August 2026

330 web agency sites, and an audit to redo

AuditAgencies

We pointed our checker at the websites of 330 French web agencies and IT firms. The first pass claimed a dead link on six sites in ten. That was wrong, and the mistake was ours.

The mistake first

Our checker collected every link carrying an href attribute, then flagged as broken anything answering 400 or above. Two mistakes in one sentence. WordPress declares machine endpoints in the head of every page: oembed, xmlrpc. They answer 400 or 405 when called without parameters, which is correct behaviour, and no visitor ever follows them. They accounted for the overwhelming majority of our “dead links”.

Same story for certificates. We flagged every expiry under thirty days. But a Let’s Encrypt certificate lasts ninety days and renews around day sixty: seeing it at eighteen days left says nothing except “renewal is about to fire”. Of twenty-five certificates under thirty days, twenty-two were in that case.

The corrected method

One request on the homepage, then up to ten clickable anchors followed — anchors only, not head declarations. A link counts as dead only if it answers 404, 410 or a server error: a password-protected page or a refused verb is not a failure. A certificate counts only if it is long-lived, therefore renewed by hand. We measured full response time, the HTTP-to-HTTPS redirect and the presence of an HSTS header. No privileged access: nothing beyond what a visitor sees. 2,703 links checked, on 24 August 2026.

The results

• 20 sites out of 330 have at least one dead internal link: 44 links in total, 38 of them 404 and 6 server errors.
• 12 answers in 401, 403, 405 or 429 were set aside: they do not indicate a broken page.
• 19 sites did not answer at all at the time of the check.
• Only 3 sites have a certificate needing human action within thirty days: two DigiCert, one Sectigo, valid for a year or six months.
• 17 sites do not redirect HTTP to HTTPS, and 191 send no HSTS header at all.
• Median response time: 593 milliseconds. Nine sites in ten under 2.1 seconds. Fifteen above three seconds, the worst at 10.5 seconds.

What that tells us

One dead link across sixteen sites is not the spectacular figure we thought we had. It is an accurate one, and it says something more useful: agency sites hold up rather well, and the noise comes from the tools measuring them. An audit that cries fire at every WordPress endpoint is not rigorous, it is unusable — and in front of an agency, it turns against whoever sent it.

The rest keeps all its value. A ten-second page raises no alert: it just makes the visitor leave. A commercial certificate at eighteen days is waiting for an action nobody scheduled. A link answering a server error genuinely breaks a journey. Those three deserve continuous monitoring, precisely because none of them announces itself.

Check your own

The same check, with the corrected rules, is freely available on our audit page: one address, no account, the result on screen. It does not replace continuous monitoring — it looks once, at one moment — but it gives you the lie of the land, and that is often the starting point.