Two in three of France’s largest cities do not yet enforce protection against email spoofing

KrakenShield barometer, October 2026: we looked at the official websites of France’s 100 most populous municipalities, from the outside and without forcing anything. Basic encryption is solid: 100% of certificates are valid and 93% of sites support TLS 1.3. But the second layer of settings, the ones that protect residents on public Wi-Fi or against fake emails, is uneven. 66% of domains enforce no DMARC policy and 40% of sites do not enable HSTS.

City hall websites have become service counters: civil registration, school enrolment, canteen payments, reporting issues. Their security configuration is therefore a public service matter as much as a technical one. This barometer looks for no vulnerability: it only records what any visitor can see, and no city is named.

1. A healthy encryption baseline

Of the 99 sites measured, all present a valid certificate, 92.9% accept TLS 1.3, the latest version of the encryption protocol, and 94.9% automatically redirect HTTP to HTTPS. More than half of the certificates (53.5%) come from a free, automated certificate authority, a sign that automatic renewal is now the norm.

What it means: the connection between residents and their city hall is encrypted everywhere. This is the main achievement of recent years and deserves credit.

2. Four sites in ten without HSTS

39.8% of sites (37 of 93 analysable pages) do not send the Strict-Transport-Security header, or send it with a zero duration. Only 43% enable it for at least one year.

What it means: without HSTS, the very first visit of a resident who types the address without “https” travels unencrypted for a brief moment. On a malicious public Wi-Fi network, that moment is enough to divert the visit to a fake page.

The fix: a single server header, first with a six-month duration, then one year once every subdomain serves HTTPS.

3. Retired protocols still accepted

4% of sites still accept TLS 1.0 and TLS 1.1, two versions formally retired in 2021 and refused by every current browser. Two of these four sites sit behind a protection service whose default setting still allows these versions.

What it means: no resident needs them, but they needlessly widen the attack surface and weigh on compliance audits.

The fix: set the minimum version to TLS 1.2, often a single option in the hosting console.

4. Email, the weak link: 66% without an enforced DMARC policy

This is the clearest finding. 22.2% of domains have no DMARC record and 43.4% have one in “monitoring only” mode (p=none). In total, 65.7% of domains do not ask mail providers to reject or quarantine messages that spoof their name. Only 13.1% are in “reject” mode.

What it means: a fraudster can more easily send a fake notice from the city (a fine, a canteen bill, a summons) using the city’s exact address. Mail filters stop some of these, but without a clear instruction from the domain.

The fix: a gradual rollout. Publish DMARC at p=none with reporting, identify every service that sends on behalf of the city (newsletters, online services, contractors), then move to p=quarantine and finally p=reject. SPF is already present on 94.9% of domains: the foundation is there.

Notably, city size makes almost no difference here. Municipalities above 200,000 inhabitants stand at 63.6% without an enforced policy, against 65.9% for the others.

5. Browser defence headers remain rare

Only 31.2% of sites declare a Content-Security-Policy, which limits the scripts allowed on a page and reduces the impact of code injection. 20.4% send a Permissions-Policy and 32.3% a Referrer-Policy. Overall, 22.6% of sites have none of the six protections observed, while 17.2% have all of them.

What it means: these headers do not fix a flaw, they limit its consequences. They matter most on sites that embed many third-party services (maps, videos, analytics).

The fix: deploy the CSP in “report only” mode first to see what would be blocked, then enforce it. The other headers take a few lines.

Here, size does matter: 54.5% of cities above 200,000 inhabitants have a CSP, against 28% for the others, and 72.7% have HSTS of at least one year, against 39%.

6. Small disclosures and cookies

14% of sites reveal the version number of their server or programming language in HTTP responses, which helps an attacker target a known flaw. 19.4% set at least one cookie without the Secure attribute on the home page. Finally, only 8.1% of domains publish a CAA record, which names the authorities allowed to issue their certificates.

The fix: hide versions in the server configuration, add Secure and HttpOnly to cookies, publish a one-line CAA DNS record.

An encouraging overall grade

With our simplified grade, 57.4% of graded sites score A or A+, 38.3% score B and 4.3% score C. None scores F. Moving from B to A usually takes a single header (HSTS).

What about NIS2?

As of 6 October 2026, the European NIS2 directive has not yet been transposed into French law. The bill on the resilience of critical infrastructure and the strengthening of cybersecurity was adopted by the Senate in March 2025, then by a special committee of the National Assembly in September 2025; its plenary reading, scheduled for 7 October 2026, has once again been postponed. The European Commission referred France to the Court of Justice of the EU on 8 July 2026 for failure to transpose. The government has indicated that municipalities above 30,000 inhabitants would be covered directly, smaller ones through their inter-municipal body: every city in this barometer is above that threshold. The final scope and obligations will depend on the adopted text, but the settings described here are basic hygiene in any case.

Methodology Passive measurement carried out on 6 October 2026 on the official websites of the 100 most populous French municipalities (INSEE 2023 municipal populations, mainland and overseas). 99 sites measured successfully, 1 failure. Only the home page, its headers and public DNS records were read: no port scanning, no vulnerability testing, no forms. Header indicators cover the 93 home pages served normally (6 sites returned an anti-bot filtering page). Limitations: a snapshot at one date, home page only, email may use a different domain from the website, and a header being present does not guarantee an effective policy. No city is named.