All articles · Web Security

We Scanned Türkiye's 100 Most Popular Websites: Security, Speed and SEO

By PerfoMetrix Team·November 4, 2026·5 min read

After scanning the world’s 100 most popular websites, we ran the same study on Türkiye. On 2 November 2026 we ran one PerfoMetrix scan of the home page of each site on our Türkiye Top 100 list and added up the results.

The picture is familiar: encryption is solved, one-line security headers are often missing, and lab speed scores are low. A few results stand out for Türkiye: more sites turn away automated visitors, cookies are less often marked Secure, and about one site in eight loads trackers before a visitor could consent. As before, this post names no site.

How we measured

• Sites: the Türkiye Top 100 for September 2026, built from the Chrome UX Report’s most visited origins in Türkiye and ordered by the Tranco research ranking. Adult, gambling and piracy sites are excluded, as on our list pages. The list includes global services popular in Türkiye as well as Turkish sites.
• Scan: our normal passive scan of each home page, the same one anyone can run for free: the page and its response headers, the TLS handshake, public DNS records, blocklists, and Google’s Lighthouse through PageSpeed Insights on a mobile profile. No logins, no attacks, no more than a handful of requests per site. The methodology page explains how scores work.
• One snapshot: results are for one home page on one day, scanned from our server in Germany. Inner pages and other days can differ.

Finding 1: Almost a third turn away automated visitors

29 sites answered our scanner with an error status instead of their home page, and 2 more could not be reached at all, so 31 of 100 did not show us their real page (21 of the world’s top 100 did the same). Bot protection is a legitimate choice, and our scanner respects it: we don’t disguise ourselves as a browser. The figures below cover the 69 sites that answered normally; the security percentages use the 68 with complete security data.

Finding 2: Encryption is solved, the HTTP redirect less so

Every site that answered served its page over HTTPS with a current TLS version, and none had an invalid certificate. Eight in ten (79%) send HSTS. But 13% didn’t redirect a plain http:// request to HTTPS, compared with 11% of the world’s top sites: a visitor who types the address without https:// may land on an unencrypted page first.

Finding 3: Security headers lag the world’s top sites

Each of these is usually one line in a web server or CDN configuration. 38% of the sites enforce no Content Security Policy at all, the main defence against injected scripts. Our guide to security headers explains each one, and the Security Headers Generator writes the lines for you.

Finding 4: Cookies and consent

• 28% set at least one cookie without the Secure flag on the home page (29% worldwide), and half have cookies that scripts can read (no HttpOnly).
• 13% loaded a tracking script or set a tracking cookie before a visitor could make a choice in a consent banner. Under KVKK’s cookie guidance and the GDPR, non-essential cookies need consent first. Our guide to tracking and consent shows what to check.

Finding 5: Email authentication

• SPF: 84% pass.
• DMARC: 74% have a policy that passes our check; 15% have none, against 12% worldwide.
• MTA-STS is rare: 4 of the 58 domains that receive mail.

A domain without DMARC lets anyone send mail that claims to come from it, the raw material of phishing in the brand’s name. Our post on moving DMARC to reject walks through it.

Finding 6: The rarely seen extras

• security.txt: published by 25%, the same share as the world’s top sites.
• DNSSEC: 13% (9% worldwide).
• CAA records: 40% (43% worldwide).
• Version numbers in headers (Server, X-Powered-By) still show on 26%.
• Outdated software: 3 sites showed a software version past its end of life, and 3 a version listed in our known vulnerabilities pages. Most sites hide their versions, so this is a lower bound.
• Known vulnerable JavaScript libraries turned up on 2 of 68 sites.

Finding 7: Slow in the lab, better for real users

On a simulated mid-range phone, only 8% of the sites scored 90 or more in Lighthouse (13% worldwide), and only 7% had a “good” Largest Contentful Paint. Performance had the lowest median of any section: 65.

Real users fare better. In Chrome’s field data for the same pages, 58% have a good LCP, 55% a good INP (responsiveness) and 80% a good CLS (layout stability), slightly below the world’s top sites for loading and responsiveness. Only 23% of the home pages stayed under our page-weight threshold. Our post on why Lighthouse and real users disagree explains the gap.

Finding 8: Basic SEO markup

• Exactly one H1: 42% of the home pages (about half worldwide).
• A meta description of a useful length: 55%.
• Complete Open Graph tags for link previews: 62%.

Finding 9: No signs of compromise from the blocklists

None of the sites, or the third-party scripts they load, was listed by Google Web Risk or blocked by Quad9’s threat filtering, and none loaded a script from a host known to have been compromised.

The scores

Across the 98 completed scans the median overall score was 80 (a B), the same as the world’s top 100. By grade: 13 A, 36 B, 34 C, 14 D and 1 F. Security was the strongest section (median 90), performance the weakest (median 65).

What this means for your site

The most visited sites in Türkiye share the same blind spots as the rest of the web, and every one of them is cheap to fix:

1. Redirect every http:// request to HTTPS and send HSTS.
2. Add the missing security headers: a Content Security Policy, nosniff, Referrer-Policy, Permissions-Policy and clickjacking protection.
3. Mark cookies Secure, HttpOnly and SameSite, and load no tracker before consent.
4. Publish SPF and a DMARC record, then move DMARC towards reject.
5. Judge speed by real-user data, and use the lab to find what to fix.

Run a free scan to see where you stand, or check one thing at a time with the Security Headers Checker and the Website Speed Test.

Tags:researchTürkiyesecurity headersCore Web VitalsKVKKtop websites