We scanned 304 web agency front pages. Here is what failed most.
Web agencies sell accessibility, security and privacy work to their clients. So I wanted to know how their own front pages do. Between 16 September and 23 October 2026, I scanned the front pages of 304 third-party web d
Web agencies sell accessibility, security and privacy work to their clients. So I wanted to know how their own front pages do.
Between 16 September and 23 October 2026, I scanned the front pages of 304 third-party web design and development agencies with Sitejar, the scanner I build. Each site got one read-only scan of its front page, across six areas: accessibility, security, privacy, deceptive design, technical quality and SEO. No site is named, and no published figure describes fewer than five sites.
This extends an earlier 57-site study about fivefold, so most figures now carry an interval of roughly plus or minus five points instead of twelve.
The headline numbers
- Accessibility: at most 1 of the 304 front pages had no accessibility finding. 99.7% or more fell short.
- Security: 91% fell short of full marks.
- Privacy: 85% fell short.
- Technical quality: 84% fell short.
- SEO: only 12% fell short, and none by more than six points.
- Deceptive design: no findings at all. More on why below.
The most common findings
| Finding | Share of sites | 95% CI |
|---|---|---|
| Low text contrast | 82% | 77.5 to 86.1 |
| Missing Content-Security-Policy header | 61% | 55.6 to 66.5 |
| Link without a discernible name | 39% | 33.8 to 44.7 |
| Missing Strict-Transport-Security header | 38% | 32.9 to 43.7 |
| Content outside any landmark region | 36% | 31.0 to 41.7 |
| No link to an accessibility statement | 29% to 30% | 24.8 to 35.0 |
| Third-party cookie set before consent | 21% to 22% | 17.4 to 26.7 |
| Tracking script loading before consent | 21% | 17.1 to 26.3 |
| Form field missing a label | 20% | 15.9 to 24.9 |
Some shares are given as a range because one site, our own, was removed from the sample after counting. The paper explains exactly how that was handled.
Contrast fails about as often as on the rest of the web
The WebAIM Million 2026 report found low contrast text on 83.9% of the top million home pages. We found it on 82% of agency front pages. The tools and rules differ, so this is not a direct comparison, but it is close enough to notice.
Low contrast is rarely a skill problem. It is usually one design decision: a light grey for captions, placeholders or a footer, defined once as a token and inherited everywhere. Thin type and soft greys look refined on a big, bright monitor and fail the 4.5:1 ratio. The fix is just as systematic: change the token once, at the source.
Where agencies do better
On structural accessibility, agency front pages looked much better than the web as a whole. WebAIM reports missing alt text on 53.1% of home pages; we saw it on 11%. Missing form labels: 51% there, 20% here. Buttons without an accessible name: 30.6% there, 12% to 13% here. Rule definitions differ, so read these as a direction, not exact gaps.
Security headers point the same way. About 39% of agency front pages sent a CSP and about 62% sent HSTS, both higher than the HTTP Archive Web Almanac 2025 reports for the web overall. Still, a majority had no CSP at all.
Tracking before consent
A third-party cookie was set before any consent choice on 21% to 22% of sites, and a tracking script loaded before consent on 21%. Our tallies don't record how many sites had both, so the safe statement is this: at least a fifth of agency front pages started tracking before the visitor chose anything, and the true share could be close to twice that.
Why deceptive design came back clean
Zero findings in 304 scans does not mean agencies never use dark patterns. Those patterns live in flows: checkouts, subscription forms, cancellation pages. An agency front page is mostly a portfolio, a services summary and a contact form, so there was very little for those rules to test. A score of 100 here means nothing was found where there was little to find.
Limits
This is one page, scanned once, by machine. No crawl, no logins, no clicks on consent banners, no form submissions. Sites that block automated visits were not scanned, so the sample favours agencies that are easy to find and allow scanning. A scan like this does not replace human review.
If you run an agency site
The three most common problems are also among the cheapest to fix: your grey text tokens, a Content-Security-Policy header and an HSTS header. The last two are server or CDN configuration, not page code.
Read the full paper
The full method, all 25 reported findings and the comparison with the earlier 57-site study are in the paper: Web Agency Front Pages at Scale: A Six-Dimension Benchmark of More Than 300 Sites.
DOI: 10.5281/zenodo.23986917. The earlier 57-site study: 10.5281/zenodo.23986811.
If you want to check your own front page, Sitejar has a free plan.
Originally published by Dev.to Security. Aggregated on AIWithGhost for educational purposes β full credit and traffic to the original publisher.