Throughout September 2026, UrbaDigital conducted a systematic analysis of Ecuador's public digital infrastructure: one sector per week, four sectors across the month. We used Mozilla HTTP Observatory, a free and public tool, to assess the security configuration of each institutional portal.
The result is an x-ray of the Ecuadorian public sector's web security as it stands today: fifty institutions, four very distinct types of work, and a pattern that barely shifts between them.
What does HTTP Observatory measure? It evaluates the configuration of HTTP security headers and produces a score from 0 to 100, mapped to a letter grade (A to F). It does not detect active breaches; it measures how well a site is hardened to prevent them. Eight categories per site: CSP, HSTS, X-Frame-Options, SRI, Cookies, CORS, Redirection handling, and Referrer Policy.
The Four Sectors at a Glance
Week of Sep 7
State Platforms
8 institutions · DATA593, ANT, CNE ×2, IESS Affiliation, GOB.EC, SRI, Quipux
25/ 100F
Week of Sep 15
Public Universities
20 institutions · from Yachay Tech (0) to UTM (80)
47/ 100C
Week of Sep 8
Municipalities (GADs)
17 institutions · from Guayaquil (0) to Quevedo (70)
27.6/ 100F
Week of Sep 20
Justice and Healthcare
5 institutions · Fiscalía, IESS Appointment System, MSP, ARCSA, Contacto Ciudadano
27/ 100F
Three out of the four sectors average below 30 out of 100. The exception was the university sector, where four institutions —UTM, EPN, UTN, UG— scored 75 or higher and lifted the average to 47.
All Results — From Worst to Best
HTTP Observatory Score by Institution — September 2026
50 institutions · scale 0–100 · passing threshold ≥ 70 (Grade B or higher)
State Platforms · 8 institutions
GOB.EC — Citizen Portal45
Quipux — Document Management50
Justice and Healthcare · 5 institutions
Fiscalía — Case inquiry10
IESS — Online appointment system20
ARCSA — Sanitary Control35
Ministry of Public Health70
Municipalities / GADs · 17 institutions
Ambato · Guayaquil · Manta · Ibarra0
Azogues · Quito · Esmeraldas55
Public Universities · 20 institutions
Yachay Tech · ESPOCH · ESPOL0
UTB · UCE · UEA · UTMachala55
F — critical (0–24)
D — poor (25–49)
C — acceptable (50–69)
B — passing (70+)
Source: WebPerformance Report · HTTP Observatory · Sep 2026
What Failed Across All Four Sectors
Certain failures surfaced in every sector, without exception.
Content-Security-Policy (CSP)
50 of 50
Not a single site had a valid CSP. This header governs which scripts can execute on the page — its absence is the most common enabler of Cross-Site Scripting (XSS) attacks.
X-Frame-Options
~40 of 50
Missing in approximately 80% of sites. Without it, a page can be embedded inside a third-party iframe — the primary vector for clickjacking attacks against citizens submitting forms.
HSTS
~35 of 50
Without HTTP Strict Transport Security, a session can be downgraded from HTTPS to plaintext HTTP and intercepted across shared or public networks.
Cookies (Secure Attribute)
~20 of 50
Session cookies delivered without the Secure flag can be intercepted across unencrypted channels — especially critical in authenticated systems like the IESS appointment manager.
The 100% failure rate for CSP across all tested services is not a coincidence: it is a structural pattern. We saw it in municipalities. We saw it in universities. We see it once again here. It reflects default configurations that simply are not being enforced at the web server or reverse proxy layer across vast portions of Ecuador's public digital infrastructure.
The Five Institutions That Passed
Five institutions obtained a passing grade of B or higher. What they share is far more instructive than what sets them apart.
80
UTM — Technical University of Manabí
Highest score among all 50 institutions. Server configuration enables multiple security headers by default.
75
UG · UTN · EPN
Three universities with consistent header configurations and nginx setups with security enabled by default.
70
MSP — Ministry of Public Health
Only institution in the State and justice/healthcare sectors that passed. Uses nginx with security headers enabled.
70
Quevedo — Municipal GAD
Only municipality that passed. Routes traffic through Cloudflare, which injects security headers by default — not due to deliberate local configuration.
The difference between a B and an F in HTTP Observatory is rarely a matter of budget. It is almost always a matter of configuration.
The LOPDP Dimension
The Organic Law on Personal Data Protection classifies certain data categories as sensitive under Article 6: health data, judicial and criminal records, genetic data, and information relating to an individual's legal status. Institutions processing these categories are legally required to implement reinforced technical safeguards.
LOPDP · Art. 6 — Sensitive Data
Special Categories of Processing
Health data, genetic information, judicial and criminal records, and data regarding an individual's legal status are classified as sensitive. Their processing demands reinforced technical and organizational safeguards.
LOPDP · Art. 37 — Security of Personal Data
Security Obligations of the Controller
Data controllers must implement technical safeguards that guarantee the confidentiality, integrity, and availability of personal data[cite: 1]. A missing HSTS header, cookies transmitted without the Secure flag, and the total absence of CSP are concrete technical deficiencies directly pertinent to this legal obligation.
The LOPDP applies to public entities without exception. The Superintendence of Personal Data Protection has been active since 2023 and has initiated enforcement proceedings — including regulatory sanctions in 2025 against LigaPro (~$250K) and the Ecuadorian Football Federation (~$200K). Ecuador maintains some of the highest statutory penalties in the region for non-compliance: up to 2% of annual turnover for serious infractions.
We do not state that these portals have experienced a breach or that data has been leaked. What the findings of this analysis establish is that their present configuration fails to meet the technical baseline mandated by the LOPDP for the categories of data they handle. The law does not wait for an incident to occur before imposing duties — it mandates preventive security controls in advance.
Five Patterns from September
CSP is a universal failure. 50 institutions analyzed across four sectors. None had a valid Content-Security-Policy header. It is not individual negligence — it is a structural deficit in Ecuador's public digital infrastructure.
Portals handling the most sensitive data hold the lowest scores. Fiscalía (judicial records), IESS Appointment System (health data), and Contacto Ciudadano (citizen grievances) received an F — precisely the portals that the LOPDP mandates to provide the most robust protections.
Scale and prestige do not predict security. Guayaquil (2.6M residents) scored 0. ESPOL — one of Ecuador's most prestigious engineering schools — scored 0. UTM scored 80. The decisive variable is server configuration, not institutional stature.
Universities outperformed all other sectors. An average of 47, compared to 25–28 across the rest. Four universities scored 75 or higher. The university sector exhibits more diverse IT practices, with certain teams actively maintaining header configurations.
Remediation is not expensive. Every institution that passed did so through server-level header configuration — without replacing infrastructure or purchasing specialized software. HSTS, X-Frame-Options, and Referrer Policy can be added in minutes. The gap between a 0 and a 70 is configuration hygiene.
Methodology
Tool: Mozilla HTTP Observatory (via webperformancereport.com) · Evaluation Period: September 7–20, 2026 · Total Institutions: 50 · Sectors: Central State platforms (8), public universities (20), municipal GADs (17), justice and healthcare portals (5) · Selection Criteria: Citizen-facing portals with direct interaction — authentication, data submission, case inquiries, appointment scheduling, grievance filings · All scans are public and independently reproducible at observatory.mozilla.org.
This report is the final release in UrbaDigital's September 2026 series. Earlier editions covered 17 municipal GAD portals (September 8), 20 public university domains (September 15), and 5 justice and healthcare portals (September 20).
Complimentary Web Security Diagnostic for Your Institution
Is Your Portal Configured This Way Too?
We run HTTP Observatory and compare your technical posture against the requirements of the LOPDP. You receive an actionable findings report and a prioritized remediation roadmap — at no cost.
Request an Evaluation
