How secure are Azerbaijani websites? 106 sites checked
How well are banks, universities, government bodies, news sites and online shops protected, as seen from outside?
Key findings
- The basics are in place. Of the 106 sites that opened, 100% use HTTPS and 99% are mobile-friendly. Another 5 did not open at all because of a TLS/certificate error and are not in this percentage.
- Extra layers of protection are thin. Only 14% use CSP, 42% HSTS and 47% clickjacking protection. All of these are free, a few lines of server configuration.
- E-mail protection depends on the sector. 33% of the sites have no DMARC at all and 8% only monitor. Banks, telecom operators and government do well here, while news sites, healthcare, online shops and universities lag behind: fake e-mails in their name are easy to send.
- Sectors differ a lot. The highest average score is in banks (94), the lowest in news sites (82). Among news sites, only 19% have a DMARC policy that blocks fake e-mails.
- Descriptions for Google. Only 39% have a meta description of a useful length.
Share of sites that pass each check
Out of 106 sites; the weakest checks are at the top. SPF and DMARC are counted for sites on their own domain.
Grade distribution
A is 90 and above, B 75+, C 60+, D 40+, F below 40. Scores and grades use the previous scale; the same sites may score lower in a check today.
- A4341%
- B5754%
- C66%
- D00%
- F00%
By sector
Average score and the share of sites with each key protection. In sectors with few sites, read the percentages with care.
| Sector | Sites | Avg. score | HSTS | CSP | DMARC (enforced) | SPF |
|---|---|---|---|---|---|---|
| Banks | 16 | 94 | 75% | 31% | 100% | 100% |
| Telecom operators | 6 | 90 | 33% | 0% | 100% | 100% |
| Universities | 15 | 89 | 40% | 27% | 47% | 93% |
| Government | 22 | 87 | 27% | 9% | 95% | 95% |
| Online shops | 14 | 87 | 36% | 14% | 36% | 100% |
| Healthcare | 12 | 84 | 42% | 0% | 25% | 83% |
| News sites | 21 | 82 | 38% | 10% | 19% | 57% |
| All | 106 | 87 | 42% | 14% | 58% | 88% |
How does your site do?
Run the same check for free in 30 seconds and see how to fix each problem.
How it was checked
On 1 November 2026, 139 public Azerbaijani websites (banks, universities, government, news sites, online shops, telecom operators, healthcare) were checked with SaytYoxla. For each site only the home page was opened once and the certificate and two public DNS records (SPF, DMARC) were read; nothing was probed or attacked. 18 sites that block automated checks and 15 that did not open (5 of them with a TLS/certificate error) were left out; the results cover the remaining 106. This is not a full security audit: it only covers settings visible from outside. Individual sites are not named.