We evaluated the web security of 17 municipal decentralized autonomous government (GAD) portals across Ecuador using Mozilla HTTP Observatory[cite: 1], the same free, public tool that anyone can use to audit a website in minutes. The result leaves no room for interpretation: no portal reaches Tier A, the sector average stands at 27.6 out of 100, and 70.6% currently operate in Tier D or F.
This is no longer just a technical issue. Municipal portals process citizen identity records, property taxes, cadastral registries, and civic documentation for thousands of residents. With the Organic Law on Personal Data Protection (LOPDP) fully in force and the Superintendencia de Protección de Datos Personales (SPDP) actively conducting audits, every red mark in this study is, potentially, documentable regulatory non-compliance[cite: 1].
Key Findings
- 0 out of 17 portals achieve Tier A in web security.
- 100% fail on Content Security Policy (CSP), the foundational control against malicious code injection in the citizen's browser.
- 70.6% of the sector (Tiers D, D-, and F) operates with attack vectors exploitable today without sophisticated tools.
- 5 out of 17 portals do not implement SRI at all (a critical -50 point penalty), leaving external resources without integrity verification.
- A 70-point gap exists between the sector's top posture (quevedo.gob.ec, 70/100) and the lowest (0/100 across four portals).
Infrastructure Providers Do Not Explain the Results
We cross-referenced the findings by server and infrastructure provider, and the pattern repeats: simply operating behind a modern CDN or proxy does not, by itself, translate into a robust security posture.
The three portals routed through Cloudflare (quevedo.gob.ec, esmeraldas.gob.ec, and guayaquil.gob.ec) achieve scores in Tiers B, C, and F respectively—the proxy reduces surface-level network exposure, but cannot replace secure application-level header configuration.
End-of-Life Versions Exposed in Headers
Two portals explicitly expose unpatched PHP versions in their HTTP headers: babahoyo.gob.ec runs PHP 7.3.33, and esmeraldas.gob.ec runs PHP 5.6.40—the latter burdened with more than a decade of known vulnerabilities with no security patches available.
The New Reality: This Is Also a Risk Under the LOPDP
Municipal GADs process national identification records, land registries, property tax accounts, and civic documentation belonging to their citizens—precisely the personal data rigorously protected under the LOPDP[cite: 1]. Two legal articles connect directly to our findings:
Security of Personal Data
Mandates the implementation of adequate and necessary technical, organizational, and security measures according to the state of the art[cite: 1]. Content Security Policy (CSP) is free and has been a universal web standard for years; its complete omission across the sector is indefensible during a regulatory audit or post-incident review.
Data Protection by Design and by Default
Requires that security controls and appropriate data processing principles be integrated into digital systems from their initial conception, rather than added as reactive patches after a security compromise[cite: 1].
Legal Precedent: Sanctions Against LigaPro
This risk is no longer merely theoretical. In January 2026, the SPDP sanctioned Ecuador's Professional Football League (LIGAPRO) with a fine of USD 95,502.63 for failing to implement data protection by design and default in its Fan ID application—the exact same regulatory principle that applies to the web security findings in this study. A serious incident can trigger simultaneous sanction proceedings from multiple oversight bodies.
The Good News
The initial phase of technical remediation—implementing CSP, HSTS, and X-Frame-Options—carries zero software licensing cost and can be completed in under 30 days by internal IT staff[cite: 1]. It represents the fastest way to mitigate attack vectors while generating tangible compliance evidence ahead of any potential SPDP audit.
What to Do Now
- Request a free diagnostic assessment for your municipality using HTTP Observatory—takes 5 minutes, requires no credentials, and involves zero cost.
- Review with your legal and IT teams whether you have a designated Data Protection Officer (DPO) and a formally established security incident response protocol.
- Prioritize Phase 1 technical remediation (CSP, HSTS, X-Frame-Options) before investing in complex third-party software suites.
- ANALYTICS Mozilla HTTP Observatory: Public web security and server response header scanning tool — observatory.mozilla.org[cite: 1]
- PLATFORM WebPerformance Report: Continuous monitoring and vulnerability assessment platform for the public sector — webperformancereport.com[cite: 1]
- REGULATION Organic Law on Personal Data Protection (LOPDP): Articles 37 and 39 — procuraduria.utpl.edu.ec[cite: 1]
- REGULATOR Superintendencia de Protección de Datos Personales (SPDP): Sanction resolutions, enforcement, and public audits — spdp.gob.ec[cite: 1]
- AUTHOR URBADIGITAL SA: Specialized engineering, high-end software systems, and data firm in Ecuador — urbadigital.com[cite: 1]
This sector benchmark was conducted by URBADIGITAL SA utilizing the continuous diagnostic architecture of WebPerformance Report to collect and audit web security telemetry across the 17 evaluated municipal portals[cite: 1].
