Law firm websites in Poland: how fast are the top firms?

Most law firm websites in Poland are fast for the people who open them. We measured the websites of 170 Polish law firms, the firms ranked for Poland by The Legal 500 and Chambers and a few specialists, and looked each one up in the Chrome UX Report (opens in a new tab), Google's record of how fast sites are for real Chrome users. Of those with enough traffic to be measured, 74% pass Google's Core Web Vitals (opens in a new tab) on phones, more than the Polish online shops in our study of Core Web Vitals by ecommerce platform.

What they lack is not speed but the signals that search engines and AI assistants read first. Only 12% of the sites say in structured data that they belong to a law firm, and 7.1% describe their lawyers. 71% send none of the six security headers we checked. And not one blocks AI crawlers, although fewer than one in ten publishes an llms.txt for them.

pass Core Web Vitals on phones

74%

run on WordPress

78%

mark themselves up as a law firm

12%

send no security header

71%

How fast are law firm websites?

Chrome keeps field data only for sites with enough visitors: 50 of the 170 had it on phones, mostly the larger firms. Among those whose three Core Web Vitals could be assessed, 74% pass on phones and 84% on desktops. Loading is where they fall short when they do: 73% keep Largest Contentful Paint within 2.5 seconds, while 97% respond to a tap in time.

Google's threshold 2.5s

0s2s4s6s

Source: Chrome UX Report (Google); Outofplace study, 24 Sept 2026Download CSVDownload PNG

Show the data

Range	websites
0s–0.5s	0
0.5s–1s	5
1s–1.5s	8
1.5s–2s	15
2s–2.5s	8
2.5s–3s	2
3s–3.5s	5
3.5s–4s	5
4s–4.5s	0
4.5s–5s	0
5s–5.5s	0
5.5s–6s	1

The chart as an image, free to reuse under CC BY 4.0 with credit to Outofplace and a link to this page.

The sites without field data we timed ourselves: we asked each homepage three times for its first byte, the moment the server starts answering. The median site answered in 0.7s; one in ten took 1.6s or more, before a browser could draw anything. A page built afresh for every visitor on a shared server looks like this; a cached one on a content delivery network answers in a few hundred milliseconds. Only 11% of the sites served their homepage from a cache and 11% sat behind a CDN.

0s1s2s3s

Source: Outofplace measurement, 24 Sept 2026Download CSVDownload PNG

Show the data

Range	websites
0s–0.2s	6
0.2s–0.4s	55
0.4s–0.6s	14
0.6s–0.8s	30
0.8s–1s	12
1s–1.2s	20
1.2s–1.4s	8
1.4s–1.6s	6
1.6s–1.8s	8
1.8s–2s	3
2s–2.2s	2
2.2s–2.4s	2
2.4s–2.6s	0
2.6s–2.8s	1
2.8s–3s	1

The chart as an image, free to reuse under CC BY 4.0 with credit to Outofplace and a link to this page.

What are law firm websites built on?

WordPress, overwhelmingly: 78% of the sites, about half of them with the Yoast SEO plugin. Custom-built sites come a distant second; modern frameworks like Next.js and hosted builders like Webflow are rare.

• WordPress
• Custom-built
• Next.js
• Webflow
• Other

Sitesn = 17078%15%

Source: Outofplace study, 24 Sept 2026Download CSVDownload PNG

Show the data

Item	WordPress	Custom-built	Next.js	Webflow	Other	n
Sites	78%	15%	2.4%	2.4%	2.4%	170

The chart as an image, free to reuse under CC BY 4.0 with credit to Outofplace and a link to this page.

WordPress isn't the problem; what is layered on it is. The median homepage loads 22 scripts. Of the sites whose jQuery version we could read, 20% still load a version older than 3.5, the release that closed known cross-site scripting holes; several run the same agency theme with jQuery 1.8.3 from 2012.

Do Google and AI assistants know it is a law firm?

Search engines and AI assistants don't guess what a page is when it tells them. Structured data (opens in a new tab) in JSON-LD states it outright: this is a law firm, at this address, with these practice areas and these lawyers. Two in three sites carry some, but mostly the generic Organization and breadcrumbs an SEO plugin adds by default. The types that describe a law practice are rare: LegalService (opens in a new tab) on 12%, Person for lawyers on 7.1%, FAQPage on 1.8%. One site still uses Attorney, a type schema.org has deprecated in favour of LegalService.

Any JSON-LD68%

Organization54%

BreadcrumbList48%

LegalService (a law firm)12%

Person (a lawyer)7.1%

FAQPage1.8%

Attorney0.6%

Source: Outofplace study, 24 Sept 2026Download CSVDownload PNG

Show the data

Item	Value	95% interval	n
Any JSON-LD	68%	60%–74%	170
Organization	54%	47%–61%	170
BreadcrumbList	48%	41%–56%	170
LegalService (a law firm)	12%	8.2%–18%	170
Person (a lawyer)	7.1%	4.1%–12%	170
FAQPage	1.8%	0.6%–5.1%	170
Attorney	0.6%	0.1%–3.3%	170

The chart as an image, free to reuse under CC BY 4.0 with credit to Outofplace and a link to this page.

The basics of a page's outline are shakier than you'd expect from firms that sell precision. 34% of homepages have no h1 heading, so the page never says in one line what it is about. Of the sites with language versions, 30% name a default (x-default) for visitors whose language they don't serve.

Sitemap in robots.txt77%

Exactly one h148%

No h1 at all34%

hreflang x-default30%

llms.txt9.4%

Source: Outofplace study, 24 Sept 2026Download CSVDownload PNG

Show the data

Item	Value	95% interval	n
Sitemap in robots.txt	77%	70%–83%	170
Exactly one h1	48%	40%–55%	170
No h1 at all	34%	27%–42%	170
hreflang x-default	30%	22%–39%	111
llms.txt	9.4%	5.9%–15%	170

The chart as an image, free to reuse under CC BY 4.0 with credit to Outofplace and a link to this page.

Are law firm websites secure?

Security headers are a few lines of server configuration that tell the browser how to protect a page: HSTS (opens in a new tab) keeps it on HTTPS, a Content Security Policy (opens in a new tab) limits which scripts may run, frame protection stops another site from wrapping it. For firms whose contact forms receive confidential first messages, they are cheap insurance. 71% of the sites send none of the six we checked; 15% send HSTS and 7.7% a Content Security Policy.

0 headers71%

1 header14%

2 headers7.1%

3 headers1.8%

4 headers2.9%

5 headers1.8%

Source: Outofplace study, 24 Sept 2026Download CSVDownload PNG

Show the data

Item	Value
0 headers	71%
1 header	14%
2 headers	7.1%
3 headers	1.8%
4 headers	2.9%
5 headers	1.8%

The chart as an image, free to reuse under CC BY 4.0 with credit to Outofplace and a link to this page.

Strict-Transport-Security15%

Frame protection14%

X-Content-Type-Options13%

Referrer-Policy10%

Permissions-Policy8.2%

Content-Security-Policy7.7%

Source: Outofplace study, 24 Sept 2026Download CSVDownload PNG

Show the data

Item	Value	95% interval	n
Strict-Transport-Security	15%	10%–21%	170
Frame protection	14%	9.7%–20%	170
X-Content-Type-Options	13%	8.7%–19%	170
Referrer-Policy	10%	6.3%–15%	170
Permissions-Policy	8.2%	5%–13%	170
Content-Security-Policy	7.7%	4.5%–13%	170

The chart as an image, free to reuse under CC BY 4.0 with credit to Outofplace and a link to this page.

How do law firms treat AI crawlers?

With open doors. Not one of the 170 sites blocks an AI crawler in robots.txt, and only 5 mention one by name, to let it in. That sets law firms apart from the most popular Polish sites, where 21% block at least one, as our study of AI crawlers on the Polish web found. 16 sites (9.4%) publish an llms.txt (opens in a new tab), a plain-text guide to the site for language models.

Being open matters once a client asks an AI assistant instead of a search box. We asked four of them with web search on (from OpenAI, Google, Perplexity and Anthropic) 51 questions a prospective client might ask in five practice areas, from white-collar crime to customs and tax control, in Polish and English: 332 answers in all. The answers name firms and cite where they read about them. The rankings matter: The Legal 500 was cited in 17% of answers and Chambers in 14%. But of the ten sources cited most often, 6 were law firms' own websites. What a firm publishes about itself, in a form a machine can read, ends up in the answer.

What to fix on a law firm website

Most of what this study found missing takes days, not a redesign.

1. Serve pages from a cache

   A page cache (a WordPress caching plugin or the host's own) and a CDN in front take the first byte from seconds to a few hundred milliseconds. Check the result in PageSpeed Insights (opens in a new tab): the top of the report shows real users' data when there is enough of it.

2. Say you are a law firm, and who your lawyers are

   Add LegalService for the firm and Person for each lawyer, linked to each other, alongside what your SEO plugin already emits.

3. Send the security headers

   Six lines in the server configuration or at the CDN. Start the Content Security Policy in report-only mode, so nothing breaks while you tune it.

4. Give every page one clear heading

   One h1 that says what the page is about, in the words a client would use.

5. Let AI assistants read you

   Keep search crawlers allowed in robots.txt, publish an llms.txt that points to your practice areas and lawyers, and keep those pages readable without scripts.

A minimal LegalService with one lawyer looks like this (replace the details with your own):

{
  "@context": "https://schema.org",
  "@graph": [
    {
      "@type": "LegalService",
      "@id": "https://www.example-law.pl/#firm",
      "name": "Example Law Firm",
      "url": "https://www.example-law.pl/",
      "telephone": "+48 22 000 00 00",
      "address": {
        "@type": "PostalAddress",
        "streetAddress": "ul. Przykładowa 1",
        "postalCode": "00-001",
        "addressLocality": "Warszawa",
        "addressCountry": "PL"
      },
      "knowsAbout": ["White-collar crime", "Tax control"]
    },
    {
      "@type": "Person",
      "name": "Anna Example",
      "jobTitle": "Advocate",
      "worksFor": { "@id": "https://www.example-law.pl/#firm" }
    }
  ]
}

How we measured

We started from every firm ranked for Poland in The Legal 500 EMEA (opens in a new tab) and Chambers Europe (2026 editions, public tables read on 24 September 2026), added sixteen smaller firms in white-collar crime, customs and tax control and services for foreigners, and checked by hand that each site belonged to a law firm. International firms whose Polish office has no site of its own were left out. Of 285 candidate domains, 170 remained.

OutofplaceResearchBot fetched each site's robots.txt first, then the homepage with its headers, llms.txt and the sitemap, one request at a time. Field data comes from the Chrome UX Report API at origin level, 28 days to 22 September 2026. The AI answers came through Vercel AI Gateway with each vendor's own web search: Gemini and Perplexity answered every question three times, OpenAI's and Anthropic's models once, on a sample of questions from every practice area.

Further reading