State of Website Health 2026: Data From 219 Audited Sites

Key findings from 219 randomly sampled websites:

• 87.7% failed at least one automated WCAG accessibility check; colour contrast failed on 64.4%.
• Only 25.4% had a good Largest Contentful Paint on a throttled mobile profile; 80.6% had a good CLS.
• The median site shipped 55.9% unused JavaScript on load, and third parties accounted for 77.5% of JavaScript bytes.
• 56.6% of homepages linked to URLs that redirect; 17.4% had at least one broken internal link.
• 18.7% of crawled pages had no meta description and 18.5% had no H1.
• Only 21.0% had all five basic security protections; 34.4% sent a Content-Security-Policy.
• Just 22.4% passed eight core AI search readiness checks; 12.8% had a valid llms.txt.

Most "state of the web" numbers come from vendors' own customers, who are not a random slice of the web. This report uses a random sample of ordinary websites, the same sample across every test, and publishes the method and scripts so anyone can check or rerun it.

Method

Third-party sites in the sample are never named. Each section links to the full study with its detailed method.

1. Accessibility

The median homepage had 10 failing elements across 3 rules, and the median failing contrast ratio was 3.63:1 against the 4.5:1 requirement, so most contrast fixes are a slightly darker shade. Full data: website accessibility statistics and accessibility audit services vs tools.

2. Performance (Lab Core Web Vitals, Throttled Mobile)

Measured with 4× CPU slowdown, 150 ms RTT and 1.6 Mbps (201 of 219 completed). These are lab numbers: real-user pass rates are higher because most visitors have faster devices. See the Core Web Vitals data study.

3. JavaScript

Details: unused JavaScript statistics and do AI crawlers render JavaScript?

4. On-Page SEO and Content

From 25-page crawls of 57 sites (1,332 pages):

That last row is why homepage-only checks mislead: the homepage is usually the best-maintained page. See free vs paid website audit tools.

5. Links, Redirects and Site Structure

See the website structure audit and orphan pages study.

6. Security Basics

Of the 186 homepages that answered a plain request with 200:

HTTPS is nearly universal; the headers that harden it are not. Our guide to security headers covers each one.

7. AI Search Readiness

Bot protection that rejects plain HTTP clients (15.1% of sites) blocks more AI crawlers than robots.txt rules do (6.4%). Full study: AI search readiness data study.

What Healthy Sites Do Differently

The minority of sites that passed most checks shared a few habits, visible across the sections above:

1. Content and links in the HTML. Server-rendered or static pages passed both the AI readiness and structure tests far more often.
2. Less JavaScript. Lighter pages had better LCP and much lower blocking time; Astro sites, which ship little JavaScript by default, had the best median LCP in our framework breakdown.
3. Templates, not pages. Missing descriptions, H1s and duplicate titles cluster by template; fixing the template fixes hundreds of pages.
4. Clean sitemaps. Final URLs only, no redirects or removed pages.

Check Your Own Site Against the Benchmarks

Each linked study includes its own script. As a quick start, this one checks the five security basics from section 6:

"""Five security basics for one site, as measured in the State of Website Health study.

Usage: python3 security_basics.py https://example.com/
Checks: HTTP redirects to HTTPS, HSTS, Content-Security-Policy, clickjacking
protection (X-Frame-Options or CSP frame-ancestors) and X-Content-Type-Options.
"""
import sys, urllib.request
from urllib.parse import urlsplit

UA = {"User-Agent": "Mozilla/5.0 (security-basics)"}


def get(url):
    with urllib.request.urlopen(urllib.request.Request(url, headers=UA), timeout=20) as r:
        return r.geturl(), {k.lower(): v for k, v in r.headers.items()}


def main(url):
    final, h = get(url)
    try:
        http_final, _ = get(f"http://{urlsplit(final).netloc}/")
        https_redirect = http_final.startswith("https://")
    except Exception:  # noqa: BLE001
        https_redirect = False
    csp = h.get("content-security-policy", "")
    checks = [
        ("HTTP redirects to HTTPS", https_redirect),
        ("Strict-Transport-Security", "strict-transport-security" in h),
        ("Content-Security-Policy", bool(csp)),
        ("Clickjacking protection", "x-frame-options" in h or "frame-ancestors" in csp),
        ("X-Content-Type-Options: nosniff", h.get("x-content-type-options", "").lower() == "nosniff"),
    ]
    for name, ok in checks:
        print(f"{'PASS' if ok else 'FAIL'}  {name}")
    print(f"\n{sum(ok for _, ok in checks)}/5 security basics in place")


if __name__ == "__main__":
    main(sys.argv[1])

PASS  HTTP redirects to HTTPS
PASS  Strict-Transport-Security
PASS  Content-Security-Policy
PASS  Clickjacking protection
PASS  X-Content-Type-Options: nosniff

5/5 security basics in place

How BugViso Measures Website Health

Every check in this report is part of a BugViso website audit: axe-core accessibility on every crawled page, Core Web Vitals with throttled reloads and JavaScript coverage, metadata, duplicates and the internal link graph, security headers and TLS, and AI search readiness. The results roll into a 0–100 health score with a list of every deduction and the reason for it, so you can see exactly where your site sits against these benchmarks.

For the full list of what BugViso tests here, see the technical SEO audit tool.

Using This Data

You're welcome to cite these figures with a link to this page. The sample, seed and method are above, and each linked study describes its own measurement in detail. If you rerun a test and get a different result, we'd like to hear about it.

FAQ

What percentage of websites have accessibility errors?

In our random sample, 87.7% of homepages failed at least one automated WCAG check, most often colour contrast.

How many websites pass Core Web Vitals?

In our throttled lab test, 23.4% had both a good LCP and a good CLS. Real-user data from the 2024 Web Almanac puts the share passing all three Core Web Vitals at 43% on mobile.

How much JavaScript do websites waste?

The median homepage left 55.9% of its JavaScript unused on load, and most JavaScript bytes came from third parties.

How many websites are ready for AI search?

22.4% passed all eight core checks in our study; the biggest gaps were missing structured data and bot protection that blocks non-browser clients.

The Takeaway

The average website fails on accessibility, loading speed and JavaScript weight long before AI search or advanced SEO comes into play, and a free BugViso audit shows where your own site sits on each of these benchmarks.