We scanned 507 Australian business websites. One scored an A.
Aggregate results from 507 quick scans of real Australian business websites run between 22 June and 30 July 2026: average score 62/100, one A grade, no Bs, 82% missing a Content-Security-Policy header, 75% with no AI-search foundations, and 47% tracking visitors without a consent banner.
Frequently asked questions
How were the 507 websites chosen?
They are Australian business websites (.au domains) discovered through public business directories and scanned by the AuditHQ quick scan between 22 June and 30 July 2026. The sample leans toward small and mid-sized businesses - sole traders, local services, professional firms - rather than enterprises, so the numbers describe the SMB web, not the top end of town.
Does a missing Content-Security-Policy header mean a site has been hacked?
No. A missing CSP header means one of the browser’s guardrails against injected malicious scripts is switched off, not that an injection has happened. It is a seatbelt finding: most sites drive for years without the seatbelt and nothing goes wrong, but if a script injection ever lands, the header is the difference between a blocked attack and a compromised checkout page.
Why did only one site out of 507 score an A?
Because the scan samples across six public-signal areas at once - visibility, trust, technical health, reputation, hiring signals, and AI readiness - and almost every site is strong in one or two areas and untouched in others. The typical Australian business site is findable on Google and loads fine, but has no AI-readable foundations, thin reputation signals, and missing security headers. Averaging strong and absent areas together lands most sites in the C band.
Are these results representative of every Australian business website?
No single sample is. This one is 507 real, currently-operating business sites sourced from public directories, which skews it toward SMBs and away from enterprises with dedicated web teams. The findings are automated, passive checks of publicly observable signals on a point-in-time basis - a site could fix any of these tomorrow. Treat the percentages as a credible picture of the Australian SMB web in mid-2026, not a census.