Website readiness research · Snapshot 23 October 2026
The state of website readiness
We checked 46,473 popular websites from the Status Is Down catalog for 31 public configuration practices that make sites faster, safer and easier to find. Here is what the web gets right, what it skips, and how to fix it on your stack.
- Sites checked
- 46,473
- Practices checked
- 31
- Median readiness index
- 64/100
- Site profiles
- 14,332
40,095 published after exclusions
across four lanes
weighted share of measured checks observed
Chrome UX Report top-50K sites
Key findings
- Only 10% of sites spread their nameservers across more than one DNS operator, so for most sites a single DNS provider problem would reach every visitor.
- 67% already use certificates valid for 100 days or less, the public maximum from 15 March 2027. The rest still renew on longer cycles.
- 34% send HSTS with at least a one-year max-age, even though 91% redirect plain HTTP to HTTPS.
- 7.1% publish a security.txt file telling security researchers how to contact them, and 13% restrict which certificate authorities may issue for them.
- 37% advertise HTTP/3 and 40% of image-heavy homepages serve WebP or AVIF.
- The most popular sites are only slightly ahead: the median readiness index is 67 in the Top 1K band and 63 in the Top 1M band.
All 31 checks by lane
Share of measured sites where each practice was observed. Select a check for the method, stack-specific fixes and category comparisons.
Enable 77/100
Crawlability, discoverability, mobile readiness and clean redirects.
Harden 56/100
Transport security, certificates, DNS integrity and safe browser defaults.
- HTTP requests move to HTTPS91%
- HSTS kept for at least a year34%
- TLS 1.3 negotiated91%
- Certificate has more than 14 days left99%
- Certificate lifetime of 100 days or less67%
- CAA records limit who can issue certificates13%
- DNSSEC signed8%
- security.txt published7.1%
- DMARC policy enforces quarantine or reject39%
- X-Content-Type-Options: nosniff48%
- Framing restricted51%
- Content Security Policy present32%
- Referrer-Policy set24%
Accelerate 64/100
Delivery protocols, compression, caching and image and script loading.
Recover 10/100
Choices that limit how far a single provider problem can spread.
By popularity band
Median readiness index and lane scores for each Chrome UX Report popularity band.
| Band | Sites | Median index | Enable | Harden | Accelerate | Recover |
|---|---|---|---|---|---|---|
| Top 1K | 473 | 67 | 73 | 62 | 67 | 14 |
| Top 5K | 2,125 | 66 | 76 | 57 | 65 | 11 |
| Top 10K | 2,537 | 66 | 78 | 57 | 65 | 11 |
| Top 50K | 18,725 | 64 | 76 | 56 | 63 | 10 |
| Top 100K | 5,291 | 64 | 77 | 57 | 64 | 11 |
| Top 500K | 5,375 | 64 | 77 | 56 | 64 | 11 |
| Top 1M | 5,569 | 63 | 78 | 54 | 64 | 11 |
Category benchmarks
42 categories with at least 50 profiled sites. All categories
| Category | Sites | Median index | Biggest gap |
|---|---|---|---|
| E-Commerce & Marketplaces | 5,718 | 71 | HSTS kept for at least a year |
| News & Media | 3,856 | 68 | HSTS kept for at least a year |
| Education & Online Learning | 1,516 | 61 | HSTS kept for at least a year |
| Government Services | 954 | 53 | Modern image formats in use |
| Cars & Automotive | 703 | 66 | HSTS kept for at least a year |
| Literary & Knowledge | 696 | 62 | HSTS kept for at least a year |
| Sports Broadcast & Fantasy Games | 677 | 64 | HSTS kept for at least a year |
| Fitness & Health | 613 | 67 | HSTS kept for at least a year |
| Banking & Finance | 549 | 66 | Modern image formats in use |
| Entertainment & Video Streaming | 536 | 62 | HSTS kept for at least a year |
| Puzzles & Video Games | 522 | 60 | HSTS kept for at least a year |
| Web Tools | 492 | 67 | HSTS kept for at least a year |
| Gaming Platforms & Consoles | 485 | 62 | HSTS kept for at least a year |
| Travel Bookings & Trip Planning | 478 | 68 | HSTS kept for at least a year |
| Business Tools | 469 | 63 | HSTS kept for at least a year |
| Food & Grocery Delivery | 413 | 68 | HSTS kept for at least a year |
| Events & Online Ticketing | 387 | 63 | HSTS kept for at least a year |
| Job Portals, HR & Recruitment | 382 | 65 | HSTS kept for at least a year |
| Forums & Communities | 377 | 62 | HSTS kept for at least a year |
| Design & Content Creation | 356 | 69 | HSTS kept for at least a year |
| Uncategorized | 343 | 62 | HSTS kept for at least a year |
| Online Publishing | 306 | 64 | HSTS kept for at least a year |
| Telecommunications & Internet | 285 | 67 | Static files cached for 30 days or more |
| Audio & Music Streaming | 277 | 66 | HSTS kept for at least a year |
| Real Estate & Property Listings | 254 | 66 | HSTS kept for at least a year |
| Stock & Crypto Trading | 241 | 69 | HSTS kept for at least a year |
| Data & Analytics | 233 | 63 | HSTS kept for at least a year |
| Programming & Software | 231 | 68 | HSTS kept for at least a year |
| Dating Apps | 218 | 58 | HSTS kept for at least a year |
| Insurance & Financial Planning | 203 | 69 | security.txt published |
| Trains & Public Transport | 203 | 60 | Modern image formats in use |
| Social Media & Networking | 193 | 63 | HSTS kept for at least a year |
| Ratings & Reviews | 190 | 66 | HSTS kept for at least a year |
| Weather Forecast | 190 | 63 | Modern image formats in use |
| Postage & Courier Services | 185 | 60 | HSTS kept for at least a year |
| Hotels | 176 | 66 | HSTS kept for at least a year |
| Online Payment & Wallets | 157 | 64 | Static files cached for 30 days or more |
| Energy, Electricity & Gas | 132 | 64 | Modern image formats in use |
| Workplace Productivity | 125 | 66 | Static files cached for 30 days or more |
| Cloud Storage & File Transfer | 118 | 57 | HSTS kept for at least a year |
| Generative AI Chatbots & Assistants | 94 | 73 | HSTS kept for at least a year |
| Airlines | 91 | 63 | Modern image formats in use |
Stack playbooks
- WordPress4,581 sites
- Next.js2,897 sites
- WordPress on Cloudflare1,893 sites
- Shopify1,642 sites
- Next.js on Cloudflare888 sites
- Next.js on Amazon CloudFront688 sites
- Drupal635 sites
- Nuxt630 sites
- Adobe Experience Manager456 sites
- Next.js on Vercel331 sites
- WordPress on Amazon CloudFront291 sites
- Magento / Adobe Commerce270 sites
Provider benchmarks
- CloudflareCDN and edge platform
- Amazon CloudFrontCDN and edge platform
- Google edgeCDN and edge platform
- AkamaiCDN and edge platform
- CloudflareDNS operator
- Amazon Route 53DNS operator
- Akamai Edge DNSDNS operator
- GoDaddy DNSDNS operator
- Google Trust ServicesCertificate authority
- Let's EncryptCertificate authority
- DigiCertCertificate authority
- AmazonCertificate authority
Check your own site
Run the same 31 checks live on any domain, then keep a private action plan in a free owner workspace.
Method, cohort and limits: how we measure. Live status and incident history for websites are on Status Is Down.