What 3,231 Saudi online stores actually score

The shape of it

Half of these stores sit between 61 and 77. The best scored 97 and the worst 44, so this is not a handful of broken sites dragging an average down. It is the middle of the market.

What this market can and cannot see

Read from the home page markup: analytics, advertising pixels and consent tooling. A store with no analytics is not running a quiet operation, it is running a blind one. From the 1198 stores read in depth.

64% of stores cannot tell you where an order came from, and 37% track people without asking.

What separates the strongest from the weakest

The 299 highest-scoring stores against the 299lowest. A fault both halves share is the market’s habit; one only the weak half has is what is actually separating them.

Which of the six checks is weakest

The same six engines behind the free report, scored separately over the 1198 stores read in depth. Weakest first.

What these stores are built on

Read from each store’s own markup. The platform is the one cause a reader can act on: where one platform’s stores score below another, that is a default rather than a hundred separate mistakes.

What is actually wrong

The twelve faults found on most stores, each counted once per site. 61 distinct faults appeared across the 1198 read in depth.

By what they sell

Weakest first. Real estate came out lowest at a median of 65. The largest group is digital marketing, 994 agencies whose own sites have a median of 69.

Where you would sit

Run the free report on your own address and this is what the number means, against all 3,231 stores that answered.

The ten fixes worth the most, in order

Ranked by how many stores each would help, weighted by what it costs them. Every fix is the instruction our own engine writes when it finds that fault, so this is the same advice you get on your own report.

1. Any site can load your pages inside itself

   high77% of stores

   With neither frame-ancestors nor X-Frame-Options, another site can put your page in an invisible frame over its own buttons, so a click meant for their page lands on yours. On a page with a Buy or a Delete on it, that is the whole attack.

   Fix: Add frame-ancestors 'self' to your Content-Security-Policy, or send X-Frame-Options: SAMEORIGIN if you have no CSP yet.

2. Nothing tells the browser to stay on https

   high66% of stores

   Without Strict-Transport-Security, a visitor typing your domain or following an old link starts on http. That first request travels in the clear and can be intercepted before your redirect ever runs. The header removes that first request entirely for anyone who has visited before.

   Fix: Send Strict-Transport-Security: max-age=31536000; includeSubDomains once you are sure every subdomain serves https.

3. No og:image

   high64% of stores

   Without an og:image, a link to this page shares as a blank or cropped card, which kills the click on social and in chat apps.

   Fix: Add <meta property="og:image" content="…"> pointing at a 1200×630 image on a public URL.

4. Links with no text at all

   high62% of stores

   For example the one pointing at /. Usually a link wrapped around an icon or an image with no alt text. A screen reader has nothing to announce but the address, read out character by character, and search has nothing to describe the destination with.

   Fix: Add an aria-label saying where it goes, or alt text on the image inside it.

5. No Content-Security-Policy

   medium79% of stores

   A CSP is the difference between one injected script running and one injected script being blocked. It is the only header here that limits the damage of a flaw somewhere else, which is why it is worth the work of writing it.

   Fix: Start in report-only mode: Content-Security-Policy-Report-Only with default-src 'self'. Watch what it would have blocked, then enforce it.

6. Browsers may guess your file types

   medium76% of stores

   Without nosniff, a browser can decide a file is a script because of what is inside it, regardless of the type you sent. An uploaded file that was never meant to be code can end up executed as code.

   Fix: Send X-Content-Type-Options: nosniff. It is one line and it has no downside.

7. No H1 heading

   high45% of stores

   The H1 tells a reader and an engine what the page is about in one line. Without one, the topic is unclear.

   Fix: Add exactly one H1 that states the page's subject.

8. No structured data

   medium67% of stores

   There is no JSON-LD on the page, so it cannot qualify for rich results (stars, FAQ, breadcrumbs, product info) in search.

   Fix: Add a JSON-LD <script type="application/ld+json"> describing the page (Article, Product, FAQPage, etc.).

9. Thin content

   medium59% of stores

   Only about 2 words. A page with little to read struggles to rank for anything competitive.

   Fix: Add real, useful content that answers the question the page targets.

10. Images with no width and height set

    medium58% of stores

    The browser cannot reserve space for an image whose size it does not know, so the page jumps as each one loads. That is the shift visitors misclick on.

    Fix: Put width and height attributes on every img tag. CSS can still resize it; the attributes only tell the browser the shape to reserve.

How this was done, and what it cannot tell you

A study that hides its method is an advert. This is the whole of it, including the parts that weaken the result.