Security of small businesses in Lisbon and Amadora

In November 2026 we analysed the websites of 69 local businesses found on Google Maps: clinics, vets, accountants, estate agents and repair services.

Main findings

Percentage of the 58 sites we were able to analyse.

No content policy (CSP) (52 / 58)

90%

No effective protection against fake emails in their name (45 / 58)

78%

No local business data for Google (42 / 58)

72%

No HSTS (40 / 58)

69%

No link to the Google Maps listing (37 / 58)

64%

Show the versions of the software they use (28 / 58)

48%

Server software with no security updates (9 / 58)

16%

JavaScript libraries with known flaws (8 / 58)

14%

WordPress

25 of the sites use WordPress.

With versions or plugins that have known, public flaws (13 / 25)

52%

By sector

Sites with no effective protection against fake emails (DMARC missing or only monitoring).

Sector	Sites	Unprotected	Average security score
Accounting	9	9 (100%)	61/100
Repairs and building work	7	7 (100%)	69/100
Vets	4	4 (100%)	68/100
Dental clinics	14	12 (86%)	69/100
Physiotherapy and health	11	9 (82%)	73/100
Estate agents	13	4 (31%)	74/100

Sites that weren't working

11 of the 69 addresses listed on Google Maps weren't working: 7 had their site down, 3 had an expired domain and 1 blocked access. On one of the sites analysed we found signs of suspicious code, possibly injected.

Methodology

The sites were chosen from Google Maps searches by sector, in Amadora and Lisbon (Benfica, Alvalade and Campo de Ourique), on 6 November 2026. We left out large chains and social media pages. The analysis is passive and follows the SinalPT methodology. The names of the businesses are not disclosed.

For journalists

Aggregated data by sector is available on request at contacto@sinalpt.com. You can cite this study as “SinalPT, November 2026”.

How is your site doing?

See in seconds whether it has the same problems.

Analyse my site