What 28 real website audits
actually found.
Every statistic below is computed from our own report corpus — 1,460 findings across 28 full-pipeline audits of real websites. No invented industry numbers, no "studies show" — just what a deterministic, 260+-check audit engine found, with the methodology and its limits stated plainly.
The statistics, in one paragraph
1,460 findings across 28 audits
Every figure on this page — including these — is generated by a script from the audit corpus, so a re-run over a bigger corpus updates the page, not a hand-typed table.
Read this before citing any number
What the sample is
28 full-pipeline audits of real websites, each crawling a median of 25 pages (a few test crawls in the sample ran shallower or deeper than the standard 25-page audit) with the same deterministic engine, versions 0.0.95–0.0.102 (260+ checks), plus a live security examination. Every run produced a machine-readable audit.json; every number here is computed from those files.
What it is not
Not a random sample of the web. The sites belong to owners who chose to order an audit — a self-selected group, weighted toward small businesses that suspected a problem. Expect the true averages for all sites to look better than these.
What counts as a "finding"
A distinct issue the engine raised for a site, at one of three severities: error (broken or unsafe), warning (works but wrong or risky), info (worth knowing). Repeated instances of the same issue on one site count once.
Reproducibility
The page is generated by ops/stats_page.py, which recomputes every figure from the corpus. Client reports stay private; only these aggregates are published, and they carry a Dataset schema for citation.
Most of what's broken isn't on fire
Errors are the tip of the iceberg: 11% of findings. The bulk — 75% — is warnings: things that work but are slow, risky, invisible to search engines or AI assistants, or quietly costing you visitors.
Where the problems live
1,460 findings across 18 categories. Performance and accessibility lead — followed closely by security, which is exactly what free scanners don't examine.
How uneven the damage is
Median 56, but the spread runs from 11 to 91 findings. Even the best site in the sample wasn't clean — and the worst had more than five times the median.
The same 13 issues, everywhere
The findings that showed up most often across all 28 sites. If your site hasn't been audited, odds are several of these are on it right now.
| # | Finding | Category | Severity | Sites affected | Share |
|---|---|---|---|---|---|
| 1 | Content Security Policy | Security | warning | 27 of 28 | 96% |
| 2 | Markdown Response | Agent Experience | info | 27 of 28 | 96% |
| 3 | Meta Description | Core SEO | error | 27 of 28 | 96% |
| 4 | Sub-processor Disclosure | Legal Compliance | info | 27 of 28 | 96% |
| 5 | Open Graph Tags | Core SEO | warning | 25 of 28 | 89% |
| 6 | llms.txt | Agent Experience | info | 25 of 28 | 89% |
| 7 | Critical Request Chains | Performance | warning | 24 of 28 | 86% |
| 8 | Keyword Stuffing | Content | warning | 23 of 28 | 82% |
| 9 | Privacy Policy | E-E-A-T | warning | 23 of 28 | 82% |
| 10 | Word Count | Content | warning | 23 of 28 | 82% |
| 11 | H1 Tag | Core SEO | error | 22 of 28 | 79% |
| 12 | Token Weight | Agent Experience | warning | 22 of 28 | 79% |
| 13 | X-Frame-Options | Security | warning | 22 of 28 | 79% |
"Sites affected" counts each site once per finding, out of 28 audited — a finding raised on the same site at two severities (e.g. Meta Description, error on some sites and warning on others) still counts that site once, and its most severe form is shown. When findings tie at the cut-off count, every tied finding is shown — the table can carry more than twelve rows. Same corpus, same per-site counting, as the /what-is/ definition series — recomputed by ops/stats_page.py, never typed.
Take the numbers, name the source
This page carries a Dataset schema, so agents and writers can cite it unambiguously. The one-line version:
Source: YourSiteIsBroken, Website audit statistics (2026), 28 full-pipeline audits of self-selected, mostly small-business sites (median 25 pages each). Related: best website audit tools, ranked honestly · audit options compared.
Fair questions, straight answers
Is this a scientific study of the web?
No, and we won't pretend otherwise. The sample is 28 real audits of real sites, and the site owners chose to have them audited — a self-selected group, skewed toward small-business sites that suspected something was wrong. Treat the numbers as 'what a competent audit finds on ordinary small-business sites', not as a survey of the internet.
Where does the data come from?
From our own audit engine, a deterministic rule-based crawler that runs 260+ checks over a median of 25 pages per site, plus a live security examination. Each run writes a machine-readable audit.json; the numbers on this page are computed from those files by a script (ops/stats_page.py), never typed by hand. Individual client reports stay private — only these aggregates are published.
Can I get the raw data?
Not the client reports — those are private. What you can do is cite the aggregate numbers on this page (they carry a Dataset schema), or run the same engine on your own site for £7.99 and get your own 25-page report with every finding explained and prioritized.
What does a median of 56 findings per site actually mean?
It means a typical site in this sample had 56 distinct issues worth fixing — spanning performance, accessibility, security, SEO, content and AI-readiness. Most were warnings rather than outright errors; errors averaged about 6 per site. A clean bill of health was rare: 26 of the 28 sites scored an F grade overall.
When is this page refreshed?
Every January. The script that computes every number re-runs over the grown corpus, the counts and year in the title are updated, and the sitemap lastmod is bumped. Figures on this page reflect audits run between 2026-09-12 and 2026-10-07.
Your site is one of the 28+ — find out which kind.
Enter your URL and pay securely — your report PDF lands in your inbox in ~30 minutes.