Table of contents
Update, 10 July 2026. The first version of this article was based on 50 domains and said two in three Polish municipalities had no HTTPS. That sample was small and skewed. I rescanned 2442 of Poland’s 2479 municipalities and rewrote the piece on the full data. The real numbers are below.
You fill out a form at your city hall. You type your ID number, your address, your date of birth. You hit submit. The good news: on almost every Polish municipal site, that connection is now encrypted. The problem is what sits on top of it.
I scanned 2442 of Poland’s 2479 municipalities, every one with a working web address in the official MSWiA register. Passively, without touching a single system. Just SSL, HTTP headers, and DNS, the stuff anyone can see from outside.
What This Actually Means
Start with the good news, because there is some. Public sector HTTPS in Poland is nearly everywhere. Only about 1 percent of municipalities run with no HTTPS at all. The padlock most residents look for is usually there.
Encryption, though, is the foundation, not the house. And almost nothing stands on top of it.
67 percent of municipalities send no HSTS header. 77 percent have no Content-Security-Policy. 79 percent set no Permissions-Policy. 58 percent have no protection against clickjacking. One in three has at least one issue I rate as high risk.
There is a softer edge to the HTTPS number too. 9 percent of municipalities have a valid certificate but still serve content over plain HTTP if you reach them that way, because nobody set up the redirect. The encryption exists, but the connection can quietly drop off it, and a login sent over that accidental HTTP is exposed. It gets worse when the same password is reused elsewhere, the exact habit behind most password security failures out there.
Why Everyone Looks in the Wrong Direction
Most public sector cybersecurity talk revolves around ransomware, hoodie hackers, and attacks from abroad. It is a convenient story. It shifts the blame onto “Russian hackers,” a target nobody can actually do anything about. The boring stuff, the kind covered in a proper cybersecurity strategy, never makes the headlines.
The real problem is boring. A server config missing a few lines. The redirect to HTTPS that never got set up, the security header nobody added. This is plain neglect, and a passive scan catches it in seconds, without ever touching the inside of the system.
None of these headers is exotic. You set them once, in a config file, and they work for years. A missing Content-Security-Policy or X-Frame-Options is what lets someone inject foreign code into a council page, or hide the real site inside an invisible frame they control. For a site where a resident types in personal data, that is not cosmetic.
What This Means for You, If You Run One of These Sites
Where a municipal site still serves over plain HTTP, that 9 percent, it is a direct GDPR problem. You process citizens’ data without basic transport protection, and an auditor does not need to be a hacker to see it. They only need to open the site over HTTP and watch the encryption fall away.
Missing security headers sit in the next tier. They are the “appropriate technical measures” the regulation expects, the ones you have to be able to justify skipping. “We never got around to it” is not the answer you want on record after an incident.
The Technical Fixes, Explained Without Jargon
HTTPS is connection encryption. Poland’s municipalities have it. That is the win worth keeping.
HSTS tells the browser to talk to a site encrypted, always, and never any other way. 67 percent of the municipalities in the scan do not send it, so an attacker can still try to force that first connection down to plain HTTP.
CSP and X-Frame-Options, both covered in the OWASP secure headers guide, make it harder to inject foreign code into a page, or to hide a legitimate site inside an invisible frame controlled by someone else.
An SSL certificate is free through Let’s Encrypt, and most municipalities already run one. The headers take a few lines in a server config and half an hour of your time, done over a coffee break.
Check Your Own Site Today
Open your own site in a new tab. The padlock is probably there, and that is good. Now open the developer console and look at the response headers. That is where the gap hides: no HSTS, no CSP, no frame protection. If they are missing, you found out before your next audit did.
Download the full scorecard as a PDF, including the breakdown by type of municipality.
Leave a Reply