We scanned 507 Australian business websites. One scored an A.

Where this data comes from

Between 22 June and 30 July 2026, AuditHQ's quick scan ran against 507 distinct Australian business websites - real, currently-operating businesses with .au domains, discovered through public business directories. The quick scan samples publicly observable signals across all nine of AuditHQ's audit suites: marketing visibility, technical health, security, privacy, reputation, social presence, hiring signals, AI readiness, and AI visibility. No logins, no active probing - only what any visitor, search engine, or AI crawler can already see.

That makes this one of the more grounded pictures available of what the Australian small-business web actually looks like in mid-2026. Not a survey of what owners think their site does. A scan of what the site provably does.

The grade curve is brutal

The average score across all 507 sites is 62 out of 100. Sixty-nine percent of sites land in the C band, and nearly a third score a D or worse. Exactly one site in the entire sample earned an A, and not a single site earned a B.

That distribution tells you something specific: this is not a story of good sites and bad sites. It is a story of uneven sites. Almost every business in the sample is strong somewhere - usually basic findability and page delivery - and absent somewhere else entirely. The averaging of strong and absent is what fills the C band.

What is actually broken, ranked

Because these counts come from each site's top surfaced findings, they are conservative - a site drowning in higher-priority issues may have the same problem without it making that site's list. Three of them deserve unpacking:

• 82% have no Content-Security-Policy header. In plain terms: one of the browser's built-in guardrails against malicious injected scripts is switched off. It does not mean these sites are compromised - it means that if an injection attempt ever lands, nothing at the browser level is standing in its way. It is a one-header fix that four out of five Australian business sites have never shipped.
• 75% are unreadable to AI search. No llms.txt, no AI-crawler stance, little or no machine-readable structure. When a customer asks ChatGPT or Perplexity for "a good accountant in Parramatta", these businesses are not in the running - not because an AI judged them and found them wanting, but because there is nothing there for it to read. This matches what we found when we checked Australia's biggest retailers - the gap runs from the top of the market to the bottom.
• 47% track visitors without asking. Analytics or advertising pixels were detected with no consent banner in the page. Under the Australian Privacy Act reforms and the overseas regimes that apply the moment an EU or Californian visitor lands, that is accumulating liability, quietly, every day.

The pattern: 2015 problems are solved, 2026 problems are untouched

Averaging the six signal areas across all 507 sites makes the shape of the problem obvious. The strongest area in the sample is basic search visibility (73/100 average) - being findable on Google is a solved problem for most Australian businesses. Technical health (65) and trust signals (71) hold up reasonably too.

The weakest area, by a wide margin, is AI readiness: a 44/100 average, with two-thirds of all sites scoring under 50. Reputation signals (58) and hiring signals (61) sit in the soft middle.

In other words: the Australian SMB web has finished the last decade's homework - be online, be findable, load properly - and has not started this decade's. Being readable and citable by AI engines, proving your reputation with structured signals, and meeting modern privacy expectations are the three areas where nearly everyone is exposed, and they are exactly the areas where buyers' behaviour is shifting fastest.

The caveats that keep this honest

• Point-in-time, automated, passive. Every number is what the scan observed on the day it ran. Any site could fix any finding tomorrow.
• Top-findings counting. The per-finding percentages count sites where the issue ranked among that site's most important surfaced findings, so they understate rather than overstate.
• Sample skew. Directory-sourced .au business sites lean SMB. Enterprises with dedicated web teams are underrepresented, which almost certainly flatters nothing and no one here - the numbers describe the businesses that make up most of the Australian economy.

FAQ