We scanned all 16,314 US government domains. Half didn't answer.
Every domain in the CISA public .gov registry, checked against WCAG 2.1 Level AA and against the structure machines need to read a page. Not a sample — a census. Only 51.1% served a page we could scan at all, and one in five does not resolve.
By Alejandro (Alex) Perez, Horizontal Impact · Method and limitations: /research/methodology
Half the government web never replied.
The most striking result arrived before any accessibility check ran. Of 16,314 registered domains, 8,336 returned a page. Here is what happened to the rest — percentages are of all registered domains.
- Did not answer — 3,432 (21%)
- DNS resolution failed, the connection was refused, or the domain pointed at a private address. Registered in the .gov registry, but nothing responds.
- Timed out — 2,278 (14%)
- No response within 10 seconds. Some share of this is our timeout being strict rather than the site being down — we report it separately rather than folding it into 'broken'.
- Refused an identified crawler — 1,762 (10.8%)
- Answered 403, 406 or 429 to a named, robots-respecting crawler. Bot protection at the edge, not a fault in the site.
- Opted out in robots.txt — 308 (1.9%)
- Disallowed our crawler. A legitimate choice, respected, and not counted as a failure.
- Genuinely broken — 152 (0.9%)
- The homepage itself returned 404, 410 or a 5xx error.
The 21% that did not answer is the number we would stand behind hardest. A domain in this registry is a live government identity. One in five of them resolves to nothing.
365 homepages are telling search engines to go away.
We expected to find government sites blocking AI crawlers. They are not. Exactly 9 sites — 0.1% — disallow OpenAI's search crawler in robots.txt. Government wants to be found.
What we found instead is stranger. 365 government homepages (4.4% of those we scanned) carry a noindex directive — an instruction to every search engine, not just AI ones, to leave the page out of results entirely. On a homepage that is almost never intentional. It is the signature of staging configuration that reached production and stayed there.
Two further gaps in the same direction: 31.2% of scanned sites serve no robots.txt at all, and 28.4% have no discoverable sitemap. Neither is a failure on its own, but together they describe a web that is reachable mostly by accident.
And 12.4% of the pages we scanned were client-rendered shells — the HTML arrives essentially empty and the content is assembled by JavaScript afterwards. A browser copes. A crawler that does not execute scripts sees a blank page.
A quarter score below 70.
Median WCAG score across the 8,336 scanned homepages was 82 out of 100. 2,070 sites (24.8%) scored below 70. The failures are not exotic — they are the same handful of mistakes, repeated across thousands of sites.
Share of scanned sites with at least one instance. Every one of these has a documented fix in the WCAG rule library.
Twenty years of enforcement is visible in the data.
Federal sites have been subject to Section 508 for over two decades. State and local government came under the DOJ's ADA Title II rule far more recently. The gap between them is the clearest signal in the dataset.
| Cohort | Sites | Median | Below 70 |
|---|---|---|---|
| FederalSection 508, enforced 20+ years | 661 | 89 | 14.4% |
| Special districtsTitle II, deadline April 2027 | 737 | 86 | 22.1% |
| StateTitle II | 651 | 85 | 19.5% |
| Local governmentTitle II, first deadline passed | 6,142 | 81 | 26.7% |
Across all Title II entities — 7,530 scanned sites — the median is 82 and 25.6% score below 70.
The Title II dates
- April 24, 2026 · passed — Public entities serving 50,000 or more people
- April 26, 2027 — Public entities serving fewer than 50,000, and all special district governments
We report what the rule says and what the scan found. Nothing here is a legal opinion about any entity.
Three findings we nearly published wrong.
Each of these survived a first pass and failed a second. We include them because a census is only worth as much as its error-checking, and because in every case the corrected finding was more interesting than the wrong one.
- 01
What the first pass said: 12% of government sites are broken.
What was actually true: Nine tenths of that bucket is bot protection answering 403 or 429 — not a broken site. Genuinely broken homepages are 0.9%. The better finding was underneath: robots.txt permitted us on 98.1% of domains, while edge infrastructure refused 10.8% — 5.7 times as many sites blocked by a WAF as by the file everyone argues about. robots.txt is not the binding constraint on crawler access.
- 02
What the first pass said: Accessibility and machine-readability are negatively correlated (r = −0.117), so the shared-core thesis is wrong.
What was actually true: That correlation is an artefact of page size. WCAG scores fall as pages grow (r = −0.382 against log size) because there is more to fail, while shared-core structure rises with size (r = +0.748) because larger sites tend to have it. Holding size constant, the partial correlation is +0.275 — modest, positive, and consistent within size quartiles.
- 03
What the first pass said: 4.5% of government sites block ChatGPT's crawler.
What was actually true: That figure summed two different problems under one label. Nine sites (0.1%) disallow OAI-SearchBot in robots.txt. The other 365 carry a noindex directive — invisible to every search engine, not just AI ones. Government is not trying to hide from AI; a small number of sites are accidentally hiding from everything.
What this does not show.
- Homepages only. One page per domain. A homepage is not a site, and a good homepage can front a bad one.
- Automated testing catches roughly a third of accessibility barriers. Keyboard traps, focus order and screen-reader logic need a person. Every figure here is a floor, not a verdict.
- A 10-second timeout is strict. Some of the 14% that timed out would have answered with more patience.
- One point in time. Scanned 27 July 2026. Sites change.
- Tribal domains are excluded from every compliance figure. Tribes are sovereign and Title II does not apply to them, so counting them in a compliance rate would be a category error. They were scanned; their scores are not published.
Full method, corpus definition and crawler behaviour: the methodology page. We publish aggregates only — no per-domain results, and no list of which government sites scored badly.
If your site is in this data, we can fix it.
Horizontal Impact audits public-sector websites against WCAG 2.1 Level AA and does the remediation. The audit covers a representative set of your pages, separates the template-wide problems — where one fix corrects every page — from page-by-page content work, and produces an effort estimate you can budget against.
Same checks used for this study, run properly across your site rather than one page.
Accessibility audits at Horizontal Impact (opens in a new tab) →The instrument used for this study is AccessKnight, free to run against any URL.