In late October, a pair of critical PHP vulnerabilities known as PHP2Shell forced Nepal to take a large part of its government web estate offline as a precaution. According to the Kathmandu Post, most of those sites run on the shared GIWMS platform, and most were reported back online within days.
Every report said "thousands of sites". None had a count. So I made one.
What I did
I listed every government organisation with a .gov.np name in public certificate-transparency logs: 1,128 of them, of which 725 are local governments (the …mun.gov.np sites) and 403 are ministries, departments, boards and other bodies. On 3 November 2026 I looked at each homepage once.
The check was passive: at most three requests per organisation, response headers only. Nothing was probed, no pages beyond the homepage were requested, and nothing was stored except the headers. I am publishing totals only. No organisation is named here or in the dataset.
One limitation shapes everything below: I ran this from a server in India. A site that blocks visitors from outside Nepal looks exactly like a site that is down. I will re-run the same script from a Nepali connection and publish the comparison.
The numbers
- 1,128government organisations checked
- 376(33%) answered normally over HTTPS
- 46answered with an invalid security certificate; 45 of those still serve a page if you ignore the warning
- 704(62%) gave no response at all within 20 seconds
- 2names no longer exist
The split by type is the striking part:
| No response | Answered | Certificate error | |
|---|---|---|---|
| Local governments (725) | 608 (84%) | 101 | 16 |
| Other government bodies (403) | 96 (24%) | 275 | 30 |
Down, or closed to the world?
Five out of six local government websites did not answer a visitor from outside Nepal. Since most government sites were reported back online by 26 October, the likeliest explanation is not that they are still broken but that they now refuse traffic from abroad, a step some organisations take after a security incident.
I want to be careful here: that is an inference, not a measurement. The re-run from inside Nepal will settle it. But if it holds, it matters. Nepal has a large population working and studying abroad, and a municipality website is where a migrant worker finds a notice, a form or a phone number for their ward. A site that is technically online but unreachable from Doha or Seoul has failed many of the people who most need it.
Certificates
Forty-six organisations serve HTTPS with a certificate a browser will not trust, so a visitor sees a full-page warning. Forty-five of them still serve a page behind that warning, which suggests expired or mismatched certificates rather than missing servers. In my September check of 30 government sites, every certificate was valid. On a re-check of the same 30 sites this month, four were not.
The sites that answered
Among the 374 sites that answered normally:
- 93%redirect plain HTTP to HTTPS. Good.
- 3.7%send
Strict-Transport-Security, the header that stops a browser being talked back down to plain HTTP - 2.4%send a
Content-Security-Policy - 11.5%send none of the six common security headers
- 121announce the exact version of their web server software
- 15send an
X-Powered-Byheader, and 9 of those give their PHP version. One still reports PHP 7.3, which stopped receiving security fixes years ago.
That last group is small, which is good news. In September, five of 30 government sites sent an X-Powered-By header; on this month's re-check of the same 30, none did. Hiding version numbers after a PHP vulnerability is exactly the right reflex. It is not a fix, but it stops a site advertising which flaw to try.
One platform, one point of failure
Of the 422 organisations whose sites answered at all, 324 sit on the same network block. That is consistent with what the reporting says about GIWMS: most of Nepal's government web presence runs on one shared system.
A shared platform is a sensible choice for hundreds of small offices without their own technical staff. Patches roll out once, and design and accessibility improvements reach everyone. The cost is the one PHP2Shell exposed: when the platform has a problem, the whole government goes quiet at once.
What would help
- Publish a status page. One public page saying which government sites are up, which are restricted, and why. Citizens and journalists would not have to guess.
- Lift or narrow the geographic block as soon as it is safe, at least for the public pages of local governments.
- Renew the 46 certificates. This is cheap, automatable, and the most visible failure to an ordinary visitor.
- Add HSTS and a basic security header set at the platform level. On a shared system, one configuration change covers hundreds of sites.
Method and data
The aggregate dataset is public as JSON, with the method and limitations written into it. The per-organisation results are kept private and are available to Nepal's National Cyber Security Center on request. Certificate-transparency logs only list names that have had a certificate, so organisations that have never used HTTPS are missing from the frame, and the true estate is larger.
This measures response headers only. It says nothing about patching, application security or access control, and a site can pass every check here and still be compromised. The wider picture for Nepali websites is in the 34-site audit, and all my datasets are on the research page.
Featured photo: Karrattul, Wikimedia Commons, CC0. Cropped to 16:9.
