We took the 50 agencies Google shows firstwhen someone searches for “web development agencies” and ran on them the same technical audit we run on any site: six dimensions, from performance to security, measured with public tools. The question was simple: do those who sell websites deliver, on their own site, the technical basics they sell?
The answer is an honest portrait of the market - and it fails precisely where the client doesn’t look. But the study doesn’t stop at the audit: the same data shows why that structure matters - not for organic rankings (where it barely weighs), but for what costs money: CPC in Google Ads, bounce, conversion and the chance of being cited by an AI. This is an original study, with the methodology open at the end. Data collected in July 2026; a snapshot, not a sentence.
- Sample:the 50 agencies Google returns first for “web development agencies”
- Sites analyzed: 49 (1 failed to load)
- Dimensions: 6 - performance, schema, tracking, SEO, security and AI
- Tools: PageSpeed/Lighthouse, CrUX, Security Headers, Schema Validator
- Editorial criterion: low scores anonymized; top named
Key numbers
- Average score 69.9/100 (median 73). And the figure that sums it all up: none of the 49 agencies was satisfactory across all six dimensions at once.
- Security is the worst dimension: ~69% landed at a critical level - which echoes the Web Almanac 2025, which reports ~64% of sites without HSTS across the web at large.
- 57% have critical performance- and, by Google’s own formula, that makes paid media more expensive: the landing page experience is part of the Quality Score, which feeds into Ad Rank.
- 45% have satisfactory SEO and, at the same time, critical security. Polished on the outside, fragile on the inside.
- In our sample, structure did not explain Google position (R² of 0.4%) - but it explains where the money leaks: CPC, bounce and conversion.
- Only 20% declare a person (Person) and 14% have no structured entity at all. A good share of the market is hard for an AI to understand - and 61% are not ready to be cited by AI.
The best in the study
Excellence exists - it’s just rare. We set out to highlight the three best - but, due to a tie at the top, the group ended up with four: the agencies that reached an A+ grade, the top of the scale. Deliberately without positions and without individual scores - all at the same level of distinction:
(A+ distinction group, in alphabetical order.) They are proof that it can be done right. When infrastructure is taken seriously from the start, the result shows - and it is verifiable, live, on each of these domains.
The overall portrait: a mediocre market
Distributed on a scale from A+ to D, the 49 agencies that loaded ended up like this: half stopped at grade B or below. At the opposite end from the podium, the last place scored 9/100(we keep it anonymous; the goal is the market’s pattern, not exposing whoever built a bad site). And one of the 50 didn’t even load at the time of the audit - a connection/SSL failure, the worst possible outcome for a business that lives off putting websites online.
One finding cuts across the entire sample: completenessnever showed up. None of the 49 was satisfactory across all six dimensions at once - the market has isolated competencies (one is fast, another is well structured), rarely the whole infrastructure standing. It’s the difference between passing one subject and having a complete report card.
The dimension the market ignores: security
If there is one clear verdict, it’s this: security is the market’s blind spot. Around 69% of the agencies landed at a critical level - missing security headers, no content policy (CSP), no HSTS. We measured it the way anyone can reproduce: pasting the domain into Security Headers, Snyk’s reference tool.
It’s not exclusive to these agencies - the Web Almanac 2025 shows the whole web failing at this (about 64% without HSTS, nearly 8 in 10 without CSP). The difference is that an agency sellsthis. When the site of those who build sites lacks the basic header, the problem starts at the source. And security is invisible to the client - until the day it isn’t: the form that leaks, the certificate that expires, the door left open.
Polished on the outside, fragile on the inside
The most revealing number isn’t a single dimension - it’s the intersection of two. 45% of the agencies have satisfactory SEO and, at the same time, critical security.
Nearly half the market took care of the storefront - titles, meta tags, structured data - and left the foundation exposed. And it makes sense: SEO has visible returns (position, traffic); security only collects when something goes wrong. So the investment goes to what shows. SEO was, by far, the strongest dimension (33 of the 49satisfactory); security, the weakest (34 critical). The market’s photograph in a single frame.
Structure doesn’t move rankings. It moves money.
In our sample, structure did not explain Google position. But it did explain where the money leaks. You might assume the agencies at the top of the search are the technically best - and the data doesn’t support that: position and technical score barely relate (R² of 0.4%). Google’s top 10 averaged 73.5; the bottom 10, 70.8 - a negligible difference. Google ranks by content, relevance and authority, not by infrastructure.
An honest caveat: these positions are the ones we observed during collection, with the residual personalization described in the methodology - so read the correlation as a direction, not an exact measurement. What doesn’t change with the ordering is the essential point: high scores show up at the bottom of the list and mediocre ones at the top. Ranking well and having solid infrastructure remain different achievements.
But beware of the lazy conclusion: “so structure doesn’t matter”. It does - it just isn’t in organic rankings that it collects its price. It’s in the money:
- In Google Ads, structure becomes CPC.Ad Rank doesn’t look only at your bid: it looks at quality, and the landing page experience (which includes speed and mobile) is part of the Quality Score. Slow landing = worse experience = lower Quality Score = more expensive click for the same position. The 57% with critical performance are, in practice, paying a speed tax on every campaign.
- In conversion, structure becomes lost revenue. Sites that load in 1 second convert 2.5x more than 5-second ones (Portent, 2022); and 0.1s less lifted retail conversions by 8.4% (Deloitte/Google, 2020). With a median LCP of 3.5s and only 1 in 4 sitesreaching “Good” (≤2.5s), most of the market wastes, at load time, the traffic it already paid to attract.
- In credibility, structure becomes trust.Security and stability are what separate a site that inspires a purchase from one that scares people away - and that doesn’t show in the rankings, it shows in the wallet.
In other words: you can be first on Google and still pay more per click, lose the conversion at load time and scare away whoever arrived. Ranking and having a solid site are different achievements. Structure amplifies the return of everything that comes after the click.
What AI can’t understand, AI tends to ignore
Search is migrating to AI-generated answers, and that’s where the dimension the market hasn’t even started addressing comes in: being a clear, machine-readable entity. The data is revealing.
Only 20% of the agencies declare a person (Person schema) and 14% have no structured entityat all. Without that, the AI is “not sure” who the company is, and tends to ignore or confuse it. Not by chance, 61% are not ready for AI in our measurement. An agency that can’t resolve its own digital identity is unlikely to resolve its client’s.
And there’s measurement, the prerequisite of any decision: only 2 of the 49 have complete tracking. The rest operate on half the data - deciding media and conversion in the dark. Structure, here, isn’t decoration: it’s the difference between knowing and guessing.
How we measured
Transparency is part of the method. Here is exactly what we did, with the honest caveats.
Collection methodology.The survey was carried out on July 7, 2026, from the organic results of Google Brazil (google.com, pt-BR language, BR region) for the term “web development agencies” (original query in Portuguese: “agências de desenvolvimento de sites”). We went through the first result pages, in ranking order, until identifying the first 50 valid companies. We excluded: paid ads, directories and marketplaces (such as oHub and hosting lists), third-party editorial content (blogs and portals), social profiles without their own website, and companies whose main activity isn’t web development. Of these 50, one failed to load at audit time; the analyses cover the remaining 49.
Transparency note. Collection was done with location filtering turned off, but in a regular (non-incognito) session - so some algorithm personalization may still have influenced the set and its order. This affects the sample composition and the position-vs-score comparison; the per-site technical measurements (PageSpeed, CrUX, Security Headers, Schema Validator) are server-side and reproducible, independent of that. The list reflects the organic positioning observed on that date, subject to regional and temporal variations - and future rounds will collect the sample in an incognito, logged-out session for full neutrality.
The six dimensions. Each site received a seal per dimension - satisfactory, attention or critical - in performance, structured data (schema), tracking, SEO, security and AI readiness, composing the 0-100 score and the A+ to D grade.
Speed (the most important caveat). We measured mobile only, on purpose: Google is mobile-first and the Core Web Vitals that count are the mobile field ones. We prioritized real field data (CrUX)when it existed; when it didn’t, we ran Lighthouse via PageSpeed 5 times and kept the lowest LCP. This is deliberately generous - the lab is more pessimistic than the field, so we gave each site its best result. The portrait here is the best case, and even so only 1 in 4 reaches “Good”. Comparing CrUX (field) with Lighthouse (lab) means bringing different instruments together; the lowest of five is how we balance the two while we don’t yet have a calibration index of our own.
Security, schema and entity. Read straight from the HTML and the HTTP headers, the way Security Headers and the Schema.org Validator do - scanning JSON-LD, microdata and RDFa, including @graph graphs and nested entities.
Nothing here is opinion: every number is live, on each agency’s domain, and can be reproduced with the same public tools.
Conclusion
The market that sells websites is, on average, mediocre - and it fails precisely where the client can’t evaluate on their own: security, real speed, entity, measurement. None of the 49 was complete across the six dimensions. Half take care of the storefront and leave the foundation exposed.
And the point that closes the study: being at the top of Google guarantees none of this- but the structure the rankings ignore is the same one that weighs on your CPC, your bounce, your conversion and your visibility in AIs. It doesn’t put you in first place; it makes first place worth it. That is the gap Inodus exists to turn from exception into rule: infrastructure treated as engineering, measured and verifiable, not as finishing touches.
Want to see how your site - or your vendor’s - performs on the same six dimensions? Run the free online audit.
Frequently asked questions
Which agencies were evaluated?+
The first 50 returned by Google for "web development agencies", in July 2026 - a public, dated snapshot. The four best, all rated A+, were Agência Kaizen, ciaweb, ID7 Studio and Studio Visual (in alphabetical order).
What was the market's average score?+
69.9 out of 100 (median 73). And none of the 49 was satisfactory across all six dimensions at once - the market has isolated competencies, not complete infrastructure.
What is the most critical dimension?+
Security, by far: ~69% at a critical level. The strongest was SEO (33 of 49 satisfactory) - the market takes care of what shows.
If structure doesn't improve rankings, what is it for?+
It doesn't move organic position (R² of 0.4% in our sample), but it moves money: performance feeds into the landing page experience, which is part of the Quality Score and, therefore, of the cost per click in Google Ads; speed affects bounce and conversion; and entity/structure affect the chance of being cited by AI.
How did you measure speed?+
Mobile only (what counts for Core Web Vitals), with CrUX field data when available and, in its absence, the lowest of 5 Lighthouse runs - a deliberately generous measurement. Even so, only 1 in 4 reaches a "Good" LCP.
How we interpret the sources in this article
This is a proprietary Inodus study: the numbers come from our own audit, using public, reproducible tools. Official external and research data (Google, Web Almanac, Deloitte, Portent) enter as context and mechanism references - to explain why the patterns we found matter - not as proof of individual scores. Benchmarks are a signal of direction, not a universal rule; and this snapshot is dated.
Methodology and sources
Original Inodus study (July 2026 survey, 50 agencies from Google for “web development agencies”)proprietary. Measurement tools: Lighthouse/PageSpeed and Google - Core Web Vitalsofficial; Security Headers (Snyk) and Schema.org Validatorofficial. Commercial mechanism: Google Ads - Quality Scoreofficial; Deloitte/Google, “Milliseconds Make Millions”case study and Portent, 2022proprietary. Market context: HTTP Archive - Web Almanac 2025research/analysis. Method caveat: lab LCP is optimistic by design (lowest of 5 runs) and compared to field CrUX only as an approximation. This article is informational.