Perimetry Research

How we measure

Perimetry Research publishes studies of how well public bodies protect their websites and e-mail. Every study follows the same rules.

Passive checks only

We read what any visitor or mail server can see: public DNS records, the domain registration (RDAP), the TLS certificate, one request for the home page over HTTP (its redirect is read, not followed), and the home page over HTTPS (following its redirects, as a browser would). Nothing else on the site is requested. When a domain publishes an MTA-STS policy, its policy file is read too, as mail servers do.

No port scanning, no subdomain discovery, no login attempts, no forms, no testing for vulnerabilities. The robot is slow on purpose and spreads its requests over several hours.

The robot

It identifies itself as PerimetryResearch/1.0 (+https://perimetry.cloud/research/methodology/). If you run a site it visited and would rather it did not, write to hello@perimetry.cloud and we will leave the domain out of the next editions.

The French communes study

Population: every current commune in the State’s geographic API, with its population and département. For each one, the main town hall in the official directory of the administration (Service-Public.fr, published by the DILA under the Licence Ouverte 2.0), its website and its e-mail address.

A domain is the commune’s own when no other commune uses it. Sites on a website platform (a site builder, a shared portal, a hosting provider’s address) are graded as platforms, not as communes; a page of a State site given as the commune’s website does not count as its site; sites shared by several communes (an intercommunal site, for example) and pages on social networks are counted but not graded. An e-mail address at Orange, Wanadoo, Gmail, a local internet provider and similar providers counts as a consumer mailbox.

A certificate counts as valid when it is in date, issued for the site’s name and not self-signed; an incomplete chain, which browsers complete themselves, is not held against the site. An answer we could not get (a site that does not answer at all, a DNS lookup that fails) is left out of the score rather than counted as a failure.

Each commune with a domain of its own gets a score out of 100: the share of the checks below that it passes, among those that apply to it. The website checks only apply when the site is on the commune’s own domain; the e-mail checks are made on its own mail domain when it has one, on its website’s domain otherwise. A commune needs at least three checks that apply to be graded. Grades: A from 90, B from 75, C from 60, D from 40, E from 20, F below.

Corrected on 8 November 2026. When a site’s certificate could be read but not its home page (a timeout or a connection cut, often a site refusing robots), HSTS and the protective headers used to count as failed, though the rule above says an answer we could not get is left out. They are now left out (a redirect loop and a site without HTTPS still fail them). The November 2026 edition was recalculated: 137 communes are concerned; the national average stays at 47 out of 100; 31 communes move up a grade, 16 from D to C and 15 from C to B (B: 1,172 → 1,187, C: 6,033 → 6,034, D: 9,864 → 9,848); HSTS goes from 28.1% to 28.3% and the headers from 25.9% to 26.1% of the sites they apply to; the averages of the communes of 100,000 inhabitants or more (65 → 66), under 1,000 (43 → 44) and of nine départements gain a point. The honour roll and the best of each size band do not change.

The study of intercommunalities, départements and regions

Population: every intercommunality with its own tax powers in the official list of the State’s geographic API (geo.api.gouv.fr, Licence Ouverte 2.0), matched on its SIREN number with its record in the official directory of the administration (Service-Public.fr, DILA, Licence Ouverte 2.0), the same file as the communes study; every departmental and regional council in that directory; the authorities with a special status it lists (Collectivité de Corse, Martinique, Guyane, Mayotte, the Ville de Paris, the Collectivité européenne d’Alsace, the Métropole de Lyon) and the overseas collectivities it lists (Wallis-et-Futuna is not among them). Directory records of other bodies (syndicates, for example) are left out and counted.

Two more sources, from BANATIC, the national base of intercommunalities (DGCL, data.gouv.fr, Licence Ouverte 2.0): the eleven établissements publics territoriaux of the Grand Paris, a category of their own (their website is the directory’s when it lists them, otherwise their official website in Wikidata, CC0); and the intercommunalities created on 1 January by a merger, which the geographic API does not list yet: they are studied as the directory lists them, with BANATIC’s name, category, population and number of communes, and marked as recent mergers; the former intercommunalities they replace are left out.

Categories: metropolises, urban communities, agglomeration communities and communities of communes (from their official names), territorial public establishments, départements, regions, authorities with a special status and overseas collectivities. The population and the number of communes come from the geographic API (the Rhône without the Métropole de Lyon), or from BANATIC for the bodies it alone lists.

The website and the e-mail address are the ones the directory gives. The rules are the communes study’s: a domain two bodies of the study use is shared and not graded; a site on a website platform is graded as the platform’s; a page of a State site does not count. An intercommunality whose website is a page on a member town’s site, or whose address is on a domain a town outside it writes from, is not graded on that town’s domain; one whose site sits at the root of a domain it shares with a town (the city and its metropolis, for example) is graded on it, as that domain serves both.

The same ten checks, the same score and the same grades as the communes study, so the two compare. When the home page could not be read over HTTPS (a timeout, a connection cut, often a site refusing robots), HSTS and the protective headers are unknown and left out of the score; a redirect loop still fails them, as visitors cannot reach the site either. A body whose home page could not be read is never named.

Small groups: a category, a population band or a region shows no figures below ten graded bodies, and the groups without figures taken together must count ten graded bodies or more (otherwise the smallest groups shown are hidden too, or, for the categories, the hidden ones are left out of the totals), so that no figure can be worked out by subtraction. Below thirty graded bodies, a category names its honour roll only, never its best performers, and publishes no score histogram and no quartiles: with fourteen regions, naming seven and showing how the scores spread would tell that the others are below the line.

For each category and population band of thirty graded bodies or more, the edition also publishes how the scores spread (how many bodies score in each five-point band, a band of fewer than three being merged with its neighbour, and the quartiles): enough for a body to see where it stands among its peers, without naming any of them.

Mutualisation: the share of the town halls (read in the same directory) whose website or e-mail is on their intercommunality’s own domain.

The study of universities and higher education establishments

Population: every establishment in the list of the main higher education establishments published by the ministry of Higher Education and Research (“Principaux établissements d’enseignement supérieur”, data.enseignementsup-recherche.gouv.fr, Licence Ouverte 2.0; the licence is checked on every run, and a different one stops it). The list gives each establishment’s type, sector (public or private) and official website; when it gives no website, the official website in Wikidata (P856, CC0) is used, found by the Wikidata identifier the list gives.

Categories: the universities and the establishments the ministry classes with them (by its typology of universities), the other grands établissements (by their type), and the schools, by sector and by what their name says: public engineering schools; public schools of art, architecture and culture; other public establishments (the French schools abroad, the institutes of political studies, the veterinary schools…); private business and management schools; private engineering schools; other private establishments.

The domain graded is the website’s. A site on another organisation’s domain (a school on a subdomain of its university, a programme page of a group of schools, a page of its parent body’s site) is counted, not graded; when several establishments use one domain, the one whose home page is at its root owns it; schools on subdomains of a domain none of them owns (the architecture schools on archi.fr) share it and are graded on none.

The ministry’s list gives no contact address, and none is made up: the check on the contact address does not apply, so the score counts nine checks, and the honour roll asks for all nine. The e-mail checks (SPF, DMARC) are made on the website’s domain, the one whose mail servers (MX) the edition also counts.

The same checks, score and grades as the studies of the communes and of the local authorities, so the three compare. When the home page could not be read over HTTPS (a timeout, a connection cut, often a site refusing robots), HSTS and the protective headers are unknown and left out of the score; an establishment whose home page could not be read is never named.

Small groups: a category, a sector or a region shows no figures below ten graded establishments, and the groups without figures taken together must count ten graded establishments or more (otherwise the smallest groups shown are hidden too, or, for the categories, the hidden ones are left out of the totals and of their sector), so that no figure can be worked out by subtraction. Below thirty graded establishments, a category names its honour roll only, never its best performers, and publishes no score histogram and no quartiles.

The best of a category are named in the categories of thirty graded establishments or more only (in November 2026, the universities and the private engineering schools); ties between equal scores are broken by the number of checks that apply, then by the number of enrolled students the ministry’s list gives. The seven architecture schools on archi.fr, which none of them owns, are not graded.

A website the ministry’s list gives wrongly (a former domain after a merger, for example) is corrected in a public file of the study (research/universites/site-overrides.json), each correction with its source and its date; the November 2026 edition corrects one: the Université de Toulouse, listed with the former domain of the Université Toulouse III – Paul Sabatier (univ-tlse3.fr), is graded on the domain of its own site (utoulouse.fr), to which the former one redirects.

The study of the French State’s domains

Population: the domains of the State in two open lists, both under the Licence Ouverte 2.0. The first is the DINUM’s list of the domain names of public bodies (gitlab.adullact.net), its State types only: Gouvernement, Préfecture, Ministère, Académie, Ambassade and Santé (communes, local authorities, universities and hospitals have studies of their own). The second is the list of sites of the observatory of the State’s digital ecosystem published by the Service d’information du Gouvernement (data.gouv.fr, file “audience-liste-sites”), without the sites it marks as parked. Each address is brought back to its registrable domain (interieur.gouv.fr is one domain); a domain in several groups is counted once, in the first of: prefectures, académies, embassies, ministries, health, other government domains, the observatory’s other sites. The November 2026 edition counts 1,440 domains.

A domain is inactive, counted and left out, when it does not exist in DNS or has neither a site in use nor a mail server: many are former campaign or former body domains still listed.

The grades, the categories and the kinds of site are those of the domains with a site of their own. The active domains without one (a site that sends visitors to another domain, or a domain used for mail only) can only be judged on their DNS and mail: they are shown apart, as what they are, domains in whose name e-mail can be forged unless DMARC is enforced. Most embassy domains (ambafrance-xx.org) send visitors to a site on another domain: they are counted among them, so the embassies have too few graded domains to show figures.

The checks, score and grades of the communes study, without the check on the contact address, which the lists do not give: nine checks, as in the studies of higher education and of .fr domains. A domain needs three checks that apply to be graded; a group shows no figures below ten graded domains.

The honour roll names the domains that pass all nine checks and have no serious issue; no other domain is named. The serious issues (an expired certificate, DNS answers that fail, a listed domain anyone could register…) were reported to the CERT-FR of the ANSSI before publication; the study gives their number only.

The study of the UK State’s domains

Population: the domains of the UK’s central government in open lists under the Open Government Licence v3.0. GOV.UK itself, the single website of the ministerial departments and of most of their bodies. The domains of the Cabinet Office’s list of .gov.uk domain names registered for a central government organisation: the latest editions of the list give the domain names only, so whom a domain is registered for is read in the edition of 30 March 2023, the last to say it, matched by name to the organisations of GOV.UK, and the domain is kept only if it is still in the latest edition (31 March 2026). And the websites of the GOV.UK organisations that keep one of their own (exempt from GOV.UK). Local government (councils, parish and town councils), the police and fire services are left out, as the French study leaves out communes and local authorities; so are public corporations (the BBC, Channel 4…) and the bodies GOV.UK classes as “other” (the Bank of England…).

Categories: the GOV.UK organisations’ own classification (ministerial and non-ministerial departments, executive agencies, non-departmental public bodies, courts and tribunals, devolved governments, other central bodies). A domain registered after March 2023, or for a name that differs from the organisation’s on GOV.UK, cannot be classified and is not in the study: the list is complete for the bodies’ own websites, not for every .gov.uk domain of central government.

Everything else follows the study of the French State: inactive domains counted and left out, the main figures on the domains with a site of their own, the domains without one shown apart, nine checks, three that apply needed to be graded, groups of ten graded domains or more, only the domains that pass all nine checks named. The serious issues are reported to the NCSC before publication; the study gives their number only.

The study of active .fr domains

Population: the .fr domains in the open data of Afnic, the .fr registry (file A, “Noms de domaine en .fr”, Licence Ouverte), that are still registered, plain .fr (not asso.fr, com.fr and the like) and not internationalised. The file gives the holder’s type for very few domains, the holders’ data being protected: the few marked as held by a natural person, or by a holder outside France, are left out; all the others are kept. The November 2026 edition draws on the file of September 2026: 4,633,263 eligible domains.

A random sample of 20,000 of them is measured, drawn again identically from the edition’s seed. With a sample this size, a share measured on all of it is within about one point of the share among all eligible domains (95% confidence); for a group, the margin grows as the group gets smaller.

Because the holder is unknown for most domains, the study cannot tell a company’s domain from an association’s or a private person’s. That is why it never names a domain, not even the good performers: it publishes aggregates only.

A domain is inactive, counted and left out, when it does not exist in DNS or has neither a site in use nor a mail server: a parked page or a host’s placeholder page is not a site in use. The site is read on the domain itself, then on www when the domain itself has no site. A domain whose site sends visitors to another domain (an alias of a brand’s main address, for example) is judged on its DNS and mail only, its site being someone else’s.

The checks, score and grades of the communes study, without the check on the contact address, which a domain alone does not give: nine checks, as in the study of higher education. A domain needs three checks that apply to be graded.

Groups: by age (from the creation date in Afnic’s file), by mail provider (from the names of the mail servers, MX, of the domain: Microsoft 365, Google Workspace, OVHcloud, another provider, none) and by kind of site (from the home page: WordPress, a site builder, another kind of site, none of its own). OVHcloud sets up its mail servers by default with many of the domains registered there: its group mixes mailboxes in use and settings left as they came. The registrars are not published.

Good performers only

We name the communes that do well (the honour roll and the best of each size band), never the ones that do badly, and never a commune with a serious issue, whatever its score. Everything else is published as aggregates: by size of commune and by département, where a département with fewer than ten graded communes shows no figures, so that none of them can be singled out.

Website platforms are graded on a sample of up to five communes’ sites there: a check counts as passed when most of the sample passes it.

Serious issues are reported privately

Some findings could be used against a commune right away: a domain listed in the official directory that no longer exists (anyone could register it), a registration the registry is deleting, an expired certificate, an SPF record that lets anyone send mail in its name. These are never published. We tell the commune first, quietly, and count them in the study without naming anyone.

Limits

Each edition is a snapshot taken over a few hours. The directory can be out of date or wrong; we use it as published. DKIM keys are looked for on common selectors only, so they are not graded. A site behind a protection service may answer differently to a robot than to a visitor. Mail servers are not tested (STARTTLS needs port 25, which the study’s infrastructure cannot reach).

Reuse

The figures of each edition can be downloaded as JSON from the study page. You may reuse them with a link to the study. The underlying directory remains under the Licence Ouverte 2.0 (source: Service-Public.fr, DILA).

The ten checks of the communes study