Anatomy of the median New York law firm website

Over the last two months we have published a dozen studies about New York law firm websites and the AI answers that cite them: which sites get cited, what size they are, what markup they carry, which widgets they run. Each one looked at a single part. This piece puts the parts back together. It walks through one website, the median one, from the domain registration up to the contact form, and at each layer says what the engines make of it. Nothing here is a recommendation. It is a dissection.

How we took it apart

In August we fetched the homepages of 2,626 New York law firm websites and could read 2,365. For 2,026 of them we could also read a sitemap, the machine list of every page the site wants indexed. We looked up each domain's registration date, fingerprinted the platform and the web agency where either left a mark, counted pages by type, checked the markup and the tracking scripts, and catalogued the forms, captchas, phone links, and chat widgets on the homepage. Then we matched every site against the AI answers we have collected since July for the questions New Yorkers type when they need a lawyer, on ChatGPT, Gemini, and Google AI Overviews. Every homepage count below is out of 2,365. Every sitemap count is out of 2,026. The median is the site in the middle of each distribution; it is not a real site, and no firm is named.

Foundation: the domain and what it runs on

The median firm domain was registered in 2012. A quarter of the market predates 2005, and a quarter was registered in 2018 or later. That is a fourteen-year spread in one metro, and domain age is one of the strongest single correlates of being cited that we have measured, which our cited-sites portrait covers: the median cited domain dates from 2007, the median never-cited one from 2012.

Under the domain sits a platform. Where we could identify one, 84 in 100 sites run WordPress: 1,441 sites, against 143 on Squarespace, 118 on Wix, and a scattering of Weebly and Webflow. Another 641 sites hide their platform, most of them because a legal web agency serves the pages from its own stack. Where the agency left a signature we recorded it: Scorpion on 67 homepages, FindLaw on 34, LawLytics on 12, then Juris Digital, Postali, and Civille in single digits. The visible agency share is small. The agency footprint is much larger than that, because the FindLaw and Scorpion intake scripts appear on 218 homepages, twice as many as carry either company's site signature.

One more fact about the WordPress majority. WordPress exposes a REST API, a programmatic door for reading and writing pages, and 1,376 of the 1,441 WordPress sites leave it reachable: 900 fully open to reads, 476 answering but requiring a login to write. Only 53 sites switched it off. A system maintaining one of these sites would never touch the HTML. It would read and write through that door, with the owner's credentials, the same way the site's own editor does.

Structure: what the sitemap lists

The median firm sitemap lists 103 URLs. A quarter of sites list 25 or fewer, a quarter list 414 or more, and the top of the range runs to tens of thousands, which our study of site size took apart. The count matters less than the composition. We sorted every listed URL by its path into four kinds: blog and news posts, practice pages, attorney bios, and everything else (the homepage, contact, about, locations, results, and pages we could not place).

Three in four sites have a blog, and on a site that has one, the blog is the median 42 percent of everything listed. Practice pages, the pages that say what the firm does and for whom, are 13 in 100 URLs; the median site has 16 of them. Attorney bios are 4 in 100 URLs, and more than half of all sites list no bio page at all in their sitemap, which for a business that sells a named professional's judgment is a strange thing to leave out. Two thirds of sitemaps show a page touched in 2026, and just under half show a blog post dated this year; 15 in 100 sites have a blog whose newest post is more than a year and a half old. The sitemap is also the one place where a machine can see the whole site at once and tell what changed. A system maintaining the site would read it nightly, and it would notice the missing bio pages before anyone in the office did.

Surface: what the page says about itself

A homepage carries two kinds of markup. One kind is for the visitor's browser: the title, the headings, the analytics tag that counts the visit, the pixel that follows them to Facebook. The other kind is for a machine reader: structured data that says, in a vocabulary the engines parse, this is a law firm, it practices these areas, it sits at this address, and here are the questions clients ask. The median homepage has the first kind and mostly lacks the second.

The median homepage runs 946 words of visible text, carries a title tag and an H1, and reports to Google Analytics. Three quarters emit some JSON-LD, but that figure is inflated by plugin defaults: strip those and 31 in 100 say they are a legal service, 14 in 100 say they are a local business with an address, and 6 in 100 mark up a single FAQ. Sixty-four in 100 measure who arrives; 6 in 100 tell the engines what the visitor will find. Our AI-readiness census argued about what this means. The anatomy point is simpler: the structured data is generated by the same platform that generates the analytics tag, and a system maintaining the site could fill it in from facts the site already states in prose.

Doors: how a visitor gets in

Everything above exists to produce a phone call or a form fill, so the last layer is the doors. Seventy in 100 homepages carry a tap-to-call phone link. Fifty-eight in 100 carry a contact form, usually one, built on Gravity Forms (403 sites), Contact Form 7 (301), the Wix or GoDaddy builders (217 between them), or an agency's own intake form (FindLaw's on 84). Forty in 100 homepages put a captcha in front of that form, almost always reCAPTCHA. Thirty-one in 100 publish an email link. Two in 100 embed a scheduler, Calendly on 43 sites. And 21 in 100 homepages have neither a form nor a phone link, which means the visitor has to go looking.

The chat widgets sit on this layer too: 12 in 100 homepages, led by Intaker, ApexChat, and Juvo Leads, and our widget study found they mark the firms that are already cited rather than cause it. The doors are built for a person with a thumb. When the visitor is an assistant acting for a client, 30 in 100 homepages offer a form it can submit, and the rest ask it to prove it is human or to make a phone call. A system on the firm's side of that exchange would answer the assistant in kind, with a yes, a fee range, and a slot, before the phone rang.

Readers: what the engines actually cite

Now the other direction. We took every citation in the AI answers we have collected since July, kept the 49,544 that point at one of the 2,626 census sites (three quarters of all citations; the rest go to courts, government, news, and directories), and sorted each cited URL by the same path rules we used on the sitemaps. That gives two shares for every kind of page: how much of a firm site it is, and how much of the citation traffic it earns.

The half of the site that gets written to is the part the engines read least. Blog posts are 50 in 100 URLs and 3 in 100 citations. Practice pages are 13 in 100 URLs and 67 in 100 citations, and no engine puts them below 62. Homepages take another 14. Bios, the pages about the people, round to zero, which matches the finding in our size study that the engines answer the question a client asked, and a client asks about a problem, not a partner. If a system were deciding where the next hour of writing on the median site should go, this table is the whole argument, and it points at the 16 practice pages, not the 22 posts.

The median site, in one paragraph

A domain registered in 2012, running WordPress with the REST API reachable, built or maintained by a web agency that left an intake script but no signature. A sitemap of 103 URLs, 22 of them blog posts and 16 practice pages, no attorney bios, last touched this year. A homepage of 946 words with a title, an H1, and Google Analytics, some default JSON-LD, no LegalService markup, no FAQ. A phone link, one Gravity form behind reCAPTCHA, no scheduler. In the AI answers we track, cited at least once in 23 in 100 cases, and when cited, cited on a practice page. Every one of those facts was read by a script from the public site, and most of them could be changed by one.

That last point is the reason to write an anatomy at all. A site like this was built once, by a vendor, for a browser. It is now read every day by machines that decide whether to mention the firm, and nobody is reading it back. The registration record, the sitemap, the REST API, the schema, the form: every layer is legible to software, and every layer is where the citations are decided. The work of keeping such a site current, measured against what the engines are actually answering, is no longer a person's job and never really was one. We ran this dissection on lawyers because that is the market we track. The same census runs, unchanged, on any local business with a website, and the next one we publish will be a trade that is not law.

Usual caveats: one metro, homepage-only fingerprints for the surface and doors layers so every share there is a floor, sitemaps as the site inventory so pages a site does not list are not counted, and page kinds inferred from URL paths, applied identically to sitemaps and to cited URLs so the two shares are comparable but both are estimates. Citations are the answers to our tracked New York searches, counted per answer, collected since July. The median site is a composite. Nothing here says that changing a layer changes a citation; it says what the layers are and where the citations land.