WSI.Public portal
Published snapshot
Web Security Index country profile
Bulgaria (BG)
wsi-2026-v2
Security scanned
Latest WSI
May 2026 · top 10k · 8,629 sites
53.59
of 150
Highlights · May 2026
- Weakest component: Cross-Origin Security at 11% of its maximum (5.6 / 50).
- Largest untapped gain: Content-Security-Policy — adopted by only 20.8% of sites; wider adoption is worth up to 15.8 extra points.
- Best-adopted practice: SSL_Valid passes on 98.8% of scored sites.
- Finance & Banking leads the categories (63.5); Media, News & Communications trails (50.4).
Measurement coverage
May 2026 · only final HTTP 2xx pages are WSI-eligible
- Targets
- 10,000
- 2xx eligible
- 8,629
- HTTP 4xx
- 481
- HTTP 5xx
- 25
- Bot challenges
- 727
- Technical errors
- 138
Historical WSI
Select a measurement to inspect its WSI signals below. Values are comparable only within the same cohort and measurement basis; the chart marks the legacy-to-2xx methodology break.
Bulgaria
May 2026
2xx eligibility
BG53.6(top 10k)
| Measurement | Comparison basis | Sample | BG |
|---|---|---|---|
| 2xx eligibility | top 10k | 53.6 |
WSI signal detail
May 2026 · top 10k · 8,629 scored sites
Selected from history
Content Security
Average 15.5 / 50 across 8,629 scored sites
Cookies_Secure31.9%(2.5 / 8p)
Referrer-Policy19.8%(1.0 / 5p)
SRI_Implemented24.2%(1.5 / 6p)
Cookies_HttpOnly35.0%(2.8 / 8p)
Cookies_SameSite27.7%(2.2 / 8p)
X-Content-Type-Options35.3%(1.8 / 5p)
Strict-Transport-Security37.5%(3.8 / 10p)
Cross-Origin Security
Average 5.6 / 50 across 8,629 scored sites
Content-Security-Policy20.8%(4.2 / 20p)
Cross-Origin-Opener-Policy3.1%(0.2 / 5p)
Access-Control-Allow-Origin9.2%(0.9 / 10p)
Access-Control-Allow-Methods5.4%(0.3 / 5p)
Cross-Origin-Embedder-Policy0.7%(0.0 / 5p)
Cross-Origin-Resource-Policy1.8%(0.1 / 5p)
Network & Protocol Security
Average 32.4 / 50 across 8,629 scored sites
SSL_Valid98.8%(14.8 / 15p)
HTTP Version85.2%(17.0 / 20p)
DNSSEC_Enabled3.8%(0.6 / 15p)
Category Breakdown
WSI by simplified page category; marker size is the site count · May 2026
Data table
| Category | Sites | CS | COS | NPS | WSI |
|---|---|---|---|---|---|
| Finance & Banking | 201 | 23.6 | 9.1 | 30.8 | 63.5 |
| Technology & IT Services | 498 | 19.7 | 7.9 | 32.3 | 59.9 |
| Government & Public Sector | 95 | 18.8 | 9.4 | 26.8 | 55.0 |
| Community & Consumer Services | 2,661 | 15.4 | 6.7 | 32.4 | 54.5 |
| Healthcare & Medical | 325 | 14.0 | 5.4 | 33.4 | 52.7 |
| Commercial & Business Services | 3,316 | 15.4 | 4.6 | 32.6 | 52.6 |
| Education & Research | 393 | 15.7 | 4.8 | 31.9 | 52.4 |
| Media, News & Communications | 1,140 | 12.9 | 4.7 | 32.8 | 50.4 |
| Weighted mean | 8,629 | 15.5 | 5.6 | 32.4 | 53.6 |
Performance context
Real-user field timings, outside the WSI score · May 2026
Country-origin cohort
10,000
May 2026
Validated CrUX contexts
2
separated by device form factor
Country-specific · BigQuery
Phone
9,506 measured originsMay 2026dataset 202605Mean origin LCP p75
1,671ms
primary contextual metric · lower is faster
Mean origin TTFB p75
720ms
secondary control metric · lower is faster
Country-specific · BigQuery
Desktop
8,880 measured originsMay 2026dataset 202605Mean origin LCP p75
1,490ms
primary contextual metric · lower is faster
Mean origin TTFB p75
671ms
secondary control metric · lower is faster