22 out of 100: what a check of more than 800 Ukrainian sites showed

A corporate website is usually made once: ordered from a studio, accepted, paid for and forgotten. People remember it when it “goes down”, when the host sends a spam warning, or when a customer reports that something strange opens from a page. We decided to look at the actual state of sites.

Over a month, the in-house Smart Audit checking service, developed within the cluster's ecosystem, went through the websites of Ukrainian companies. The result: average score 22 out of 100.

How we counted

Smart Audit works passively: it reads only public pages, changes nothing on the site and does not guess passwords. The score has four parts: security, search visibility, speed and readiness to work with AI agents.

The analysis covers 832 unique domains (31 August – 6 October 2026). For each, the latest completed check was taken; the developer's own sites were excluded.

First, the limits of the conclusions. This is not a survey of all Ukrainian business but a sample of sites that went through our service. Many of them are small companies: 671 sites belong to the “services and B2B” segment, 126 are online shops, 35 are media. For an average corporate site this cross-section is representative; for large companies with their own IT teams it is not.

The overall picture

Only 9 of the 832 sites scored 75 points or more.

Score	Sites	Share
below 30	608	73%
30–49	172	21%
50–74	43	5%
75 and above	9	1%

Area	Average score
Security	19
Search visibility	17
Speed	18
AI readiness	57

The highest score for AI readiness does not mean sites are ready. It results from the check covering only basic things. Most often missing is the file llms.txt, which tells AI agents what is on the site: 89% of sites do not have it. Security turned out to be among the weakest areas: on 86% of sites its score is below 50.

Security: protection you can switch on for free

The most common security problems do not require sophisticated attacks. It is simply the absence of settings that the browser would apply itself if the server told it about them.

Protective mechanism	Sites without it or with a weak setup
Permissions-Policy (restricting camera, microphone, geolocation)	93%
Content-Security-Policy (protection against script substitution)	90%
Referrer-Policy (what is passed in the address when following a link)	87%
Protection against embedding in other sites' pages	73%
Ban on guessing file types (nosniff)	71%
HSTS (forced HTTPS)	62%

Next come forms. On 61% of sites forms collect personal data without explicit consent to processing, on 55% no protection against forged requests was found, and on another 60% there is no check against automated spam.

There are also problems it is simpler to call dangerous:

• on 37% of sites, cookies are set without protective flags;
• on 28% the server reveals its software version, and on 16% of sites the site itself reports the exact version of the platform, which makes it easier to pick known vulnerabilities;
• on 19% of sites, service addresses that should not be accessible to visitors are open;
• in 9% a form sends personal data through the address bar;
• in 4% the connection security certificate is missing or invalid, and in another 5% it is about to expire.

Platforms: where it is worst

Platform	Sites	Average score
WordPress	201	19
OpenCart	86	11
Bitrix	18	12
Next.js	28	33
Drupal	7	30
The rest, including in-house developments	474	25

By site type: shops score 14 points, service sites — 23, media — 30. The worst result is for online shops on OpenCart. For a shop this is a double risk: orders and customers' personal data are processed here.

We would separately warn against simplistic conclusions: the samples for Drupal, Joomla, Tilda or Wix are small, so comparing them with WordPress should be done with caution. Our data show rather where problems are most widespread than “which platform is worse”.

Why this happens

For the most part the problem is not the owner's negligence but how the life of a typical site is arranged.

• The site is assembled from other people's parts. A ready-made theme, a dozen plugins from different authors and an admin panel with unclear separation of rights. Each plugin is updated in its own time, and one missed update opens the door to the whole site.
• Nobody is responsible for its condition. The studio handed over the project and left, the host provides the server but does not touch the code, the owner does not know what exactly to update. The site is as if nobody's.
• A break-in stays unnoticed for a long time. Rarely does anyone break into a site for a loud effect. More often they plant hidden links, send out spam and collect form data. People find out when search engines have already lowered their trust in the domain.

What can be done about it

1. Close the simple gaps. The lion's share of findings is fixed with a few lines of server settings: security headers, page descriptions, image sizes, consent in forms. That is hours, not months.

2. Appoint someone responsible. Someone must know which version the site runs on, when the last backup was made and who will close a vulnerability if one appears tomorrow.

3. Reconsider the platform. If a site rests on dozens of plugins, its protection depends on the discipline of all their authors. The alternative is an integrated system in which security is built into the foundation and updated in one release for everyone.

Genau diesen Weg haben wir im Cluster gewählt. Als wir das Ausmaß des Problems auf fremden Websites erkannten, stellte sich die Frage, was wir selbst Partnern anbieten. Die Antwort war Smart CMS: our own website management system, which SmartGT develops together with veterans and other cluster partners and provides to clients and incubator participants.

The most frequent findings of our analysis are closed in it out of the box: a content security policy unique to each request, restriction of browser capabilities, forced HTTPS, a ban on embedding and on guessing file types. Forms carry consent to data processing, and incoming text is cleaned of malicious code. For search there is a separate module: description and title of each page, canonical addresses, structured markup, and also the file llms.txt for AI agents.

This is not a guarantee of invulnerability: no honest engineer promises that. But it is the difference between a site where every protection has to be configured and remembered, and a site where they are on by default. The platform is suitable not only for business-card sites: it runs corporate websites, online shops with a basket and online payment, personal accounts, news outlets and an AI consultant. Everything is updated centrally, so a new vulnerability is closed for all sites at once. The cluster's sites, including veterano.media and veterano.info, run on exactly this.

How to check your site

The simplest way is to start with a report. Smart Audit is free, does not need access to the site and changes nothing on it: enter the address and in a few minutes you get a list of problems by priority. A low score is not a verdict but the typical state of an unattended site. The only question is whether you learn about it from a report or from a message from a customer.

We began checking other people's sites to understand what we ourselves work with, and it turned out the problem is systemic. Sites are no longer seen as something that needs care and are treated like a business card made once and for all. Yet it is infrastructure through which customers leave enquiries and pay. We built Smart CMS together with cluster partners so that security is a default requirement, not an option you have to remember to switch on. But the main point is not our platform. Check your site today, before an attacker does it for you.

Mykhailo Vasianovych, CEO of SmartGT, coordinator of the AI incubator of the Veterans Cluster of Ukraine, and trainer in applying artificial intelligence for civil servants. He specialises in business-process automation, AI integration and Microsoft 365 deployment.

Materials for editorial offices

For reprinting, the text can be taken from this page. The formatted version and photos are available for download as separate files:

• Article as PDF — 4 pages, 428 KB
• Photo 1. Cover card — 1200×630, 352 KB
• Photo 2. Distribution of scores of 832 sites — infographic, 63 KB
• Photo 3. Protection that sites lack — infographic, 89 KB
• Photo 4. Mykhailo Vasianovych — portrait, 149 KB

When reprinting, please cite the original source — veterano.info — and the data source: Smart Audit (SmartGT).