University Website Security: Lessons From 123 Peruvian Institutions

A university website is often the first place where an applicant submits personal details, a student signs in, a researcher shares work, or a parent pays a fee. Whether that connection is secure, and whether the website tells browsers to keep it secure, is visible to anyone who checks. To understand how this looks in practice across a whole national system, Webometrics checked the main website of all 123 Peruvian institutions listed in the July 2026 edition on 11 November 2026.

The results describe a pattern that web teams in many countries will recognize. 101 institutions answered over HTTPS with a certificate that a standard client could verify, so basic encryption is widespread. The extra protections that keep visitors on a secure connection are far less common. Among the 98 verified sites run on the institution's own domain, 26 (26.5%) sent an HTTP Strict Transport Security (HSTS) header, and 55 (56.1%) sent none of the six security headers examined.

This study describes publicly observable technical signals on one page per institution: the homepage, checked once. It does not test for vulnerabilities, and it does not judge how secure an institution's systems are. Webometrics is a UNIRANKS project dedicated to the development and application of webometric university evaluation and research.

Key findings

• 101 of 123 institutions (82.1%) served their homepage over HTTPS with a certificate verified by a standard command-line client on 11 November 2026.
• 88 of the 99 sites that answered on plain HTTP (88.9%) redirected visitors to HTTPS.
• 5 sites answered over HTTPS but their certificate could not be verified: for 4, the client could not trace the certificate to a trusted root (usually a missing intermediate certificate), and 1 certificate had expired.
• Among 98 sites run on the institution's own domain, the most common header was X-Content-Type-Options (35 sites, 35.7%), followed by frame-embedding protection (33, 33.7%) and HSTS (26, 26.5%).
• 8 institutions sent all six headers examined, including the Universidad Nacional Mayor de San Marcos, second in the national list.
• 10 sites (8.1%) refused the automated request and 7 (5.7%) gave no HTTPS response, so their headers could not be determined.

Why website security matters for universities

HTTPS protects what visitors send and receive

HTTPS encrypts the connection between a visitor's browser and the website, and the site's certificate lets the browser confirm it is talking to the genuine domain. Without it, anyone positioned on the same network, such as a shared campus or café Wi-Fi network, can potentially read or alter what passes between the two. RFC 6797, the standard that defines HSTS, describes exactly these risks: passive attackers who eavesdrop on local wireless networks, and active attackers who impersonate the network or its name servers.

For a university, the stakes are concrete. Homepages lead to application forms, student and staff sign-in pages, library systems, fee payments and research repositories. A verified certificate and a secure connection protect the personal data, passwords and documents that move through those journeys.

Visitor confidence starts with the browser

Browsers increasingly treat unencrypted websites as the exception. In October 2025, Google announced that Chrome would enable its "Always Use Secure Connections" setting by default with Chrome 154 in October 2026, which means Chrome will ask for the user's permission before the first visit to any public site without HTTPS. A certificate that has expired or cannot be verified produces a full-page warning in mainstream browsers. For an applicant comparing universities, or an international visitor who cannot judge the institution any other way, such a warning is the first impression.

HSTS keeps visitors on the secure version

Redirecting plain-HTTP requests to HTTPS is a good start, but the very first request can still travel unencrypted, and an attacker on the network can interfere with that redirect. HSTS closes most of that gap: once a browser has seen the header, it connects to the site only over HTTPS for the period the site sets, and it refuses to continue past certificate errors. The protection begins after the first secure visit; RFC 6797 calls the remaining first-visit risk the "bootstrap" vulnerability, which browsers address with pre-loaded lists of HSTS sites.

Who is affected

• Applicants who submit identity documents, transcripts and contact details.
• Students and staff who sign in to learning platforms and email, often from public or shared networks.
• Researchers and partners who download data or files and need to trust that they are unaltered.
• International visitors, who rely on browser signals more than on local reputation.

HTTPS, HSTS and search visibility: what the evidence says

Website security and search visibility are related, but the link is often overstated.

• HTTPS is a lightweight Google ranking signal. When Google announced it in August 2014, it described HTTPS as "a very lightweight signal" affecting fewer than 1% of global queries and carrying less weight than signals such as high-quality content.
• A certificate alone does not raise rankings. Google's page experience documentation lists HTTPS among the aspects of a good page experience, but states that there is no single signal and that Search "always seeks to show the most relevant content, even if the page experience is sub-par."
• Google's documentation does not present HSTS or the other security headers as ranking signals. Their value lies in protecting visitors and preventing errors that can break the secure version of a site.
• Indirect effects are real. Certificate errors, mixed redirects and broken secure versions can stop visitors and crawlers from reaching pages at all, which harms visibility far more than any ranking signal.

These practices are not Webometrics ranking indicators. This study is separate from the ranking, and configuring HTTPS or HSTS does not change a Webometrics score. The indicators used in the ranking are described on the Webometrics methodology page.

Research design

• Population: all 123 Peruvian institutions on the Webometrics ranking page for Peru, July 2026 edition (2nd Edition, Final), read on 11 November 2026.
• Domain: the main web domain shown in each institution's Webometrics profile. If the domain did not answer, one further request was made with "www." added.
• Requests: one HTTPS request and one plain-HTTP request to the homepage, following up to five redirects, with a 20-second timeout and an identifying user agent, on 11 November 2026 between 07:01 and 07:22 UTC.
• Certificate check: verification against the server's standard certificate store (OpenSSL via curl). Browsers can sometimes complete a missing intermediate certificate on their own, so a failed check here does not always mean a browser warning.
• Headers recorded from the final HTTPS response: Strict-Transport-Security (with a positive max-age), Content-Security-Policy, X-Content-Type-Options (nosniff), X-Frame-Options or a frame-ancestors directive, Referrer-Policy and Permissions-Policy.
• Exclusions from the header analysis: 3 institutions whose homepage redirected to the Peruvian government portal gob.pe, because the headers recorded belong to that portal, not to the institution.

Results

HTTPS and certificates

Security headers on university-run sites

The national leaders

Of the 20 institutions at the top of the national list, 11 returned a verified HTTPS response from their own domain, and 6 of those 11 sent HSTS. Among the institutions further down the list, 20 of 87 university-run sites with a verified response did (23.0%). Six of the first 20 refused the automated request, so the comparison rests on small numbers and should be read with care.

The eight institutions that sent all six headers were the Universidad Nacional Mayor de San Marcos, the Universidad Privada del Norte, the Universidad Andina del Cusco, the Universidad de Ciencias y Humanidades, TECSUP, the Servicio Nacional de Adiestramiento en Trabajo Industrial, the Instituto Superior Tecnológico CIBERTEC and the Escuela Nacional de Marina Mercante Almirante Miguel Grau. The list includes a large public university, private universities and technical institutes, which suggests that a complete configuration depends on deliberate choices rather than on size or type of institution.

What universities worldwide can learn from these findings

1. Encryption is the baseline; configuration is the gap. More than four in five Peruvian institutions had verified HTTPS, yet most of their own sites sent no security headers. Universities that "have HTTPS" should not assume the work is finished.
2. Certificate problems are usually maintenance problems. Four of the five unverified certificates could not be traced to a trusted root, which typically means a missing intermediate certificate, and one had expired. Both are configuration and renewal issues rather than technology choices.
3. Redirects are not the same as enforcement. Nearly nine in ten sites redirected plain HTTP to HTTPS, but only about a quarter of university-run sites told browsers to keep using HTTPS through HSTS.
4. Prominence does not guarantee good configuration. HSTS was somewhat more common among the top 20 institutions, but several leading sites still lacked it, and the eight sites with all six headers came from very different kinds of institutions.
5. Know which system serves your homepage. Three institutions redirected to a national government portal, so their homepage security depended on another organization's settings. The same applies to content-delivery networks, hosting providers and CMS platforms.

How to assess and improve your own university website

Check where you stand

• Test the certificate chain from outside your network, not just in your own browser, which may hide a missing intermediate certificate.
• Request the plain-HTTP address of your homepage and main subdomains and confirm that each one redirects to HTTPS.
• Read your response headers with your browser's developer tools, or with a free scanner such as Mozilla's HTTP Observatory, which assesses a site's HTTP headers and other security settings.
• Review Search Console for pages Google cannot reach securely; Google's page experience documentation points site owners to its HTTPS report.

Improve in a safe order

• Complete the certificate chain and automate renewal. Serve the intermediate certificates with the site certificate. Renewal automation is becoming essential: a schedule adopted by the CA/Browser Forum in April 2025 reduces the maximum validity of public TLS certificates from 398 days to 47 days in steps between March 2026 and March 2029.
• Redirect all plain-HTTP traffic to HTTPS, then add HSTS. OWASP's example value is max-age=63072000; includeSubDomains; preload; start with a shorter max-age and add includeSubDomains only once every subdomain supports HTTPS.
• Add the low-risk headers first: X-Content-Type-Options: nosniff, a Referrer-Policy such as strict-origin-when-cross-origin, and frame protection (X-Frame-Options or frame-ancestors). The OWASP HTTP Headers Cheat Sheet gives recommended values.
• Plan Content-Security-Policy separately. OWASP describes it as complex to configure and maintain; test it in report-only mode before enforcing it.
• Check again after every platform change. Headers set on one server can disappear when a site moves to a new host, content-delivery network or CMS. Our guides to launching a new university website without losing backlinks and changing a university domain safely include redirect checks that fit naturally with a security review.
• Assign ownership. Decide who monitors certificates and headers across the main site and every subdomain, including faculty, library and repository sites.

Effect on website quality, user experience and institutional visibility

A secure, correctly configured website supports the other qualities universities care about. It keeps application and sign-in journeys working without browser warnings, protects the data of students and staff, and avoids errors that stop visitors and search engine crawlers from reaching content. These are part of what makes a university website credible, alongside clear content, accurate information and reliable access, themes explored in what makes a university website authoritative. Security configuration does not by itself move a university up search results or rankings; it removes obstacles that can undermine everything else the website does.

Key takeaways

• Most Peruvian institutions in Webometrics already encrypt their homepages; the main gap is in the protections that keep visitors on HTTPS.
• HSTS and a small set of security headers are inexpensive to add and protect applicants, students and researchers on every visit.
• HTTPS is a lightweight Google ranking signal; a certificate alone does not raise rankings, and none of these practices changes a Webometrics score.
• Certificate errors and lost headers usually follow renewals and platform changes, so automation and re-checks matter most.
• The lessons apply to any university website, whatever its country or size.

Limitations

This is a single check of one page per institution on one day; configurations change, and other pages or subdomains may differ from the homepage. Headers were read from HTTP responses only; policies set in HTML meta tags were not counted. Ten sites refused automated requests and seven did not respond, so their configuration is unknown. A certificate that failed verification with a standard command-line client may still be accepted by some browsers. The study does not test for vulnerabilities and does not measure how secure an institution's systems are. It is not a measure of any Webometrics ranking indicator.

Frequently asked questions

How many Peruvian universities use HTTPS?

On 11 November 2026, 101 of the 123 Peruvian institutions in the July 2026 Webometrics edition served their homepage over HTTPS with a verified certificate.

What is HSTS?

HTTP Strict Transport Security (RFC 6797) is a response header that tells browsers to connect to a site only over secure connections for a set period.

Does HTTPS improve a university's Google ranking?

Only slightly. Google describes HTTPS as a very lightweight ranking signal that carries less weight than content quality and relevance. Its main benefits are protecting visitors and avoiding browser warnings.

Does this study measure how secure a university is?

No. It records a few publicly visible signals on the homepage. It does not test systems, look for vulnerabilities or assess security practices.

Do these headers affect the Webometrics ranking?

No. This study is separate from the ranking. The indicators used in the ranking are described on the Webometrics methodology page.

For the wider picture of Peruvian and regional higher education online, see the Webometrics ranking for Peru, the ranking for Latin America and Latin America's 2025 web presence in higher education. An earlier Webometrics study used the same signal-based approach for accessibility on U.S. public university homepages.

Questions about how your institution appears in Webometrics, or about improving its web presence? Contact the Webometrics team.

Sources

• Webometrics (WEBOMETRICS by UNIRANKS). Peru ranking, July 2026 edition, and institution profiles. https://www.webometrics.org/peru. Accessed 11 November 2026.
• Webometrics. Homepage checks of 123 Peruvian institutions, 11 November 2026 (data file held by Webometrics).
• Hodges, J., Jackson, C. and Barth, A. (2012). RFC 6797: HTTP Strict Transport Security (HSTS). Internet Engineering Task Force. https://www.rfc-editor.org/rfc/rfc6797. Accessed 13 November 2026.
• OWASP Foundation. HTTP Headers Cheat Sheet. https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html. Accessed 11 November 2026.
• Ait Bahajji, Z. and Illyes, G. (7 August 2014). HTTPS as a ranking signal. Google Search Central Blog. https://developers.google.com/search/blog/2014/08/https-as-ranking-signal. Accessed 13 November 2026.
• Google Search Central. Understanding page experience in Google Search results. https://developers.google.com/search/docs/appearance/page-experience. Accessed 13 November 2026.
• Google (28 October 2025). HTTPS by default. https://blog.google/security/https-by-defau/. Accessed 13 November 2026.
• CA/Browser Forum (11 April 2025). Ballot SC-081v3: Introduce Schedule of Reducing Validity and Data Reuse Periods. https://cabforum.org/2025/04/11/ballot-sc081v3-introduce-schedule-of-reducing-validity-and-data-reuse-periods/. Accessed 13 November 2026.
• Mozilla. HTTP Observatory. https://developer.mozilla.org/en-US/observatory. Accessed 13 November 2026.

Suggested citation

Webometrics (UNIRANKS). (2026). University Website Security: Lessons From 123 Peruvian Institutions. Webometrics.org. Data collected 11 November 2026; updated 13 November 2026.