Key findings
- Of the 159 public websites measured, 136 (85.5%) fail at least one of two basic WCAG Level A criteria, even in an automated test. Only 23 municipalities pass both checks.
- All 81 governorship websites declare the page language incorrectly. The code reads
lang='tr'instead oflang='tr'. Browsers read the value as'tr', quotes included, which is not a valid language code. 9 municipalities on the same platform have the same bug. - The bug comes from a single template, so one fix would correct 90 public websites at once.
- 74.4% of municipalities redirect HTTP to HTTPS, while 14 municipal sites still serve content over unencrypted HTTP.
- 41% of municipal sites send none of the six security headers checked. Governorship sites send four, but none use HSTS or CSP.
- 36 municipal sites load visitor tracking code (mostly Google Analytics) on first page load, and 17 of them show no trace of a cookie notice.
Why now?
Presidential Circular No. 2025/10 on the accessibility of websites and mobile applications was published in Turkey's Official Gazette on 21 June 2025. It covers public institutions, municipalities and universities, as well as banks, private hospitals and telecom operators, and gave them one year to comply. E-commerce sites were given two years. Compliance is measured against a Level A checklist published by the Ministry of Family and Social Services and WCAG 2.2.
Counting from publication, the deadline for public institutions passed in June 2026. We found no current, independent and reproducible measurement of the websites of Turkey's 81 provincial municipalities and 81 governorships. This study offers a first look at their homepages.
Finding 1: The same language bug on every governorship site
Screen readers use a page's lang attribute to decide which language to speak it in. If the language is wrong or invalid, Turkish text may be read with another language's pronunciation rules. That is why WCAG 3.1.1 (Language of Page) is one of the most basic Level A criteria.
On all 81 governorship homepages, the first line is identical: <html lang='tr'>. The template has encoded the quotation marks as HTML character references. When the browser decodes them, the language value becomes 'tr', quotes included, which is not a valid language tag. 9 municipalities that appear to use the same platform (Artvin, Erzurum, Hakkari, Isparta, Kars, Mardin, Niğde, Siirt, Bartın) carry the same line.
Every governorship site offers an accessibility menu with text size and contrast settings. Such menus help users, but they do not fix coding errors like an invalid page language. The good news: because the bug sits in a central template, one fix would correct 90 sites at once.
Finding 2: Images without text alternatives
Blind users understand images through the text alternative in the alt attribute. Even decorative images need the attribute, left empty (alt=""). A missing attribute is an automatically detectable failure of WCAG 1.1.1.
Of 5,264 images on municipal homepages, 1,001 (19%) have no alt attribute, and 54 of 78 municipalities have at least one such image. On governorship sites, 486 of 1,219 images (39.9%) lack the attribute, and the problem appears on all 81 sites. Some of these are placeholder images with an empty source.
Finding 3: Unencrypted connections and missing security settings
58 of 78 municipal sites redirect HTTP requests to HTTPS. 14 sites serve the same content over unencrypted HTTP, where a visitor's connection can be read or altered by someone in between. HSTS, which tells browsers to connect only over HTTPS, is used by just 26 municipalities.
32 municipal sites send none of the six security headers checked. Content-Security-Policy, which limits where a site may load code from, appears on only 14. The governorship template uses four headers consistently (X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy), but none of the 81 sites use HSTS or CSP.
Responsible disclosure note: we also saw software versions exposed in response headers (32 municipalities), 3 sites running PHP versions that no longer receive security updates, 7 sites loading jQuery versions older than 3.5 with known vulnerabilities, and 1 site with an expired TLS certificate. To avoid enabling abuse, we report these only as totals, without naming sites, and the dataset excludes version details.
Finding 4: Data protection links are common, cookie management is not
63 municipal homepages include a link or text on personal data protection (KVKK, Turkey's data protection law). 36 municipal sites load tracking code on first page load: Google Analytics on 36, Meta Pixel on 7 and Yandex Metrica on 5. 17 of these sites show no trace of a cookie notice or consent tool.
This is a lower bound: some sites may have configured tracking to run only after consent. But where no cookie notice appears at all, it is likely that visitors are tracked without being informed.
Finding 5: Speed is fine, page weight varies
The median time to first byte (TTFB) on municipal sites is 414 ms, and 13 sites take more than a second. The median homepage HTML size is 168 KB, with the largest at 2.5 MB. The governorship template has a median TTFB of 401 ms and pages of about 427 KB.
Checklist for institutions
- Fix the page language:
<html lang="tr">. For the governorship template this is a one-line change. - Give every image an alt attribute: a description for meaningful images,
alt=""for decorative ones. - Redirect HTTP to HTTPS and add HSTS.
- Remove software versions from response headers and move to supported versions.
- Run tracking code only after cookie consent.
- Treat automated tests as a starting point: keyboard navigation, screen reader and contrast checks need human review.
Methodology
Sample: the official websites of Turkey's 81 provincial municipalities (30 metropolitan and 51 provincial) and 81 governorships. Domains follow the province.bel.tr and province.gov.tr patterns, with exceptions (such as ibb.istanbul for Istanbul) checked one by one.
Date: data collected on 10 November 2026.
Measurement: for each site we requested only the homepage, /robots.txt and /llms.txt, once, sequentially and with pauses, using a clearly identified user agent (HititMedyaResearch/1.0). One extra request to the http:// address checked the HTTPS redirect. All checks ran on the initial HTML and response headers from the server; JavaScript was not executed.
WCAG checks: for 3.1.1 we checked whether the lang value on the html element is a valid language tag. For 1.1.1 we counted img elements in the initial HTML that have no alt attribute. Whether alt text is meaningful was not assessed.
Excluded: 3 municipal sites could not be measured: Çorum (bot protection, status 468), Muğla (redirect loop for requests without cookies) and Muş (timeout). Rates are based on the 78 municipalities and 81 governorships measured.
Limitations: this is an automated screen, not a compliance audit. Automated tools catch only part of WCAG. Only homepages were checked. Content loaded later by JavaScript and tracking code that runs after consent were not measured.
Use the data
Province-by-province results are available as CSV and free to use with attribution (CC BY 4.0). You can find each province in the table below. To embed the charts:
WCAG chart:
<a href="https://www.hititmedya.com/insights/turkish-municipal-and-governorship-websites-scorecard-2026"><img src="https://www.hititmedya.com/data/arastirma/kamu-web-wcag-en.svg" alt="WCAG Level A failure rates on Turkish municipal and governorship websites" width="1200" style="max-width:100%;height:auto"></a>
<p>Source: <a href="https://www.hititmedya.com/insights/turkish-municipal-and-governorship-websites-scorecard-2026">Hitit Medya Research</a></p>Security settings chart:
<a href="https://www.hititmedya.com/insights/turkish-municipal-and-governorship-websites-scorecard-2026"><img src="https://www.hititmedya.com/data/arastirma/kamu-web-guvenlik-en.svg" alt="Basic security settings on Turkish municipal websites" width="1200" style="max-width:100%;height:auto"></a>
<p>Source: <a href="https://www.hititmedya.com/insights/turkish-municipal-and-governorship-websites-scorecard-2026">Hitit Medya Research</a></p>We will update this scorecard every year with the same method. If your institution has fixed something or you spot an error, let us know and we will reflect it in the next measurement.
Sources
- Presidential Circular No. 2025/10, Official Gazette, 21 June 2025, issue 32933.
- W3C. Web Content Accessibility Guidelines (WCAG) 2.2.
- W3C. Understanding SC 3.1.1: Language of Page.
- W3C. Understanding SC 1.1.1: Non-text Content.
- OWASP. Secure Headers Project.