What 430 Website Scans Show About Speed, SEO and Security
We went through every public report in RoastWeb's sitemap: 972 reports, which come down to 430 different websites once repeat scans are combined and our own sites are left out. The scans ran between December 2025 and October 2026, and each one checked the same things: speed in Google's mobile test, the SEO tags in the page's HTML, the server's security headers, structured data and link previews. This is what those 430 sites had in common, and what to fix first on yours.
In one line: Across 430 websites scanned with RoastWeb between December 2025 and October 2026, the median page took 6.2 seconds to show its main content in Google's mobile lab test, 54% got an F for security headers, 45% had no structured data, and 22% had no meta description.
Key takeaways
- ▸Speed was the biggest gap. Only 12% of pages met Google's 2.5-second target for Largest Contentful Paint in the mobile lab test, and 70% took more than 4 seconds.
- ▸Security headers were missing more often than anything else: 83% of sites had no Permissions-Policy, 67% no Content-Security-Policy and 42% no Strict-Transport-Security.
- ▸SEO basics were often missing too: 34% had no canonical tag, 30% no H1 heading and 22% no meta description.
- ▸45% had no structured data at all, and 38% had no Open Graph image for link previews.
- ▸WordPress sites had the lowest median score (69 out of 100) and the weakest security headers. Shopify stores had strong headers but slow pages.
How we got the data
RoastWeb publishes a report only when the site owner chooses to share it, and every shared report is listed in our sitemap. On October 24, 2026, that was 972 reports. Many sites were scanned more than once, so we kept the latest scan for each site. We then removed our own websites, test scans and adult sites, which left 430 websites.
Each scan measures four things in four ways:
- ▸Speed comes from Google PageSpeed Insights' mobile test. Google's documentation says this lab data "is generated through Lighthouse, simulating page load," so it's a controlled test under mobile conditions rather than a measurement of real visitors.
- ▸SEO tags (title, meta description, canonical, headings) come from the HTML the server sends, before any JavaScript runs.
- ▸Security headers come from the server's response to the page request.
- ▸Structured data and link previews come from the JSON-LD, microdata and Open Graph tags in the HTML.
Two limits are worth keeping in mind. The sample is sites whose owners shared their report, mostly small businesses, startups and side projects. It isn't a random slice of the web. And not every check ran on every site: the speed test, for example, finished on 351 of the 430. Each number below says how many sites it covers.
How fast do these pages load on mobile?
Largest Contentful Paint (LCP) is the moment the biggest thing on the screen, usually the main image or headline, finishes loading. Google's PageSpeed Insights rates up to 2.5 seconds as good and anything over 4 seconds as poor.
| Measure | Result |
|---|---|
| Median LCP | 6.2 seconds |
| Good LCP (2.5 s or less) | 12% (41 of 351) |
| Poor LCP (over 4 s) | 70% (244 of 351) |
| Good layout stability (CLS 0.1 or less) | 86% (298 of 347) |
| Median Total Blocking Time | 70 ms |
Most of these pages didn't jump around while loading, and most didn't block the browser with heavy scripts. So the slow LCP points at what arrives last: an oversized hero image, a web font, or a slow server response. A lab test on mobile settings is harder than a new phone on fast Wi-Fi, which is why your own phone may feel quicker. Visitors on older phones or weaker connections see something closer to these numbers.
Which SEO basics are missing?
These counts cover the 411 sites where the SEO check ran.
| Missing | Sites |
|---|---|
| Canonical tag | 34% (139) |
| H1 heading | 30% (123) |
| Sitemap (none in robots.txt or at /sitemap.xml) | 22% (92) |
| Meta description | 22% (89) |
| robots.txt file | 16% (67) |
| Title tag | 4% (15) |
Another 17% (69 sites) had more than one H1. Because these checks read the HTML before JavaScript runs, a site that adds its tags with JavaScript can show up here as missing them. That first HTML is also what many crawlers and link-preview tools read first, so it's worth getting right.
How many sites use structured data?
45% of sites (183 of 411) had no structured data at all. Google's documentation says it "uses structured data that it finds on the web to understand the content of the page," so a page without it leaves Google to guess what the business is and what the page is about.
Among the 228 sites that did have structured data, these were the most common types:
| Type | Share of sites with structured data |
|---|---|
| WebSite | 61% (140) |
| Organization | 50% (113) |
| WebPage | 29% (65) |
| BreadcrumbList | 21% (49) |
| FAQPage | 13% (29) |
| LocalBusiness | 12% (27) |
Are the security headers there?
Security headers are short instructions a server sends with every page, telling the browser what to allow. The OWASP Secure Headers Project describes them as "HTTP response headers that your application can use to increase the security of your application." These counts cover 422 sites.
| Header | Missing on | What it does |
|---|---|---|
| Permissions-Policy | 83% | Turns off browser features the site doesn't use, such as the camera or location |
| Referrer-Policy | 71% | Limits what other sites learn from the link a visitor clicked |
| Content-Security-Policy | 67% | Controls which scripts and resources may run on the page |
| X-Frame-Options | 64% | Stops other sites from showing yours inside a frame |
| X-Content-Type-Options | 55% | Stops the browser from guessing a file's type |
| Strict-Transport-Security | 42% | Tells browsers to always use HTTPS |
More than half the sites (227 of 422, or 54%) got an F for security headers, and 15% (62) got an A. Most of these headers take a few minutes to add at the server or the CDN. Content-Security-Policy is the exception: it can break scripts if it's written too strictly, so add it last and test it.
Do the pages share well?
Open Graph tags decide what a link looks like when someone shares it on social media or in a chat. Of 422 sites, 38% had no og:image, 31% no og:description and 27% no og:title. Without an image, a shared link shows up as a small plain card, which is easy to scroll past.
What about images and privacy pages?
- ▸58% of the sites with images (214 of 369) had at least one image the scan flagged for missing alt text.
- ▸25% of sites with images (92 of 369) served WebP images.
- ▸42% of sites (173 of 411) had no privacy policy the scan could find in their links, their page code or at common addresses such as /privacy.
Does the platform make a difference?
The scan names a platform when the page's code makes it clear. It could for 262 of the 430 sites; the rest are left out of this table, as are platforms with fewer than 20 sites.
| Platform | Sites | Median score | Median LCP | Median security score |
|---|---|---|---|---|
| WordPress | 87 | 69 | 7.4 s | 10 |
| Next.js | 77 | 81 | 4.9 s | 30 |
| Shopify | 31 | 82 | 7.4 s | 80 |
| React | 22 | 78 | 4.6 s | 40 |
Shopify storefronts came with most security headers already in place, which lifted their security score, but they were among the slowest in the mobile test. WordPress sites had the lowest overall score and almost no security headers at the median, though results there depend heavily on the host and plugins. Sites built with Next.js and React were the fastest of the four groups.
What should you fix first?
- ▸Add the easy security headers. Strict-Transport-Security, X-Content-Type-Options, Referrer-Policy and X-Frame-Options can all be set once at your server or CDN. Leave Content-Security-Policy for last and test it.
- ▸Speed up the main image. Compress it, serve it as WebP or AVIF, give it a width and height, and preload it. That's usually the element LCP measures.
- ▸Check every page's head. One H1, a canonical tag and a meta description on each page.
- ▸Add structured data. Organization and WebSite markup at least, then the type that fits each page, such as Product, Article or LocalBusiness.
- ▸Add an og:image. Shared links then show a picture instead of a plain card.
Frequently Asked Questions
How many websites does this data cover?
430 different websites, from 972 public RoastWeb reports scanned between December 17, 2025 and October 23, 2026. Repeat scans were combined, keeping the latest one for each site, and our own sites, test scans and adult sites were left out.
What is a good Largest Contentful Paint?
Google's PageSpeed Insights rates LCP of 2.5 seconds or less as good, 2.5 to 4 seconds as needing improvement, and over 4 seconds as poor. In this data, 12% of pages were good and 70% were poor in the mobile lab test.
Which security header is missing most often?
Permissions-Policy, missing on 83% of the 422 sites checked. Referrer-Policy (71%) and Content-Security-Policy (67%) came next. Strict-Transport-Security, which tells browsers to always use HTTPS, was missing on 42%.
Do I need structured data?
It isn't required, but Google says it uses structured data to understand the content of a page, and 45% of the sites in this data had none. Start with Organization and WebSite markup, then add the type that fits each page, such as Product, Article or LocalBusiness.
Why is my own phone faster than these numbers?
The speed numbers come from a lab test that loads the page under simulated mobile conditions, which is slower than a new phone on good Wi-Fi. Visitors on older phones or weaker connections see something much closer to the lab result.
How can I check my own site?
Run a free RoastWeb scan on your homepage. It runs the same checks as this study: Google's mobile speed test, the SEO tags in your HTML, your security headers, your structured data and your link preview.
Sources
- ▸Google for Developers, "About PageSpeed Insights," retrieved October 24, 2026: https://developers.google.com/speed/docs/insights/v5/about
- ▸web.dev, "Largest Contentful Paint (LCP)," retrieved October 24, 2026: https://web.dev/articles/lcp
- ▸web.dev, "Cumulative Layout Shift (CLS)," retrieved October 24, 2026: https://web.dev/articles/cls
- ▸Google Search Central, "Intro to How Structured Data Markup Works," retrieved October 24, 2026: https://developers.google.com/search/docs/appearance/structured-data/intro-structured-data
- ▸OWASP Foundation, "OWASP Secure Headers Project," retrieved October 24, 2026: https://owasp.org/www-project-secure-headers/
- ▸RoastWeb, the 972 public reports listed in roastweb.com/sitemap.xml, retrieved October 24, 2026