I think it is safe to say that website is clearly used hands-down more often than Web site, so I think it should certainly be regarded as at least a valid variant. (And it is, by most authorities on standard English.)
In the case of "acronyms" such as R&D the spaces would normally be omitted, but where the surrounding elements are words (for example, Tate & Lyle), spaces are invariably present.
Here's a link to Marks and Spencer's small print, where they refer to themselves as both M&S and Marks & Spencer on the same web page.
Just to clarify a point arising in comments elsewhere, in the title of a guide to HTML & XHTML the spaces are expected - although both surrounding elements are acronyms in themselves, they do not form a new single acronym when conjoined with an ampersand.
Also note that although at least some style guides (incl. Chicago Manual of Style) explicitly rule against spaces in acronyms, as @nohat points out, they are only style guides - there is no absolute rule in play unless your commissioning editor requires adherence to such. For example, in the UK, hospital Accident and Emergency departments are invariably A & E (with spaces).