{
 "title": "Nepal government web census after PHP2Shell, November 2026",
 "author": "Diwakar Bhatt",
 "url": "https://diwakarbhatt.com.np/blog/nepal-government-websites-after-php2shell.html",
 "auditDate": "2026-11-03",
 "sample": "1,128 organisation-level .gov.np domains found in public certificate-transparency logs (crt.sh), non-expired certificates. One record per organisation.",
 "vantage": "A server in India. Sites that block traffic from outside Nepal cannot be told apart from sites that are offline.",
 "method": "Passive. For each organisation, at most three requests to the homepage only: an HTTPS HEAD (falling back to www., and to a 1-byte GET if HEAD is refused) and a plain-HTTP HEAD to see whether it redirects to HTTPS. Response headers only; no paths guessed, nothing probed, no content stored.",
 "organisations": 1128,
 "byType": {
  "localGovernments": 725,
  "otherBodies": 403
 },
 "outcomes": {
  "timeout": 704,
  "http_response": 376,
  "tls_error": 46,
  "dns_nxdomain": 2
 },
 "outcomesByType": {
  "localGovernments": {
   "timeout": 608,
   "http_response": 101,
   "tls_error": 16
  },
  "otherBodies": {
   "http_response": 275,
   "timeout": 96,
   "tls_error": 30,
   "dns_nxdomain": 2
  }
 },
 "tlsErrorsThatStillServeAPage": 45,
 "answeringBelow500": 374,
 "httpRedirectsToHttps": 348,
 "securityHeaders": {
  "strict-transport-security": 14,
  "content-security-policy": 9,
  "x-frame-options": 320,
  "x-content-type-options": 326,
  "referrer-policy": 211,
  "permissions-policy": 9
 },
 "noneOfSixHeaders": 43,
 "disclosesPhpVersion": 15,
 "phpVersionsDisclosed": {
  "7.3": 1,
  "8.3": 3,
  "8.2": 3,
  "8.4": 2
 },
 "disclosesServerVersionNumber": 121,
 "organisationsWithAnAddress": 422,
 "largestShareOnOneNetwork16": 324,
 "limitations": [
  "Totals only. Individual organisations and addresses are not published.",
  "Measured from outside Nepal; a re-run from a Nepali connection is planned to separate blocking from downtime.",
  "Certificate-transparency logs include only names that have had a certificate, so organisations that have never used HTTPS are missing.",
  "Response headers say nothing about patching, application security or access control.",
  "A single visit per organisation on one day; results can change after the audit date."
 ]
}