We Graded 20 of the Internet's Biggest Websites. The Results Are Surprising.

Amazon got an F. Google got a D. Reddit barely scraped past with a D-minus. And the site that came out on top? GitHub, with a 94.

We took our Website Grader and pointed it at 20 of the most-visited websites on the internet. The grader checks five things that every website should get right: performance, security headers, SSL configuration, SEO fundamentals, and availability. Then it spits out a score from 0 to 100 and a letter grade.

We expected the biggest tech companies in the world to ace this. They did not.

The Full Leaderboard

The average score across all 20 sites was 78.1. Just nine out of twenty scored a B or higher. Only two earned an A.

What We Graded (and Why It Matters)

Our Website Grader evaluates five categories, each weighted differently:

• Performance (30%) — Page load time, total page weight, number of HTTP requests. A bloated homepage with 400 requests is going to hurt here.
• Security Headers (25%) — Does the site send Content-Security-Policy, X-Frame-Options, Strict-Transport-Security, and other HTTP security headers? Most sites skip at least two.
• SSL/TLS (20%) — Certificate validity, protocol version, cipher strength. We use the same checks as our SSL Certificate Checker. Virtually everyone passes the basics, but older TLS versions and weak ciphers dock points.
• SEO (15%) — Meta tags, Open Graph data, structured markup, mobile viewport, canonical URLs. The bare minimum for search engines and social sharing.
• Availability (10%) — HTTP status codes, redirect chains, server response time.

A perfect 100 means you nailed all five. Nobody in our test did.

The Winners

GitHub (94, A) came in first and it was not close. GitHub ships a tight set of security headers, loads fast, has clean meta tags, and runs a modern TLS stack. If you have ever looked at their response headers, they are textbook. The two points off Performance (their dashboard JS bundle is hefty) and a minor SEO gap on structured data kept them from a perfect score.

Vercel (92, A-) was right behind. This makes sense. Vercel is in the business of fast websites. Their own site practices what they preach: small bundles, aggressive caching, edge-delivered. They lost a few points on security headers — no Permissions-Policy header, which is becoming the new baseline.

WordPress.com, Cloudflare, and dev.to all clustered in the B+ range (88-89). Cloudflare scoring a B+ and not an A is the kind of thing that raises eyebrows, but their marketing site carries more JavaScript than you would expect from a company that sells CDN services.

The Biggest Surprises

Amazon: 55 (F)

Dead last. The world's largest online retailer scored an F.

The homepage made over 300 HTTP requests on our test. Page weight was north of 7 MB. The security headers situation is bleak — no Content-Security-Policy, no Permissions-Policy, a weak X-Content-Type-Options setup. The SEO meta tags on the homepage are minimal at best. Amazon optimizes for one thing: getting you to buy stuff. Web standards compliance is clearly not the priority.

Google: 65 (D)

The irony is thick. Google invented Lighthouse. They built PageSpeed Insights. They penalize slow websites in search rankings. And their own homepage scores a D in our grader.

How? Google.com is fast — it loaded in under 400ms — but speed is only 30% of the score. The homepage ships almost no security headers. There is no structured data markup (the company that literally defined structured data). The SEO meta tags are bare bones. Google's homepage is a search box and a logo. That minimalism helps performance but tanks every other category.

Wikipedia: 68 (D+)

Wikipedia runs on donations and volunteer labor, so expectations should be calibrated. But the missing security headers and outdated frontend patterns pulled the score down. The HTTP headers on wikipedia.org are sparse.

Reddit: 61 (D-)

Reddit's new React-based frontend is heavy. Very heavy. We measured a page weight over 5 MB with 200+ requests. The security headers are incomplete and the initial load time was among the worst in our sample. Old Reddit would have scored differently.

The Middle of the Pack

The C-tier is where most of the social media giants landed. Facebook (79), Twitter (77), and Netflix (75) all hover around a C+/C. These are sites that prioritize their app experience and treat the public-facing web page as a gateway to get you into the native app or logged-in experience. Their homepages are not optimized the same way a content site would be.

Stack Overflow (79) was a mild disappointment. For a site built by developers, for developers, we expected it to set a better example on security headers. Medium (72) has gotten progressively heavier over the years as they have layered on paywalls, tracking, and interstitials.

What This Tells Us

Three patterns jumped out:

1. Developer-focused companies score highest. GitHub, Vercel, dev.to, Stripe — these companies have engineering cultures that care about web standards. It shows.
2. Security headers are the most commonly neglected category. Even sites with perfect SSL and fast load times lose 15-20 points because they skip headers like Content-Security-Policy or Permissions-Policy. Our HTTP Header Analyzer can show you exactly which ones you are missing.
3. Being big does not mean being good. Amazon, Google, and Facebook have more engineers than most countries have developers. But their homepages are not built to score well on web standards. They are built to serve business goals. Those are different things.

None of this means Amazon is "bad" or that Google does not know what they are doing. It means that web grading tools measure adherence to best practices, and even the biggest companies make trade-offs. The question is whether your site is making the right ones.

Methodology

All tests were run in March 2026 using the ZeroKit Website Grader. We tested the root URL of each site (e.g., https://github.com) without authentication, from a standard browser environment. Scores reflect the state of each homepage at the time of testing and may change as sites update their configurations. You can verify any result by running the same URL through our grader yourself.

Want to dig deeper into a specific site? Try our individual tools: the SSL Certificate Checker for TLS details, the HTTP Header Analyzer for security headers, or the DNS Lookup for infrastructure details.