Latest WSI
May 2026 · top 10k · 9,118 sites
50.65
of 150
Highlights · May 2026
- Weakest component: Cross-Origin Security at 11% of its maximum (5.6 / 50).
- Largest untapped gain: Content-Security-Policy — adopted by only 20.4% of sites; wider adoption is worth up to 15.9 extra points.
- Best-adopted practice: SSL_Valid passes on 98.8% of scored sites.
- Finance & Banking leads the categories (59.2); Media, News & Communications trails (48.7).
Measurement Dynamics
Select a measurement to inspect its WSI signals below. Top 1k and top 10k samples are different statistical populations and are compared like-for-like.
Bulgaria
| Measurement | Sample | BG |
|---|---|---|
| May 2025 | CrUX origins only — security scan not performed yet | |
| November 2025 | CrUX origins only — security scan not performed yet | |
| top 10k | 50.6 | |
WSI signal detail
May 2026 · top 10k · 9,118 scored sites
Selected from dynamics
Content Security
Average 12.5 / 50 across 9,118 scored sites
Cookies_Secure20.2%(1.6 / 8p)
Referrer-Policy21.3%(1.1 / 5p)
SRI_Implemented23.9%(1.4 / 6p)
Cookies_HttpOnly16.4%(1.3 / 8p)
Cookies_SameSite19.0%(1.5 / 8p)
X-Content-Type-Options35.2%(1.8 / 5p)
Strict-Transport-Security37.6%(3.8 / 10p)
Cross-Origin Security
Average 5.6 / 50 across 9,118 scored sites
Content-Security-Policy20.4%(4.1 / 20p)
Cross-Origin-Opener-Policy3.9%(0.2 / 5p)
Access-Control-Allow-Origin9.1%(0.9 / 10p)
Access-Control-Allow-Methods5.2%(0.3 / 5p)
Cross-Origin-Embedder-Policy1.4%(0.1 / 5p)
Cross-Origin-Resource-Policy2.4%(0.1 / 5p)
Network & Protocol Security
Average 32.6 / 50 across 9,118 scored sites
SSL_Valid98.8%(14.8 / 15p)
HTTP Version85.6%(17.1 / 20p)
DNSSEC_Enabled4.1%(0.6 / 15p)
Category BreakdownThe dashed line is the origin-weighted mean: Σ(category WSI × sites) / Σ(sites). Categories differ hugely in size, so a plain average of the category numbers would let a tiny category count as much as a huge one. Weighting by site count makes each category count in proportion to its origins, so the line equals this country's average WSI across every individual site.
WSI by simplified page category; marker size is the site count · May 2026
Data table
| Category | Sites | CS | COS | NPS | WSI |
|---|---|---|---|---|---|
| Finance & Banking | 206 | 19.4 | 8.9 | 31.0 | 59.2 |
| Technology & IT Services | 525 | 15.6 | 7.9 | 32.5 | 56.1 |
| Community & Consumer Services | 3,045 | 12.7 | 6.6 | 32.7 | 51.9 |
| Government & Public Sector | 97 | 15.8 | 9.2 | 26.6 | 51.6 |
| Education & Research | 398 | 13.2 | 4.7 | 32.0 | 49.9 |
| Healthcare & Medical | 326 | 10.9 | 5.4 | 33.4 | 49.7 |
| Commercial & Business Services | 3,346 | 11.8 | 4.6 | 32.6 | 49.0 |
| Media, News & Communications | 1,175 | 11.0 | 4.7 | 32.9 | 48.7 |
| Weighted mean | 9,118 | 12.5 | 5.6 | 32.6 | 50.6 |
Performance contextFor each eligible origin, LCP p75 is the primary perceived-performance metric and TTFB p75 is a secondary delivery control. COUNTRY records come from the CrUX BigQuery country dataset. CrUX API records are GLOBAL even when the origin belongs to this country's cohort. Country cards show the mean across origin-level p75 values, not a recomputed country-wide user percentile. These contextual metrics never contribute to WSI.
Real-user field timings, outside the WSI score · May 2026
Country-origin cohort
10,000
May 2026
Validated CrUX contexts
3
separated by provenance and device
Country-specific · BigQuery
Phone
9,506 measured originsMay 2026dataset 202605Mean origin LCP p75
1,671ms
primary contextual metric · lower is faster
Mean origin TTFB p75
720ms
secondary control metric · lower is faster
Country-specific · BigQuery
Desktop
8,880 measured originsMay 2026dataset 202605Mean origin LCP p75
1,490ms
primary contextual metric · lower is faster
Mean origin TTFB p75
671ms
secondary control metric · lower is faster
Global · CrUX API
All devices
1 measured originsMay 2026collection 2026-06-18–2026-07-15Mean origin LCP p75
1,140ms
primary contextual metric · lower is faster
Mean origin TTFB p75
552ms
secondary control metric · lower is faster