, the site suffers from significant security shortcomings, including the absence of a valid SSL certificate and lack of modern TLS protocols, which exposes users to potential risks. The site also lacks visible cookie consent mechanisms and formal security or incident response policies, indicating gaps in compliance and security maturity. Overall, while the business is well-positioned locally with clear contact information and good content quality, the digital security posture requires urgent improvements to protect customer data and enhance trust.

T

TriCommerce

tricommerce.com.br

54

TriCommerce is a Brazilian e-commerce platform offering modular and rapid online store solutions tailored for small to medium-sized businesses and retailers. The company provides a range of plans and themes, including B2B and enterprise options, with a focus on ease of use, integration with marketplaces and ERPs, and humanized customer support. Their market position is that of an accessible and comprehensive e-commerce solution provider in Brazil. Technically, the website employs a variety of modern web technologies including jQuery, OwlCarousel, Google Maps API, and integrates marketing and CRM tools such as Sendinblue, RD Station, and Kommo CRM. However, the site suffers from a lack of a valid SSL certificate and does not implement modern TLS protocols, which significantly impacts its security posture. While DNS records for SPF and DMARC are configured, other security best practices like HSTS, DNSSEC, and security headers are missing. The website's performance is slow with a high load time and large page size, though mobile optimization and user experience are good. Overall, the site demonstrates moderate trustworthiness with positive customer reviews and social proof but requires urgent security improvements.

H

Hypothekarbank Lenzburg AG

hblasset.ch

56

HBL Asset Management, a brand of Hypothekarbank Lenzburg AG, operates a professional asset management and investment product platform targeting private investors primarily in Switzerland. The website offers financial market news, investment insights, and profiling tools to support investor decision-making. Technically, the site is built on the Umbraco CMS and integrates several modern web technologies including Google Analytics, Cookiebot for GDPR-compliant cookie consent, and Google Tag Manager. However, the site lacks HTTPS encryption, which is a critical security deficiency. While cookie consent and privacy policies are well implemented, the absence of SSL/TLS and security headers exposes users to risks. The company maintains a strong digital presence with social media integration and clear contact information, but should urgently address security gaps to protect user data and enhance trust.

S

Saulės spektras, UAB

medicina.lt

43

Medicina.lt is a Lithuanian healthcare information portal operated by Saulės spektras, UAB, providing a comprehensive directory of medical institutions, pharmacies, medical equipment suppliers, and expert advice. The site targets Lithuanian healthcare consumers seeking medical services, products, and professional guidance. It holds a strong market position as a trusted source for healthcare-related information with multilingual support and user engagement features such as reviews and Q&A with experts. Technically, the site uses a custom CMS with JavaScript libraries, Google Analytics, and Google Maps API, hosted by Hostex. Performance is moderate with good mobile optimization and SEO practices. However, the security posture is weak due to an invalid SSL certificate and lack of HTTPS, no DNSSEC, and missing security headers, which poses risks to user data confidentiality and trust. Privacy and cookie policies are comprehensive and GDPR compliant, with explicit consent mechanisms implemented. Overall, Medicina.lt is a well-established healthcare portal with room for critical security improvements to protect users and enhance trust.

D

Deen - Agência de Marketing Digital

deen.com.br

52

Deen - Agência de Marketing Digital is a small Brazilian digital marketing agency specializing in branding, social media, and website development services. The company targets businesses seeking to enhance their digital presence, primarily within Brazil. The website highlights notable clients and awards, positioning Deen as a recognized player in the digital marketing sector. Technically, the website employs multiple marketing and analytics tools such as Google Analytics, Hotjar, LinkedIn Insight Tag, and Jivochat, indicating a moderate level of digital maturity. However, the site suffers from significant security shortcomings, including an invalid SSL certificate, lack of HTTPS enforcement, and absence of essential security headers and DNS security features. These issues expose the site and its visitors to potential risks and undermine trust. Overall, while the business demonstrates good branding and content quality, the technical and security posture requires urgent improvement to align with industry best practices and regulatory compliance.

M

MOVERGS - Associação das Indústrias de Móveis do Estado do RS

movergs.com.br

61

MOVERGS is a regional industry association focused on supporting and strengthening the furniture manufacturing sector in Rio Grande do Sul, Brazil. The organization provides member benefits, industry representation, event coordination, and sector data to its target audience of furniture manufacturers and related stakeholders. The website reflects a medium-sized organization with a solid regional presence and partnerships with recognized industry and governmental entities. Technically, the website uses a legacy technology stack including jQuery 1.7.2 and several JavaScript libraries for UI and media handling. It relies on Cloudflare for DNS but lacks a valid SSL certificate, resulting in no HTTPS support and poor security posture. Performance is slow with a large page size and many resources. SEO and accessibility are basic but functional. From a security perspective, the site has SPF and DMARC configured for email security but lacks critical HTTPS implementation, security headers, and DNSSEC. No incident response or vulnerability disclosure policies are found. Cookie consent is implemented, but GDPR compliance is uncertain. The overall security score is low, exposing the site and users to risks. Strategically, the site should prioritize obtaining a valid SSL certificate and enabling HTTPS, improve security headers and DNS configurations, and publish clear security and privacy policies. Enhancing technical modernization and performance will also improve user trust and engagement.

R

Reply

vanillareply.com

65

Vanilla Reply, a part of the Reply group, specializes in tailored e-commerce, CMS, and PIM solutions primarily serving the German market. The company leverages strong partnerships with leading technology providers such as Shopware, Sylius, Akeneo, Storyblok, and TYPO3 to deliver integrated and agile digital experiences. Their business model focuses on consulting, custom software development, and cloud-based operations, positioning them as a trusted medium-sized player in the e-commerce sector. Technically, the website employs modern web technologies including Google Tag Manager, reCAPTCHA, OneTrust for cookie consent, and Google Maps API. The hosting is managed via register.it with a valid SSL certificate supporting TLS 1.3 and 1.2, and OCSP stapling enabled. However, performance is somewhat slow with a page load time of over 8 seconds, indicating potential optimization opportunities. The site is well-optimized for mobile and accessibility, with good SEO practices. From a security perspective, the site demonstrates good practices such as strong TLS protocols and no known SSL vulnerabilities. However, it lacks DNSSEC, CAA records, and DMARC, which are recommended for enhanced DNS and email security. The cookie consent mechanism is robust and GDPR compliant, but no explicit security policy or incident response information is publicly available. Overall, Vanilla Reply presents a professional and trustworthy digital presence with strong business and technical foundations. Strategic improvements in DNS security, email authentication, and performance optimization would further enhance their security posture and user experience.

É

École Française Motocyclisme

ecole-francaise-motocyclisme.com

56

École Française Motocyclisme is a French organization dedicated to motorcycle training across various disciplines including motocross, enduro, trial, and motoball. It operates a national network of over 150 certified schools and is affiliated with the Fédération Française de Motocyclisme, positioning itself as a key player in motorcycle sports education in France. The website serves as an educational and promotional platform, offering expert advice, school locators, and event information. Technically, the site is built on WordPress with common web technologies such as jQuery, Google Maps API, and Google Analytics. While the site has a valid SSL certificate and implements cookie consent mechanisms, it lacks modern TLS protocols and advanced DNS security features. Performance is slow, likely due to resource load and page size. Security posture is moderate with room for improvement in protocol support and formal security policies. Overall, the site is professional, trustworthy, and well-branded, targeting motorcycle enthusiasts and learners in France.

R

RE/MAX

remaxcommercial.com

50

RE/MAX Commercial operates as a prominent commercial real estate brokerage platform, offering extensive property listings for sale and lease across multiple regions, primarily in the United States and Canada. The company leverages the strong RE/MAX brand and network to connect commercial property buyers, sellers, and brokers, providing a trusted marketplace and professional services. Their website is well-structured with clear navigation, targeting commercial real estate investors and professionals seeking brokerage services. The business model centers on brokerage commissions and facilitating commercial real estate transactions through a digital platform integrated with professional broker searches and office locators. Technically, the website is built on WordPress VIP, utilizing modern web technologies including Yoast SEO for search optimization, Google Tag Manager for analytics, and TrustArc for cookie consent management. Hosting is provided via Amazon AWS DNS infrastructure, ensuring scalability and reliability. The site demonstrates good mobile optimization and SEO practices, with structured data enhancing search engine visibility. Performance is fast, and the user experience is professional and consistent with the RE/MAX brand. From a security perspective, the site maintains a valid SSL certificate but lacks modern TLS protocol support and advanced security headers, which limits its security posture. The presence of TrustArc indicates compliance with privacy regulations including GDPR, supported by a comprehensive privacy policy and cookie consent mechanism. However, there is no explicit security policy, incident response information, or vulnerability disclosure found, which are areas for improvement. Contact information is available primarily via phone and contact forms, with no direct company emails listed. Overall, RE/MAX Commercial presents a mature digital presence with strong business positioning in commercial real estate. Security practices are adequate but could be enhanced to meet higher standards. Strategic improvements in security protocols and transparency would further strengthen trust and compliance, supporting continued growth and market leadership.

D

DEKRA Bilbesiktning

dekra-bilbesiktning.se

55

DEKRA Bilbesiktning is a leading vehicle inspection service provider in Sweden and Europe, offering a wide range of inspection and testing services including battery tests for electric vehicles and registration inspections. The company leverages a robust digital infrastructure built on WordPress with modern optimization and analytics tools, ensuring a good user experience and SEO performance. Security measures include valid SSL certificates and essential security headers, though TLS protocols are outdated and could be improved. The website demonstrates compliance with GDPR through comprehensive privacy and cookie policies and implements user consent mechanisms. However, explicit security policies and incident response information are not publicly available, indicating areas for enhancement. Overall, DEKRA Bilbesiktning maintains a professional and trustworthy online presence with strong market positioning in the transportation sector.

P

Profesora Skrides Sirds Veselības Klīnika

skride.lv

55

Profesora Skrides Sirds Veselības Klīnika is a specialized cardiology healthcare provider based in Latvia, offering a wide range of cardiovascular and related medical services. The clinic positions itself as a multidisciplinary center with experienced specialists, targeting Latvian residents seeking high-quality heart and vascular care. The website supports multilingual content in Latvian and English and provides clear contact and appointment booking options, including online scheduling through a partner platform. The business model focuses on direct healthcare services supplemented by e-commerce offerings such as gift cards and subscriptions.

W

Woolworths

woolworths.com.au

70

The website demonstrates a strong foundation in email security, SSL/TLS configuration, and network security, reflecting well on its technical defenses. However, there are significant gaps in security headers implementation and compliance with GDPR and NIS2 regulatory frameworks, which expose the business to legal, reputational, and operational risks. Missing critical headers like Content-Security-Policy and X-Frame-Options increase susceptibility to common web attacks such as clickjacking and cross-site scripting. The absence of a Privacy Policy, Cookie Policy, and Consent Banner represents a major compliance failure that could result in regulatory penalties and loss of customer trust. Lack of documented security policies, incident response plans, and business continuity arrangements further weakens the organization's preparedness against cyber incidents. DNS security could be improved by enabling DNSSEC to prevent DNS spoofing. Overall, the current posture demands urgent attention to governance, compliance, and web security controls to protect business interests and meet regulatory obligations.

M

Medibank Private Limited

medibank.com.au

73

The website demonstrates a moderate overall security posture with no critical vulnerabilities detected, but several high and medium-risk issues require urgent attention. Key compliance gaps exist in GDPR adherence, notably the absence of a cookie policy and consent banner, which expose the business to regulatory penalties and reputational damage. The NIS2-related security framework and incident response capabilities are severely lacking, indicating unpreparedness for cyber incidents and potential operational disruptions. Security headers and SSL/TLS configurations are generally adequate but have room for improvement to mitigate common web-based attacks. DNS health and network security score well, reflecting a solid underlying infrastructure. Email security is robust, reducing phishing risks via email vectors. Prioritizing GDPR compliance and establishing formal security policies will significantly reduce legal and operational risks. Immediate remediation will enhance customer trust and regulatory standing, supporting long-term business resilience.

The website's security posture exhibits several critical and high-risk vulnerabilities that could severely impact business operations and data integrity. The presence of critical issues such as lack of email authentication and exposure of MySQL services pose immediate threats that could lead to data breaches or service disruptions. High-risk exposures like FTP services and DNS misconfigurations further increase the attack surface and risk of unauthorized access. Medium-level issues, including missing security headers, GDPR and NIS2 compliance failures, and expiring SSL certificates, indicate gaps in regulatory adherence and defense-in-depth strategies. Overall, the security hygiene needs urgent improvement to protect sensitive information, maintain customer trust, and ensure compliance with legal and industry standards. Immediate remediation of critical vulnerabilities and strengthening of network security controls should be prioritized. Failure to address these concerns promptly could result in reputational damage, regulatory penalties, and operational downtime. Investing in a comprehensive security enhancement plan will align the website with best practices and reduce business risk significantly.

I

Inforoutes 06

inforoutes06.fr

57

The website's overall security posture reveals significant gaps, particularly in privacy compliance and core security controls. Critical issues include the absence of essential email authentication, exposing the organization to phishing risks, and non-compliance with GDPR regulations despite operating in the EU, which could result in legal penalties and reputational damage. The lack of security policies, incident response procedures, and vulnerability disclosure mechanisms indicates immature information security governance. Missing key HTTP security headers such as Content-Security-Policy and X-Frame-Options increase exposure to common web attacks like clickjacking and cross-site scripting. Additionally, the presence of a high-risk exposed FTP service and issues within SSL/TLS configurations further elevate the risk profile. While DNS and network security show moderate maturity, critical controls require immediate attention. Addressing these findings will enhance regulatory compliance, reduce cyber risk, and protect customer trust.

The website's security posture is currently weak, with critical gaps in privacy compliance, network security, and foundational security headers. Critical services like MySQL are exposed, significantly increasing the risk of data breaches and unauthorized access. The absence of GDPR-required policies and consent mechanisms puts the business at high legal and reputational risk, especially as it operates within the EU. Security headers are largely missing or misconfigured, leaving the site vulnerable to common web attacks such as clickjacking, XSS, and content injection. The lack of an established information security framework, incident response procedures, and vulnerability disclosure policies indicates immature cybersecurity governance. While email security and DNS health show moderate strength, SSL/TLS implementation needs improvement to ensure secure communications. Immediate remediation is necessary to reduce risk exposure and ensure regulatory compliance, protecting both customer data and business continuity.

U

USLI

usli.ca

63

The website's overall security posture reveals significant vulnerabilities, particularly in foundational security controls and regulatory compliance. While no critical issues were found, numerous high and medium severity gaps exist, notably in security headers, GDPR compliance, and adherence to NIS2 requirements. The absence of key HTTP security headers like Strict-Transport-Security and Content-Security-Policy exposes the site to common web attacks such as clickjacking and cross-site scripting. GDPR non-compliance, especially lacking cookie policies and consent mechanisms, risks substantial legal and reputational damage. NIS2 deficiencies, including missing security policies and incident response plans, indicate unpreparedness for managing cybersecurity incidents. However, email security, SSL/TLS configurations, DNS health, and network security demonstrate comparatively better maturity. Immediate remediation is essential to mitigate risk exposure, protect customer data, and align with regulatory frameworks. Addressing these weaknesses will enhance trust, reduce liability, and strengthen the organization's cybersecurity resilience.