State of law firm websites 2026

The legal industry's relationship with technology has shifted faster in the past 24 months than in the previous decade. According to the American Bar Association's 2024 Legal Technology Survey Report, AI adoption among lawyers nearly tripled in a single year - from 11% in 2023 to 30% in 2024. Among firms with 100+ attorneys, the rate reached 46%. The 2026 Future Ready Lawyer Survey from Wolters Kluwer found that 62% of legal professionals now report up to 20% weekly time savings from AI tools. Thomson Reuters reports that legal tech spending grew 9.7% in 2025 - the fastest real growth ever recorded in the industry.

But here is the disconnect this report exists to document: the same firms that are internally deploying Harvey, Legora, CoCounsel, and Lexis+ AI - sometimes spending eight figures annually on internal AI infrastructure - have public-facing websites that, in many cases, look and behave the way they did in 2019. The AI revolution that has reshaped the inside of these firms has barely touched their front doors.

This is not a critique disguised as data. Some firms are doing extraordinary work. We name them. The patterns to avoid are described, but the firms are not - because the goal of this report is to inform, not to embarrass. Our editorial position is clear: the legal industry deserves better digital infrastructure than it currently has, and the firms that are building toward that future deserve recognition.

This report is published by Smotrów Design, a design and technology studio that has spent more than a decade building websites for law firms (AVELLUM, Moris, Aurum, Andoni Law & Tax, Mamunya IP, Bimaris, and others) and legal software products including Jusnote - the legal practice management platform now adopted across Ukraine and expanding through Europe. We bring the perspective of builders, not consultants. The data and the conclusions are shaped by what we see when we are inside these systems, not just when we look at them from outside.

Methodology

We selected 40 firms across four regions - 10 from each. The selection was purposive, not random: we chose firms that are widely recognized as elite within their respective markets, aiming to capture the standard against which other firms measure themselves rather than the industry average.

For each firm, we evaluated the public website against the following dimensions: CMS detection and frontend technology, performance metrics (LCP, INP, CLS, total page weight), mobile responsiveness across viewport sizes, accessibility features, multilingual support, structured data implementation, AI feature presence (chatbots, semantic search, voice/audio), content velocity and publication infrastructure, conversion architecture (forms, CRM integration), and security posture (HTTPS enforcement, security headers, privacy policy depth).

Some limitations should be disclosed. CMS fingerprinting is imperfect - approximately 24% of leading legal websites return "CMS not detected" in third-party scans, particularly when firms run custom or proprietary platforms behind aggressive CDNs. Field performance data through the Chrome User Experience Report (CrUX) is only available for sites with sufficient traffic; smaller firms in the Ukrainian and CEE samples could only be lab-tested. AI features deployed behind authenticated portals or intranets are by definition outside the scope of this public analysis - which may significantly understate the real AI footprint inside the firms studied.

The sample of 40 firms is elite-tier, not statistically representative of the global legal industry. The findings describe what the standard-setters are doing - or, in some cases, failing to do.

Technical foundation

The foundational decision behind any website - which CMS and frontend technology to build on - shapes everything that follows: who can edit content, how the site integrates with other systems, how vulnerable it is to attack, and how expensive it will be to maintain over its lifetime. We covered the architectural framework in our guide to choosing a CMS for law firms. This report tests how that framework plays out in practice across the elite tier.

CMS landscape

Across our 40-firm sample, the technology stack distribution diverges meaningfully from the broader legal industry baseline. Among Legal 500-style firms globally, WordPress accounts for approximately 49% of detectable platforms, with another 24% returning "CMS not detected" (typically custom or proprietary builds), Sitecore at 5%, and a long tail of enterprise CMS platforms below 2% each.

In our elite sample, the picture shifts. Approximately 35-40% of the analyzed firms run on WordPress in some form - sometimes managed enterprise WordPress on dedicated infrastructure, sometimes shared hosting with extensive plugin stacks. About 20-25% use enterprise CMS platforms (Sitecore, Adobe Experience Manager, RubyLaw being the dominant three). Around 8-12% of the cohort runs on a headless CMS architecture (Strapi, Sanity, Contentful, or custom-built API-first systems with React or Next.js frontends). The remainder are split between proprietary legal CMS platforms and stacks that resist clean classification.

Specific stacks confirmed through public records and infrastructure analysis:

The headline finding: roughly four in ten top corporate law firms still run on WordPress in 2026. Among the firms that have moved off WordPress, the destinations split between enterprise CMS platforms (Sitecore, AEM, RubyLaw) and increasingly headless architectures.

Headless CMS adoption among elite legal firms has moved from approximately 3% in 2024 to roughly 10% in 2026. The headless CMS market itself grew at a 19-22% compound annual rate in 2025 - significantly faster than the 8-10% growth of the overall CMS market. The legal industry is following the broader enterprise pattern, just with characteristic delay.

Last redesign cadence

By examining design patterns, copyright dates, photography styles, and HTML/CSS signatures, we estimated the date of last major redesign for each site in the cohort. Roughly 25% of the sample shows visual and structural evidence of a redesign in 2019 or earlier - predating the Core Web Vitals era, GDPR-compliant cookie consent norms, and Google's mobile-first indexing. The median across the cohort is approximately 4-5 years between major redesigns, with the most modern firms refreshing on approximately 3-year cycles.

This matters because the web has changed structurally in the past five years. A site designed in 2019 was built for a different search ecosystem - one without AI Overviews, without Generative Engine Optimization, without the performance thresholds that now influence Google rankings. Continuing to maintain a 2019-era site in 2026 is increasingly a strategic liability, not just a cosmetic choice. We covered this dynamic in detail in our guide to law firm website redesign.

Performance

Google formally introduced Core Web Vitals as a ranking factor in 2021. The current 2026 thresholds:

A site passes only if 75% of real user sessions hit "Good" across all three metrics.

Aggregated cohort findings

Median desktop LCP across our 40-firm cohort sits between 2.6 and 3.1 seconds - borderline "Needs Improvement." Median mobile LCP runs 4.1 to 4.8 seconds - squarely in "Poor" territory for the typical visitor on 4G. The bottom quartile shows mobile LCP of 6.5 to 9 seconds - well past the threshold at which Google's industry research suggests 53% of mobile users abandon before the page renders.

A consistent pattern emerged in the cohort: firms running WordPress on shared hosting consistently sat 1.8 to 2.5 times slower on mobile than firms running on headless or .NET-based stacks. Specifically, firms on Next.js or other headless architectures loaded approximately 2.5 times faster than the WordPress median in our sample - a quantifiable performance gap with direct conversion implications. As we documented in our law firm website technology guide, the technology choice is not aesthetic. It is architectural and the consequences are measurable.

Page weight tells a similar story. Top-quartile firms ship 800KB to 1.4MB per homepage. Bottom-quartile firms shipped 4 to 7MB - typically dominated by uncompressed hero photography, autoplay video backgrounds, and stacks of analytics and marketing scripts. We observed a recurring pattern across the lower-performing sites: a single uncompressed lawyer hero image often represents 80-90% of total page weight on the homepage.

Cumulative Layout Shift performs better than other metrics. Approximately 70% of the cohort passes (CLS below 0.1). The failures cluster around firms running multiple late-loading third-party widgets - cookie banners, chatbots, social media embeds.

The weakest metric across the sample is Interaction to Next Paint. Firms with heavy WordPress plugin stacks frequently exceed 300-500 milliseconds INP, especially on archive and listings pages where lists of articles or attorneys must be filtered, sorted, and rendered. The data reflects what we see when we audit these sites: every plugin adds JavaScript execution overhead, and at scale this overhead becomes user-facing.

Named performance leaders

Some firms in our cohort earned recognition for performance.

A finding worth pausing on: the fastest-loading websites in our sample are not in New York or London. They are in Kyiv. Ukrainian elite firms - building or rebuilding their digital presence during wartime, often with smaller budgets than their AmLaw counterparts - consistently ship lighter, faster sites with cleaner architecture. The reason is structural: their sites were built more recently, from cleaner foundations, by teams who treated performance as a first-class concern rather than a post-launch optimization.

Anonymized observations

Without naming firms: three of the top ten US firms by revenue exceed five-second mobile LCP - a threshold at which more than half of mobile users abandon. One AmLaw 50 firm's homepage triggers 47 active third-party scripts, pushing INP above 600 milliseconds. Firms in the bottom quartile of our performance sample show average mobile load times above 6 seconds versus 1.9 seconds at the top - a 3.3-times gap that maps directly to estimated lost contact-form conversions.

User experience

Mobile responsiveness

All 40 firms in the sample serve technically responsive websites - none deliver a desktop-only experience. But responsive is not the same as mobile-first. An estimated 35-45% of the analyzed sites show clear desktop-first design thinking: fixed pixel widths that break under 375px, typography that becomes unreadably small on standard mobile screens, navigation that requires multiple taps to reach key practice area pages.

The data context: more than 60% of visits to law firm websites now happen on mobile devices, based on aggregated traffic patterns we have seen across our client portfolio. Designing the desktop experience first and adapting it to mobile is the inverse of where the audience actually is.

Accessibility

This is where the cohort's collective performance is weakest - and where the legal industry's exposure to risk is highest.

Approximately 85% of the analyzed sites ship no explicit accessibility features beyond what comes baked into modern browsers - no font-size controls, no high-contrast mode, no text-to-speech, no visible accessibility statement linked from the footer. The industry baseline is below where general corporate websites have moved.

The legal context is that ADA Title III website accessibility lawsuits hit 8,800 in 2024 (according to Seyfarth Shaw) and reached 2,019 in the first half of 2025 alone (according to UsableNet) - a 37% year-over-year rise. The Department of Justice's April 2024 final rule under ADA Title II made WCAG 2.1 AA the explicit compliance baseline for state and local government websites; many courts and corporate clients now apply that baseline informally to their outside counsel as well.

A subset of analyzed firms - roughly 15-20% of those with any accessibility features - rely on overlay widgets such as accessiBe or UserWay rather than code-level accessibility. This pattern has been criticized by the American Bar Association's Business Law Section, by disability rights organizations, and most pointedly by the Federal Trade Commission, which fined accessiBe $1 million in January 2025 for misrepresenting the effectiveness of overlay-based accessibility solutions.

The combination of legal pressure, regulatory scrutiny, and reputational exposure makes accessibility the most asymmetric risk in the sample: the upside of doing it well is modest (some inbound traffic, some reputational benefit), while the downside of doing it poorly is increasingly material.

Multilingual support

Average languages per site, by region:

Continental European firms set the standard for multilingual sophistication. Cuatrecasas, Garrigues, Uría Menéndez, Wolf Theiss, and CMS treat multiple languages as first-class architectural concerns - structured for parallel content production, with legal alerts published in three or four languages within hours of each other. The AmLaw 100 lags here, in part because the addressable market for an English-only site is genuinely massive, but the gap is increasingly visible to multinational clients evaluating outside counsel.

Structured data

Approximately 50-60% of the cohort uses at least basic Organization or LocalBusiness schema - typically delivered by Yoast or similar WordPress plugins. Far fewer (estimated below 20%) implement deeper LegalService, Person (Attorney), or Article schema that would help AI search citation rates and Generative Engine Optimization performance.

This is a significant structural gap given how much referral traffic in 2026 now flows through AI Overviews, Perplexity, ChatGPT Search, and similar systems. As we covered in our GEO guide, structured data is no longer optional infrastructure - it is the substrate that AI search engines use to attribute authoritative content.

AI and digital features

This section is where the disconnect between what these firms do internally and what their public websites express becomes most visible.

Chatbots

Approximately 12-18% of our 40-firm cohort deploys some form of chatbot on the public website. Among the elite tier, this rate is markedly lower than the broader legal market - in the personal injury, immigration, and family law verticals, chatbot deployment rates exceed 30-40%.

Within the elite firms that do deploy chat, our breakdown: roughly 60% use generic vendor solutions (Drift, Crisp, Intercom-style products), 30% use AI-augmented vendor products, and 10% use custom implementations. The American Bar Association's 2024 Solo and General Practitioner eReport explicitly warned about chatbot risks for law firms - particularly around accuracy and the ethics of presenting automated responses as substitutes for attorney consultation. Multiple bar opinions issued through 2025 have addressed similar concerns.

Without naming firms: three of the top ten US firms by revenue still deploy chatbots that auto-launch within five seconds of arrival. The pattern is one we covered in detail in our article on AI tools for law firm websites - a UX choice that signals consumer-grade conversion tactics rather than serious professional service standards.

AI-powered search

Approximately 5-10% of the cohort has shipped meaningful AI-powered semantic search on the public site. This is the most underutilized AI category in the sample - and the one where we see the clearest opportunity for differentiation.

Latham & Watkins runs Coveo, an AI-powered enterprise search platform, allowing visitors to find content, attorneys, and practice areas through natural-language queries rather than keyword matching. Sidley Austin also runs Coveo. These are the two clearest examples of AmLaw firms investing in the search layer as an AI surface. The investment is visible in the user experience: when visitors search for concepts rather than exact terms, the system retrieves relevant content even when the words do not appear on the matching pages.

A relevant external example from our own portfolio: the Legal Positions Database we built for the Supreme Court of Ukraine uses semantic NLP search across thousands of judicial positions. A legal professional types a question in natural language - "circumstances under which a court may refuse to enforce an arbitration clause" - and the system returns conceptually relevant judicial positions, not keyword matches. This is the pattern that any law firm with a substantial publications archive should consider.

Voice and audio content

Effectively 0% of the sample offers native text-to-speech as an accessibility or content-consumption feature. This is the easiest win in the entire AI category - implementable through ElevenLabs, ReadSpeaker, or browser-native Web Speech APIs - and yet it remains essentially unaddressed across the elite tier.

Internal AI versus website AI

This is the most newsworthy disconnect this report documents. The firms in our sample have invested aggressively in internal AI:

Across the AmLaw 100, more than 41 firms had publicly disclosed generative AI use as of early 2024, according to Law.com's survey. The 2024 ABA Tech Report identified ChatGPT (52.1%), Thomson Reuters CoCounsel (26%), and Lexis+ AI (24.3%) as the leading internal tools.

But the same firms paying eight-figure annual license fees for internal AI infrastructure are shipping public-facing websites with lexical search and no semantic discovery, no text-to-speech, no AI-powered content navigation. The internal sophistication is not visible to clients, prospects, or recruiters who experience the firm through its public web presence.

Content strategy

Publication infrastructure

Across the cohort, 30% of firms publish content weekly or more frequently (Latham & Watkins, Sidley Austin, Linklaters, Freshfields, Hogan Lovells, CMS lead this group). 40% publish monthly. 30% publish quarterly or less - and within that group, several firms have published nothing new in the past 90 days.

The leaders treat content as product. Latham & Watkins maintains practice-specific microsites including Tech Regulation Portal and the interactive Book of Jargon glossary - investments that demonstrate sustained content infrastructure rather than blog-style activity. Sidley Austin sustains a 100-plus articles per quarter pace with disciplined topic taxonomy. A&O Shearman's FinTech Foundry sub-site is one of the strongest examples of a vertical microsite that out-ranks the parent on niche queries.

The Continental European firms (Cuatrecasas, Garrigues, Uría Menéndez) and the CMS network maintain consistent multi-language thought-leadership pipelines, often publishing the same analysis in 3-4 languages within 24 hours.

In Ukraine, AVELLUM and the broader top tier maintained active publication cadences through the war - in both Ukrainian and English - with a quality and consistency that any peer market would recognize. This is one of the most underappreciated stories of resilience in the global legal industry.

Practice area depth

Cohort medians for practice area pages: AmLaw and Magic Circle firms typically maintain 25-40 dedicated practice area pages; Continental European firms 12-20; Ukrainian top firms 15-25. As we documented in our practice areas guide, the structure of these pages determines both user experience and search performance.

Quality varies sharply. The leaders ship 800-1,500 word practice-area narratives with named representative matters, partner authorship, structured key-contacts widgets, and dedicated landing pages for sub-practices. The laggards run 200-400 word pages of generic boilerplate.

Author attribution

Across the cohort, fewer than one in four firms attribute insights articles to a named partner with a clickable bio link. As we covered in our attorney profile guide, the attorney profile is the highest-converting page on most legal websites - and the failure to connect insights authorship to attorney profiles is a missed authorship-and-trust signal that AI search will increasingly penalize.

Conversion architecture

The median contact form across the cohort has 5-7 fields - typically name, email, phone, firm, message, consent, and country. The conversion-optimized outliers ship 3-field minimum-viable forms: name, email, message.

Two AmLaw 100 firms in our sample require 11 or more fields on the primary contact form, including pre-engagement disclaimers. This is a pattern almost guaranteed to suppress inbound enquiries from in-house counsel, who are typically the most valuable lead source for elite firms. As we covered in our contact page guide, the cost of friction in the contact form is measurable - and almost always higher than the perceived benefit of capturing more upfront information.

CRM tells (visible form action URLs, tracking pixels, marketing automation script signatures) suggest approximately 30% of the cohort has integrated the website with a serious CRM system. The remaining 70% appear to send inquiries to plain mailto handlers or basic email addresses. This is a substantial gap - and one we addressed in our CRM integration guide.

Newsletter subscription is offered by approximately 70% of the cohort. Only a minority offer topical or jurisdictional segmentation - Latham & Watkins, Sidley Austin, and CMS lead here, allowing visitors to subscribe by practice area and jurisdiction rather than receiving generic firm-wide updates.

Security posture

HTTPS enforcement is universal across the sample - 100%. This would have been a finding in a 2018 study; in 2026 it is table-stakes.

HSTS (HTTP Strict Transport Security) is present on approximately 70-80% of the cohort - notably enforced on Slaughter and May, Sidley Austin, and Latham & Watkins. The 20-30% gap is concentrated in Continental European and Ukrainian firms, suggesting an opportunity for the security teams in those firms to align with global best practices.

Content Security Policy headers are present on an estimated 30-40% of the cohort. This is a meaningful gap given the volume and severity of WordPress plugin vulnerabilities. The leaders ship comprehensive CSP headers; many firms do not.

The WordPress security context in 2026 is materially worse than it was in 2024. Patchstack's State of WordPress Security 2026 report (published February 25, 2026) documented 11,334 new vulnerabilities in the WordPress ecosystem in 2025 - a 42% year-over-year increase from 2024's 7,966. Of those, 1,966 (17%) were rated high severity. Plugins accounted for 91% of vulnerabilities. Highly exploitable vulnerabilities increased 113% year-on-year. The weighted median time from disclosure to first exploitation in 2025 was just 5 hours. 46% of vulnerabilities had no patch available at the time of public disclosure. Patchstack's pentesting studies in 2025 found that traditional hosting defenses (Cloudflare, ModSecurity, Imunify360, internal WAFs) blocked only 12-26% of real-world WordPress exploits.

Without naming firms: more than half of the WordPress-based sites in our sample run plugins last updated more than 12 months ago. The structural profile is not unlike the one that contributed to the 2016 Mossack Fonseca breach - the Panama Papers, the largest legal data leak in history - which security researchers attributed in part to outdated WordPress and Drupal installations running unpatched plugins.

The supply-chain concern compounds the technical risk. The September 2024 to ongoing dispute between Automattic (the parent company of WordPress.com) and WP Engine - in which Automattic blocked WP Engine customers from the official plugin repository, forcibly forked the Advanced Custom Fields plugin into a new "Secure Custom Fields" version using the original plugin's slug, and pursued an 8% gross-revenue trademark royalty against WP Engine - introduced a category of supply-chain risk that no responsible CTO would have anticipated three years ago. The Computer Fraud and Abuse Act allegations by WP Engine are ongoing as of this writing. As one WordPress agency CEO told The Register, "I received phone calls from the chief legal counsels of some of our clients - these are large corporations - saying, 'this is a supply chain security issue.'"

Privacy policies are universal across the sample (mandatory under GDPR for any firm with EU clients, and under various US state privacy laws). Quality varies. Latham & Watkins's policy explicitly names Sitecore and Coveo as subprocessors - a level of disclosure that exceeds typical legal industry practice. Many firms still rely on boilerplate that predates current GDPR enforcement standards.

Regional patterns

The data divides cleanly along regional lines, with each region demonstrating distinctive strengths and weaknesses.

The leaders

Where firms are doing things right, this section names them and explains why.

Patterns to avoid

The patterns described below were observed in multiple firms across the cohort, but we name no specific examples - the goal is to inform, not to embarrass.

What this means for law firms in 2026

The actionable framework for any firm planning a digital initiative in 2026 or 2027:

Methodology limitations and call for collaboration

Several limitations should be disclosed. The sample is purposive and elite-tier - it describes what the standard-setters do, not what the average law firm does. CMS detection has known false negatives. Field performance data is unavailable for low-traffic sites. AI features deployed behind authenticated portals or intranets are by definition outside this analysis.

The report celebrates leaders by name and anonymizes problems by design. This is editorial choice, not statistical timidity.

We intend to publish an updated State of Law Firm Websites report in 2027. We invite firms to share their internal performance data and CMS facts on a confidential basis to deepen the anonymized aggregates. We invite peer agencies to contribute their stack-detection data for a more comprehensive census. The legal industry will benefit from better collective benchmarking, and we are committed to providing it.

Conclusion

The legal industry stands at the intersection of two trajectories. Internally, AI adoption is accelerating - now at 42% of firms using AI tools in 2026, up from 26% in 2024 according to U.S. Legal Support's 2026 Outlook. Generative AI is reshaping legal research, document review, contract analysis, and increasingly client communications. The internal sophistication of the elite legal firms in 2026 is genuine and rapidly improving.

Externally - on the public-facing websites that prospective clients, recruits, journalists, and regulators encounter first - the picture is more complicated. Some firms have invested in modernization. Most have not. The gap between internal AI sophistication and external digital presence is the defining tension in legal digital strategy in 2026.

The firms that close this gap - that translate their internal investment into experiences clients can see - will set the standard for the rest of the decade. The firms that do not will increasingly lose ground in the search visibility, lead conversion, talent acquisition, and brand differentiation contests that decide who grows and who stagnates.

This report is part of Smotrów Design's ongoing work on legal industry digital infrastructure. For our broader perspective on the architectural decisions behind law firm websites, see law firm website design: 5 things that actually matter. For the technology framework these decisions sit within, see law firm website technology: what to build on in 2026. For the CMS framework specifically, see CMS for law firms: how to choose the right platform for a corporate legal website. For our perspective on the AI tools that actually belong on a law firm website, see AI tools for law firm websites: what actually works and what to avoid.