Sri Lanka web security census 2026

The short version

216 of the 294 entries on the Colombo Stock Exchange list give a website. One of those is a typo that points at an unrelated company’s domain, so we left it out. The other 215 point to 193 different websites, because some groups list one site for several companies. We count each website once.

151 of those websites returned a normal homepage, and the header figures are out of those 151. The http and secure-connection figures have their own totals, given on each line and explained below.

48.3%73 of 151 did not send an HSTS header, which tells browsers to always use the secure version of the site.
65.6%99 of 151 did not send a Content-Security-Policy header, which limits the scripts a page is allowed to run.
28.5%43 of 151 showed software version numbers in their response headers.
8.9%13 of 146 did not move visitors from plain http to the secure https version of the site.
7.6%12 of 157 did not offer TLS 1.3, the newest version of the protocol behind https. TLS 1.2 is still acceptable, so this is a gap in keeping up to date, not a flaw.

These are signs of configuration habits. They are not proof that any site can be broken into.

Why the totals differ

Of the 193 websites, 18 did not resolve, 13 answered only with a protection service’s check page, and 11 gave no usable answer even on a second try. That leaves 151 normal homepages for the header figures.

The http figure is out of the 146 websites that answered a plain http visit, with check pages left out. The secure-connection figure is out of the 157 websites where that check completed; this includes sites behind a protection service, because the secure connection comes before any check page.

How we did it

We took the 294 entries on the Colombo Stock Exchange list (289 companies and 5 unit funds) and the website each one declares on its exchange record. For each website we made the same requests a browser makes when it opens a homepage: public DNS lookups, one secure connection to read the certificate and the protocol version, one plain http visit to see whether it moves to https, and one https homepage request, following the site’s own redirects as a browser does, with the response headers read and the page itself discarded.

We probed no paths, scanned no ports, touched no forms, and tried nothing that needs a login. Every web request named us in its user agent, with a link back to this site. Some websites were contacted more than once, because several companies share them.

The main pass ran on the night of 17 September 2026, Sri Lanka time. Websites that did not answer were tried once more the following night, 18 to 19 September.

What we left out on purpose

Websites behind a CDN or firewall that answered with a check page (13). The headers on those pages belong to the protection service, not to the company.
Entries with no website on their exchange record (78), and 18 listed web addresses that did not resolve (several are typos on the record). An address that does not load is not the same as a company being offline.
Any sector breakdown. Several sectors hold too few companies to report safely.
Any per-company result. Raw results stay private.
Email settings (SPF and DMARC). We looked at them too, but our second count of those lookups is not finished, and we only publish figures we have counted twice.

What this cannot tell you

A missing header is a missing header. It says nothing about the rest of a company’s security.
We read headers, not page content, so “no CSP header” means no header; a policy can also be set inside the page.
Version numbers in headers show the software is advertising itself, which helps an attacker plan. It does not mean that software is vulnerable.
Each figure describes the websites on the nights above. A site may have changed since.

Why we ran it

We could not find an earlier sector-wide census of Sri Lanka’s listed companies, though paid rating services do publish scores for individual companies. A published baseline lets every company compare itself with the market as a whole.

If you work at a listed company and want to know where your own website stands, email ryan@ghosts.lk and we will send the result privately, to an address on your company’s own domain.