{
  "study": "Zabezpečení webů advokátních kanceláří v ČR",
  "publisher": "CIAD - Český institut pro AI a data",
  "url": "https://ciad.cz/studie/zabezpeceni-webu-advokatnich-kancelari/",
  "license": "CC BY 4.0",
  "generated": "2026-08-03",
  "scan_dates": [
    "2026-03-25",
    "2026-07-31"
  ],
  "note_on_data": "Agregátní data bez doménových jmen a bez jmen kanceláří. Vzorek je konvenienční (Praha + Brno, veřejný seznam s hodnocením), ne náhodný vzorek českých advokátů.",
  "sample": {
    "total_domains": 239,
    "unique_domains": 239,
    "sampling_method": "convenience sample: law firms in Praha and Brno drawn from a public rated directory, not random or representative of all Czech lawyers",
    "cities": [
      "Praha",
      "Brno"
    ],
    "wave_march_2026_03_25": {
      "reachable": 208,
      "unreachable": 31
    },
    "wave_july_2026_07_31": {
      "reachable": 232,
      "unreachable": 7
    },
    "intersection_reachable_both_waves": 207
  },
  "scoring": {
    "definition": "six security headers only: Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy. Range 0-6. One point per present header.",
    "https_and_redirect_reported_separately": true,
    "superseded_definition_note": "An earlier internal aggregation (mean 1.98, median 1.0) blended HTTPS presence and HTTP→HTTPS redirect into an 8-point score. That figure is superseded and is not used in this dataset.",
    "march_wave": {
      "n": 208,
      "mean": 0.99,
      "median": 0.0,
      "score_le_1_pct": 75.5,
      "score_ge_5_pct": 5.3
    },
    "july_wave": {
      "n": 232,
      "mean": 0.89,
      "median": 0.0,
      "score_le_1_pct": 78.4,
      "score_ge_5_pct": 4.3
    }
  },
  "headers_missing_pct": {
    "march_wave_n208": {
      "Strict-Transport-Security": 78.4,
      "Content-Security-Policy": 88.0,
      "X-Frame-Options": 78.8,
      "X-Content-Type-Options": 76.9,
      "Referrer-Policy": 86.1,
      "Permissions-Policy": 93.3
    },
    "july_wave_n232": {
      "Strict-Transport-Security": 79.7,
      "Content-Security-Policy": 89.2,
      "X-Frame-Options": 80.6,
      "X-Content-Type-Options": 79.3,
      "Referrer-Policy": 87.5,
      "Permissions-Policy": 94.4
    },
    "intersection_n207_missing_count": {
      "Strict-Transport-Security": {
        "march": 162,
        "july": 162
      },
      "Content-Security-Policy": {
        "march": 182,
        "july": 183
      },
      "X-Frame-Options": {
        "march": 163,
        "july": 164
      },
      "X-Content-Type-Options": {
        "march": 159,
        "july": 162
      },
      "Referrer-Policy": {
        "march": 178,
        "july": 179
      },
      "Permissions-Policy": {
        "march": 193,
        "july": 194
      }
    }
  },
  "http_to_https": {
    "method": "full redirect-chain trace starting from http://, not first-hop only",
    "march_full_sample": {
      "n": 208,
      "no_redirect": 30,
      "pct": 14.4
    },
    "july_full_sample": {
      "n": 232,
      "no_redirect": 48,
      "pct": 20.7
    },
    "intersection_march": {
      "n": 207,
      "no_redirect": 29,
      "pct": 14.0
    },
    "intersection_july": {
      "n": 207,
      "no_redirect": 30,
      "pct": 14.5
    },
    "intersection_fixed_in_4_months": 3,
    "intersection_newly_broken_in_4_months": 4,
    "comparability_note": "Full-wave percentages (208-site vs. 232-site) are not directly comparable: the July wave reaches 24 more sites than March, and those additional sites skew weaker. Only the 207-site intersection is a valid before/after comparison."
  },
  "stability_4_months_intersection_n207": {
    "unchanged": 198,
    "improved": 3,
    "worsened": 6
  },
  "city_march_wave": {
    "Praha": {
      "n": 135,
      "mean_score_0_6": 1.02,
      "median_score_0_6": 0.0,
      "missing_hsts_pct": 81.5,
      "missing_csp_pct": 87.4
    },
    "Brno": {
      "n": 73,
      "mean_score_0_6": 0.92,
      "median_score_0_6": 0.0,
      "missing_hsts_pct": 72.6,
      "missing_csp_pct": 89.0
    },
    "note": "Difference is within noise; treated as a null finding, not a real Praha/Brno gap."
  },
  "reputation_vs_security_march_wave": {
    "rated_n": 177,
    "avg_public_rating": 4.6,
    "rating_ge_4_8": {
      "n": 109,
      "mean_score_0_6": 1.05
    },
    "rating_lt_4_8": {
      "n": 68,
      "mean_score_0_6": 0.81
    },
    "note": "0.24-point gap on a 0-6 scale; public rating does not meaningfully predict header security."
  },
  "response_time_march_wave": {
    "n": 208,
    "median_ms": 569,
    "p90_ms": 2469,
    "over_3s_count": 13,
    "over_3s_pct": 6.2
  },
  "scan_method": {
    "type": "passive",
    "description": "One GET request to the public homepage per site (https first, http fallback), reading response headers only. No authentication, no vulnerability scanning, no port scanning, no penetration testing.",
    "user_agent": "Mozilla/5.0 (compatible; CIAD-research/1.0; +https://ciad.cz/)",
    "timeout_s": 12
  }
}