We analyzed 171 real websites: State of Website Health 2026

We took the most recent audit of every site analyzed on Webmatik between March and September 2026 — 171 unique websites — and wrote up what the data says. It is the first edition of a report we will keep updating as the dataset grows.

The headlines

• The median site scores 65/100, and only 2% reach Excellent. Sites are built to look good — UI/UX is the strongest category, median 83 — but not to perform: retention (50), AI readiness (56) and conversion (60) are the weakest.
• 82% fail the main Core Web Vitals check (Largest Contentful Paint), and mobile fails at twice the desktop rate: 61% against 29%.
• 72% have no Content-Security-Policy, 64% no clickjacking protection, 59% no HSTS — while only 11% still have mixed content. HTTPS is solved; the headers on top of it are not.
• The average brand is named in just 19% of AI answers about its own category, and 26% were never cited with a link at all. 62% of sites have no llms.txt.
• 72% show no trust signals where they matter, and 63% hide their pricing.
• Agencies have the weakest security of any site type (median 47) — the people who build websites for everyone else.

The report covers every category with sample sizes, a site-type breakdown, the five fixes that would move most sites, and the methodology with its caveats: this is a self-selected sample that skews toward small and mid-sized businesses.

Read the full report → You are welcome to quote any figure with a link back.

Two new guides

• Why ChatGPT doesn't recommend your business — how AI assistants actually choose which names to mention, the six most common reasons you are not one of them, and a 30-day plan to change that.
• Website audit checklist — the same 52 checks Webmatik runs, with the pass threshold for each, how to test it by hand, and how many sites fail it.