You Shipped Your Website. Surprise: You're Not Done.

Two things happened on sites we operate this month, both good reminders that websites today require several complementary layers of automated and manual testing + monitoring.

The first: a transit website's Google Maps bill quietly headed for $1,440 a month. Nothing was broken. Every page worked. An automated client averaging 153 page views per "visitor" was loading the live map thousands of times a day, and every load billed. Nobody did anything wrong at launch; the launch was two years ago, and the web around the site changed. We wrote that story up separately; the measured ending is an 87% cost reduction.

The second: on the same site, the AI translation backend died behind an exhausted spend cap and stayed dead for fourteen days. Eleven thousand error events. No one noticed, because the system was built well: translation is cache-first with a long TTL and fails open, so cached strings kept serving and every page stayed almost entirely translated. A cache-first system with a dead backend looks healthy for exactly as long as the cache lasts. The better your degradation story, the quieter your failures.

Neither of these is a build defect. Both are operations. And that is the surprise hiding in every launched website: shipping was the halfway point. A website in 2026 is not an artifact you finish. It is a system you operate.

The bar moved while you were building

Three separate shifts, all recent, all measurable.

1. Your audience is no longer only human.

Cloudflare's mid-2026 numbers put automated requests at 57.5% of HTML page traffic, the first time bots have outnumbered people, with agentic AI traffic up roughly 7,851% year over year. Agents do not see your hero animation. They read your markup, your feeds, your structured data, and increasingly your machine-facing surfaces: llms.txt, MCP endpoints, API catalogs. A site with none of those is invisible to the fastest-growing category of visitor. A site that serves maps to them bills you for the privilege, which is how our first story happened.

2. Acessibility acquired teeth while the web got worse at it.

The European Accessibility Act has been enforceable for most covered services since June 2025. In the United States, more than 5,000 digital accessibility lawsuits were filed in 2025; federal web accessibility suits were up 27% over the year before. Meanwhile the WebAIM Million, the annual census of the top million home pages, found 95.9% of them with detectable WCAG failures in 2026, averaging 56 distinct errors per page, and the numbers got worse this year, not better. The report's authors point at growing page complexity and AI-assisted coding. The legal exposure is rising and the baseline is falling at the same time.

3. Performance stopped being a vibe.

Core Web Vitals are measured from real users' browsers and feed search ranking. As of the May 2026 field data, 55.9% of tracked origins pass all three. Nearly half the web fails a public, continuously updated exam most owners have never looked at.

The Good News: it got cheap

If the bar moved and that were all, this would be one more article telling you to be anxious. Here is the half that usually goes unreported: the cost of clearing the bar has collapsed.

Every tool in the previous three paragraphs' implied to-do list is free. The accessibility engine that powers most commercial audit products is open source. Lighthouse ships inside the browser you already have. Type checkers, linters, dead-code scanners, test runners: free, fast, and better than they have ever been. What was never cheap was the labor of wiring them up and reading their output, and that is the part that just changed, because a coding agent can run the whole loop: build the harness, sweep every page, read the failures, fix them, and re-run to prove it.

We know, because we did it to our own site and kept the receipts. In one working day, most of it agent-executed:

• An axe-core sweep of all 26 page templates found 10 distinct accessibility rule failures spanning most of the site: duplicate landmarks, a missing page title on the 404, contrast failures in a data visualization, keyboard-unreachable charts. By the end of the day: zero violations, on every template, with the fixed conventions now enforced by the build itself.
• A Lighthouse pass over 21 pages found our worst page at 74, dragged down by layout shift from web font swaps. After metric-matched fallback fonts, font preloading, and image priority fixes, every audited page scores 86 to 94 and cumulative layout shift is roughly zero site-wide.
• An agent-readiness audit went from "mostly invisible to agents" to 10 of 11 findings closed: llms.txt, a public MCP server, an RFC 9727 API catalog, markdown content negotiation, and the rest.

A decade ago each of those was a consulting engagement with a PDF at the end. Last week each one was an afternoon, and each produced a harness that lives in the repository and re-runs with one command. The audit is no longer an event. It is a habit with a cron schedule.

What "operated" means in practice

Not a war room. Three layers of automation, in ascending order of how often they run:

Gates on every change. Type checking, linting, tests, dead-code scanning. These run in seconds and make whole categories of decay impossible to commit.

Gates on publishing. Content has failure modes code checks miss: editorial drift, broken frontmatter, silently reformatted archives. Ours are pattern scans and characterization tests; yours will differ; the principle is that publishing is a deploy and deserves a gate.

Continuous audits and loud monitoring. The sweeps above, re-run on a schedule, plus the operational lesson both opening stories teach: anything that fails open needs a health signal that does not depend on the output looking wrong. Our translation outage produced a Sentry alert that fired, was marked high priority, was emailed, and was ignored, because its subject line described a mechanism instead of a consequence. When most alerts are ignorable, all of them are. Billing alerts, error budgets, and alert copy that states impact are part of the website now.

The full toolbox, with names, configs, and what each check caught on a real project, is its own article: The Website Workbench.

You're not done, and that's the good news

The surprise is not that the site you shipped needs operating. Every serious system does, and websites became serious systems while nobody was watching: they got a second audience, a legal floor, and a public report card. The surprise is how little operating now costs. The tools are free, the harnesses take an afternoon, and the agent that runs them does not get bored on the twenty-sixth template.

The site that gets this attention is faster for people, legible to agents, defensible in an audit, and cheaper to run. The one that doesn't will mostly look fine. That is the trap. Looking fine is what our translation system did for fourteen days.