WSI.Public portal
Published snapshot
Web Security Index country profile
Romania (RO)
wsi-2026-v2
Security scanned
Latest WSI
May 2026 · top 10k · 8,581 sites
57.14
of 150
Highlights · May 2026
- Weakest component: Cross-Origin Security at 14% of its maximum (6.8 / 50).
- Largest untapped gain: Content-Security-Policy — adopted by only 23.4% of sites; wider adoption is worth up to 15.3 extra points.
- Best-adopted practice: SSL_Valid passes on 99.1% of scored sites.
- Technology & IT Services leads the categories (63.0); Government & Public Sector trails (45.7).
Measurement coverage
May 2026 · only final HTTP 2xx pages are WSI-eligible
- Targets
- 10,000
- 2xx eligible
- 8,581
- HTTP 4xx
- 535
- HTTP 5xx
- 18
- Bot challenges
- 709
- Technical errors
- 155
Historical WSI
Select a measurement to inspect its WSI signals below. Values are comparable only within the same cohort and measurement basis; the chart marks the legacy-to-2xx methodology break.
Romania
Limited comparability. Legacy measurements have no HTTP-status provenance, while the current methodology scores only final 2xx pages. The series is intentionally broken at the methodology change; values across that boundary are descriptive context, not a like-for-like delta.
May 2026
2xx eligibility
RO57.1(top 10k)
| Measurement | Comparison basis | Sample | RO |
|---|---|---|---|
| Legacy · HTTP status unknown | top 10k | 58.6 | |
| Legacy · HTTP status unknown | top 10k | 50.7 | |
| 2xx eligibility | top 10k | 57.1 |
WSI signal detail
May 2026 · top 10k · 8,581 scored sites
Selected from history
Content Security
Average 17.8 / 50 across 8,581 scored sites
Cookies_Secure37.5%(3.0 / 8p)
Referrer-Policy21.2%(1.1 / 5p)
SRI_Implemented25.6%(1.5 / 6p)
Cookies_HttpOnly37.2%(3.0 / 8p)
Cookies_SameSite30.6%(2.4 / 8p)
X-Content-Type-Options46.1%(2.3 / 5p)
Strict-Transport-Security44.8%(4.5 / 10p)
Cross-Origin Security
Average 6.8 / 50 across 8,581 scored sites
Content-Security-Policy23.4%(4.7 / 20p)
Cross-Origin-Opener-Policy3.3%(0.2 / 5p)
Access-Control-Allow-Origin13.8%(1.4 / 10p)
Access-Control-Allow-Methods9.8%(0.5 / 5p)
Cross-Origin-Embedder-Policy0.5%(0.0 / 5p)
Cross-Origin-Resource-Policy1.8%(0.1 / 5p)
Network & Protocol Security
Average 32.5 / 50 across 8,581 scored sites
SSL_Valid99.1%(14.9 / 15p)
HTTP Version85.6%(17.1 / 20p)
DNSSEC_Enabled3.4%(0.5 / 15p)
Category Breakdown
WSI by simplified page category; marker size is the site count · May 2026
Data table
| Category | Sites | CS | COS | NPS | WSI |
|---|---|---|---|---|---|
| Technology & IT Services | 489 | 21.1 | 8.9 | 33.0 | 63.0 |
| Commercial & Business Services | 3,081 | 20.0 | 7.5 | 33.0 | 60.5 |
| Finance & Banking | 234 | 21.8 | 7.7 | 30.4 | 59.8 |
| Healthcare & Medical | 305 | 18.0 | 6.0 | 32.6 | 56.6 |
| Community & Consumer Services | 2,907 | 16.9 | 6.9 | 32.5 | 56.3 |
| Media, News & Communications | 1,008 | 12.6 | 5.0 | 33.3 | 50.9 |
| Education & Research | 404 | 14.6 | 4.9 | 30.1 | 49.5 |
| Government & Public Sector | 153 | 16.2 | 4.7 | 24.7 | 45.7 |
| Weighted mean | 8,581 | 17.8 | 6.8 | 32.5 | 57.1 |
Performance context
Real-user field timings, outside the WSI score · May 2026
Country-origin cohort
10,000
May 2026
Validated CrUX contexts
2
separated by device form factor
Country-specific · BigQuery
Phone
9,742 measured originsMay 2026dataset 202605Mean origin LCP p75
1,811ms
primary contextual metric · lower is faster
Mean origin TTFB p75
768ms
secondary control metric · lower is faster
Country-specific · BigQuery
Desktop
9,119 measured originsMay 2026dataset 202605Mean origin LCP p75
1,531ms
primary contextual metric · lower is faster
Mean origin TTFB p75
707ms
secondary control metric · lower is faster