Until this report is ready, the Zimbabwe Web Security Index is the place to look. It is built from a real passive scan of 17 well known Zimbabwean websites, and its method is published on the page.
What the assessments look at
Each passive assessment checks the basics that anyone, including an automated bot, can see from outside:
Missing security headers such as HSTS, CSP and X-Frame-Options
No privacy policy, which is a Data Protection Act (2021) gap
No HTTP to HTTPS redirect, or a weak TLS setup
No SPF or DMARC, so email can be spoofed from the domain
What to do now
- Add the core security headers (HSTS, CSP, X-Frame-Options, X-Content-Type-Options).
- Keep your CMS, plugins and server software up to date.
- Publish a privacy policy and make sure HTTP redirects to HTTPS.
- Set SPF and DMARC records so no one can spoof email from your domain.
- Get a passive assessment so you know where you stand. It's free.
Methodology: passive assessment only, using public DNS, certificate transparency, HTTP response headers and open-source reconnaissance. No authentication, port scanning or exploitation. When figures are published they will be aggregated and anonymised, and no individual business will be identified.