The state of the Estonian web: the hypothesis that survived

Everyone who writes about the Baltics starts from the same assumption: Estonia is the digital one. The state says so itself, and e-Estonia’s own figures put the share of state services available online at 100%. That is a claim about government. Whether it also describes the ordinary Estonian web, the shops, clinics, law firms and sports clubs on .ee, is a different question, and until this year nobody had counted. The Baltic Web Audit, our near-census of the Latvian, Estonian and Lithuanian web in July and August 2026, treated it as a hypothesis and tested it.

In short

The hypothesis survives. Estonia leads 16 of the 24 measures in the audit’s scoreboard outright and shares a 17th, across 76,100 living .ee websites. It has the fastest median mobile load in the region (5.73 seconds), the fewest dead domains (25%), the most DNSSEC (22%) and the least AI blocking (3% block AI search). The more interesting finding is why: Estonia’s lead is structural. Two Estonian hosts serve 56.5% of its web, 81.2% of placeable sites sit on servers in Estonia, and an analytics tool built in Estonia runs on 4.3% of .ee. The lead stops at the layer a person has to write: half of Estonian homepages have no meta description.

The Estonian web in numbers

The audit followed every .ee domain it could find down to whether a website exists behind it. Roughly 200,000 .ee domains are registered. 101,728 of them appeared in a year of the public web index. 76,100 turned out to be living websites, and 25,628 are dead: pointing nowhere, parked at a placeholder or answering only errors. That makes Estonia the Baltic country that converts the largest share of its registrations into real sites, about 38%. The full funnel for all three countries is in our piece on dead domains.

Against its neighbours, the same web looks like this. Every figure is from the report’s scoreboard.

Measure	Estonia	Latvia	Lithuania
Living websites	76,100	49,258	95,014
Dead domains, share of those measured	25%	31%	29%
Median mobile load (LCP)	5.73s	6.60s	6.33s
Sites with a good LCP, 2.5s or less	22%	15%	18%
Blocks AI search crawlers	3%	7%	5%
Blocks AI training crawlers	8%	15%	18%
DNSSEC signed	22%	12%	2%
Cookies set before consent	65%	76%	71%
Hosted at home, of placeable sites	81.2%	40.8%	68.1%
Footer copyright year 2020 or older	8.6%	14.6%	14.3%
Product markup on shops	14.7%	2.6%	3.3%

Two rows deserve a sentence each. Estonia blocks AI the least, which makes it the Baltic web most readable by assistants such as ChatGPT. And its shops are the only ones in the region that tell search engines what they sell in any number: 1,280 of 8,708 labelled Estonian shops carry product markup, about five times the Latvian and Lithuanian rate.

The early-adopter reputation holds too. Lovable, the AI site builder, was detected on 150 production .ee sites, against 92 in Lithuania and 69 in Latvia, even though Lithuania’s web is larger. We looked at what those sites need before they are ready for customers in the piece on Lovable in production.

The lead is structural: Estonia runs its own web

“Fastest” is the headline, and it is the least interesting part. What separates Estonia from its neighbours is that it built a domestic stack and then actually adopted it.

It hosts itself. Zone, which describes itself as the largest hosting provider in Estonia, serves 31,707 living .ee sites: 41.7% of a national web on one company’s network. Elkdata, the second Estonian host, adds 11,285 sites, or 14.8%. Two Estonian companies serve 56.5% of Estonia’s living web. Zone’s own server stack is the most common server string on .ee, and Zone runs the nameservers for 33,623 .ee domains.

It stays at home. Of the Estonian sites whose real location is visible, 54,068 of 66,600 are served from Estonia itself, 81.2%, with Germany a distant second. Only 12.2% of the Estonian web hides its location behind a relay network such as Cloudflare. In Latvia that figure is 31.3%, and of the Latvian sites that can be placed, only 40.8% are at home.

It measures itself with its own tools. Plausible, a privacy-focused analytics tool whose company gives its address as Tartu, Estonia, was detected on 3,257 Estonian sites, 4.3% of the living .ee web. In Latvia it was detected on 26 sites and in Lithuania on 8. That is the clearest case in the whole study of a country preferring its own software.

It builds its own. Voog, a website builder made in Tartu, serves 2,089 .ee sites by server header. And 12.7% of reachable Estonian sites are hand-built, with no CMS and no framework detected at all, roughly double the share in Latvia (6.6%) and Lithuania (6.9%).

A domestic host at that scale moves national statistics by itself. Let’s Encrypt, the free automated certificate authority, is behind 79.4% of Estonian certificates, the regional high, because a host that automates certificates for two fifths of a country sets the number for the country. The newest encryption standard, TLS 1.3, runs on 96.1% of Estonian secure connections.

What a landlord costs

Concentration cuts both ways, and the report’s hosting chapter says so analytically rather than alarmingly. One company at 41.7% of a national web is efficient, consistent and patchable in bulk. It is also a single point of national failure: an outage, a compromise or a business failure at one host is, on these numbers, a two-fifths outage of a country’s web.

It also means the national web is only as modern as its host’s defaults. HTTP/3, the newest way for a browser and a server to talk, runs on 13.7% of live Estonian sites, against 24.8% of Lithuanian and 30.5% of Latvian ones. Latvia leads that row because Cloudflare switches HTTP/3 on by default, and Estonia trails because its dominant stack does not. Nobody in either country chose that. Whoever writes the defaults writes the national web, and in Estonia the defaults are written in Estonia.

Where Estonia does not lead

The lead is real and it is not total. Four areas show an Estonian web that looks much like its neighbours, or worse.

Speed is better, and still poor. A median of 5.73 seconds is the best in the region and more than double the 2.5 seconds Google defines as a good LCP. 63% of Estonian sites sit in the band Google calls poor, four seconds or slower. Being the fastest of three slow national webs is a ranking, not a result. The regional picture is in the six-second web.

The written layer is the thinnest in the Baltics. 49.9% of Estonian homepages have no meta description, the highest rate in the region, so on half the Estonian web Google improvises the search snippet. 42.4% have no main heading. The median Estonian homepage carries 278 words, against 330 in Latvia and 337 in Lithuania. The most efficient Baltic web is also the tersest.

Consent and email are adopted, then left switched off. 65% of Estonian sites set cookies before the visitor has agreed to anything, and among the sites that installed a consent tool the figure is 91%, as bad as anywhere in the region. Email is the same pattern. 83% of live Estonian domains receive mail, and 9% are actually protected against spoofing. Of the Estonian domains that do publish a DMARC record, 68.6% leave the policy on “none”, which watches forged mail and does nothing about it.

The bare domain won, and www was forgotten. Where the main address could be determined, 81.7% of Estonian sites use the bare domain, without www, the most in the region. The side effect: on 28.7% of secure Estonian sites the certificate does not cover the www version, so a visitor who types www out of habit meets a browser warning.

What you can check on your own .ee site, and what needs a developer

Five checks need no developer and take a few minutes each:

• Search for your own company name. If the text under your result is a jumble of menu items, you have no meta description. Every SEO plugin and site builder has a field for it on each page. Write two sentences that say what you do and for whom.
• Look for one main heading. Your homepage should have exactly one H1 that names what the business is. In WordPress it is usually the page title or the first heading block. A logo image is not a heading.
• Type www in front of your address. Open https://www.yourdomain.ee in a private window. A certificate warning means the certificate lists only the bare domain. The fix sits with your host: the certificate has to cover both names, and the www version should redirect to the bare one.
• Read your DMARC record. Use our DMARC checker or look up the TXT record at _dmarc.yourdomain.ee. No record means nothing stops a forged sender. p=none means you are watching and not blocking. The DMARC piece explains how to read it.
• Watch your own cookie banner. Open the site in a private window and do not click the banner. If the browser’s developer tools already list analytics or advertising cookies, the banner is decoration. Cookies before consent walks through the check.

What genuinely needs a developer is the rest. Moving DMARC from “none” to enforcement without losing real mail is a staged job that starts with reading the reports. Wiring a consent tool so scripts actually wait for a click means touching how each script loads. And getting a 5.7 second page under 2.5 is rarely one setting: it is images, fonts, scripts and server response measured on a real phone, which is what our speed optimization work covers.

Why we can say any of this

The figures come from a near-census rather than a sample. We measured 293,806 of the 306,872 Baltic domains in our frame across July and August 2026, from one fixed location, with a crawler that identified itself honestly on every request. Everything is published as an aggregate and no individual site is ever named beside a weakness. The Estonian chapter, the scoreboard and the method are all in the Baltic Web Audit.

If you run an Estonian site and would rather know than guess, send us the address and we will tell you where it stands on each of these measures.