The corpus
Every domain in the CISA public .gov registry as downloaded on 27 July 2026 — 16,314 domains. No sampling, no filtering, no exclusions at selection time. This is a census rather than a survey, which means there is no sampling error to report and no weighting to argue about.
The registry is public and free to download, so any figure here can be reproduced independently. That was part of why this corpus was chosen.
What the crawler did
One request to each domain's homepage, plus a request for robots.txt and a probe for a sitemap. It identified itself on every request as:
AccessKnightResearchBot/1.0 (+https://accessknight.com/research/methodology)
- robots.txt was respected. 308 domains disallowed us and were not scanned. That is recorded as an opt-out, not a failure.
- Homepage only. One page per domain. We did not crawl into sites.
- 10-second timeout per request, and requests were paced so the run never concentrated load on any one host.
- No JavaScript execution. The scan reads the HTML as served. This is deliberate — it is what a non-rendering crawler sees — and it is why client-rendered shells are reported as a distinct finding rather than silently scoring badly.
- No LLM calls. Every measurement is deterministic and repeatable. Nothing in this study was graded by a model.
What was measured
Two independent scores per page. The accessibility score runs 33 automated WCAG 2.1 Level AA checks across images, headings, forms, ARIA, colour contrast, tables, navigation, documents and media. The machine-readability score covers crawler access, indexability, sitemap discoverability, server-rendered content, structured data, heading structure, landmarks and accessible names.
Scores are the weighted share of applicable criteria a page passes. Checks that cannot apply to a page — table rules on a page with no tables — are excluded from its denominator rather than banked as passes, so a sparse page cannot score well simply by having little to get wrong.
What was excluded, and why
Tribal domains are excluded from every compliance figure. Tribal nations are sovereign, and ADA Title II does not apply to them. Including them in a compliance rate would be a category error, and publishing a comparative score for governments who are neither the audience for this report nor subject to the rule it discusses serves no purpose we could defend. They were scanned as part of the census; their results are not published here.
Level AAA findings are excluded from all counts. The study measures against Level AA, which is the standard Title II and Section 508 reference. AAA criteria are reported by the scanner as advisory and were not counted.
No per-domain results are published. Aggregates only. We are not publishing a list of which government websites scored badly, and the raw per-domain results are not committed to any public repository.
Two things that were easy to get wrong
Both of these produced a plausible, quotable, incorrect finding on the first pass. They are documented in full on the report itself, but they matter to anyone reproducing this work.
HTTP errors are not evidence of broken sites. Roughly nine tenths of the HTTP-error bucket is 403/429 — bot protection answering a crawler. Reporting that alongside genuine 404s and 5xx errors would have overstated how broken government sites are by an order of magnitude.
The accessibility/machine-readability correlation is confounded by page size. The raw figure is r = -0.117, which reads as though the two work against each other. But WCAG scores fall as pages grow (r = -0.382 against log page size) because larger pages have more to fail, while shared-core structure rises with size (r = +0.748). Holding page size constant, the partial correlation is +0.275 — modest, positive, and stable within size quartiles. The size-controlled figure is the one to quote.
Limitations
Automated testing detects roughly a third of accessibility barriers. Keyboard traps, focus order, reading order and screen-reader behaviour require manual testing that no scanner performs. Every accessibility figure in this report is a floor.
A homepage is not a site. A 10-second timeout is strict, and some share of the timeouts would have answered given longer. The scan is a single point in time — 27 July 2026 — and sites change. None of this is a legal opinion about any entity's compliance.
Questions, corrections, removal
If you administer a .gov domain and want to discuss a result, correct something here, or ask that your domain be excluded from future runs, write to contact@horizontalimpact.com. Corrections will be made on this page with a note saying what changed.
You can also run the same two checks against any URL yourself, free and without an account, from the AccessKnight homepage.