Greadme State of Websites Report 2026: What Do 643 Real Website Audits Reveal?

Headline Statistics

• 0 / 112sites passed all five security-header checksPage Audit, May–Sep 2026
• 69%of mobile homepages have a lab LCP over 4 seconds (implied)n = 207 mobile audits
• 92.5%of sites fail at least one accessibility checkn = 643 sites
• 35%of sites already serve an llms.txt filelive check, n = 601, Sep 7 2026
• 0.7%of sites block an AI search crawler in robots.txtlive check, n = 601
• 31%of homepages have no canonical tagn = 308, Dec 2025–Sep 2026
• 35%of sites get all six SEO basics rightn = 305
• 0.00correlation between performance and meta-tag scoresn = 625 sites

Methodology: What Was Measured, and How

The dataset is every Page Audit, Site Audit and AI Visibility check stored in Greadme's database on September 7, 2026, plus one live sweep of the audited domains run the same day. The sweep fetched each site's robots.txt, llms.txt and homepage once, using the same code that powers the public Greadme AI Access Checker.

What counts as a website

One website is one registrable domain, so shop.example.com and example.com are the same site. Sites hosted on a shared platform subdomain (vercel.app, netlify.app, github.io and similar) are counted by full hostname; there are 61 of them, 9% of the sample. 91% of the audited URLs were homepages.

Duplicates and the “as found” rule

252 of the 643 sites were audited more than once. Unless a section says otherwise, every statistic uses the first audit of each site, on the device it was first run on. That is the site as its owner found it, before any fix. Re-audits are analysed separately in the “Do sites improve?” section. Where mobile and desktop are compared, the first audit per site and device is used (547 desktop, 227 mobile).

Exclusions

• 79 audits by Greadme's two admin accounts (internal testing).
• 20 audits of Greadme's own domains.
• 3 audits of raw IP addresses or localhost.
• For the live sweep: 42 domains that no longer resolved, timed out or failed TLS, and homepages that answered with anything but HTTP 200 for the header check.

Why sample sizes differ between sections

Greadme's audit format grew over the year, and a check can only be counted for the audits that ran it. Three periods matter: July–November 2025 (category scores and Lighthouse audits, meta-tag checks stored inconsistently), December 2025–April 2026 (all twelve meta-tag checks and structured-data validation added), and May–September 2026 (security headers, lab Core Web Vitals and page-weight diagnostics added). Each statistic states its own n. The aggregate “total score” changed definition when the security category was added, so it is never compared across periods here.

How failures are counted

A Page Audit stores an individual check only when its Lighthouse score is below 0.9, so “a site failed check X” means that check was stored for the site's first audit. Performance figures are lab measurements (simulated throttling: a mid-range phone on a slow 4G connection for mobile, a fast connection for desktop), not field data from real visitors. Medians are preferred to averages throughout because page weight, load time and layout shift are all heavily skewed by outliers.

Finding 1: Nobody Ships Security Headers

Fact: of the 112 sites audited since Greadme added its five security-header checks (May 2026), none passed all five, and 52% failed all five. The median security score is 10 out of 100; 36% of sites score zero.

The Content Security Policy numbers deserve a closer look. 69% of sites send no CSP header at all. Of the 31% that do, almost every policy still carries a high-severity weakness. Counted across all 112 sites, 17% rely on host allowlists that can be bypassed, 17% allow 'unsafe-inline', 12% omit script-src, and 13% omit object-src. Exactly one site out of 112 was not flagged on this check at all. The MDN Web Docs guide to CSP describes the nonce-based approach that avoids every one of those findings.

A second, independent measurement agrees

Because 112 is a modest sample, the live sweep re-checked the response headers of all 551 audited homepages that returned HTTP 200 on September 7, 2026. This is a simpler test (is the header present at all?), so the numbers are more forgiving, and they still tell the same story.

The two measurements line up: the audit found CSP absent on 69% of sites, the header sweep found it present on 27%. HSTS: absent on 38% in the audit, present on 55% in the sweep. Meanwhile 3.6% of all 643 sites still served their first audit over plain HTTP.

Interpretation: transport encryption has become the default (96% on HTTPS) but the layer above it has not. Security headers cost nothing in performance and are set in one place, yet the median site in this sample scores 10 out of 100 on them. The platform breakdown later in this report suggests why: the header usually comes from the hosting platform, not from the site owner.

Finding 2: The Mobile Gap Is Where Websites Actually Fail

Fact: the median performance score of a mobile audit is 65. The median desktop audit scores 84. Only 12.8% of mobile audits reach the “Good” band of 90 or more, against 41.1% of desktop audits, and 19.8% of mobile audits score below 50.

Comparing two different groups of sites could hide a selection effect, so the cleanest test is the 131 sites that were audited on both devices. For those sites the median mobile score is 63 and the median desktop score is 82. Mobile scored lower on 78.6% of them; the median gap is 15 points, and 38.9% of sites lose 20 points or more when the same page is loaded on a simulated phone. Of the 50 sites that scored 90 or better on desktop, 35 did not reach 90 on mobile.

Largest Contentful Paint: the metric that breaks on phones

Largest Contentful Paint (LCP) measures how long the biggest visible element takes to appear. Google's web.dev threshold calls 2.5 seconds “good” and anything over 4 seconds “poor”. Greadme stores the LCP check whenever a page misses the good threshold, along with the measured value, which allows the distribution of failing pages to be reconstructed.

Among the 181 mobile audits that missed the LCP target, the median LCP was 6.3 seconds, and 78.5% were over 4 seconds. Combining the failure rate with that distribution gives the implied share of all mobile homepages in the sample: 69% paint their largest element after 4 seconds, 46% after 6 seconds, and 25% after 10 seconds. On desktop the implied share over 4 seconds is 8%.

Layout shift is the one Core Web Vital most sites already handle: only 13.5% of mobile and 16.9% of desktop audits exceed a CLS of 0.1. Blocking time is split: 37.7% of mobile audits exceed 200 ms of Total Blocking Time, and among those the median is 525 ms.

Interpretation: most owners audit on desktop (81% of first audits ran on desktop, which was Greadme's default until September 2026), so most owners see a number in the 80s and stop worrying. The same page on a simulated phone is a different product. Since Google indexes the mobile version, the desktop score is the one that matters least.

What makes the slow sites slow

Since May 2026 every audit also stores page-weight diagnostics. On the 89 desktop audits with that data, the median homepage transfers 1.9 MB across 53 requests and 16 script files; 65% exceed 1 MB and 25% exceed 5 MB. The relationship between weight and score is strong: the log of page bytes correlates with the performance score at −0.56, and Total Blocking Time at −0.67.

The individual checks point the same way. Of the 114 sites audited with the current check set (May–September 2026): 78.9% have long main-thread tasks, 73.7% load render-blocking resources, 68.4% have layout shifts, 67.5% deliver images inefficiently, 66.7% ship unused JavaScript, 59.6% have poor cache policies, 58.8% trigger forced reflows and 43.9% ship legacy JavaScript for browsers nobody uses. Across the full 643-site sample, 44.5% log errors to the browser console on the homepage and 41.4% render images without explicit dimensions.

Finding 3: The Accessibility Score Is Hiding the Problems

Fact: the median accessibility score is 89 and 82.7% of sites land in the “Good” band (80 or above). At the same time, 92.5% of sites fail at least one accessibility check, the median site fails three, and of the 532 sites that score “Good”, 91% still fail at least one check.

Contrast is the story. It fails on 68.7% of sites, and the failing sites have a median of 7 offending elements, with a quarter of them at 17 or more. The next two failures, link names and heading order, are the kind a screen-reader user hits on every page: a link that reads “link” and an outline that jumps from H1 to H4.

Interpretation: the score is weighted, so a site can lose a few points for contrast on dozens of elements and still read as “Good”. The number reassures, while the list underneath it describes a page that a low-vision visitor cannot read. Treat the score as a summary and the check list as the finding.

Finding 4: Two Kinds of Websites

Fact: across 625 sites, the correlation between the performance score and the meta-tag score is 0.00. Performance and accessibility correlate at 0.21; accessibility and meta tags at 0.06. Knowing that a site is fast tells you nothing about whether its SEO basics are in place.

The live sweep identified the platform behind 551 homepages from their HTML and response headers. WordPress runs 36.7% of them, Next.js 19.2%, Shopify 3.3%, Wix 2%, Webflow 2%, and 33.4% are custom or unidentified (the last group is mostly hand-built JavaScript sites). Joining that to the audits produces two clearly different populations.

Meta-tag and structured-data rows use the sites audited from December 2025 onward (WordPress n = 78–106, Next.js n = 60–70, custom n = 102–123). Shopify (n = 18), Wix (n = 11) and Webflow (n = 11) are too small to tabulate; Shopify stores stood out for sending CSP on 94% and HSTS on 100% of homepages, and every one of them served an llms.txt.

Interpretation: WordPress sites arrive with an SEO plugin that writes the canonical tag, the Open Graph block, the structured data and, since 2025, the llms.txt, so the metadata is nearly perfect (only 7.7% miss a canonical). They pay for it in weight: a median desktop score of 78 against 91 for Next.js, and the highest contrast-failure rate of any group, which points at theme defaults rather than individual designers. Custom-built sites are the mirror image: fast, and missing a canonical tag more than half the time. The 61 sites on hosted subdomains (developer portfolios and side projects) are the extreme case, with a median performance score of 93 and a median meta-tag score of 55.

The security headers follow the platform too. 84.9% of Next.js sites send HSTS because their host adds it; 18.8% of WordPress sites do, even though 49.5% of them sit behind Cloudflare. The header is a hosting decision far more often than a site-owner decision.

Finding 5: The SEO Basics Are Still Not Basic

Fact: of 305 sites audited from December 2025 onward, 34.8% get all six on-page basics right: a title, a meta description, a canonical tag, complete Open Graph tags, any structured data, and HTTPS. 25.9% manage three or fewer. The median site passes five.

The title tag is nearly universal (98.4% present), and the ones that exist are reasonable: median 48 characters, with 19.8% over 60 characters and 25.7% under 30. Meta descriptions, where present, have a median of 139 characters; 22% run past 160. Canonical tags are the weak point: 31.2% of homepages have none, and of those that do, 91.5% point at themselves while 5.7% point at a different host (mostly a staging or preview deployment pointing at the production domain, which is correct).

Two smaller numbers deserve mention because they are the kind of mistake that costs everything. Six of the 308 homepages (1.9%) carry a noindex robots meta tag, five of them noindex, nofollow, on a site the owner was checking for search visibility. And 42.2% of homepages have no robots meta tag at all, which is not a problem (the default is index, follow), so it is not counted as one here even though Greadme flags it.

Structured data: present, valid, and mostly boilerplate

Fact: 63% of 387 sites have structured data on the homepage. Where it exists it is almost always well-formed (91% pass validation with no errors) and almost never complete: 99.2% of sites with structured data carry at least one warning, with a median of four.

52% of the sites with structured data declare only the generic types a plugin writes for every page (WebSite, WebPage, Organization, BreadcrumbList and their relatives). The most common warnings are all about the Organization entity: no address (63.5% of sites with structured data), no contact information (53.3%), no description (53.3%), no sameAs links to the company's other profiles (31.1%). The most common actual error, on 11 sites, is an Organization with no logo. 43.9% of all sites declare at least one type that can qualify for a rich result.

Interpretation: structured data adoption is a plugin-adoption number (97% of WordPress sites versus 38% of custom sites), and what the plugin writes is a skeleton. The entity information that search engines and AI systems can actually use, who the organisation is, where it is, how to reach it and what else it is called, is the part left blank. The free Greadme Schema Validator lists those blanks for any URL without an account.

Finding 6: The AI Crawler Panic Is Not in the Data

Fact: on September 7, 2026, 601 of the audited domains were reachable and had their robots.txt evaluated for twelve AI-related crawlers using Greadme's own rules engine. 81.7% of sites have a robots.txt. 0.7% (4 sites) block an AI search crawler, 0.8% (5 sites) block a user-triggered AI fetcher, and 0.5% (3 sites) block Googlebot. Three of those sites disallow everything for every user agent, which reads as an unfinished site rather than an AI policy; the other two name a single Perplexity or ChatGPT agent inside a list that is otherwise about training crawlers.

Training crawlers are a different matter, and the pattern is precise. 9.8% of sites block at least one training crawler, 9.2% block training while leaving every search crawler open, and of the 59 sites that block training, 74.6% block all five training bots at once and 86.2% sit behind Cloudflare (Cloudflare fronts 40.5% of the whole sample). 22.3% of sites name at least one AI crawler explicitly in robots.txt; among those, 41.8% block a training bot and 0.7% block a search bot.

Interpretation: the widely repeated claim that many sites “accidentally block AI” does not appear in this sample. Sites that block do so deliberately, for training only, and the all-five, Cloudflare-heavy pattern is consistent with a one-click managed block list rather than hand-written rules. Search visibility in AI answers is not being thrown away in robots.txt. If a site is missing from AI answers, robots.txt is almost never the reason.

The surprise: one in three sites already has an llms.txt

Fact: 208 of 601 sites (34.6%) serve a real llms.txt file. Adoption is a platform story, not an owner story: 100% of Shopify stores, 90.9% of Wix sites and 54% of WordPress sites have one, against 23.6% of Next.js sites and 19.6% of custom sites. 81 of the 208 files identify their generator in the first line: 73 name one of three WordPress SEO plugins and 8 name a standalone generator. With the 28 Shopify and Wix files, at least 52% were written by a platform or plugin, and the sites on hosted developer subdomains almost never have one (3.3%).

A related signal is spreading the same way: 8.7% of sites now carry Content-Signal directives in robots.txt, and 90.2% of those sit behind Cloudflare, which injects the directive into the robots.txt files it manages.

Interpretation: llms.txt reached a third of the sample without a third of the owners deciding anything. Google has said it does not use the file, a point covered in Greadme's guide to llms.txt, so the practical effect is unproven either way. What the number does show is how fast a default can move the web: adoption is set by four vendors, not by 208 decisions. The Greadme AI Access Checker reports both the per-bot verdicts and the llms.txt status for any site, free and without an account.

Finding 7: When Owners Ask AI About Their Own Category, It Rarely Answers With Them

Fact: 23 sites ran Greadme's AI Visibility check between February and August 2026. Each check asks GPT, Claude and Gemini two owner-chosen questions about the site's category (six answers per site) and records whether the site's domain is mentioned. 69.6% of sites were mentioned in none of the six answers. Across all 138 answers, 12.3% mentioned the site. Per model, GPT and Claude each mentioned 21.7% of sites at least once; Gemini mentioned 13%.

Interpretation, with caution: 23 sites is a small sample, the prompts were chosen by the owners (only one of the 23 included the brand name), and the sites are a mix of small local businesses, software products and personal portfolios. The figure is indicative, not a market rate. It is still the most direct measure in this dataset of the gap between “AI can crawl my site” (true for 99% of sites above) and “AI recommends my site” (true for 30%). Crawlability is necessary and nowhere near sufficient. The Greadme AI Visibility Checker runs this test for a site's own prompts.

Finding 8: Site-Wide, the Same Mistakes Repeat on Every Page

Greadme Site Audit crawls a whole site rather than one page. The stored crawls cover 55 sites, of which 44 returned at least one crawled page (2,884 pages in total). Seven large sites account for 62% of the pages, so the figures below are reported per site (share of sites with at least one affected page) rather than per page, which would mostly describe those seven.

At page level, 14.2% of successfully crawled pages have no H1, 6% have more than one, 4.1% have no title and 1.7% of crawled pages returned a 404. Of the 31,668 images the crawler saw, 50% have no alt text. Image formats are still old: 30% JPEG and 22.4% PNG against 1.4% WebP and 0.1% AVIF (43.8% had no recognisable extension, typically CDN-transformed URLs, so the modern share may be understated).

Interpretation: the single-page audit understates the site. A homepage with a hand-written description sits above hundreds of templates that have none, and the alt-text gap on half of all images is the largest single accessibility failure in the dataset by volume. This sample is small (44 sites) and should be read as direction, not precision.

Do Sites Improve After an Audit?

Fact: 105 site-and-device pairs were re-audited at least one day after the first audit, with a median gap of 28 days. 61.9% scored higher the second time, 31.4% lower. The median change in total score is +1 point; the median change in performance is +2. Meta-tag scores moved most, up 8.6 points on average, because a missing description or canonical is a one-line fix. Accessibility barely moved (median 0).

Interpretation: the cheap fixes get done and the expensive ones do not. Adding a canonical tag takes a minute; removing 3 MB of JavaScript takes a project. The re-audit data is also biased toward engaged owners, so the true improvement rate across all 643 sites is lower than 62%.

Which Problems Explain the Poor Scores?

On the 114 sites audited with the current check set, the median site fails 9 scored checks, out of 66 distinct checks that failed at least once. The failures concentrate: the top four (render-blocking resources, text contrast, forced reflows and Speed Index) account for 27.9% of every failure recorded, and the top twelve for 57.8%. Fixing render-blocking CSS and JavaScript, the largest images, and the colour palette would clear the most common failure on most sites.

Among the lab metrics, Total Blocking Time is the strongest single predictor of a poor performance score (correlation −0.67), ahead of LCP (−0.59) and page weight (−0.56). Layout shift is the weakest (−0.52), which matches its low failure rate: sites have largely solved CLS and largely not solved JavaScript.

What Surprised Us

• Zero sites passed every security check. Not a low number: none. Even the live check found only 4.7% sending all four common headers.
• llms.txt is on a third of sites while the industry still debates whether to create one. The platforms decided.
• Accidental AI blocking is a myth in this sample. Search crawlers are blocked on under 1% of sites. Training crawlers are blocked on 10%, almost always all at once and almost always through Cloudflare.
• Performance and SEO hygiene have a correlation of exactly 0.00. They are different skills held by different people, and the platform a site runs on predicts which one it has.
• WordPress sites have the worst contrast failure rate (81.7%), which suggests theme defaults, not designers, are choosing the grey-on-white text.
• A quarter of mobile homepages take more than 10 seconds to paint their largest element in the lab. The desktop scores their owners looked at were mostly in the 80s.
• Six homepages carry noindex on a site the owner was auditing for visibility.

Limitations and Sampling Bias

• Self-selected sample. These are sites whose owners chose to audit them, on a tool whose users are mostly on a free plan. Sites with an engaged owner are probably better than average, and sites that were audited because something was wrong are probably worse. The two biases pull in opposite directions and cannot be separated.
• Geography. 33% of sites are on an Israeli domain (.co.il, .org.il) and 38% on .com. The sample over-represents Israeli small businesses, which also inflates the WordPress share.
• Lab, not field. Every performance number is a simulated Lighthouse run through Google's PageSpeed API, not real-visitor data. Lab LCP on a simulated slow phone is systematically slower than the field LCP of a real audience on modern devices; the mobile findings describe the page under load, not the typical visit.
• One page per site. 91% of audits were homepages. Inner pages, which the Site Audit section shows are usually worse, are under-represented.
• Device choice was not random. Desktop was the default until September 2026, so the 227 mobile audits were chosen deliberately by their owners; those owners may be more sophisticated than average.
• The check set changed over time, which is why the security (n = 112), lab metric (n = 89) and meta-tag (n = 308) sections have smaller samples than the score sections (n = 643). A percentage on n = 112 carries roughly ±9 points of sampling uncertainty at 95% confidence; on n = 643 roughly ±4.
• Platform detection is heuristic. It reads signatures in the homepage HTML and headers. It is reliable for WordPress, Next.js, Shopify, Wix and Webflow, and the “custom / other” group certainly contains some misfiled sites.
• Small sub-samples. The Site Audit (44 sites) and AI Visibility (23 sites) findings are directional. Greadme's Content Audit data (4 non-internal results) was too small to use at all and is not reported.
• Time span. Audits span 15 months. Sites and Lighthouse both changed during that period; no trend claims are made because the sample composition shifted at the same time.

What This Means for Website Owners

1. Add the headers this week. HSTS, X-Frame-Options (or a frame-ancestors CSP) and X-Content-Type-Options are one configuration block each and carry no performance cost. That alone moves a site from the 36% sending nothing into the top 5%. A real Content Security Policy is a project; start with report-only mode.
2. Audit on mobile, and believe that number. Read the mobile score as the site's score. If LCP is over 4 seconds, the fix is nearly always the hero image (size, format, preload) and the JavaScript that runs before it paints.
3. Read the accessibility checks, not the score. Fix contrast in the theme once and it fixes every page. Name every icon link and button.
4. Know which kind of site you have. On WordPress, the metadata is handled and the budget should go to weight: images, plugins, fonts. On a custom build, the speed is handled and the budget should go to the canonical tag, the description, Open Graph and an Organization entity with an address, contact details and sameAs links.
5. Stop worrying about robots.txt and AI. Check it once; it is almost certainly open. Then spend the effort on being the site an AI would cite: named authors, an Organization entity that says who you are, pages that answer the question a customer asks.
6. Run the site-wide crawl, because the homepage is the page you have already fixed. The template pages are where the missing descriptions, missing H1s and alt-less images live.

Frequently Asked Questions

What is the average website performance score in 2026?

In this sample of 643 sites, the median performance score on the first audit was 80 overall: 84 on desktop and 65 on mobile. 51% of sites scored 80 or above on their first (mostly desktop) audit, 12.3% scored below 50, and 6.2% scored a perfect 100.

What percentage of websites have a Content Security Policy?

26.5% of 551 audited homepages sent any Content-Security-Policy header on September 7, 2026. In the deeper audit of 112 sites, 69% had no CSP and only one site had a CSP without a high-severity weakness.

How many websites block AI crawlers?

Of 601 sites checked, 9.8% block at least one AI training crawler (GPTBot, ClaudeBot, Google-Extended, Applebot-Extended or Meta-ExternalAgent) and 0.7% block an AI search crawler (OAI-SearchBot, Claude-SearchBot or PerplexityBot). 0.5% block Googlebot, in every case by disallowing all crawlers.

How many websites have an llms.txt file?

34.6% of 601 sites served a real llms.txt on September 7, 2026. Adoption is highest on Shopify (100%), Wix (91%) and WordPress (54%), where the platform or an SEO plugin generates the file, and lowest on custom-built sites (20%).

How common are missing meta descriptions and canonical tags?

On 308 homepages audited since December 2025, 17.2% had no meta description and 31.2% had no canonical tag. Only 1.6% had no title tag. Only 46.1% had a complete set of Open Graph tags and 3.6% a complete set of Twitter Card tags.

How was this research produced?

By read-only analysis of Greadme's production database plus one live sweep of the same domains, on September 7, 2026. Duplicates were collapsed to the first audit per site, internal test accounts and Greadme's own domains were excluded, and every statistic states its own sample size and date range. No figure in this report is estimated or sourced from outside Greadme's data.