Two years ago, “is our website any good?” was mostly a matter of taste. In 2026, most of the answer is measurable, and some of it is the law. Speed is three numbers, two of which every major browser can now report. Accessibility has dated deadlines. Regulators check whether you honor a browser’s privacy signal. Many of your visitors aren’t people, and the packages your site is built from are a target. This guide sets out what good now looks like, who the rules apply to, and what to ask whoever builds your site.
Where I can, I use our own site as the evidence, flaws included.
Speed: Three Numbers, Measured on Real People
Google’s Core Web Vitals turn “fast” into three numbers, taken from real visits at the 75th percentile, mobile and desktop separately. A page passes only if it meets all three (LCP, INP and CLS thresholds below).
| Metric | What it measures | Good | Poor |
|---|---|---|---|
| Largest Contentful Paint (LCP) | How fast the main content appears | 2.5 seconds or less | Over 4.0 seconds |
| Interaction to Next Paint (INP) | How fast the page responds to taps and clicks | 200 ms or less | Over 500 ms |
| Cumulative Layout Shift (CLS) | How much the page jumps around | 0.1 or less | Over 0.25 |
Two changes made these numbers harder to ignore. On March 12, 2024, INP replaced First Input Delay, which only timed the first tap. And on December 12, 2025, Safari 26.2 shipped the measurement behind LCP and INP, so both now work in every major browser. Google’s public dataset, the Chrome UX Report, still counts only Chrome users.
Most sites still miss. In the 2025 Web Almanac, using July 2025 data, 48% of sites passed on mobile and 56% on desktop. Loading is the weak spot: only 62% had a good mobile LCP.
Platforms differ. Among online stores, 76% of Shopify sites passed, against about a third of WooCommerce and Magento sites. Among content management systems, 45% of WordPress sites passed on mobile, against 85% for Duda and 74% for Wix.
I don’t read that as a verdict on WordPress. It’s the median install, with its median theme and plugins; a well-built WordPress site can pass. The platform question deserves its own framework.
For search, Google says “Core Web Vitals are used by our ranking systems,” but good scores don’t guarantee top rankings; relevance still wins. I treat these numbers as an experience and conversion measure first.
The Browser Now Does Work You Used to Pay a Framework For
Browsers have shipped features that make a site feel fast and polished with very little code. Not all of them work everywhere, so use them as enhancements, never as dependencies. The shared vocabulary is Baseline: a feature is “Newly available” once it works in Chrome, Edge, Firefox and Safari, and “Widely available” 30 months later.
- Page-to-page transitions. Cross-document view transitions animate an ordinary multi-page site between pages with a few lines of CSS. Chrome, Edge and Safari 18.2 support them; Firefox doesn’t yet, so they aren’t Baseline, though they’re on the Interop 2026 list.
- Prerendering. Speculation rules let a browser fetch or render the next page before the click. Only Chromium browsers support them; Safari keeps them behind a flag. WordPress 6.8 switched on a cautious version by default.
- GPU graphics. WebGPU runs in Chrome, Edge and Safari 26 or later, but Firefox has it only on Windows and Apple Silicon Macs, not yet on Linux or Android, and it isn’t Baseline.
On our site, page-to-page transitions are pure CSS, switched off when a visitor’s device asks for reduced motion; in Firefox, pages simply load normally. Our particle field uses WebGPU where the browser has it and WebGL 2 elsewhere, and if neither runs, every panel still reads fine.
That’s the bar: better where the browser can do more, and nothing broken where it can’t.
Accessibility Has Dates Now, and They Depend on Who You Are
This is a summary, not legal advice. Check your own position with counsel.
In the EU, the European Accessibility Act has applied since June 28, 2025. It covers specific services provided to consumers, listed in the table below, and its definition of e-commerce turns on a consumer contract. Three details matter for planning:
- Microenterprises that provide services, meaning fewer than 10 people and no more than €2 million in turnover or balance sheet, are exempt.
- Excluded: archived content not updated after June 28, 2025, pre-recorded video and office documents published before then, and third-party content you don’t fund or control.
- Products already used to deliver a service can carry on until June 28, 2030.
The technical yardstick is the European standard EN 301 549, which today points to WCAG 2.1, the Web Content Accessibility Guidelines. Version 4.1.1, published September 2, 2026, moves to WCAG 2.2. As the law firm Davis Wright Tremaine noted, its main legal effect starts only once it’s cited in the EU’s Official Journal.
In the US, it depends on who you are.
- State and local governments fall under the ADA Title II web rule: WCAG 2.1 AA. On April 20, 2026, the Justice Department pushed both deadlines back a year. Governments must make sure their contractors meet it too, which matters if you build their sites.
- Businesses open to the public (Title III) have no federal web regulation: the Justice Department’s guidance says it “does not have a regulation setting out detailed standards,” so enforcement happens in court. Seyfarth Shaw, a law firm that tracks filings, counted 3,117 federal website accessibility lawsuits in 2025, up 27% on 2024, not counting state courts.
| Rule | Who it covers | Standard | When |
|---|---|---|---|
| European Accessibility Act | Consumer e-commerce, banking, e-books, passenger transport, e-communications, audiovisual media access | EN 301 549 (WCAG 2.1 now; version 4.1.1 moves to 2.2) | Applies since June 28, 2025 |
| ADA Title II, population 50,000+ | State and local governments | WCAG 2.1 AA | April 26, 2027 (was April 24, 2026) |
| ADA Title II, under 50,000 | Smaller governments and special districts | WCAG 2.1 AA | April 26, 2028 (was April 26, 2027) |
| ADA Title III | Businesses open to the public | No regulation; WCAG cited as guidance | No date; enforced through lawsuits |
What to build to. WCAG 2.2 has been the current W3C standard since October 5, 2023. Its new criteria include Focus Not Obscured, which a sticky header can break, and Target Size. WCAG 3 is a few years from done. My advice: build to WCAG 2.2 AA, and test against 2.1 AA, which most rules still name.
The WebAIM Million, an annual automated check of a million home pages, found detectable WCAG failures on 95.9% of them in February 2026. Low-contrast text alone appeared on 83.9%.
Overlays, the widgets that promise to fix a site with one script, sit on about 2% of sites but only 0.2% of the top 1,000. I read that as the biggest sites choosing to fix the source.
On our site, axe-core, an open-source accessibility testing engine, checks the homepage and key subpages on every change, alongside JavaScript-off and reduced-motion runs. A failure blocks the deploy. That still isn’t proof of conformance, as our site walkthrough says.
Privacy You Can Prove
Privacy used to be a policy page. Now regulators test behavior.
On September 9, 2025, California’s privacy agency and the attorneys general of California, Colorado and Connecticut announced a joint sweep of businesses that may be ignoring Global Privacy Control (GPC), a browser setting that tells sites not to sell or share your data. California’s attorney general put it plainly: “businesses have an obligation to honor this request.” Then California went further: AB 566, signed October 8, 2025, requires browser makers to build in an opt-out signal from January 1, 2027.
GPC, now a W3C Working Draft, travels as a Sec-GPC: 1 header. Chrome hasn’t shipped it; its status page lists it as “Proposed”. And on October 17, 2025, Google said Chrome would keep its current approach to third-party cookies. Don’t wait for browsers to clean up tracking for you; the Web Almanac found a third-party tracker on 75% of pages.
The higher bar is to collect less, honor GPC, and be able to show what a page loads. Here’s ours:
- No analytics tags, no ad pixels, no cookies. The build fails if Google Analytics or Google Tag Manager code appears in any page or script it produces.
- A security policy that allows only our own domain. If someone added a tracking script hosted by another company, the browser would refuse to load it.
- Tests that fail on outside requests. If a tested subpage asks another domain for anything, the run fails.
- A live request ledger. On our privacy page, a small panel counts every request that page made, in your own browser, split between our domain and anyone else, plus cookies. It sends nothing anywhere, and our tests block the deploy if it ever shows a third-party request or a cookie.
Going without analytics suits a practice our size; most marketing teams need measurement. The bar isn’t zero analytics. It’s knowing what loads, honoring the opt-out signal, and having a test that tells you when that changes.
Your Second Audience: Crawlers, Answer Engines and Agents
Cloudflare, which says more than 20% of the web sits behind its network, also sells tools to manage bots, so read its numbers as one company’s view.
Its 2025 Year in Review found AI crawlers other than Googlebot made 4.2% of HTML page requests on average, Googlebot 4.5%, and humans 47% as of December 2. The imbalance is in what comes back: at their 2025 peaks, Anthropic’s crawlers made up to 500,000 page requests for every visit they referred, OpenAI’s 3,700 and Google’s 30.
Cloudflare reported on September 15, 2026 that 17% of its sites block AI training, while under 1% block search. Cloudflare’s Content Signals Policy lets robots.txt state separate preferences for search, AI answers and training, though Cloudflare says these signals “are not technical countermeasures against scraping.” And Google’s fetchers that act on a user’s request, including Google-Agent, “generally ignore robots.txt rules.”
The site itself needs less than the market suggests.
- No special files. Google says there are “no additional requirements” to appear in AI Overviews or AI Mode, and no special schema. Its AI optimization guide lists llms.txt, a proposed plain-text index for AI models, among things you don’t need, because “Google Search ignores them.” Only about 2% of sites have one, and roughly 40% of those are tied to one SEO plugin that adds the file by default.
- Honest structured data. It still helps earn rich results, and Google asks that it match the visible page. Rich results change, though: FAQ results stopped appearing on May 7, 2026.
- The basics, for agents too. Chrome’s experimental Lighthouse “Agentic Browsing” checks test accessibility and layout stability alongside WebMCP, a proposed standard for exposing site actions to agents. Google’s agent-friendly guidance says, “Everything we suggest to make a site ‘agent-ready’ also makes sites better for humans.”
That’s the whole strategy: the agent-ready site is the fast, accessible, stable site with honest structured data.
Our robots.txt names the major AI crawlers and allows search, AI answers and training: a deliberate choice for a practice that wants its writing read, not advice for a publisher that sells content. We also publish llms.txt and a Markdown copy of every article. They’re cheap, and Cloudflare says coding agents such as Claude Code already ask for Markdown. Don’t expect them to move your Google visibility; Google says they won’t.
Security Is Now Supply-Chain Hygiene
Most websites are assembled from open-source packages pulled from npm, the JavaScript package registry. It has had a rough year.
- September 2025. A self-replicating worm called Shai-Hulud compromised more than 500 npm packages, stealing developer credentials as it spread. CISA issued an alert on September 23. A second wave in November 2025 added a focus on automated build pipelines.
- August 4, 2026. The “ChainDrop” worm started from the popular keyv library and spread to hundreds of packages. The malicious keyv release even carried genuine provenance, the signed record of where a package was built. Datadog’s researchers were blunt: “It is neither forged nor a safety verdict.”
npm 12, released July 8, 2026, no longer runs packages’ install scripts unless you allow them.
The other layer is a Content Security Policy (CSP), a header that tells the browser which sources a page may load from. It’s still rare: about 22% of sites send one, and 92% of those policies include unsafe-inline, which weakens them.
Our setup, honestly: every dependency is pinned to an exact version, the build server installs exactly what the lockfile lists, and the site has one runtime dependency. Our CSP allows our own domain only, and the build fails if the policy names any full web address. It still allows inline scripts and styles, because we inline our CSS and a small startup script, so it’s origin-locked, not strict.
AI Makes Change Cheap, so the Gate Matters More
AI-assisted development is now normal. In the 2025 Stack Overflow survey, 84% of respondents were using or planning to use AI tools, yet more distrusted their accuracy (46%) than trusted it (33%). On September 23, 2025, Google’s DORA research found 90% of respondents using AI at work, with a positive link to throughput and a continued negative link to stability: “AI doesn’t fix a team; it amplifies what’s already there.”
The best independent test of speed is humbling. In METR’s July 2025 randomized trial, experienced open-source developers took 19% longer with AI tools while believing they’d been 20% faster. METR now calls those results out of date, and says its late-2025 data “gives us an unreliable signal.” Nobody has a clean number yet.
So expect faster turnaround on small changes, but treat a lower price credited to AI, with no stronger testing behind it, as a warning sign. DORA names what makes the difference: “strong automated testing, mature version control practices, and fast feedback loops.”
Here’s our gate. Every push to our main branch runs a type check, the build, HTML validation and our build rules, then browser tests at widths from 320 to 1,600 pixels, accessibility checks, JavaScript-off and reduced-motion runs, and the privacy-ledger check. The deploy job can’t start until all of it passes. Thirty-six commits reached main in the first 19 days of October; none could deploy without passing. On October 19, one push failed an accessibility check, and nothing went live until the fix did.
We use AI coding agents on this site, and their changes face the same gate as mine. That’s the oversight layer applied to a website.
I’m not neutral here: keeping a site at this bar, month after month, is what our Managed Web Infrastructure work is.
The Buyer’s Checklist
Ask for evidence: a report, a test, a file. Adjectives don’t count.
- What were our Core Web Vitals last month, on mobile, from real visits? LCP, INP and CLS against the thresholds above, with the worst template named. A lab score alone isn’t enough, and First Input Delay is out of date.
- What runs automatically before every deploy, and can a failure stop it? The deploy should depend on the tests passing.
- Which accessibility rules apply to us, by when, and what do you build to? A plain answer for your markets, WCAG 2.2 AA as the target, and keyboard and screen-reader testing by a person. An overlay isn’t an answer.
- What happens with JavaScript off, reduced motion on, or an older browser? Everything still works, and each newer feature has a named fallback.
- What third parties does each page load, and what tells us when that changes? A list, a CSP that enforces it, and a test that fails on anything new.
- Do we honor Global Privacy Control, and where is that tested? Yes, with a test, or a clear reason it doesn’t apply.
- What’s our policy for AI crawlers and agents, and who decided it? Search, AI answers and training handled separately, on purpose. A promise that llms.txt will get you cited is a red flag.
- Does our structured data match what’s on the page? Page by page, without leaning on retired rich results.
- How are dependencies installed, updated and secured? Lockfile installs, exact versions, install scripts off unless needed, and multi-factor authentication.
- Who owns updates, monitoring and fixes after launch, and how fast? A name and a response time.
If the answers you get back are vague, start on our Connect page.