83% of Websites We Audited Were Non-Compliant. Is Yours?

83% of business websites fail basic compliance checks

Over the past year I built a system that runs 25 automated scans across every website in the portfolio I manage. 2,000+ sites, roughly 300 data points each. The goal was to find which sites needed attention and which were fine.

The results were worse than I expected.

83% of sites had at least one critical compliance or security issue. Not minor items. Real liabilities that can turn into fines, lawsuits, or breaches.

What we scanned

The consent scan alone covered 1,726 URLs. Of those, 1,115 were flagged for missing or broken consent management: either no consent banner at all while tracking scripts loaded, or a banner that didn't actually gate the tracking.

Every site in the portfolio was checked for security headers, cookie consent, email authentication records, and accessibility violations, alongside the SEO and performance scans. That's where the 83% figure comes from: the share of sites with at least one critical finding across those areas.

What a website compliance audit actually checks

A proper compliance audit covers four areas most businesses ignore.

Security headers protect your visitors from attacks. Without them, a site is exposed to cross-site scripting, clickjacking, and data injection. In our analysis, 1 in 3 sites scored an F on security headers: no Content Security Policy, no XSS protection, no clickjacking defense.

Cookie consent and CCPA/GDPR compliance means asking visitors before tracking them. If you run Google Analytics, Meta Pixel, or any marketing tool without a consent banner, you're out of step with privacy regulations. 96% of sites we audited had no consent management platform installed. CCPA fines start at $7,500 per violation.

Email authentication (SPF, DKIM, DMARC) prevents email spoofing. Without it, anyone can send email pretending to be your business. 4 in 10 sites had no DMARC record. That's an open door for phishing aimed at your customers.

Accessibility is a legal requirement under ADA Title III. More than 1 in 3 sites had critical WCAG violations. ADA web lawsuits have increased 300% since 2018, and plaintiffs actively scan for these issues.

Why most businesses don't know they're non-compliant

Nobody told them.

Most web developers focus on making a site look good and work. Security headers, consent management, and accessibility are afterthoughts, if they're thoughts at all.

Your hosting provider won't flag these. Google won't tell you; it will just rank you lower. Your customers won't complain; they'll leave.

The only way to know is to run an audit.

How to check your own site

Step 1: Run the free scan. I built a free website health check that tests your site in about a minute, no email required. It covers 10 instant checks, so it won't catch everything, but it tells you where you stand on the basics.

Step 2: Check your cookie consent. If you run any analytics or tracking pixels and don't have a consent banner, you have a gap. OneTrust, Cookiebot, and Osano all have free tiers.

Step 3: Test your security headers. Visit securityheaders.com and enter your domain. Below a B, you need to add Content Security Policy, X-Content-Type-Options, and X-Frame-Options headers.

Step 4: Run an accessibility check. WAVE (wave.webaim.org) scans your homepage for free. Fix critical and serious violations first.

Step 5: If you want the full picture, the $97 audit runs all 25 scans: security, compliance, SEO, performance, accessibility, technology, and conversion readiness, with a prioritized fix list and estimated hours. Every audit includes a free 30-minute walkthrough call.

The real cost of ignoring compliance

CCPA fines: $2,500 to $7,500 per violation. If your site gets 1,000 visitors a month without consent, that's exposure.

ADA lawsuits: Average settlement runs $10,000 to $50,000, plus legal fees, and they target businesses that haven't fixed known issues.

Email spoofing: One phishing email sent "from" your domain can undo customer trust overnight.

Google: Security issues and poor page experience feed into search rankings. Competitors who've fixed these will outrank you.

The sites that score well have one thing in common: someone was paying attention. The audit is how you start.

What to do next

1. Run the free site scan. About a minute, no email required.

2. Book a free strategy call. 30 minutes. I'll review your full digital presence and tell you what to prioritize.

3. See what other businesses fixed. Real results across construction, SaaS, and compliance work.

If you're in Central Texas, the Austin fractional CMO page covers how I work with local businesses on exactly this.

Related reading: What is a fractional CMO? · Google Ads audit checklist · All services