We validated the top 5,000 websites. 87.2% break the HTML spec.

We took the Tranco top 5,000 from the Tranco list , a research ranking that averages several popularity lists to resist manipulation, and requested the home page of each domain over HTTPS in August 2026.

Each page went through the same public endpoints this site runs for its users: HTML through html-validate on its standard preset, CSS through csstree-validator with lightningcss adjudicating modern syntax. Driving the real API rather than the engines means every false-positive filter we ship applied here too, so these counts are what a user of the tool actually sees.

Severity is not a style choice. We count as an error only what violates the written HTML standard. Opinions that are still valid HTML, such as an inline style or a missing type on a button, are counted separately as best practiceand are labelled as such in the tables above. Many published “error” statistics conflate the two, which roughly triples the headline.

Messages are grouped into families by masking their variable parts, so Unknown property `colr` and Unknown property `bakground`count as one problem. The wording shown in each row is the family’s most widespread member, measured in sites like everything else, and each row states how many sites that exact wording reaches so it is never mistaken for the family total.

2,344 of the 5,000 domains produced no measurement and are excluded from every percentage on this page. A large share of the top of the list is infrastructure: CDN and DNS hostnames that were never meant to serve a page. The reasons:

• 1,471Could not reach the URL. Check that it is valid and accessib
• 441Failed to fetch: … Forbidden
• 248Response too large (max NKB)
• 80Failed to fetch: … Not Found
• 24No HTML content provided

And we ran it on ourselves. Every page of this site, all 104 of them including the one you are reading, validates at zero errors and zero warnings against the engine above. Writing this study is what made us check; it found four problems we then fixed. Publishing a number you have not applied to your own site is not research, it is marketing.

Home pages only. One page per domain, and the page a company polishes most. Checkout flows, dashboards and CMS-generated article pages are almost certainly worse, and nothing here measures them.

Popular sites only. The Tranco top 5,000 is large teams and mature stacks. It is not a sample of the web, and it is not a sample of the sites most developers work on.

HTML and CSS only. No JSON, no XML, no robots.txt. Those are things people paste into a validator, not things a home page emits, so a crawl cannot see them at all.

Our engines’ judgement. Any validator encodes decisions about what to report. Ours are documented and deliberately conservative: we drop findings we cannot trust rather than pad a count. But a different tool would produce a different ranking. That is a reason to compare, not to average.

A snapshot. Measured August 14, 2026. Sites change; this page states its date for that reason.

And an open gap. 129 of the 220 families have no fix guide on this site yet, the largest being Class "w-full" duplicated at 16.9% of sites. We write them in the order this ranking gives.

August 14, 2026: a frame named with ARIA was still being counted as unnamed.

WCAG asks for an accessible name, not for one particular attribute. An aria-label, or an aria-labelledby pointing at real text, names an <iframe> as well as title does. Our engine only knew about title, so it reported frames that were correctly labelled, on the most common accessibility finding in this study. The mirror of the same gap: a frame carrying title="" has no name either, and was reported by nobody. Both are fixed, and the frame figure moves from 27.4% to 27.2% of sites. The headline moves from 87.4% to 87.2%, which is crawl-to-crawl variation rather than the fix: these findings are warnings and never counted toward it.

August 13, 2026: three rules were counted as spec violations that the HTML standard does not require.

Our validator inherited element metadata that marks title as required on <iframe> and lang as required on <html>. Neither is required by the written standard. Both are WCAG obligations, and the W3C’s own validator phrases the second as a suggestion. A third, imagesizes on a preload link, is required only when the source set uses width descriptors, and was demanded whenever the attribute imagesrcset appeared at all.

This mattered more than its size suggests. The <iframe> rule alone fired on 27.5% of the sample and was the single most common HTML finding in the first edition, so a rule that does not belong in the error column was setting the shape of the whole ranking. The first edition reported 90.5% of sites breaking the spec and 2.6% completely clean; the corrected crawl reported 87.4% and 2.6%. The three findings did not disappear: they are warnings now, and the two accessibility ones are reported by the Accessibility Checker, which had been missing them entirely.

Two presentation errors from the same review. Each table row is a family of wordings, and the row showed only its most common member next to the family’s share, which reads as a claim about that one message. Rows now say how far the example itself reaches. And the headline figure quoted when this study was first shared was the 2.6% one, which requires zero best-practice warnings as well as zero errors. The share with fully valid HTML is the larger number, and both are now stated side by side above.

The first of these was found by readers on Hacker News after publication, the second by writing the fix guide for the first. The corpus is re-crawled on the corrected rules each time rather than adjusted after the fact, so every figure on this page comes from one run of one build.