We Scanned the Websites of the BIST 100

When people discuss the state of Turkish corporate websites, everyone has an impression and nobody has a number. So we produced one.

We measured the home pages of the companies in Borsa İstanbul's BIST 100 index — Türkiye's largest listed companies — one by one. The result says something sharper than we expected: the foundations that are solved with money are in place; the ones that are solved with attention are not.

This article gives both the findings and the method, and ends with how to run the same measurement on your own site.

What we found

• All 85 measurable home pages were served over HTTPS, and 94.1 percent carried a mobile viewport tag (Caliency measurement, 16 October 2026).
• Yet only 38.8 percent contained at least one H1 in the HTML the server sent.
• Canonical tags appeared on 57.6 percent, JSON-LD structured data on 35.3 percent, hreflang on 27.1 percent.
• 20.3 percent of images carried no alt text (979 of 4,824).
• Of the 98 published addresses, 13 never served their home page to an automated client; seven of those returned a bot-protection page.
• Two of the 100 index members publish no website at all in their KAP record.

How we measured it

The method comes first, because the numbers only mean what the method allows.

The company list: the BIST 100 (XU100) index membership published by KAP, with website addresses taken from the same companies' KAP records (Public Disclosure Platform, indices). Index membership changes; this measurement reflects the list as it stood on 16 October 2026.

The request: each site's home page only, once, with a desktop browser user agent, from outside Türkiye. One request per page, plus one each to /robots.txt and /sitemap.xml.

The limitation that matters most: no JavaScript was executed. Every figure here answers one question — "is this present in the HTML the server sends?" Anything constructed later in the browser is invisible to this measurement.

What we did not measure: Core Web Vitals field data, inner pages, content quality, rankings, traffic. One measurement of one home page is not a complete picture of an organisation's digital maturity.

First, the door: 13 sites never opened

The first finding arrived before the measurement did.

Of the 98 published addresses, 85 returned a measurable home page. Seven served a bot-protection page instead: four Cloudflare challenge screens, two Cloudflare blocks and one Incapsula block. Four refused the connection outright and two returned a server error.

These sites are not broken. They open normally in a real browser. What we measured is narrower: what happens when a non-browser client knocks.

That distinction keeps gaining weight, because the crawlers behind search engines and AI systems are automated clients too. OpenAI's own crawler documentation recommends that sites wanting to appear in ChatGPT search allow its search crawler in robots.txt and allow requests from its published IP ranges (OpenAI, Overview of OpenAI Crawlers). If a security layer refuses the request at the network level, the permission in robots.txt is never read.

None of this argues for switching bot protection off. It argues that which automated clients are allowed through should be a deliberate decision. Which AI crawlers to allow is covered in AI crawlers: allow or block, and the mechanics on the ChatGPT side in how to get cited by ChatGPT.

Infrastructure checks this study did not cover, such as redirects, www consistency and soft 404s, we measured separately on 200 popular Turkish sites in the technical SEO checklist.

What is in place: the foundations money solves

The top half of that chart is good news. HTTPS is at 100 percent — it was not ten years ago. Mobile viewport 94.1 percent, title tag 98.8 percent, html lang 85.9 percent (Caliency measurement, 16 October 2026).

These items share a property: each is done once, solved with budget, and visible when missing. A certificate gets bought, a responsive theme gets chosen, a title gets written. A corporate site rarely skips them, because someone notices when it does.

What is not: the foundations attention solves

The bottom half tells a different story.

Canonical, 57.6 percent (Caliency measurement, 16 October 2026). One site in three does not tell search engines which address is the real one. On large corporate sites full of parameters and duplicated paths, that costs more than it does elsewhere.

JSON-LD structured data, 35.3 percent. Google states that it uses the structured data it finds to understand what a page is about, and that the format easiest to implement and maintain is usually JSON-LD (Google Search Central, intro to structured data). Two thirds of Türkiye's largest companies do not state who they are in a machine-readable form. Which schema does what is covered in schema markup.

20.3 percent of images have no alt text — 979 of the 4,824 we counted. That is a loss on both accessibility and search; web accessibility explains why.

robots.txt returns 200 on 72.9 percent. A missing robots.txt is not in itself an error; the real loss is the Sitemap line it usually carries. Only 43.5 percent of sites had a Sitemap directive in theirs.

These items share a property too: they are invisible. None of them breaks a page. No executive notices one on a screen. Only machines do.

The biggest gap: the H1

One row says more than the rest: 61.2 percent of the 85 measurable home pages carry no H1 at all in the HTML the server sends (Caliency measurement, 16 October 2026). 23.5 percent carry exactly one, 15.1 percent carry several.

Two misreadings are worth heading off.

First: an H1 is not a ranking requirement. Google does not withhold indexing over a missing one. This finding does not mean these sites are absent from Google.

Second, and the actual point: the finding says the heading is not in the HTML the server sends. If it is injected by JavaScript, Google has to render the page to see it. Google describes processing JavaScript pages in three stages — crawling, rendering and indexing — and notes a page can sit in the rendering queue (Google Search Central, JavaScript SEO basics).

On four of the sites we measured, the server returned under 500 characters of text: the page arrives as an empty shell and the content is assembled in the browser. That can be a deliberate choice. It should be one.

Against the web as a whole

The comparison column is HTTP Archive's Web Almanac 2025 SEO chapter, measured across millions of pages (HTTP Archive, Web Almanac 2025 – SEO).

BIST 100 home pages are ahead of the web on meta description and hreflang — both expected in companies that run corporate communications in more than one language. Level on the title tag.

Behind on canonical, structured data and the H1.

The caveat belongs here because it explains part of the gap: the Web Almanac crawl renders pages in a real browser and ours does not. An H1 added by JavaScript counts there and not here. So the chasm in the H1 row is not all absence; part of it means "not sent by the server, built afterwards." Which is a finding in its own right.

What we take from it

Three things.

First, the visible gets done and the invisible does not. HTTPS and mobile support come up in meetings; canonical tags do not. Budget follows visibility.

Second, size is no guarantee of technical maturity. Türkiye's hundred largest companies beat the web average on three signals and trail it on three. Your own site may well deserve its place in that table — but nobody knows without measuring.

Third, who knocks at the door now matters. A site closed to automated clients may also be closed to the pool AI answers draw from. Where GEO and SEO actually diverge is covered in GEO vs SEO.

This measurement did not cover speed. We measured real-user speed data for 200 popular Turkish sites separately, in does site speed affect SEO.

Run the same measurement yourself

Every item that scored worst in this study can be checked on a single page in five minutes. No tool required.

1. Open the page source. Ctrl+U in the browser (Cmd+Option+U on a Mac). Is the main text there, or only script tags?
2. Look for four tags: <title>, meta name="description", rel="canonical" and <h1>. How many exist, and how many are right?
3. Add /robots.txt to the address bar. Does the file load, and does it contain a Sitemap: line?
4. Add /sitemap.xml. Does it respond?
5. Check for structured data. Does application/ld+json appear in the source?

A fuller version of these five steps, and why each one matters, is in what makes a website SEO-friendly. To see them all at once, our free SEO checker reports the same checks in a few seconds.

What we did not measure

An honest study states its limits.

• One home page, one request. No inner pages; a home page can be a site's best or worst.
• No JavaScript. Nothing built in the browser was counted.
• One moment, one location. 16 October 2026, from outside Türkiye. Bot-protection rules can behave differently by location.
• No Core Web Vitals field data. Real-user speed data was out of scope; Core Web Vitals covers that side.
• No rankings or traffic. This is an infrastructure inventory, not a visibility study.

Frequently asked questions

What exactly was measured in this study?

We took the website addresses of the BIST 100 index members as published by KAP, Türkiye's official disclosure platform, and fetched each company's home page once. In the HTML the server returned we looked for a title tag, meta description, canonical, H1, viewport, html lang, hreflang, JSON-LD and Open Graph; whether robots.txt and sitemap.xml respond; and how many images carry no alt text. No JavaScript was executed.

What was the most striking finding?

Of the 85 home pages that could be measured, only 38.8 percent contained at least one H1 in the HTML the server sent; 61.2 percent contained none (Caliency measurement, 16 October 2026). Every single one of those same sites was served over HTTPS. The foundations that cost money are in place; the ones that cost attention are not.

Does a page without an H1 fail in Google?

No. An H1 is not a ranking requirement and Google will not refuse to index a page for missing one. The finding says something narrower: the heading is absent from the HTML the server sends. If it is added by JavaScript in the browser, Google has to render the page to see it, and rendering is an extra step.

How many sites refused to be measured?

Of the 98 published addresses, 13 did not return a measurable home page. Seven served a bot-protection page instead (four Cloudflare challenges, two Cloudflare blocks, one Incapsula), four refused the connection and two returned a server error. All of these sites open normally in a real browser.

Why does bot protection matter here?

Because search engines and AI systems arrive as automated clients too, not as browsers. OpenAI's own crawler documentation recommends not only allowing its search crawler in robots.txt but also allowing requests from its published IP ranges. If a request is refused at the network layer, the permission in robots.txt is never read.

Are these results better or worse than the web overall?

Mixed. BIST 100 home pages are ahead of the web on meta description (80 against 67.2 percent) and hreflang (27.1 against 19.7 percent), and level on the title tag (Caliency measurement, 16 October 2026). They are behind on canonical, structured data and H1. Part of the H1 gap is method: the Web Almanac crawl we compare against renders pages in a real browser and ours does not.

Why are no company names given?

Because the subject is the pattern, not individual companies. A single measurement of a single home page is not a fair verdict on an organisation's digital maturity, and these pages can change tomorrow. We published the method in full instead, so anyone can repeat the measurement.

How do I run the same check on my own site?

For one page you do not even need a tool: open the page source in your browser and look for the title, meta description, canonical and H1 tags, then add /robots.txt and /sitemap.xml to your domain and see whether they respond. Those five checks cover every item that scored worst in this study.

In short

On the home pages of Türkiye's 100 largest listed companies, HTTPS is at 100 percent and mobile viewport at 94.1 percent (Caliency measurement, 16 October 2026). On the same pages, canonical sits at 57.6 percent, structured data at 35.3 percent and an H1 in the server's HTML at 38.8 percent. Thirteen of the 98 published addresses never served their home page to an automated client.

The table reduces to one sentence: the visible foundations have been bought, the invisible ones are still open. And the invisible ones are exactly the part machines read — search engines, and increasingly AI systems.

At Caliency these items are not sold as a separate "SEO package"; they are part of the build. What that includes is on the web development and SEO services pages. If you want to know where your own site sits in this table, send us the address and we will run the same measurement for you and send back the result.