What +15,000 Middle East online stores actually score

The shape of it

Half of these stores sit between 60 and 72. The best scored 95 and the worst 43, so this is not a handful of broken sites dragging an average down. It is the middle of the market.

What this market can and cannot see

Read from the home page markup: analytics, advertising pixels and consent tooling. A store with no analytics is not running a quiet operation, it is running a blind one. Across all 15,583 stores.

48% of stores cannot tell you where an order came from, and 52% track people without asking.

What separates the strongest from the weakest

The 3895 highest-scoring stores against the 3895lowest. A fault both halves share is the market’s habit; one only the weak half has is what is actually separating them.

Which of the six checks is weakest

The same six engines behind the free report, scored separately over the 15,583 stores read in depth. Weakest first.

What these stores are built on

Read from each store’s own markup. The platform is the one cause a reader can act on: where one platform’s stores score below another, that is a default rather than a hundred separate mistakes.

What is actually wrong

The twelve faults found on most stores, each counted once per site. 61 distinct faults appeared across the 15,583 measured.

Market by market

Every market with at least fifty stores measured, best median first.United Arab Emirates leads at 67 and Palestine trails at 61: 6 points separates the best market in the region from the worst. The ranking is the least interesting column here. Analytics is where these markets genuinely differ.

United Arab Emirates is 60% of the stores in this study, because the archive we drew the list from holds far more hosts under some national domains than others. Each market’s median below stands on its own stores and is unaffected. The region-wide median is 66 pooled, and 63 if every market counts once.

Syria (33), Yemen (17) were measured too but have too few stores to publish a median for: a number that would move on ten more shops is not a finding.

Home or away

Salla and Zid were built in the region for it. Shopify, WooCommerce and the rest were not. The 352 stores on a regional platform have a median of 79; the 13,266 on an imported one, 66. Every store on a platform inherits its defaults, so a gap here is one decision made once, not thousands made separately.

Where you would sit

Run the free report on your own address and this is what the number means, against all 15,583 stores measured.

The ten fixes worth the most, in order

Ranked by how many stores each would help, weighted by what it costs them. Every fix is the instruction our own engine writes when it finds that fault, so this is the same advice you get on your own report.

1. Links with no text at all

   high91% of stores

   For example the one pointing at /. Usually a link wrapped around an icon or an image with no alt text. A screen reader has nothing to announce but the address, read out character by character, and search has nothing to describe the destination with.

   Fix: Add an aria-label saying where it goes, or alt text on the image inside it.

2. Any site can load your pages inside itself

   high76% of stores

   With neither frame-ancestors nor X-Frame-Options, another site can put your page in an invisible frame over its own buttons, so a click meant for their page lands on yours. On a page with a Buy or a Delete on it, that is the whole attack.

   Fix: Add frame-ancestors 'self' to your Content-Security-Policy, or send X-Frame-Options: SAMEORIGIN if you have no CSP yet.

3. Scripts that block the first paint

   high73% of stores

   A script in the head with no defer or async stops the browser from building the page until it has downloaded and run. The screen stays blank meanwhile.

   Fix: Add defer to each of those tags, or move them to the end of the body. Use async only for scripts that do not touch the page.

4. Nothing tells the browser to stay on https

   high68% of stores

   Without Strict-Transport-Security, a visitor typing your domain or following an old link starts on http. That first request travels in the clear and can be intercepted before your redirect ever runs. The header removes that first request entirely for anyone who has visited before.

   Fix: Send Strict-Transport-Security: max-age=31536000; includeSubDomains once you are sure every subdomain serves https.

5. The server took 1.8s to send the page

   high62% of stores

   Nothing at all can render until the document arrives, so this delay sits in front of every other improvement on the page.

   Fix: Cache the HTML at the edge, or find the slow query or API call the page waits on before it responds.

6. One phrase linking to more than one page

   medium76% of stores

   "0" points at /shop/cart and /shop/wishlist. Two links with the same words and different destinations cannot be told apart in a list of links, and they tell search that one phrase describes two different pages.

   Fix: Give each one words specific to its own destination.

7. Requests that must finish before anything appears

   medium74% of stores

   Every stylesheet and blocking script in the head is a round trip the visitor waits through while looking at a blank page.

   Fix: Merge the stylesheets, and inline the small amount of CSS the first screen needs while the rest loads after.

8. No og:image

   high48% of stores

   Without an og:image, a link to this page shares as a blank or cropped card, which kills the click on social and in chat apps.

   Fix: Add <meta property="og:image" content="…"> pointing at a 1200×630 image on a public URL.

9. Images with no width and height set

   medium72% of stores

   The browser cannot reserve space for an image whose size it does not know, so the page jumps as each one loads. That is the shift visitors misclick on.

   Fix: Put width and height attributes on every img tag. CSS can still resize it; the attributes only tell the browser the shape to reserve.

10. CSS and JS written into the page itself

    medium69% of stores

    Inline code cannot be cached, so every visit downloads it again, and it is re-sent on every page of the site.

    Fix: Move the bulk into an external file the browser can cache, and keep inline to the small amount the first screen needs.

Or have it done

Fixed price, paid by card, and the report lands in three working days. The larger engagements are quoted after a conversation.

Every engagement is on the services page, and the twenty free tools are at /tools.

Notes. This reads one page per store, so it is a measurement of one page on one day and not a verdict on any business. It cannot see rankings, traffic or sales: a store scoring 60 may well be outselling one scoring 90.