Devstars
The web development landscape in 2026 looks nothing like it did even two years ago. AI agents are writing production code. Google’s AI Mode has 75 million daily users. WordPress vulnerabilities are up 68% year-on-year. And 93% of AI Mode queries end without a single click to an external website.
Most businesses haven’t caught up. They’re still applying web development principles from 2023, and it’s costing them visibility, conversions, and security.
We’ve been building websites for over 25 years now, and the shift happening right now is as significant as anything we’ve seen since mobile went mainstream. These aren’t theoretical trends. They’re web development principles we’re actively implementing across our 20+ client sites, from Headmasters’ 54 salon locations to Giant Storage’s multi-site operation.
Here’s what actually matters in 2026.
AI isn’t a nice-to-have tool sitting alongside your development workflow anymore. It’s become the workflow.
Over 70% of developers now use AI-assisted coding tools daily. Around 41% of all code worldwide is AI-generated. GitHub Copilot, Cursor, and Claude Code aren’t just autocompleting lines of code. They’re scaffolding entire full-stack applications, generating tests, writing documentation, and flagging security vulnerabilities before they ship.
We’ve been building this into our own operations. We built five AI agents, Elle handles the inbox, Scout does competitor research and analyses Google Search Console data, Marty takes Scout’s research and turns it into targeted content. Set up cost about £70 and runs for a few pounds a day. Those agents alone 10x the amount of work we can deliver.
But here’s the honest bit. AI-generated code needs the same scrutiny as human-written code. Maybe more. The EU Cyber Resilience Act kicks in this September, and it treats plugin developers as manufacturers. Every piece of AI-generated code still needs human review, security scanning, and proper testing.
If your development team isn’t using AI coding tools yet, start with GitHub Copilot. Set up a clear definition of done for AI-assisted code: review rules, security checks, testing requirements. Don’t ship generated code without licence and security scanning.
This is the big one. Google AI Overviews now appear in roughly 57–60% of all searches. AI chatbot referral visitors convert at 4.4x the rate of Google organic traffic. Read that again. 4.4 times.
But here’s the flip side. Only 8% of users click through when an AI summary appears, versus 15% without one. And 93% of AI Mode queries end without visiting an external site at all. Traditional search volume is predicted to drop 25% by end of 2026.
The thing is, that 4.4x conversion stat is the one that matters. Less traffic, dramatically better conversion rates. It’s a quality play, not a volume play.
What does this mean for how you build websites? Every page needs to be structured for AI citation, not just human readability.
The practical stuff: lead every page with a direct answer in the first 50–70 words. Use H2 headings that mirror the questions your customers actually ask. Deep pages receive 82% of AI citations versus homepages, so individual service pages, case studies, and FAQ pages are where the action is. Content with clear question-answer structures dramatically improves citation rates.
Schema markup is no longer optional. After Google’s March 2026 update, schema is functioning less as a SERP display trigger and more as an AI trust and entity verification signal. Prioritise Product, LocalBusiness, FAQPage, and HowTo schema for your service pages. Remove FAQ schema from pages where it isn’t the primary content type.
Audit your top 10 pages. Does each one answer a specific question in the first 50–70 words? If not, restructure. Then check your schema implementation against Google’s current 31 supported rich result types.
This one’s getting serious. WordPress vulnerabilities are up 68% year-on-year. In a single week in April 2026, 225 new vulnerabilities were disclosed across the WordPress ecosystem, 203 in plugins, 22 in themes. Of those, 91 remain unpatched.
Plugins account for 96–97% of all WordPress vulnerabilities. AI-generated code in plugins is introducing new attack vectors. And attackers are weaponising new vulnerabilities within hours of disclosure.
The broader web development world is seeing similar pressures. npm supply-chain attacks increased by 150% between 2024 and 2026. A single compromised package in your dependency tree can expose the entire project.
For WordPress sites specifically, the EU Cyber Resilience Act vulnerability reporting obligations kick in on 11 September 2026. If you distribute a plugin with any commercial element and EU users can access it, you’re in scope. From September, covered developers must have a documented vulnerability disclosure programme, a clear contact for security reports, a patching process with documented timelines, and incident reporting systems with 24–72 hour deadlines.
Beyond compliance, Google’s April 2026 Core Update has classified scaled content abuse and expired domain abuse as search spam, with both algorithmic and manual enforcement. Unhelpful content has been reduced by 45%. Security and quality are now ranking signals, not just best practice.
Run a plugin audit across all your sites. Check for Query Monitor (CVE-2026-4267), Gravity Forms (CVE-2026-3492), and any plugins that haven’t been updated in the last 90 days. Set up automated vulnerability scanning with Wordfence or Patchstack.
Users expect sites to load in under 2 seconds. The average user attention span has dropped below 8 seconds. Google processes 8.5 billion searches per day, and Core Web Vitals remain a ranking factor, but in 2026 the bar has moved.
The big shift is server-first rendering. For years, we offloaded everything to the browser, heavy JavaScript bundles, complex logic, loading spinners. The default is now server-first, moving the heavy lifting away from the user’s device. React Server Components and Server-Side Rendering have become the standard. You only send the JavaScript that’s actually needed for interactivity, keeping the client lightweight.
For WordPress sites, this translates to cleaner themes, fewer client-side scripts, and proper caching architecture. Every third-party script, tracking pixel, and embedded tool adds latency. One client of ours dropped their homepage from 4.8 MB to under 1 MB just by re-encoding images and removing unused JavaScript. Load time fell from 6 seconds to 1.4.
Progressive Web Apps have largely closed the gap with native apps. They support offline use, push notifications, background sync, and performance that’s genuinely hard to distinguish from a native build, for significantly less development cost. If someone is telling you that you need a native app, it’s worth asking whether they’ve priced a well-built PWA against it first.
Performance isn’t a pre-launch checklist anymore. It’s ongoing governance. Track route-level budgets, enforce regression in your CI pipeline, and treat performance dashboards as operational tools, not vanity metrics.
Run your top 5 pages through Google PageSpeed Insights. Identify any page over 3 MB total weight. Compress images to WebP or AVIF format. Remove any JavaScript that isn’t actively needed.
This one aligns directly with our mission of planet-friendly digital solutions.
The internet’s carbon footprint has officially surpassed the aviation industry. The average web page produces approximately 0.36g of CO2 per page view. For a site with 100,000 monthly page views, that’s roughly equivalent to driving a car thousands of miles.
Data centres consumed 460 terawatt-hours of energy in 2022. That figure is predicted to hit 620 to 1,050 terawatt-hours by 2026, driven in large part by AI processing demands.
62% of consumers now say they’d choose one brand over another if the website was demonstrably greener. 78% of shoppers want companies to tell them how their digital choices affect the planet.
The beauty of it is that sustainable web design and good performance go hand in hand. Lighter pages load faster, cost less to serve, and produce less carbon. It’s not a trade-off. Same things that cut digital waste also improve user experience and technical SEO.
The practical steps: choose green hosting that uses renewable energy. Compress images, switch to modern formats like WebP and AVIF. Kill autoplay videos, a single autoplaying hero video can add 1–3 MB per visit and most visitors mute or scroll past it anyway. Remove unused JavaScript. Lazy-load everything below the fold.
Sustainable websites aim for an A+ rating on websitecarbon.com, emitting less than 0.095g of CO2 per page view.
Test your website at websitecarbon.com. If you’re rated C or below, start with the big wins: image compression, removing unused scripts, and checking whether your host uses renewable energy.
The old model of sequential handoffs, strategy to design to development to QA, is dying. AI-augmented teams and shared platforms collapse silos and accelerate decision-making dramatically.
Gartner predicts that by 2030, 80% of organisations will have transformed large developer teams into smaller, AI-enhanced units. The shift is already happening. A single experienced developer using the right AI-driven framework can match the output of a team of four or five engineers. Developers are becoming orchestrators who direct AI agents, validate results, and make strategic decisions.
Multi-agent systems are the architecture pattern to watch. Specialised agents collaborate on complex workflows, from planning to deployment. This is exactly the pattern we’ve built with our own AI agents. It’s not about replacing people. It’s about letting the team focus on the creative and strategic work that actually moves the needle.
For agencies and businesses, this means rethinking how you structure projects. Integrated collaboration from day one. Multi-skilled teams working on shared platforms. Iterations in seconds rather than hours. The pressure shifts from “is it ready?” to “is it performing?”
The Model Context Protocol (MCP), originally developed by Anthropic, has been donated to the Linux Foundation and is now an open standard backed by Google, Microsoft, AWS, and others. MCP standardises how AI agents connect to data sources and tools. It’s moved from developer tooling into consumer hardware, with Elgato shipping native MCP support in their Stream Deck. SDK downloads hit 97 million per month in February 2026.
Identify one repetitive task in your development workflow. Build a simple AI-assisted automation for it. Start small, learn, then expand.
This is where web development and marketing strategy converge. Generative Engine Optimisation (GEO) and Answer Engine Optimisation (AEO) aren’t separate from how you build your site. They’re embedded in the architecture.
AEO helps your content show up as direct answers, snippets, and voice search results. GEO helps your brand become a trusted source that AI tools like ChatGPT, Google AI Overview, and Claude pull from and cite. Our technical GEO specialists work with clients to build this directly into their site architecture from day one, not bolt it on afterwards.
The data tells the story. AI-driven traffic is growing 165 times faster than traditional organic. Perplexity cites sources in 97% of responses. Google AI Overviews cite at 34%. ChatGPT at just 16%. Different platforms, different citation patterns, different optimisation requirements.
Citation volatility is high. Approximately 70% of cited pages change over 2–3 months, independent of traditional organic ranking fluctuations. This requires ongoing monitoring and content maintenance, not a one-off optimisation.
For web architecture, this means: individual service pages rather than consolidated portfolio approaches. Individual case study pages with clear headings for Challenge, Approach, Solution, and Results. Specific quotable statistics in your content. FAQPage schema for service pages and pricing information. HowTo schema for methodology pages. LocalBusiness schema for every location. Person schema for team members with credentials. If you’re based in London, our GEO consultancy London service covers exactly this kind of architecture work.
Google Business Profiles have shifted too. Profiles without an update or review response in 30 days are treated as stale and show up far less in the Local 3-Pack. Google’s Gemini AI now generates automatic answers from profile data, reviews, and website content.
Content age matters for AI citation. Research shows 28.76% of citations come from 2025 content, 26.85% from 2024, but only 12.32% from content published within 30 days. Content needs 3–6 months to establish trust signals before achieving optimal AI citation rates. Plant now, harvest later.
Create individual pages for your top 3 services if they’re currently bundled on one page. Add FAQPage schema to each. Lead each page with a direct answer in the first 50–70 words. Make sure your Google Business Profile has been updated in the last 30 days.
Web development in 2026 isn’t just about building websites that look good. It’s about building websites that work across an entirely new search landscape, withstand escalating security threats, perform sustainably, and leverage AI as a genuine team member.
The businesses that get the foundations right, AI-ready architecture, strong security, sustainable performance, and content structured for both human readers and AI citation, will be the ones still visible in 12 months’ time.
The ones still building the 2023 way will wonder where their traffic went.
Your next action: Pick the principle where you have the biggest gap. Fix that first. Don’t try to change everything at once. Sustainable improvement beats perfect execution.
Any questions, let me know.
All the best,
Stuart
Currently scheduling strategic partnerships for Q1-Q2 2026. Limited spaces remain.
Get a free technical consultation and project roadmap. We’ll assess your requirements and provide transparent pricing for your growth-stage development needs.
Call: +44 020 8898 3993
