The State of Website Health in 2026: What 171 Real Audits Reveal

Between March and September 2026, 171 websites were audited on Webmatik across eight categories — performance, SEO, AI readiness, conversion, UX, retention, accessibility and security — roughly 50 automated checks per site. This report is what that data says. The short version:

• The median website scores 65/100. Only 2% reach "Excellent" (86+). Sites are built to look good — UI/UX is the strongest category with a median of 83 — but not to perform: retention (50), AI readiness (56) and conversion (60) are the weakest.
• 82% fail the main-content load check (Largest Contentful Paint). Mobile is the problem: 61% fail the mobile performance threshold versus 29% on desktop — more than double.
• Security headers are still the exception, not the rule. 72% have no Content-Security-Policy, 64% have no clickjacking protection, 59% have no HSTS. Meanwhile HTTPS itself is solved — only 11% have mixed content.
• Most sites are invisible to AI search. 62% have no llms.txt; among sites checked with Cloudflare's agent-readiness scan, 90% publish no AI usage policy. Among 43 sites with a full AI-visibility scan, a brand was mentioned in only 19% of buyer-style AI queries about its own category, and 26% were never cited at all.
• The basics of conversion are missing. 72% show no trust signals, 63% hide pricing, 82% offer no live chat or visible support.
• Agencies have the worst security of any site type (median 47/100) — the people who build websites for others. E-commerce sites have the worst performance (57), where speed is most directly tied to revenue.

Every figure below can be cited with a link to this page. Sample sizes are given wherever a check ran on fewer than all 171 sites.

The data comes from completed Webmatik audits between 9 March and 6 September 2026. Where a domain was audited more than once, only the most recent audit counts, giving 171 unique websites. Each audit runs the homepage plus up to three high-traffic inner pages through automated checks; performance metrics come from Google PageSpeed Insights (lab and field data where available), organic data from DataForSEO, and AI-visibility results from real queries run against ChatGPT and Gemini.

Three caveats you should know before quoting anything:

• This is a self-selected sample. These are sites whose owners or agencies chose to run an audit — people who care enough to check. If anything, the wider web is in worse shape than these numbers suggest.
• It skews toward small and mid-sized businesses: e-commerce (41 sites), agencies (31) and SaaS (30) make up 60% of the sample, followed by corporate (11) and healthcare (9). There are no Fortune 500 properties here.
• Some checks have smaller samples. Checks that depend on PageSpeed field data, or that were added during the period (the agent-readiness checks launched in August), ran on fewer sites. Those figures show their n.

Scores are 0–100 per category; the overall Growth Score weights categories by site type (a store is weighted differently from a SaaS landing page). "Fail" means the check did not pass its threshold — for example, LCP above 2.5 seconds, or a header that is absent.

The median Growth Score across all 171 sites is 65.2 (mean 60.1 — the tail of very weak sites pulls the average down). Distribution by grade:

Read that as: half of websites are "fine" — no catastrophic problems, nothing that sets them apart — and only 4 sites out of 171 would be described as excellent. The gap between a 65 and an 86 is not one big fix; it is the accumulation of the dozen medium-sized ones catalogued below.

Median score per category, with the share of sites scoring below 50 in that category:

The pattern is hard to miss. The categories a designer can see — layout, hierarchy, mobile rendering — are in good shape. The categories that decide whether a visitor becomes a customer and comes back — conversion, retention — and the one that decides whether AI assistants recommend you at all, are where half the web is failing. Retention is the weakest category on the web: 49% of sites score under 50, typically because there is no email capture, no content cadence and no reason to return.

Core Web Vitals results for the 153 sites with complete PageSpeed data:

Two things stand out. First, layout shift is largely solved (only 13% fail CLS) while loading speed is not — LCP is the metric that most directly reflects image weight, server response time and render-blocking resources, and it is the one 8 in 10 sites miss. Second, the mobile gap: 61% fail on mobile against 29% on desktop. Most teams test on the laptop they built the site on.

The specific causes PageSpeed flagged, as a share of all 171 sites:

• 61% ship unused JavaScript that slows the page
• 53% have inefficient image delivery (oversized, uncompressed or wrong format)
• 44% use short or missing cache lifetimes for static assets
• 43% ship unused CSS
• 40% have render-blocking requests
• 36% do heavy main-thread work during load

Images and unused code are the two fixes with the highest payoff for the least effort. Where a site's server response itself is slow, no front-end fix will save it — see the TTFB guide for how to tell the difference.

This is the category with the widest gap between how much it matters and how little has been done. Basic on-site signals first (162 sites):

In August 2026 Webmatik added checks based on Cloudflare's agent-readiness scan, which looks at whether a site tells AI agents what they may do with its content. Among the 59 sites scanned since:

• 90% publish no Content Signals (no machine-readable AI usage policy in robots.txt)
• 98% offer no markdown version of pages for AI agents
• 90% score at the lowest agent-readiness levels
• Only 15% have robots.txt rules that actually block AI crawlers — so the problem is not that sites are shutting AI out; it is that they say nothing at all

What this looks like from the AI's side

For 43 of the sites, Webmatik ran a full AI-visibility scan: eight buyer-style questions a prospect would ask ChatGPT or Gemini about that site's category ("what's a good tool for…", "recommend a … in …"), checking whether the brand is mentioned and whether it is cited with a link.

• The average brand was mentioned in 19% of the queries about its own category — fewer than 1 in 5
• 26% of brands were never cited (linked) in any answer
• 9% were never mentioned at all

This is a small sample and the sites that ran the scan are on paid plans, so they are likely more visible than average. Even so: four out of five times a potential customer asks an AI assistant for a recommendation in your category, you are not in the answer. How to get mentioned by AI search engines covers the fixes; the AI visibility checker shows where you stand.

Conversion checks look for the things that turn a visitor into a lead or a sale. Across all 171 sites:

Trust signals are the one that should worry business owners most. A visitor who has never heard of you is looking for a reason to believe you; 72% of sites give them none on the pages that matter. Hidden pricing (63%) is often a deliberate choice — "contact us" — but on a SaaS or service site it is the single most common reason a comparison-shopping visitor leaves.

The urgency check ("limited stock", "offer ends", cohort dates) fails on 84% of sites, but that is a softer signal: urgency is only worth adding when it is true. Trust and pricing are not optional.

159 sites had a complete security header scan. The good news is that transport encryption has become the default — only 11% still serve mixed content. The bad news is nearly everything on top of HTTPS:

Every one of these is a one-line server or CDN configuration. A site can go from missing all five core headers to passing all of them in under an hour, which makes this the most under-exploited quick win in the whole dataset. It also shows up in the site-type breakdown below: agencies, who build sites professionally, have the lowest security median of any group.

Classic on-page SEO is the healthiest technical category — most sites have title tags (81% pass), canonical tags (76%) and structured data (75%). The failures cluster around content completeness and around the signals Google actually uses to rank:

Meta description, H1 and title checks run per page (187 page checks across homepages and key inner pages).

Two figures deserve a second look. 38% of sites have no analytics at all — they cannot know what is working. And 59% have negligible organic traffic according to third-party estimates: for most small businesses, search is not yet a channel, which is precisely why the AI-visibility numbers above matter. If you are not in Google's top 10 today, you can still be in ChatGPT's answer — that field is far less crowded.

Accessibility scores look moderate (median 67) because the most visible issues — missing alt text, blocked zoom — are mostly handled. The failures are the ones you cannot see without a keyboard or a screen reader (162 sites):

Roughly 1 in 6 people has a disability that affects how they use the web. A 39% rate of unlabeled form fields means that on 4 in 10 sites, a screen-reader user cannot reliably fill in the contact or checkout form — which is a conversion problem as much as a compliance one.

Median category scores for the site types with at least nine sites in the sample:

• E-commerce sites are the slowest (performance median 57) — heavy product imagery, app scripts and third-party tags on the platforms most stores run on. This is the type where load time has the most direct, measured effect on revenue.
• Agencies score lowest on security (47). Their own sites are often built on the same templates and plugin stacks they ship to clients, without hardening. If you are choosing an agency, running their site through a security check is a fair test.
• Healthcare sites are least ready for AI search (43), in the sector where people most often ask an assistant "who should I see for…". Corporate sites (50) and agencies (50) are not far behind.
• SaaS sites are the most balanced — the best overall median (70) and the best performance — but still leave conversion at 63 with pricing hidden on many.

Ranked by how many sites they affect and how little they cost:

1. Add the five security headers (CSP, HSTS, X-Frame-Options or frame-ancestors, X-Content-Type-Options, Referrer-Policy). Affects 6–8 in 10 sites; an hour of work at the server or CDN.
2. Fix image delivery and drop unused code. The two most common PageSpeed flags (53% and 61%) and the main drivers of the 82% LCP failure rate. Modern formats, correct sizing, lazy-loading below the fold, and removing the scripts nobody uses.
3. Put trust signals on your money pages. Reviews, client logos, guarantees, certifications — 72% of sites have none where they are needed. This is the cheapest conversion lift available.
4. Publish llms.txt and an AI usage policy, then add FAQ content. 62% lack the discovery file, 90% say nothing about AI use, 40% have no Q&A content — the exact material AI assistants extract when they build an answer.
5. Add a skip link and fix heading structure. Two hours of work that clears the two most common accessibility failures (69% and 66%) and improves how both screen readers and search engines parse the page.

Every one of these is detected — and explained with the specific fix for your site — in a free Webmatik audit.

You are welcome to quote any figure here. Please link to this page as the source and note the sample (171 websites audited March–September 2026). Suggested citation:

Webmatik, "The State of Website Health in 2026: What 171 Real Audits Reveal", September 2026. https://webmatik.ai/learn/state-of-websites-2026

The report will be refreshed as the dataset grows; the date at the top of the page reflects the most recent update. If you need a cut of the data that is not shown here — a specific industry, a specific check — get in touch.