WSI.Public portal
Published snapshot
Dashboard
Web Security Index country profile

Turkey (TR)

wsi-2026-v2
Security scanned

Latest WSI

May 2026 · top 10k · 7,103 sites

56.68
of 150

Highlights · May 2026

  • Weakest component: Cross-Origin Security at 15% of its maximum (7.4 / 50).
  • Largest untapped gain: DNSSEC_Enabled — adopted by only 2.7% of sites; wider adoption is worth up to 14.6 extra points.
  • Best-adopted practice: SSL_Valid passes on 97.8% of scored sites.
  • Commercial & Business Services leads the categories (66.7); Community & Consumer Services trails (51.5).

Measurement coverage

May 2026 · only final HTTP 2xx pages are WSI-eligible

Targets
9,999
2xx eligible
7,103
HTTP 4xx
781
HTTP 5xx
67
Bot challenges
993
Technical errors
1,053

Historical WSI

Select a measurement to inspect its WSI signals below. Values are comparable only within the same cohort and measurement basis; the chart marks the legacy-to-2xx methodology break.

Turkey
45505560May 2026TR 56.7
May 2026
2xx eligibility
TR56.7(top 10k)
MeasurementComparison basisSampleTR
2xx eligibilitytop 10k56.7

WSI signal detail

May 2026 · top 10k · 7,103 scored sites

Selected from history

Content Security

Average 18.1 / 50 across 7,103 scored sites

Cookies_Secure37.7%(3.0 / 8p)
Referrer-Policy21.0%(1.0 / 5p)
SRI_Implemented31.5%(1.9 / 6p)
Cookies_HttpOnly39.6%(3.2 / 8p)
Cookies_SameSite34.2%(2.7 / 8p)
X-Content-Type-Options40.0%(2.0 / 5p)
Strict-Transport-Security42.4%(4.2 / 10p)

Cross-Origin Security

Average 7.4 / 50 across 7,103 scored sites

Content-Security-Policy27.1%(5.4 / 20p)
Cross-Origin-Opener-Policy3.6%(0.2 / 5p)
Access-Control-Allow-Origin12.4%(1.2 / 10p)
Access-Control-Allow-Methods7.8%(0.4 / 5p)
Cross-Origin-Embedder-Policy0.7%(0.0 / 5p)
Cross-Origin-Resource-Policy2.0%(0.1 / 5p)

Network & Protocol Security

Average 31.2 / 50 across 7,103 scored sites

SSL_Valid97.8%(14.7 / 15p)
HTTP Version80.6%(16.1 / 20p)
DNSSEC_Enabled2.7%(0.4 / 15p)

Category Breakdown

WSI by simplified page category; marker size is the site count · May 2026

4951535557596163656769WSI — Web Security Indexweighted mean 56.7Commercial & Business Services1,454 originsTechnology & IT Services486 originsFinance & Banking167 originsHealthcare & Medical129 originsMedia, News & Communications1,009 originsEducation & Research564 originsGovernment & Public Sector101 originsCommunity & Consumer Services3,193 origins
Data table
CategorySitesCSCOSNPSWSI
Commercial & Business Services1,45424.810.031.966.7
Technology & IT Services48622.79.732.164.5
Finance & Banking16725.510.826.863.1
Healthcare & Medical12920.88.330.059.1
Media, News & Communications1,00914.56.633.955.0
Education & Research56418.45.530.454.3
Government & Public Sector10125.35.922.453.6
Community & Consumer Services3,19314.76.330.651.5
Weighted mean7,10318.17.431.256.7

Performance context

Real-user field timings, outside the WSI score · May 2026

Country-origin cohort
9,999
May 2026
Validated CrUX contexts
2
separated by device form factor
Country-specific · BigQuery
Phone
9,704 measured originsMay 2026dataset 202605
Mean origin LCP p75
2,024ms
primary contextual metric · lower is faster
Mean origin TTFB p75
657ms
secondary control metric · lower is faster
Country-specific · BigQuery
Desktop
8,182 measured originsMay 2026dataset 202605
Mean origin LCP p75
1,530ms
primary contextual metric · lower is faster
Mean origin TTFB p75
587ms
secondary control metric · lower is faster