Culture

Business websites

.com

Brand protection

Online stores

Hosting

Data privacy

Policy-making

Registrars

Investing & reporting

Internet Basics Series

How to

People

Cybersecurity

Web trends

Tech news

Security

COVID-19

Technology detection

domains

Software

WordPress

TLDs

GDPR

Veronika Vilgis

Although the pandemic might have been the peak for online stores, e-commerce is far from a fading trend. It’s the way we shop online is simply evolving. Influencer-led commerce, live shopping streams on platforms like TikTok and Instagram, and the increasing dominance of online marketplaces have all become powerful engines of digital retail. Major players such as Amazon and Walmart continue to expand their platforms into broader ecosystems, allowing third-party sellers to reach global audiences while capturing a slice of online spending.

To understand where e-commerce stands today, we analyzed global data over the past 10 months, focusing on the number of active e-commerce websites across regions. The overall number of global e-commerce sites has remained relatively stable in the past seven months. Figure 1 shows newly detected online stores (shown in blue) and the number of online stores that disappeared in that month (orange). The dark line shows the overall change—an amount close to zero in most months. But stability at the surface masks important regional shifts that reflect deeper economic, technological, and consumer behavior trends.

The monthly growth in the number of e-commerce websites across continents, measured relative to June 2024, reveals varied regional dynamics (see Figure 2). North America and Europe experienced moderate increases, perhaps reflecting an already mature digital commerce ecosystem.

Asia, on the other hand, showed the most pronounced growth, with figures peaking at nearly 28% above the June baseline, signaling an uptake of online retail infrastructure. This surge highlights the region's accelerating digital adoption, driven by factors such as rising digital payment solutions and the expansion of local logistics networks. Asia is home to over 60% of the global population, and its digital economy is expected to grow rapidly in the coming years, particularly in Southeast Asia and India.

South America's trajectory was more volatile, with some months showing a slight contraction, likely influenced by regional market fluctuations or infrastructural limitations. Oceania maintained relatively consistent gains, gradually increasing by over 11% by March 2025. These trends illustrate how different global regions are engaging with e-commerce at varying speeds, shaped by local economic conditions, digital readiness, and consumer demand.

Next, we take a closer look at the data country by country. In Figure 3, you can see the top 10 countries with the fastest-growing number of e-commerce websites, as well as the lowest 10 countries. The top countries are United Arab Emirates (AE),  Saudi Arabia (SA), Egypt (EG), Philippines (PH), India (IN), Indonesia (ID), Peru (PE), Turkey (TR), Albania (AL), and Bosnia and Herzegovina (BA).

Of these top 10, many are emerging or frontier markets where digital commerce is still expanding rapidly. In the Middle East, governments have prioritized digital transformation. The UAE and Saudi Arabia have launched initiatives like Vision 2030, investing in infrastructure, fintech, and logistics to support e-commerce. Egypt has also seen a boom in mobile commerce, supported by improved connectivity and financial inclusion programs.

India and Indonesia, two of Asia’s largest economies, continue to benefit from expanding internet access, youthful populations, and growing digital payment adoption. Platforms like Flipkart, Shopee, and Tokopedia are reshaping shopping habits across the region. Similarly, countries like the Philippines and Turkey are seeing increased digital entrepreneurship, where small businesses are turning to e-commerce platforms to reach both local and international consumers.

Declining e-commerce activity: countries losing ground

Not all countries are seeing a digital retail boom. The countries with the largest relative decline in active e-commerce websites are Ukraine (UA), Singapore (SG), Brazil (BR), the Netherlands (NL), Canada (CA), Argentina (AR), Malaysia (MY), Germany (DE) and Russia (RU). Finland (FI) is among the bottom 10, but actually shows a 1% growth over the past 10 months.

Several factors help explain these downturns. Ukraine continues to face wartime disruptions, making it difficult for small businesses to maintain operations online. Russia has seen tightening internet controls and sanctions, which have affected access to global platforms and payments. 

In countries like Germany and the Netherlands, where large retailers dominate, smaller e-commerce players may struggle with competition and rising operational costs. Argentina and Brazil have experienced macroeconomic challenges, including inflation and currency devaluation, making online retail difficult to sustain for small businesses. 

Malaysia has faced regulatory shifts and increased market saturation, leading to consolidation among online sellers. Singapore, despite being a tech hub, is a small market with limited expansion space, and its e-commerce growth may be stabilizing after years of early adoption. 

E-commerce isn’t going anywhere, but it is changing. While the global number of e-commerce websites has remained stable, growth has clearly shifted toward emerging markets, particularly in Asia and parts of the Middle East. Mature markets like North America and Europe seem to be stagnating, while others are seeing contractions influenced by war, economic instability, or market saturation.

As digital infrastructure continues to improve and consumer behaviors evolve, the shape of global e-commerce will keep adapting. What’s clear is that while the growth of the pandemic may have subsided, the momentum behind online retail remains —just more nuanced and regionally diverse.

Business Information

E-commerce saw explosive growth during the COVID-19 pandemic, with brick-and-mortar stores closing and digital platforms becoming a lifeline for both businesses and consumers. But, as we revealed in a previous analysis, the surge came with a caveat: many of the online stores created in 2020 and 2021 proved to be short-lived. Within just two years, a significant portion of these new digital storefronts had gone offline, unable to sustain operations, customer interest, or both.

Analyzing global e-commerce trends: top growing and declining markets

Eelco Blaauw

A Shopping Cart System (SCS) is e-commerce software that enables users to select products or services online, store them in a virtual cart, and complete their purchase through a secure checkout process. Beyond product selection, modern SCS platforms handle pricing, taxes, shipping options, and payment processing, making them an essential part of a functional online store.

With over 250 different SCS platforms detected across 24 million active websites, our structured web data shows that the market is vast and highly competitive. Each solution caters to different business models, technical preferences, and customer needs, ranging from simple plug-and-play systems for small businesses to fully customizable platforms used by large enterprises.

Despite the wide range of options, the landscape is dominated by just a handful of platforms. As shown in Figure 1, WooCommerce leads the market by a significant margin, powering 33.2% of online stores. WIX eCommerce follows with 19.3%, and Squarespace Commerce holds 17.9% of the market. Shopify remains a major player focused on dedicated e-commerce, with a 9.8% share.

Smaller platforms still carve out their niche, however. Ecwid accounts for 3.5%, while Jimdo, PrestaShop, and Square Online each serve just 1% or less of the market. Rounding out the top ten is GoDaddy GoCentral Online Store, with just 0.6% share, and the various other providers that constitute the remaining 13.3%.

These numbers illustrate how fragmented and competitive the shopping cart system market is. Choosing the right solution can significantly impact your store’s performance, scalability, and user experience, making it a critical decision for any e-commerce business.

Just like WordPress dominates the CMS landscape, WooCommerce is the clear leader in the SCS market. As a plugin built for WordPress—and owned by Automattic, the same company behind WordPress—WooCommerce benefits from its deep integration within the world’s most popular CMS. This connection makes it the go-to choice for small and medium-sized businesses seeking flexibility, control, and a vast ecosystem of plugins and themes.

WooCommerce has proven itself a rock-solid foundation for e-commerce websites: it’s steady growth over time, as seen in Figure 2, is a testament to its lasting popularity and continued relevance in an increasingly competitive market. The sharp increase visible around mid-2023 is not due to a sudden market shift, but rather the result of a major improvement in our detection technology. By enhancing our fingerprint matching and optimizing detection methods, we gained a much clearer picture of WooCommerce’s true presence on the internet.

Since that update, WooCommerce’s growth trend has stabilized, consistently holding its position as the leading SCS. This stability underscores its role as the default choice for businesses building e-commerce stores on WordPress, a position that, much like WordPress in the CMS market, remains unchallenged for now.

Hosted vs. Self-Hosted: choosing the right SCS

One of the biggest decisions businesses face when selecting a Shopping Cart System is whether to choose a hosted or a self-hosted solution. Both approaches come with distinct advantages and trade-offs, largely depending on a company’s technical expertise, customization needs, and desire for control.

Self-hosted SCS platforms like WooCommerce and Magento are installed on your own web server, giving you full control over customization, features, and data. This flexibility allows businesses to fine-tune every aspect of their store, from design to functionality. However, self-hosting also means taking on responsibility for server maintenance, security, updates, and scaling as your business grows. This can make it more demanding for less technical users.

On the other hand, hosted SCS solutions like Shopify, WIX eCommerce, and Squarespace Commerce are fully managed by the provider. These platforms offer convenience and ease of use, handling hosting, security, and updates, so online merchants can focus on running their store without worrying about the technical details. The trade-off is limited flexibility and higher long-term costs due to subscription-based pricing and add-on fees.

Figure 3 shows how these two groups have evolved. WooCommerce, the leading self-hosted platform, displays steady growth, reflecting its strong position among businesses seeking control and scalability. Magento, another self-hosted option, shows a clear decline of more than 85%, highlighting how its complexity and steep learning curve have pushed many users toward more user-friendly alternatives.

In contrast, hosted platforms like Shopify have grown consistently, with Shopify now showing a 66% increase compared to the starting point. This trend reflects the growing demand for low-maintenance, all-in-one e-commerce solutions. WIX eCommerce and Squarespace Commerce were recently added to our detection capabilities, but their current market share suggests these platforms are also attracting businesses that prioritize ease of use over technical complexity.

Ultimately, the choice between self-hosted and hosted SCS solutions depends on the needs of the business. Those seeking full control, advanced customization, and integration flexibility may favor WooCommerce. Meanwhile, entrepreneurs looking for simplicity, speed, and a fully managed service often turn to Shopify or other hosted alternatives.

The shifting landscape of shopping cart systems

While self-hosted solutions like WooCommerce and Magento have long been popular choices for businesses seeking flexibility and control, our data reveals a noticeable trend toward hosted platforms such as Shopify, WIX eCommerce, and Squarespace Commerce. These fully managed solutions appeal to businesses that prioritize ease of use, built-in support, and predictable monthly costs over technical complexity.

Whether this trend continues will largely depend on how businesses balance convenience against control. For now, WooCommerce’s steady growth signals the enduring appeal of self-hosted solutions, especially for those who value customization and ownership. Still, the consistent rise of hosted platforms hints at a shifting preference, particularly among new businesses looking to get online quickly without the overhead of managing their own infrastructure.

Our data already reflects this shift, suggesting that as the e-commerce landscape matures, the demand for simple, scalable, and low-maintenance solutions will only grow.

Tech

Ever wonder about the magic behind that ‘Add to Cart’ button? Maybe we take it for granted, but the humble Shopping Cart System (SCS) powers the seamless experience of buying multiple items online with one click: one price, one shipping calculation, one transaction. Read on to dive into the data behind digital carts.

From control to convenience: how the market for shopping cart systems is evolving

Loura Kruger-Zwart

Squarespace is one of today’s most popular website management platforms. From what started as a blog hosting project in 2003, the company has grown beyond its core as a no-code, D.I.Y., drag-and-drop website builder. These days, it delivers innovative features like domain name services, analytics capabilities, e-commerce tools, and AI integrations. 

Content management systems (CMSs) are the part of the digital ecosystem that helps individuals, organizations, and businesses structure their online content. WordPress is a hugely popular CMS, dominating the industry and accounting for almost 60% of all active websites (Figure 1). This is followed by Wix, but Squarespace has staked its claim in the top 3 of CMSs used globally. 

The popularity and online adoption of Squarespace as a content management system has been strong and steady: in Figure 2 we see that its presence on the web as a CMS has close to doubled in the past four years. Since early 2024, especially, the growth of Squarespace usage has been significant. 

Templates are to Squarespace what themes are to WordPress: the starting point of shaping and building a new website. Selecting the right one for the purpose of a site shapes how visitors interact with it, what impressions it leaves, and what capabilities it has. It can be a delicate balance: too whimsical, and visitors might not take the brand seriously, or too formal and casual visitors might be alienated. 

The most recent Squarespace iteration is Squarespace 7.1, released in 2020. It brought with it a big change—this edition doesn’t operate in the same way that the templates before it did. Pre-7.1 templates differed from each other in that they offered different functionalities: some were more appropriate for online stores since e-commerce features were built in, while others may have worked better as portfolios because of design, customizability, or contact options. These days, all templates are functionally the same, differing only in style and layout. 

This said, not every Squarespace website has made the switch yet. As seen in Figure 3, over 33% are not yet using 7.1, despite its improved flexibility and speed. Squarespace continues to support sites using the earlier templates, but only 7.1 is receiving updates and upgrades in the future. Website owners that still use 7.0 templates may hesitate to change because for many, it means rebuilding pages that took considerable time and effort to build in the past. Especially if they are not feeling restricted or slowed down, there’s not yet much pressure to switch.

Squarespace’s expansion: Google Domains become Squarespace Domains

Changing their template system has been part of the company’s shift to an all-in-one, comprehensive platform. Another major change has been their absorption of Google Domains. In September 2023, Squarespace acquired all domain registrations from Google Domains—including associated customer accounts—and began migrating them to become their host. Domains owners who previously logged into Google to manage their domains now were given Squarespace accounts, or if that Gmail address was already known, the domain was added to the existing account. 

Why this change? There was no official communication about it, but some speculate that the small margin on domains, combined with customer service needs, combined with low upsell opportunities (i.e., Google doesn’t offer the website building hosting plans that Squarespace or other CMSs do), were a recipe for Google wanting to move the domains along. 

The migration did not go entirely smoothly, however: according to Security Week, hackers exploited a flaw in Squarespace's domain transfer process from Google Domains, hijacking control of several cryptocurrency domains. This vulnerability allowed malicious actors to create fake accounts, just by guessing email addresses without email verification, and access the new Squarespace account before the real domain owners could. From here, they could alter DNS records and redirect visitors to malicious websites. 

The July 2024 attack affected major (crypto-related) platforms like Celer Network and Compound Finance, but Squarespace has since addressed the issue and urges users to update their settings and secure their accounts with two-factor authentication. Fortunately, the affected platforms have regained control and there are no ongoing threats.

Squarespace has continued to grow in the last years, adjusting to consumer preferences and embracing emerging technologies. From the company’s acquisition of Acuity Scheduling in 2019, to its purchase of Tock Reservations in 2021 (although it sold this again to AMEX in 2024), to its full adoption of generative AI tools in its website creation toolbox, Squarespace is determined to be the one-stop option for web needs.

The company went public in 2021, but in late 2024—after a back-and-forth of almost half a year—private equity firm Permira purchased all remaining shares and took Squarespace private again for around 7.2 billion USD. 

As explored here, our data shows that Squarespace is a mainstay in the CMS industry and a firm competitor to the domination of WordPress. Its updates and upgrades make it attractive for new clients, and the features and support it offers keep older customers happy. As Squarespace continues to add more services to its repertoire and manage its security, its growth is likely to continue. Only time (and structured web data) will tell where Squarespace ends up.

Let’s talk Squarespace: this top CMS is growing, not only in popularity but in its services and product offerings too. From blog hosting only to becoming an all-in-one platform, they’ve also recently taken on domain registering and scheduling software. What does the data tell us about the state of Squarespace? Dive into our explainer to learn more. 

The many hats of Squarespace: from blog hosting to all-in-one

Live chat tools have become indispensable for businesses aiming to enhance customer support, sales, and marketing efforts. Despite their advantages, the adoption of live chat software remains relatively low, with only around 16% of business websites globally implementing such tools. 

What are the top live chat solutions used on the web today?

Among the various live chat solutions available, WhatsApp Business has emerged as the dominant player, capturing 56.2% of the market share among websites utilizing live chat software. WhatsApp Business’s popularity stems from its wide adoption globally (Figure 2), easy integration with existing business processes, and, important for privacy, end-to-end encryption. Owned by Meta Platforms Inc., WhatsApp Business benefits from the global familiarity many users have with the WhatsApp messaging app, which further solidifies its position as a leader in the live chat market.

In the competitive landscape of live chat tools, Tawk.to holds the second position with 6.3% market share, followed closely by Facebook Messenger at 6.0%. Other notable players include giosg (5.5%), Live Chat Inc (5.0%), Zoho SalesIQ (2.6%), Tidio (2.6%), JivoChat (2.1%), and Crisp (2.1%). These solutions, while holding smaller shares, cater to specific business needs with unique features like multilingual support, AI-driven automation, real-time visitor tracking, lead scoring, and seamless CRM integrations. Meanwhile, the tools in the “Other” category accounts for 11.6% of the market and comprises another 56 unique live chat software.

Meta-owned tools dominate on e-commerce websites

When focusing specifically on online stores, the market share of WhatsApp Business remains comparably high, with 55.7% of online stores using it as their preferred live chat tool. Facebook Messenger follows second at 11.3%. Both of the Meta-owned platforms are free to use, reducing barriers to entry for micro, small and medium-sized businesses. Additionally, the familiarity of these platforms among users and business owners alike makes them accessible and easy to adopt, allowing businesses to connect with customers in a way that feels natural and intuitive.

The fastest growing live chat tools based on installation numbers in Q4 of 2024 were giosg, Chatilo, and Alive5 with 87%, 18% and 10% growth, respectively. Giosg’s AI Copilot integrates GPT-3.5 generated answers into their live chat solution and promises high security and data protection, which may be a major selling-point for businesses with complex products where an FAQ page doesn’t cut it. Chatilo is a live chat app that can be integrated with Slack; this integration makes it a useful tool to handle client and customer interactions within a company’s existing chat platform and without the need for separate software. Alive5 combines automation, AI, and human agents to assist website visitors and supports business-class SMS texting and web chat, offering a comprehensive communication solution for businesses.

Geographical adoption of WhatsApp Business

Geographically, WhatsApp Business live chat has seen widespread adoption—particularly in Asia, Europe, and Latin America—with significant usage in emerging markets like Brazil, Russia, India, and Indonesia. This global reach has contributed to its dominance in the live chat market.

Integrating live chat functionality on a website both enhances customer engagement and contributes positively to SEO performance. Features like real-time assistance, proactive engagement, and AI-driven chatbots can lead to longer site visits and improved conversion rates. These factors signal to search engines that a website provides valuable content and a positive user experience, potentially boosting its search engine rankings and, ultimately, a company’s online success.

While the adoption of live chat tools is still limited, platforms like WhatsApp Business have demonstrated significant market penetration due to their robust and accessible offerings. As the digital landscape continues to evolve, the integration of live chat and AI-driven communication tools is poised to play a crucial role in shaping customer service strategies and enhancing online user experiences. 

“Hi! How can we help you today?” Not just limited to physical stores anymore, live chat tools on websites provide quick and helpful customer service to online visitors. But with so many options, who are the leading live chat software providers, and what makes them different? Join us as we dive into the details about Meta’s market share and competitors’ distinctions. 

Top live chat tools revealed: WhatsApp Business takes the crown

There are all kinds of behind-the-scenes things going on online, including ‘secret messages’ for different kinds of website visitors. If you’ve had a look around on our blog before, you’ll know all about the humans.txt file message for crediting the humans behind a website’s creation, ads.txt for advertising protocols, and security.txt as the first stop for cybersecurity-related queries. But since the launch of a certain AI helper in November 2022, there’s been a new digital visitor on the online block: Large Language Models (LLMs) are collecting all kinds of information from the internet—about websites, companies, products and services, tips, tricks, and everything in between. But are these LLM-collected pages of information the right details from each website? How do they know which webpages have the most relevant information? 

It makes sense that website creators should be able to communicate with LLMs to make sure they’re retrieving high-quality answers, should future visitors first come in contact with their products, services, or advice via ChatGPT or another GenAI colleague. Introducing the newest website ‘secret message’: LLMs.txt.

As LLMs and crawlers traverse the web and collect information, they’re looking at the first pages of your site — they don’t know if your ‘about us’ page is more important than that obscure blog you wrote five years ago, and it certainly isn’t going to check every single page on your site either. Just as robots.txt indicates how crawlers can index by setting rules and directing to sitemaps, the point of LLMs.txt is to help an LLM find the best information about your website in the most direct way. This could be a list of prioritized pages with relevant details about your site, links to documentation, or a collection of quick points or resources. See a comprehensive example here, on an AI observability platform’s website. 

As with other kinds of .txt files, this one can also be added to your website root as a markdown file. According to llmstxt.org, it should include your website’s title and description, and perhaps some important details about your business’s products or services, if applicable. Next come the links to documentation, core information, or anything relevant you want to be sure an LLM could answer or share if asked. Keeping structured information on hand and easy to access in LLMs.txt files benefits LLMs. This allows them to easily access specific details, like software library features, corporate structures, legal information, personal CV details, product categories, or educational course offerings. Jeremy Howard of llmstxt.org writes: 

Creating a LLMs.txt on your website is not difficult and could bring many benefits, so is there any reason not to have one? On the one hand, this protocol is still very new and more or less still a proposal. Most LLMs likely aren’t scanning for it yet, which means the text might not even be seen. Not even Google has a page for LLMs.txt—but that doesn’t mean LLMs aren’t being considered. For example, Google currently sets rules for tools like ChatGPT, AnthropicAI, PerplexityBot, and Claude in its robots.txt file, as does the Guardian here. Most websites might start this way, including instructions for LLMs on a different page, rather than creating a whole new file. On the other hand, why not get ahead of the curve and do both? 

Keen to see which websites have already embraced LLMs online? Take a look at the growing list of examples here in the LLMs.txt directory.

The way we use the internet is changing: Large Language Models like ChatGPT or Claude can direct human users to websites without a search engine in the middle. But how do LLMs know what site information is actually relevant to the prompt? LLMs.txt seems to be the answer—a way to specify exactly what information LLMs and crawlers should gather and ultimately share if someone asks. Read on to find out more.

Optimizing websites for the future of search? LLMs.txt explained

These strategies include securing DNS communication with DNSSEC, email communications through SPF, DMARC and DKIM protocols, enhancing domain security by specifying HTTP headers, and incorporating a security.txt file. As we explore the technical aspects, our goal is to provide you with a comprehensive understanding of the multi-layered approach that is needed to safeguard websites. 

Domain Name System Security Extensions (DNSSEC) help protect the system that translates domain names into IP addresses, a crucial step in cybersecurity. DNSSEC adds cryptographic signatures to existing DNS records. These signatures are used to verify that the source of the DNS data is authentic, i.e., the data is coming from where it claims to be coming from and that the data has not been tampered with during transmission.

The objective of DNSSEC is to safeguard against certain types of attacks, such as man-in-the-middle attacks, wherein a user’s attempt to access a legitimate website is hijacked and redirected to a fraudulent website.

We identified just two countries where a mere half of business websites had DNSSEC enabled, namely the Czech Republic (55%) and Norway (52%). France, Estonia, and Brazil, with respective percentages of 19%, 18%, and 13%, are ranked as the third, fourth, and fifth most secure countries, with between 10% and 29% of their business websites being protected by DNSSEC. The vast majority of websites in the remaining nations are not protected. 

Enabling DNSSEC typically requires coordination between domain registrars and DNS hosting providers, indicating that many could do more to protect clients. The .no country code top-level domain (ccTLD) is known to be one of the TLDs with the highest protection through DNSSEC, and our results support this. Several countries have issued directives regarding the implementation of DNSSEC to enhance their national cybersecurity infrastructure. In Brazil, for example, the implementation of DNSSEC has been pushed to improve internet security within the country. Various initiatives within the EU, including ENISA (European Union Agency for Cybersecurity), have advocated for the implementation of DNSSEC. However, due to the absence of an EU-wide directive, there are significant disparities among EU nations when it comes to the implementation of DNSSEC.

Prevent phishing and spam with three key DNS records

Phishing and email spam are the most common ways for hackers to enter a network. It takes just one employee clicking on a malicious link or email attachment to compromise an entire enterprise with ransomware. To prevent a domain from being abused for phishing, just three key DNS records need to be set properly. Those records are SPF, DKIM, and DMARC. The three can help ensure the legitimacy of emails, making it more challenging for attackers to impersonate trusted senders. 

The Sender Policy Framework (SPF) enables domain owners to specify which mail servers are authorized to send emails on behalf of their domain. 

Domain Keys Identified Mail (DKIM) provides a way for an email to be signed with a digital signature, which is then verified by the recipient using the sender's public key published in the DNS. This ensures the email's content has not been tampered with during transit and that the email genuinely originates from the specified domain, making it harder for phishers to forge emails. 

Domain-based Message Authentication, Reporting, and Conformance (DMARC) allows domain owners to specify how receiving mail servers should handle emails that fail SPF or DKIM checks. It also specifies an address to send reports on pass/fail statistics, providing visibility into attempts to spoof or forge emails. DMARC helps prevent phishing by ensuring that only authenticated emails are delivered to users and by informing domain owners of potential abuse.

Most business websites in the countries we researched specify SPF, ranging from 64% in Norway to 86% in South Africa. The Czech Republic is the online nation with less than 50% of business websites protected with SPF.  DMARC coverage ranges from 8% in Mexico to 24% in Norway, indicating that a lot more could be done to improve the coverage of the DMARC framework. DKIM is not shown in Figure 6 due to its very limited coverage. In no country did the coverage exceed 0.5%. Although it appears that the majority of business websites have taken at least one measure to prevent phishing attacks, a significant proportion of domains have yet to utilize all available security measures to prevent the misuse of email fraud.

How HTTP headers play a vital role in website security 

Hypertext Transfer Protocol (HTTP) headers play an important role in the secure and efficient operation of web communications by enabling browsers and servers to exchange information beyond the content of the web page itself. They are used for various purposes, one of which is to specify security policies. For this research, we examined five security-related HTTP headers (X-XXS-protection, X-Frame-Options, Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options). The technical details of these headers are beyond the scope of this article, but each of these headers can add another layer of security to a website. Figure 7 shows the percentage of business websites per country that specify between one and five headers. 

In general, the data indicates that well over two-thirds of business websites could significantly enhance their security by defining one or more security-related HTTP headers. In many countries, between 10% and 20% of business websites include at least one or two security-related HTTP headers, but, less than 5% specify four or five of these. Overall, Norway, Indonesia, and the Philippines possess the highest coverage, whereas South Africa, Spain, and Turkey are the lowest ranked. The large share of business websites in all countries that do not utilize these extra layers of protection suggests more could be done to educate domain owners about the utility of specifying HTTP headers. This would provide them with the necessary ‘how to’ to implement them.

Security.txt offers direct contact methods for reporting

Before concluding this two-part series on business website security and naming a winner, let’s take a look at a lesser known text file called security.txt. This file is a standardized method for websites to define security policies. It's typically placed in the website's root directory, providing contact information for reporting security vulnerabilities. The objective of security.txt is to facilitate the responsible disclosure of potential security issues. 

Last year, the Dutch government mandated the implementation of the file on any websites maintained by public institutions. This is not a requirement in most countries, but it’s still a good idea. Who wouldn’t want to be informed if someone discovers a security gap on a website or in your digital product?

Surprisingly, only one country out of the thirteen under investigation had a mentionable percentage of sites with a security.txt available. 6.5% of Czech business websites have such a file. This percentage is relatively high, in comparison we detected coverage of 5% on Dutch business websites where all government websites are required to implement one. For all other countries, the share was less than 0.6%. Having a security.txt is certainly not a strong tool against major cyber threats, but being alerted to vulnerabilities can’t hurt and may in the best cases mitigate actual breaches before any actual damage is done.

No country boasts a high level of secure websites

Having examined fundamental and less well-known security measures to reduce website vulnerabilities, it's possible to draw a couple of conclusions. First, no country is exceptionally well-secured. Although business websites have some security measures set in place, they are often limited to just a single factor. For instance, instead of specifying SPF, DKIM, and DMARC, just one of them is covered. 

Furthermore, not a single nation performs well on all security indicators. Norway may have performed well in several areas, but is among the worst when it comes to fraudulent online stores. Equally, the Czech Republic seems quite secure in most measures, but SSL coverage is lower than in other countries, as is phishing protection. All researched countries would benefit from significant security improvements. 

Our overall winner is Norway, followed by Estonia and the Czech Republic (see Figure 8). But It would be incorrect to assume that this is representative of other European countries. Spain, ranking second-lowest, is a sure indicator of that. Following the European winners, the three Latin American countries included in this research rank 4th, 5th and 6th. Countries from Asia come in at lower overall ranks.

With SSL certificates being a notable exception, there is still a lot of room for corporate websites across the globe to enhance their security measures. An approach that takes multiple measures into account, from improving DNS records to HTML headers and SSL, can create a safer internet for all.

Website security is a responsibility for website owners and governments

The responsibility of securing a website, however, should not solely rest with business owners. Governments and organizations have a responsibility to fulfill, as do registrars and hosting providers. The state of business website security is a glaring issue that demands immediate and collective action. Web data is a potent ally in this battle, but it requires the support and active participation of governments and organizations to translate insights into tangible action. The issue of cybersecurity is a concern that affects all individuals and has the potential to impact beyond the digital realm. Therefore, it is imperative that we collectively strive to enhance the security of the web. 

In our previous post, we examined fundamental measures for website security and their implementation on business websites in diverse countries. In this second part, we build on these basics discussed in our first post, examining more sophisticated strategies that can be implemented to defend websites against evolving cyber threats.

Beyond the basics: more data on the state of business website security

Cyber insecurity bears huge economic risks, demanding policies and guidelines to safeguard against this increasing threat. Business websites are an easy target, especially those of small and medium-sized companies that may not have the necessary sources and knowledge to keep on top of security measures. However, the security of a business website is a vital element of a company's credibility and survival. Poor security can lead to inequity, giving bigger companies an advantage over small ones, according to Forbes. Below, we look at a select number of countries and check the security measures in place on national business and e-commerce websites. We’ll reveal that many are woefully unprepared against cyber threats. This lax security endangers sensitive information and undermines consumer trust and business continuity. 

We dive into the essentials of web security in this first installment of a two-part series, asking how often companies use outdated software, forget about SSL certificate implementation, and leave unnecessary ports open. We'll also touch upon the growing concern of fraudulent online stores, which not only pose a significant threat to consumers but also to established brands. In the second part, we’ll look at more advanced security measures, such as phishing prevention, security-enhancing HTTP headers and the implementation of a security.txt file. 

Ransomware is one of the most common cyber threats to organizations and can cause significant financial damage. Next to that, it negatively influences a company's reputation, consumer trust, and investor relationships. According to IBM, the global average cost of a data breach in 2023 was USD 4.45 million, a 15% increase over 3 years.

Website security plays a crucial role in reducing risks. The 2017 Equifax data breach, one of the most significant and far-reaching cybersecurity incidents to date, was due to a vulnerability in a web application framework. This breach exposed sensitive data of about 147 million consumers and had far-reaching repercussions, including lawsuits, a drop in stock price, and the resignation of its CEO.

In light of heightened political tension around the world, countries and international organizations have implemented policies or national strategies to improve cybersecurity. These strategies are often part of broader efforts to protect national infrastructure, businesses, and citizens from cyber threats.

But just how effective are these strategies, and how well are businesses implementing basic and more advanced security measures? Below we’ll focus on the basic but crucial aspects of website security. We will examine the state of business, including e-commerce websites, in 13 selected countries. 

PHP (Hypertext Preprocessor) is an open-source scripting language for web development. PHP plays a pivotal role in website management and maintenance due to its scalability, ease of use, and compatibility with numerous web servers and operating systems. New PHP releases are fully supported for two years. After the two years, support is continued only for critical security issues for an additional 12 months. Then, that version no longer is supported. 

Unsupported PHP versions can pose significant risks. They are vulnerable to exploitation by cyberattackers, leading to potential data breaches and website compromise. 

In our analysis of 13 countries, the share of business websites with unsupported PHP versions ranges from 8% to 29%. Nearly a third of Turkish, a quarter of French and a fifth of Spanish business websites are operating on PHP versions that no longer receive security updates. Norway “wins” here, ranking as the country with the lowest share (8%) of vulnerable business websites.  

For this research, we looked at unsupported PHP branches 4 to 7.4, but 8.0 is also no longer supported as of 26 November 2023, meaning that the true share per country is likely to be even higher. For website administrators, it is crucial to regularly check for new releases and ensure software is kept up-to-date. Hosting providers also have a role to play, alerting clients when older versions no longer receive security patches and assisting with migration to new releases.

SSL certificates at the basis of security

An SSL certificate provides fundamental protection for a website by ensuring that all communication with an external browser is encrypted. Obtaining one is fairly straightforward and is free for the most basic version. Therefore, there is no rationale for not having a certificate associated with a website.  

In our sample, the Czech Republic (11%) has the highest share of business websites with no SSL certificate, followed by Spain (5%). These two also have the highest share of invalid certificates, 9% and 5% respectively. Only Turkey has a larger share; here, 10% of all business websites have an invalid certificate. The overall winner for SSL protection is Indonesia, with only a 4% share of websites with either an invalid or no certificate.

Too many open ports lead to vulnerabilities

The term 'open port' refers to a network port that is configured to accept data packets. A website needs certain open ports to receive traffic. However, open ports can be a significant vulnerability if not properly managed. The more open ports there are, the higher the risk of someone sneaking in where they shouldn't. 

Figure 3 shows the median number of open ports for business websites for each country, meaning that exactly 50% of all websites fall below and 50% above that number. Norway ranks safest with a median of only two open ports. On the other end of the scale, South Africa and Chile have a median of 11 open ports, signalling a greater vulnerability among businesses in these countries. 

Similar to the safeguarding physical doors against unauthorized access, it is imperative to protect open ports against cyber criminals. This involves implementing firewalls, keeping software up to date, and only opening up ports when necessary. Open ports without proper security measures invite attackers to gain access to sensitive data, execute malicious code, or disrupt services. That is why regular monitoring and management of open ports are essential components of effective network security.

Before we move to more advanced security measures in the second part of this 2-part analysis of business website security, let’s take a look at a more applied part of security: fake webshops. These online stores typically sell counterfeit merchandise or offer products at incredibly low prices, luring consumers to spend without ever providing the product. 

Our proprietary Trust Grade provides an indication of the level of credibility an online store possesses. The scale ranges from A to F, wherein A signifies a high level of trustworthiness. A D, E, or F rating indicates less trustworthiness, with scores of E and F almost certainly indicating a fraudulent online shopping portal. Figure 4 shows the highest percentage of dubious online stores are found in Norway (4.8%), followed by Estonia (4.6%) and Indonesia (3.2%). The countries with the lowest share among e-commerce sites are South Africa (1.3%), Chile (0.6%) and Brazil (0.2%). Interestingly, while Norway scored relatively high on other security measures, their strong economy perhaps attracts a more significant number of fraudulent web stores. 

Tracking suspicious online stores and taking them down as quickly as possible to minimize damage to consumers and brand reputation is perhaps a task for national law enforcement. Similar to scams in the physical world, consumers need protection to make the web safer for all.

In this first part on business website security in a select number of countries, we discovered important differences in the security measures implemented by business websites across the globe. Strikingly, the share of business websites that run unsupported PHP versions is relatively high. Additionally, in some countries a relatively large number of open ports on business websites suggest more could be done to tighten security. While open ports are necessary, Norway is leading the pack and shows that having the bare minimum of open ports is manageable for most businesses. On the positive side, SSL coverage is relatively high across all countries. 

In the next part, we’ll look at additional safety measures and how well these are implemented on business sites in these same 13 countries.

Download the full Global Cybersecurity Outlook 2024 (pdf) from the World Economic Forum here.

In their 2024 Global Risks Report, the World Economic Forum ranks cyber insecurity as the 4th biggest short-term threat and predicts that it remains a major risk throughout the next ten years. To be better prepared, it’s crucial to understand the current state of information security. We took a look at the state of security of websites in 13 countries around the globe, to get a more in-depth understanding of how well websites are protected. That led to some alarming and surprising results, which you'll learn about further on in this blog.

The alarming state of business website security across countries

Tim Kreutz

In the 2021/2022 academic year, 40 percent of students who enrolled in their first year at a Dutch university, came from abroad. To grow its highly educated workforce and attract workers with specialist skill sets from outside the European Union, the Dutch government offers the Highly Skilled Migrant Program. 

Highly Skilled Migrant program offers visas

Through this program, companies can function as visa sponsors for migrants, offering them a Dutch residence permit with an accelerated application procedure. The Dutch Statistic Netherlands Bureau CBS reports that at the end of 2021, the highly skilled migrant scheme was the most used migration program by the 87 thousand labor migrants from outside the EU/EFTA zone currently working in the Netherlands (figure 1).

The Public Register Recognized Sponsors is a list of organizations that offer Dutch visa sponsorship under the Highly Skilled Migrant program. The list currently contains 10,087 company names and their Chamber of Commerce registration number (KVK-nummer in this Dutch example), but lacks further information (see Figure 2). 

This lack of information makes it hard for Non-EU citizens applying for a job in the Netherlands to find relevant positions. Information such as website, branch, location of (main) office and contact details is currently missing from the register, but is vital for jobseekers in their job search. 

Dataprovider.com's web data is an out-of-the-box solution for enriching open data, such as this public register. To give an example of how our web data can be used, we enriched this public register of visa sponsors with information that is relevant for applicants from outside the EU to find positions that are suitable to their interest and field of expertise. 

When you have only snippets of information, such as a company name or a Business Registry Number, we can match it to our database of websites and supplement it with relevant context for more than 200 data points.

In the case of the Highly Skilled Migrants program, we want to add relevant data to all visa sponsors, such as a website address, location information, (region, city, and address), branch information (Standard Industrial Classification or SIC) and extracted keywords. Without any refining, we directly matched roughly 33% of the company names in the register. The hardest fields to find were company address and email address (25% and 24% respectively), and the easiest were hostname and SIC-code (36% and 34%) (see figure 3).

The preliminary results indicate that some company names are more challenging to match to our database. To improve the number of matches, we clean up the company names in the register. We remove the mention of the legal form in company names (the Dutch BV is comparable to an LLC and N.V. is similar to an Inc). Matching the names without these abbreviations may provide better results. As an extra step, we remove common abbreviations from the names in the register and attempt to match these alternative versions of the names. The improved results are listed in Figure 3. 

The enriched dataset contains 2,225 rows with detailed company information. Download this PDF with all the information we found and added. Using this file, it's easy to find, for example, legal companies in Amsterdam, navigate to their website and look for vacancies. Alternatively, you can query the keywords field and seek companies working with, for example, ChatGPT, and contact them directly at the extracted email address.

Have a dataset you would like to enrich? Contact us at info@dataprovider.com, and we will set you up with a free demo.

The Netherlands is a knowledge-based economy. With eight Dutch universities ranked in the top 100 of the Times World University Rating in 2023, it doesn't come as a surprise that Dutch universities are popular among students from other countries. 

Enriching the Dutch public register of visa sponsors with detailed company information

Privacy laws have a significant impact on society. People are better protected against organizations misusing their personal information. And on the other hand, it has an impact on businesses and governments who are limited in how they work, and it comes with costs as they have to spend a lot of money on legal advice and build privacy-friendly systems.

Since the implementation of GDPR, many other countries have followed suit and implemented their own privacy laws to protect the privacy rights of their citizens. 

Here are a few examples of other countries that followed suit.

China: China's Cybersecurity Law (CSL) is a comprehensive privacy law that regulates the collection, use and storage of personal data by both domestic and foreign companies operating in China.

Canada: The Personal Information Protection and Electronic Documents Act (PIPEDA) is a federal privacy law that governs the collection, use and disclosure of personal information by private sector organizations.

Japan: The Act on the Protection of Personal Information (APPI) is a comprehensive privacy law that regulates the handling of personal information by both public and private entities.

South Korea: The Personal Information Protection Act (PIPA) governs the collection, use and disclosure of personal information by public and private entities.

Brazil: The Brazilian General Data Protection Law (LGPD) governs the collection, use and processing of personal data by both public and private entities.

Companies and governments often communicate about these laws on their websites. In some countries, it is even mandatory to include a privacy policy on the website. Let’s have a look at some European countries and how many websites mention the GDPR or a national equivalent. We focus specifically on business and e-commerce websites as these more frequently collect personal identifiable information (PII) than, for example, a personal website or a blog. Figure 1 shows the percentage of business websites per country that mention a data protection law on their website. The country with the highest percentage of business websites that mention data protection laws is Germany. Here, 41% of business websites reference either the GDPR or the German Datenschutz-Grundverordnung (DSGVO). Austria follows suit after Germany with 37%, Spain comes third with 31% of business websites mentioning data protection. In our sample of thirteen countries, the Netherlands, Finland and Poland have the lowest share: less than 10% of business websites reference data protection regulation, despite all three countries implementing their own legislation.

According to the German data protection law, everyone who collects, transmits, uses or processes personal data through their websites must publish a data protection declaration. This would suggest that approximately 59% of German business and e-commerce sites don’t handle personal information, and therefore, don’t see a need to publish a privacy policy. We dug a little deeper into our data and looked at German business and e-commerce sites that have a feature on their website, such as “login”, “subscribe”, “book”, “register”, or have a shopping cart system and payment providers. These are all features that suggest PPI is being collected. Among these 610,162 websites, 86% have a data protection section on their website, mention data protection or the DSGVO. This indicates that around 14% of business websites that collect personal information may not comply with the law. Having said that, the absence of a published privacy policy on the website doesn't necessarily mean that any PII collected is treated irresponsibly.

Let’s have a look across the pond. The United States don’t have a federal law that designates countrywide rules regarding privacy policies. However, some states have regulations in place. The California Online Privacy Protection Act (CalOPPA) introduced in 2003 requires all commercial websites that collect PII of California residents to post a clearly visible privacy policy that complies with the regulatory requirements. CalOPPA applies as long as the website is accessible by California residents — in other words any website accessible from California, even if it’s not located there. The Act also has a section on rules regarding children. If products or services target children, the Children’s Online Privacy Protection Act (COPPA) comes into play. If a website is directed to, or collects PII from children under the age of 13, parental consent must be sought. Failing to comply with COPPA can be expensive, as was shown by the 5.7 million settlement paid by Musica.ly (now known as TikTok) in 2019 in response to violations.

In Figure 2, we show a map of all websites that mention the California Consumer Privacy Act. As you can see, many websites outside of California mention the Act on their website, likely because they are doing business with California residents. But let’s have a look at the proportion of websites in California that mention the CCPA. Only around 4% of websites mention the actual Act. In contrast, the number of Californian business sites that have a privacy policy is much larger (35%). However, overall the percentage is still surprisingly low. 

Companies that don’t publish privacy statements or legal disclaimers about how they protect their clients PII risk hefty fines and the loss of trust from consumers. The largest fine to date for GDPR violations was issued to Amazon. Inc for €746 million, not for failing to publish a privacy policy but for not being transparent about the collection of information from consumers. Nowadays, there are plenty of free sources where you can find prefabricated Privacy Statements. As a website owner, you can modify the statement  to comply with all the countries’ legislation that you are planning to do business with. Obviously, if you do have a statement, you should also ensure that you really do comply with what you state and protect your clients’ data.

Public Sector

The General Data Protection Regulation (GDPR) is a privacy law that has had a significant impact on the way businesses around the world handle personal data. The GDPR sets strict guidelines for the collection, processing and storage of personal data of EU citizens, and it applies to any organization that handles such data, regardless of their location.

What is the state of privacy laws on business websites?

E-commerce has fundamentally transformed the way people shop, and the pandemic has greatly accelerated this trend. When was the last time you bought something online? According to a global survey of internet users, 58% reported purchasing a product or service online in the previous week (Commerce 2022, GWI). 

How payment service providers made online shopping easy

In the early stages of e-commerce — and still common today in some developing countries — businesses selling online had to rely on traditional payment methods like cash on pick-up, bank transfers, checks or money orders, which were often slow and cumbersome. The first e-commerce transaction took place in the early 1990s, although accounts differ on whether the purchased product was a Sting CD or a pepperoni and mushroom pizza from Pizza Hut. As online shopping became more popular, a growing need for faster and more convenient payment options emerged. In 1998 PayPal was founded and launched its platform to transfer money only a year later. Since then, the number of payment platforms has mushroomed, and sellers today can choose from a vast variety of PSPs.

Payment providers offer a payment gateway, which is the technology that facilitates the transfer of money between a buyer and a seller. Payment gateways are generally integrated with various payment methods, including credit cards, debit cards and online payment systems like PayPal. This means that customers can use their preferred payment method to make purchases, which makes an online store more accessible and attractive to a wider range of consumers.

In Figure 1 (top section), you’ll see an example of available payment methods offered by an online shop. If you shop online regularly, this should be a familiar sight. It is very easy to spot the different payment options. What is a lot less common to see, however, is who is handling the payments. In the lower part of Figure 1, you can see an example of a Payment Service Provider (Worldline), which is a lot less noticeable than the payment methods.  In most cases, consumers will not be aware of who handles the transactions. To find that information, consumers would have to scrutinize a website's privacy notice or terms and conditions. (e.g., here WorldPay is mentioned). 

One platform with a range of payment options

PSPs play a critical role in e-commerce by providing secure and convenient payment processing solutions. Some charge a flat fee per transaction, while others charge a percentage of the transaction amount. A good payment platform offers a range of payment methods and integration options, making it easy for businesses to accept payments from local as well as international customers.

Some of the most common payment methods include credit and debit cards, e-wallets, mobile payments, bank transfers and more. While many of these payment methods are globally accepted, there are numerous local payment methods that are specific to a country or region. In Figure 2, we show the Top 10 payment methods based on their share among websites globally. As you can see, the majority are global brands, but in ninth place we encounter JCB, which stands for Japan Credit Bureau and refers to a Japanese credit card. The Brazilian Boleto Bancario, a voucher-based payment method, lands in tenth place.

One important thing to note is that sometimes a payment method can also be a provider. PayPal is a good example that is both a payment method and a payment provider with it’s own payment processing platform. If you look back at Figure 1, you’ll also see Klarna and Clearpay (Afterpay) among the accepted methods, but these two companies offer their own payment gateways and have become famous for providing Buy Now Pay Later (BNPL) services, which allow consumers to make purchases and pay for them in instalments over time, usually with no interest.

PayPal, Visa and Mastercard are dominant globally

Lastly, while there are local variations in payment methods overall, the dominant payment methods are the same across the world, with PayPal, Visa and Mastercard coming out on top in most regions. This is, however, quite different when we look at PSPs, where we see a lot more variation across regions and countries. In Figure 3, we show the top three payment providers based on share of websites by region. 

Online payments have certainly come a long way since the early days of e-commerce, and they continue to evolve and adapt to the changing needs of businesses and consumers. With their secure and convenient payment processing solutions, value-added services, and advanced analytics tools, PSPs are an indispensable part of the e-commerce ecosystem. 

Interested in a more in-depth look at PSPs? Download our Industry Report here and don't forget to join our webinar on leveraging web data for PSPs here.

Last week we published our first Industry report on payment service providers (PSPs) — a good reason to share a bit of background on PSPs and online payment methods with you. After all, they play a crucial role in the success of e-commerce.

Payment service providers: the driving force behind e-commerce

 In fact, in the first four months of the pandemic (Feb 2020 - May 2020), we see a 151% increase globally in the number of newly discovered e-commerce websites compared with the same period in 2019 and in line with reports from individual countries. 

Follow us

Questions?

Business websites

Payment service providers: the driving force behind e-commerce

E-commerce: Pandemic winners and losers

Tracking the movement of Russian business sites

An overview of Nordic business and e-commerce sites

Start today