What we found on 109 accommodation websites in the eastern Algarve

In November 2026 we checked the 109 websites that tourist establishments in the eastern Algarve (Sotavento) list in Portugal's national tourism register, and 15 of them did not open. On the sites that did, the home page took a median 9.5 seconds to show its main content in Lighthouse's mobile lab test, 67% of the e-mail domains give receiving servers no instruction to stop forged messages, and 31% of the sites show no link to the Livro de Reclamações, Portugal's official complaints book, on the home page.

How we did it

We started from the RNET (Registo Nacional dos Empreendimentos Turísticos), Turismo de Portugal's list of tourist establishments with a valid opening licence, read through its open data service. We took the seven Sotavento councils (Faro, Olhão, São Brás de Alportel, Tavira, Vila Real de Santo António, Castro Marim and Alcoutim) and kept every establishment that lists a website: 109. Another 45 establishments in those councils list no website at all. Alojamento local (AL, Portugal's separate licence for holiday lets, rooms and small guesthouses) is not included, because the AL register has no website field.

The 109 are 35 hotels, 23 casas de campo (country houses), 18 agroturismo (farm stays), 9 hotel-apartments, 6 rural hotels, 5 campsites, 4 apartamentos turísticos (tourist apartments), 3 pousadas, 3 aldeamentos turísticos (tourist villages) and 3 turismo de habitação (historic family houses).

We ran a single pass on 8 November 2026, between 01:00 and 01:58 Lisbon time. The check was passive, limited to what any visitor or Google's own tools can see: the home page (and the page its "book" button opens), the public files that guide search robots (robots.txt, llms.txt and the sitemap), the domain's DNS records (the public settings that say which servers handle the website and the e-mail), the security certificate behind the padlock in the browser, and the headers the server sends with the page. No logins, no scans, no hidden pages.

For speed we used Google Lighthouse 12.8, the engine PageSpeed Insights runs for its lab tests, with the mobile profile and simulated slow 4G. A lab test usually comes out slower than a real visit on a good connection. It is there to compare sites under the same conditions, and it does not predict how long each guest will wait. The main metric is LCP (Largest Contentful Paint), the moment the main image or block of text appears. Google's guidance is that 2.5 seconds or less is "good" and more than 4 seconds is "poor".

Legal links were searched for on the home page only. A site may have them on another page, so we always say "not found on the home page".

We publish no names and no rankings. The check is the same one we run in our free Raio-X (Portuguese for "X-ray"), where each site's result goes only to its owner.

The headline numbers

The "Base" column shows how many addresses, sites or e-mail domains each figure is counted on.

Slow pages and few booking engines

Of the 94 sites that opened, 91 completed the Lighthouse test, and the median LCP was 9.5 seconds. On 78 of the 91 (86%) it went past the 4 seconds Google calls "poor", and only 6 came in under 2.5 seconds. The median Lighthouse performance score was 50 out of 100, with 44 sites below 50. The median home page weighs 4.0 MB, and 41 pages are over 5 MB. For comparison, livinstaysalgarve.com, a client site we built, had an LCP of 1.8 seconds on the same test (pilot run, 7 November 2026).

Speed shows up in bookings. In Milliseconds make millions, a study commissioned by Google and carried out by 55 and Deloitte on 37 European and American brand sites at the end of 2019, a 0.1-second improvement across several speed metrics, on every page of the journey, gave travel sites a 10% improvement in booking rates. Those are large brands, and for an eight-room quinta the effect could be larger or smaller.

We detected a booking engine (the system that shows availability and takes the booking on the property's own site) on 43 of the 94 sites (46%): GuestCentric on 12, Cloudbeds, D-EDGE and MotoPress on 5 each, SiteMinder and Amenitiz on 4 each, and others. The rest send guests to e-mail, the phone, a form or an online travel agency, or use an engine we could not detect. Nine home pages link straight to Booking.com and ten show a WhatsApp link. Without an engine the guest cannot see availability or pay there and then, and has to write and wait for a reply.

Forged e-mail in your property's name

DMARC is one of a domain's public settings (a DNS record). It tells mail servers what to do with a message that uses the domain's name but fails the checks. According to Google's documentation, at p=none the message is delivered as normal, at p=quarantine it goes to spam and at p=reject it is refused.

Of the 83 distinct domains, 33 (40%) have no DMARC record and 23 (28%) have DMARC at p=none, which only monitors. Together that is 56 of 83 (67%) giving receiving mail servers no instruction to reject or quarantine a forged message that uses their domain. Only 15 (18%) ask for quarantine and 12 (14%) for rejection. Another 12 domains (14%) have no SPF record, the list of servers allowed to send mail for the domain.

Guests expect e-mails about payments from the places they book, and tend to trust a message that seems to come from the hotel's own address. The scams that use property names are covered in our piece on Booking.com account scams, and the route from p=none to p=reject in the one on SPF, DKIM and DMARC.

We took that route on livinstaysalgarve.com on the evening of 7 November 2026: it moved from p=none to p=quarantine once we had confirmed that both real senders (Resend, which sends the app's guest e-mails, and the Titan mailboxes) passed the DKIM check, the signature that proves a message left a sender the domain has authorised.

Six of the 94 sites show a free-mail address (Gmail, Hotmail and the like) as their contact. Anyone can open an almost identical address on those services, and a guest has no way to tell which one is real.

Legal notices missing from the home page

We found no link to the Livro de Reclamações on the home page of 29 of the 94 sites (31%). Article 5-B(2) of Decree-Law 156/2005 says businesses "must show on their websites, in a visible and prominent place, access to the Digital Platform" of the electronic complaints book (our translation).

We found no mention of an alternative dispute-resolution (ADR) body on 76 sites (81%). Article 18 of Law 144/2015, as amended by Decree-Law 102/2017, requires businesses established in Portugal to tell consumers which ADR bodies they are bound to, by membership or by mandatory arbitration, and to give those bodies' websites. In the Algarve the consumer arbitration centre is CIMAAL.

We found no privacy-policy link on 17 sites (18%). One site still links to the EU's online dispute resolution (ODR) platform, which Regulation (EU) 2024/3228 shut down on 20 July 2025.

It happened on a site we built, too. On 7 November 2026, while preparing the Raio-X, we checked livinstaysalgarve.com and found the complaints book link and the CIMAAL line missing. Both went into the footer that evening. The rules, when they apply and the fines are in our article on legal notices for accommodation websites.

What Google and AI assistants find

Only 20 of the 94 sites (21%) describe themselves in structured data as a hotel or other lodging business (schema.org types such as Hotel, LodgingBusiness, BedAndBreakfast, Resort or VacationRental). Structured data is code the guest never sees that tells machines, in a fixed format, the name, address, type of business and check-in times. Google says in its guide to generative AI features in Search that structured data is not required to appear in AI answers and that there is no special markup to add. It leaves the facts written down so that a machine does not have to guess them.

On 29 sites (31%) the home page has no main heading (H1), and 21 (22%) have no meta description, the short summary that can appear under the link in search results. 74 sites (79%) have a sitemap and 58 (62%) declare their language versions (hreflang).

We found an llms.txt file (a plain-text summary of a site, proposed for AI assistants) on 22 sites, several of which look as if an SEO plugin generated them, and 1 site blocks AI crawlers in robots.txt. As of November 2026 none of the big AI assistants has said publicly that it reads llms.txt, and Google writes, in the same guide, that Search does not use files of this kind.

Sites that don't open, or open with warnings

Of the 109 addresses in the register, 15 (14%) did not open. For 11 the address does not resolve: the domain no longer exists, has changed or is mistyped in the register. One timed out and 3 returned a server error or refused the request.

The RNET is public, and anyone who looks your property up there finds the same dead address we did. When a domain is not renewed and gets deleted, ICANN's rules for generic domains such as .com allow 30 days to restore it, and after 5 more days the name is free for whoever registers it first. The steps, and what happens to your e-mail, are in our article on expired domains.

Among the 94 sites that opened, 8 do not redirect http:// to https:// and 2 had an invalid certificate on the day, which makes the browser show a security warning before the page. Lighthouse also scores accessibility, and 26 of the 91 sites scored below 80.

What to fix first

In order of effort, quickest first:

1. Open the address the RNET holds for your establishment and check it is your current site. If it has changed, ask Turismo de Portugal to correct it.
2. Put in the footer of every page the link to the electronic complaints book, the dispute-resolution body with its website (in the Algarve, CIMAAL) and your privacy policy. Remove any link to the old ODR platform.
3. Publish a DMARC record at p=none with a reporting address and check your SPF. When the reports show all your legitimate senders passing, move to p=quarantine and later to p=reject.
4. Replace a Gmail or Hotmail contact address with one on your own domain.
5. Check whose name the domain is registered in, turn on auto-renewal and add a second contact e-mail at the registrar.
6. Make the site always redirect to https:// and note the certificate's expiry date.
7. Cut the home page weight (photos compressed and served at the size they display, no video playing by itself on phones) and re-run PageSpeed Insights after each change.
8. Add lodging structured data carrying the same facts the page shows, a main heading (H1) and a meta description.
9. If the site has no booking engine, choose one that shows live availability and takes payment at the time of booking.

What this study cannot see

This study sees what any visitor sees: the outside. What protects a property day to day is on the inside, where no public check can reach: whether the staff computers and phones have the system, browser and apps up to date and working protection; whether remote-control programs (AnyDesk, TeamViewer and the like) are still installed or running when nobody needs them; whether the router's admin is locked and any cameras, recorders or network drives are open to the internet; whether the guest Wi-Fi is kept apart from the reception network and the cameras; whether the backups have been restored at least once; and whether each person has their own accounts, former staff have lost access, and Booking.com, Airbnb, Google and e-mail ask for a second login step.

Attack attempts are automated and reach properties of every size, well-run ones included, so these points are worth checking everywhere. On an on-site Raio-X we check this inside during a visit and leave a short written report with a quote for anything that needs fixing; the price of the visit is on request.