The state of websites in 2026

The headline: most sites are not ready

In our first days we ran a complete audit on 60 real websites, in late July 2026. The average site scored 72 out of 100. Three in four failed on security, nine in ten were too slow on mobile, and nearly four in ten were hard for AI assistants to read. Most sites are not broken, they have clear gaps.

Read alongside the sections below, one pattern stands out: the problems are consistent and fixable, not exotic. The same handful of gaps show up on site after site.

Security is the biggest gap

Security was the weakest area by far. Three in four sites (75%) earned a security grade of C or lower, and 42% scored an outright F. Seven in ten had no Content-Security-Policy, the single strongest defense against cross-site scripting. Only one in four sites reached an A or B.

The average site was missing almost four security headers. The most commonly absent were:

• Permissions-Policy (missing on 78% of sites)
• Content-Security-Policy (70%), the main defense against XSS and injection
• Referrer-Policy (70%)
• X-Frame-Options (62%), which blocks clickjacking

These are one-time configuration fixes, not rebuilds. That is what makes the number so striking: the protection is free, and most sites still skip it.

Nine in ten are too slow on mobile

Speed was a near-universal problem on mobile. Nine in ten sites (90%) had a Largest Contentful Paint above Google's 2.5-second good threshold, and nearly two in three were above four seconds. The median mobile load time for the main content was 5.5 seconds, well beyond what most visitors tolerate.

Mobile is where the audience is and where the throttled connection is least forgiving. Large uncompressed images and render-blocking resources were the recurring causes, both of which a report pinpoints per page.

AI visibility is the new blind spot

Being found by AI assistants is where sites are least prepared, largely because most owners are not measuring it yet. Nearly four in ten sites (38%) scored below 70 on AI visibility (GEO). As people increasingly ask ChatGPT, Perplexity and Google AI for recommendations, a site those tools cannot read simply does not get mentioned.

This is the gap competitors' tools do not even check. It is also the one that will matter more every quarter, which is why eighty grades it as one of four equal subscores.

What this means for your website

The pattern is consistent: most sites are not broken, they carry clear, fixable gaps that quietly cost visitors and trust. Every site we scanned was indexable by Google, so the problems are rarely fatal, they are exactly the kind a focused audit surfaces in about a minute.

The averages are useful, but your own numbers are what count. The fastest way to know where you stand is to scan your own site.

How we measured this

These figures come from 60 real websites scanned with eighty between 24 and 26 July 2026, each site counted once. It is a self-selected sample of sites people chose to test, not a random sample of the whole web, so read it as a snapshot rather than a national statistic. Speed is a mobile lab measurement (Google Lighthouse).

Frequently asked questions