The state of UK websites
In October 2026 we ran XKey's SEO check on 927 .uk home pages – 585 everyday sites and 342 of the 500 most-linked – and looked up the email security of 1,497 domains. Here's what we found.
Last updated · By the XKey team
Key findings
- 87% of everyday .uk domains don't protect their email with an enforced DMARC policy (62% have no DMARC record at all), so anyone can send email pretending to be them. Among the top 500 it's 34%.
- The average everyday site scores 67 out of 100 on XKey's SEO check, against 74 for the top 500. Only 0% score 90 or more.
- 65% have a problem with their title tag – the single most important line for Google – and 63% with their meta description.
- 68% of everyday sites have no tap-to-call or email link on the home page, so phone visitors can't contact them in one tap.
- Almost nobody blocks AI search. Just 4% of everyday sites block any AI crawler in robots.txt (13% of the top 500), but 72% have none of the question-and-answer content AI answers like to quote.
- WordPress runs 45% of everyday .uk sites where we could tell the platform.
Google basics
The share of home pages that passed each of XKey's checks with no problems:
| What we checked | Everyday .uk sites | Top 500 .uk sites |
|---|---|---|
| Title tag with no problems | 35% | 39% |
| Good meta description | 37% | 54% |
| One clear H1 heading | 38% | 44% |
| Working XML sitemap | 64% | 61% |
| Correct canonical tag | 64% | 75% |
| Valid structured data (JSON-LD) | 51% | 53% |
| Social share cards (Open Graph) | 37% | 50% |
| Enough words to rank | 50% | 69% |
Titles and descriptions are the cheapest fixes on any site: they take minutes and change what people see in Google. See how to write title tags and meta descriptions.
Email security: most small sites can be spoofed
| What we checked | Everyday .uk sites | Top 500 .uk sites |
|---|---|---|
| No DMARC record | 62% | 10% |
| DMARC set to monitor only (p=none) | 24% | 24% |
| DMARC quarantine | 8% | 28% |
| DMARC reject (fully protected) | 5% | 38% |
| No SPF record | 41% | 7% |
Since 2024 Gmail, Yahoo and Microsoft have pushed senders to set up SPF, DKIM and DMARC, and messages from domains without them are more likely to land in spam. Some domains in the sample don't send email at all (31% of everyday domains have no mail servers) – but those still need a DMARC record so nobody can fake mail from them. Check yours with the DMARC checker and SPF checker, then follow our step-by-step DMARC rollout.
AI search: open doors, little to quote
| What we checked | Everyday .uk sites | Top 500 .uk sites |
|---|---|---|
| Block at least one AI crawler | 4% | 13% |
| Block GPTBot (ChatGPT training) | 3% | 10% |
| Block ClaudeBot | 3% | 10% |
| Block Google-Extended (Gemini training) | 2% | 8% |
| Have an llms.txt file | 16% | 9% |
| Clear about who they are (entity clarity) | 16% | 29% |
The average AI search readiness score was 55 for everyday sites and 62 for the top 500. Being reachable isn't the problem – being quotable is. See AI search optimisation or run the AI SEO checker.
Speed, security and phones
| What we checked | Everyday .uk sites | Top 500 .uk sites |
|---|---|---|
| Images properly sized and compressed | 23% | 10% |
| No render-blocking scripts or styles | 24% | 25% |
| Fast server response | 77% | 93% |
| http:// redirects to https:// | 83% | 98% |
| HSTS switched on | 25% | 62% |
| Mobile viewport set | 74% | 93% |
| Every image has alt text | 74% | 83% |
Heavy images were the most common speed problem. The page speed checker shows which ones, and the image compressor shrinks them in your browser. Missing alt text is also an accessibility problem – the accessibility checker finds it and other common WCAG issues.
What UK sites are built with
| Platform | Share of everyday sites |
|---|---|
| WordPress | 45% |
| Squarespace | 5% |
| Shopify | 5% |
| Wix | 4% |
| Webflow | 1% |
| Weebly / Square Online | 1% |
| GoDaddy Website Builder | 1% |
| Blogger | 1% |
| Custom or couldn't tell | 32% |
62% of everyday sites had no analytics we could detect, and 14% still load Universal Analytics, which stopped collecting data in 2023. 11% show a cookie consent banner. Find out what any site runs on with the website technology checker.
How we did the study
- Sample. From Common Crawl's public web graph (release cc-main-2026-jul-aug-sep), the 500 most-linked .uk domains, plus a random sample of 1,000 .uk domains ranked between 500,000th and 5,000,000th on the whole web – mostly small businesses, clubs and charities.
- Checks. XKey's own SEO check on each home page (the same one anyone can run), DNS lookups for SPF, DMARC and mail servers, robots.txt rules for nine AI crawlers, and the platform from the page's code.
- Politeness. One request at a time per site, our own user agent (XKeyResearch), and robots.txt obeyed – 22 sites that asked not to be crawled were skipped.
- Limits. 147 top sites and 404 everyday sites couldn't be checked: they were offline, parked, or blocked automated visitors. Percentages for page checks are of the sites we could read (585 everyday, 342 top); email figures cover every domain that answered DNS. Home pages only. We publish totals, never results for individual sites.
Cite this study
You're welcome to use these figures with a link to this page: XKey, "The state of UK websites", October 2026, https://xkey.co.uk/uk-website-study.
How does your site compare?
Run the free SEO check on your own home page – it's the same test every site in the study got – and compare your score with the averages above.
Frequently asked questions
How many UK websites have DMARC?
In our sample, 38% of everyday .uk domains had a DMARC record, but only 13% set it to quarantine or reject, which is what actually stops spoofing.
What is the average SEO score of a UK website?
67 out of 100 for everyday .uk sites and 74 for the 500 most-linked, on XKey's free SEO check.
How many UK websites block AI crawlers?
4% of everyday .uk sites and 13% of the top 500 block at least one AI crawler in robots.txt.
How up to date are these figures?
They were collected in October 2026. The date at the top of the page shows when the study was last run.
Run a free SEO check now
About 50 checks covering Google, AI search, speed, security and local SEO. No sign-up.
Want the fixes done for you? XKey is made by IceWork, a web studio in Blackpool. IceWork builds fast, search-ready websites – a 3-page site including domain and a year's hosting is £350 all in.