State of SEO on the Russian web 2026: a study of 901 sites

Key findings

• Security headers and snippets are the most common gaps: 79% of sites set no CSP, 70% send no HSTS, and 79% have meta descriptions outside 50–160 characters.
• Structured data lags: 69% have no JSON-LD, 58% no og:title and 58% no canonical tag.
• The basics mostly hold: 90% serve robots.txt and nearly all run on HTTPS. Yet 30% return nothing at /sitemap.xml and 20% lack a 301 redirect from HTTP to HTTPS.
• 8% already publish llms.txt, rising to 18% in e-commerce. Only 6% block GPTBot in robots.txt.
• Online stores are better marked up: 49% lack JSON-LD versus 72–75% of media and other sites.
• Lower-ranked sites have less markup: 51% of the top 10k Tranco sites lack a canonical tag, compared with 63% in the 100k–1M range.

Technical basics: robots.txt, sitemaps, HTTPS

Most sites have the foundation in place. Only 10% fail to serve robots.txt, and under 1% do not work over HTTPS. Treat the HTTPS number with care: the way we picked live sites skews it, as explained in the method section.

Sitemaps are the weak spot. Nearly a third of sites return nothing at /sitemap.xml, and about as many do not list a sitemap in robots.txt. The share barely moves with site size: 30% in the top 10k, 29% in the 10k–100k range, 30% below that. Another 20% do not send a permanent 301 from HTTP to HTTPS, so the redirect is either missing or temporary.

Meta tags and snippets: title, description, Open Graph

Titles are almost universal: only 6% of sites have pages without one. But 67% have at least one title shorter than 10 or longer than 70 characters. Descriptions follow the same pattern: 21% of sites miss them on key pages, and where length could be measured, 79% fall outside 50–160 characters.

Length is not a direct ranking factor, but search engines truncate long titles and descriptions and often rewrite empty or very short ones. Note how strict the count is: a site counts as failing if the issue appears on any one of up to ten checked pages.

Open Graph is rarer still: 58% of sites have no og:title, so link previews in messengers and social feeds are built from whatever the preview bot finds. 24% do not declare a language in <html lang>, and 14% have no meta viewport.

Structured data and canonical tags

JSON-LD is the biggest gap after security headers: 69% of sites have no structured data on the checked pages, so search engines get no explicit facts about the organisation, product or article. 58% have no canonical tag, which leaves search engines to pick the main version among copies with UTM tags, filters and sort parameters. 54% have images without alt text.

Security: HSTS, CSP, security.txt

70% of sites send no Strict-Transport-Security header and 79% set no Content-Security-Policy. Neither header affects rankings directly, but both are standard items in a technical audit. Lower-ranked sites configure them less often: CSP is missing on 69% of the top 10k and 87% of the 100k–1M range, HSTS on 63% and 76%.

A security.txt file with a contact for vulnerability reports (RFC 9116) exists on 2% of sites, and on 8% of the top 10k.

AI and LLMs: llms.txt and GPTBot

The newest signal in the study. llms.txt, a markdown summary of a site for language models, is published by 8% of Runet sites. We counted a file only if /llms.txt returned non-empty text with a 200 status, not an HTML fallback page, and reviewed all 73 files by hand: 72 were real, one was a text placeholder.

Online stores lead: 18% publish llms.txt, twice the rate of media sites and more than three times that of other sites. Higher-ranked sites lead too: 15% of the top 10k versus 7% further down. Blocking AI crawlers is rare: 6% disallow GPTBot in robots.txt, with media sites highest at 9%.

Segments: stores, media and the rest

We split sites into three segments using a rough heuristic on the home page HTML: e-commerce (189 sites), media (158) and other (554). Read the breakdown as a direction rather than exact figures.

Stores do better on almost every metric, most clearly on meta tags and markup: only 4% lack a description and 49% lack JSON-LD. Store platforms that generate descriptions and product markup from catalogue data are a likely reason. The canonical gap is smaller: 52% of stores versus 59–60% of the rest.

Site size: lower rank, less markup and hardening

Tranco is a research-grade ranking of the top one million domains, built from several traffic and link sources. We split the sample into three rank bands: the top 10k, 10k–100k and 100k–1M. On almost every metric the lowest band looks worse.

There are exceptions. The share of sites with nothing at /sitemap.xml is flat at about 30% across bands, and images without alt text are more common in the top band (59% versus 50% at the bottom). The top band is also the smallest (149 sites versus 381 and 371) and had the most bot-protection failures (11%), so its numbers are the least precise.

What to fix on your own site

• Make sure /robots.txt and /sitemap.xml return 200 and the sitemap is listed in robots.txt
• Set up a permanent 301 from HTTP to HTTPS and a Strict-Transport-Security header
• Keep titles at 10–70 and descriptions at 50–160 characters on every key page
• Add a canonical tag to every indexable page, including pages with parameters
• Add JSON-LD: Organization on the home page, Product or Article on product pages and posts
• Fill in og:title, og:description and og:image for link previews
• Declare <html lang>, a meta viewport and alt text on meaningful images
• Choose an AI crawler policy in robots.txt and publish an llms.txt

The App-Kit SEO audit checks every item on this list — it is the same engine we used for the study. Paste your URL and in about half a minute you will see which checks fail and how to fix them.

Method and limitations

Sample. We took the Tranco top 1M list (list ID 262W9, 20 October 2026) and every domain in it under .ru and .рф — 36,195 domains. We split them into three rank bands and randomly picked 1,000 live sites: 170 from the top 10k and 415 from each of the other two bands.

Crawl. 21–22 October 2026, using the App-Kit SEO audit engine in fast mode: up to 10 pages per site, crawl depth 2, at most one request per second, robots.txt respected. The crawler identified itself as AppKitResearchBot/1.0. 94 sites failed (WAF and captchas, robots.txt disallow, timeouts) and 5 were excluded because they served a login page instead of a site, leaving 901.

Counting. The unit is a site, scored by its worst checked page. Shares are taken over sites with a clear pass or fail; intervals are 95% Wilson. We publish only metrics with at least 80% coverage and 30 sites per slice. A manual check of 6 metrics on 21 sites matched 126 of 126 verdicts.

Limitations

• Server-rendered HTML only, no JavaScript: on single-page apps some tags may appear after rendering.
• Sites may serve a crawler a different version than a browser.
• WAFs and bot protection, certificates from the Russian state CA (not in standard trust stores) and robots.txt blocks removed some sites, mostly large ones. The figures describe the typical Runet site more than its top tier.
• Ten pages per site is not a full crawl, so large sites likely have more issues than we saw.
• Tranco ranks by global traffic, so Runet ranks in it are approximate.
• This is a snapshot as of 21–22 October 2026.

Data and citation

The aggregated data is open under CC BY 4.0: reuse it with a link to the source. It contains no per-site data. Column names are in English; metric titles are in Russian.

Source: App-Kit study “State of SEO on the Russian web 2026” (app-kit.ru/blog/seo-runeta-2026)