Most small business websites don't fail because of one big mistake. They fail because of fifteen small ones stacked on top of each other — a missing SSL padlock here, a broken contact form there, no analytics anywhere. Individually, none of them sink a site. Together, they're the difference between a website that generates leads and one that just sits there.
This is the checklist we run on every project before it ships, and the same one we use when we audit an existing site for a new client. Fifteen points, grouped into six areas: security, performance, conversion, trust, measurement, and the basics that make a business look established instead of thrown together. Where we've written a deeper guide on a specific point, we've linked it — this article is the map, not every square inch of the territory.
None of these fifteen require a developer on retainer or a five-figure rebuild. Most are configuration, not construction — a setting to turn on, a plugin to update, a form to test. The reason they get skipped isn't difficulty, it's ownership: nobody on the team is explicitly responsible for checking them, so they quietly go stale until a customer notices before you do.
Security & stability (1–3)
Before anything about design or copy, a site has to be safe to visit and hard to lose. These three are the non-negotiable foundation.
Performance & findability (4–6)
A secure site nobody can find, or that loads too slowly for anyone to wait for, isn't doing its job either. This is where speed and basic SEO come in.
Conversion & trust (7–10)
Traffic that arrives and leaves without contacting you is wasted traffic. These four points are what turn a visit into a lead.
Measurement & reach (11–13)
You can't improve what you don't measure, and a well-built site is wasted if the assets inside it are slow or your presence stops at the homepage.
Branding basics & ongoing care (14–15)
The last two are easy to skip and easy to notice when they're missing.
SSL certificate (HTTPS everywhere)
Every page should load over HTTPS, not just the checkout or contact form. Google confirmed HTTPS as a ranking signal back in 2014, and modern browsers now flag plain-HTTP sites as "Not Secure" right in the address bar — which is enough to make a first-time visitor bounce before they read a word of your homepage. Most hosts issue a free certificate automatically; if yours doesn't, that's a sign to move hosts.
Automated backups
A daily, automated, off-server backup with more than one restore point. Plugin updates fail, hosts have outages, and someone on your team will eventually delete the wrong page. A backup turns a disaster into a five-minute rollback instead of a rebuild from scratch. Test the restore process at least once — a backup nobody has ever restored from is a hope, not a plan.
Core and plugin updates on a schedule
CMS cores, themes, and plugins ship security patches constantly. An unpatched plugin is one of the most common ways small business sites get compromised — not through a sophisticated attack, but through an automated bot scanning for a known, unfixed vulnerability. Someone needs to own this on a monthly cadence, whether that's you, a freelancer, or a care plan, and updates should be applied to a staging copy first if the site is complex enough that a bad update could break checkout or lead forms.
Mobile-responsive design
Google indexes and ranks your site primarily based on its mobile version, not desktop — this has been true since Google finished its move to mobile-first indexing. If your layout breaks, your text overlaps, or your buttons are too small to tap on a phone, you're fighting your own ranking with no upside. Most local searches happen on a phone, in the moment, often while someone is standing in a parking lot deciding which business to call — that's not the visit to lose to a layout bug.
Page speed and Core Web Vitals
Largest Contentful Paint, Interaction to Next Paint, and Cumulative Layout Shift are the three performance metrics Google actually uses in ranking. Unoptimized images and bloated page builders are the most common culprits on small business sites. We cover the full breakdown of what still matters here in our Core Web Vitals guide.
Basic technical SEO
Indexable pages, a submitted sitemap, clean URLs, unique title tags and meta descriptions on every page, and no orphaned or duplicate content. This is table stakes, not a growth strategy — it's what makes your site eligible to rank at all. If you want the fuller picture of what SEO includes and whether you need a retainer, we wrote a dedicated guide on website SEO for small business.
A contact form that actually converts
Short (name, email or phone, message), visible without scrolling on your key pages, and tested end-to-end so submissions actually land in an inbox someone checks. We've audited sites where the form had been silently broken for months — no errors, no bounce, just leads disappearing into a misconfigured mail server. Set a calendar reminder to submit your own form every few months and confirm you actually get the email.
A clear call-to-action above the fold
"Call now," "Get a quote," "Book a consultation" — one obvious next step, visible the instant a visitor lands, before they scroll. A site with no CTA is a brochure, not a lead-generation tool. We go deeper on this and nine other conversion killers in our guide to signs your website is hurting your sales.
Testimonials and reviews
Real quotes, ideally with a name, a business, or a star rating pulled from Google. Social proof does real work for a first-time visitor deciding whether to trust an unfamiliar local business — it's often the single page section that turns a browser into a phone call.
Portfolio, case studies, or before/after examples
If your work is visual — construction, design, renovation, salons — show it. If it isn't, show process: how a project or engagement actually runs from first call to delivery. Either way, this is the section that answers "can this business actually do the thing they say they do."
Analytics and conversion tracking
Google Analytics 4 at minimum, with the actual conversions you care about — form submits, phone clicks, booking completions — set up as tracked events, not just pageviews. Without this, you're making decisions about your website blind. You won't know which pages bring in leads and which ones are dead weight, and you won't be able to tell whether a redesign or a new marketing push actually moved the number that matters.
Social media integration
Links to active profiles (and only active ones — a linked account that hasn't posted in two years undercuts the trust you're trying to build), plus correct Open Graph tags so your pages preview properly when shared on Facebook, LinkedIn, or in a text message.
Optimized image and video hosting
Compressed, correctly sized images served in a modern format, and video hosted externally (YouTube, Vimeo, or a CDN) rather than uploaded raw to your server. Unoptimized media is the single most common cause of a slow small business site, and it directly drags down the Core Web Vitals score in item 5.
A custom domain, professional email, and basic branding
A domain you own (not a free subdomain), a matching @yourbusiness.com email address, a favicon, and a consistent logo across every page. None of this is complicated, and all of it is what separates a business that looks established from one that looks like it launched last week.
Structured data and consistent business info
Organization and LocalBusiness schema markup, plus your name, address, and phone number entered identically everywhere they appear online — your site, Google Business Profile, directories. Consistency here is what lets Google confidently associate your business with your website. Our guide to a minimum viable schema graph covers exactly what to add and what to skip.
Using this as a launch checklist
If you're about to launch a new site, run through all fifteen before you announce it publicly — items 1 through 6 especially, since they affect whether Google can find and trust the site at all. If you're auditing an existing site, start with items 7 through 10; a conversion problem is usually more expensive than a technical one, because every day it goes unfixed is leads walking away.
None of these fifteen points require a full rebuild on their own. Most are a few hours of focused work — an afternoon, not a project. What tends to happen instead is that they pile up quietly over a year or two because nobody owns the list. That's the real argument for either reviewing it yourself on a quarterly basis, or putting it on a care plan so someone else does. We cover what that ongoing maintenance actually costs, and what breaks first when it's skipped, in a separate guide if you want the full picture.
The most common pattern we see isn't one catastrophic failure — it's a site that launched with all fifteen boxes checked, then drifted for two or three years with no one revisiting them. The SSL cert auto-renews so nobody thinks about it, but the contact form quietly breaks after a hosting migration, the testimonials are from a client who closed two years ago, and nobody's looked at the analytics dashboard since the site went live. Individually forgivable. Together, it reads to a visitor as a business that isn't paying attention — and that impression costs more leads than any single item on this list.
- 1. Google Security Blog (2014). "HTTPS as a ranking signal."
- 2. Google Search Central. "Mobile-first indexing best practices." Google Developers.
- 3. web.dev / Google. "Web Vitals — essential metrics for a healthy site."
- 4. Google Search Central. "Understand how structured data works." Google Developers.
- 5. Google Analytics Help. "[GA4] About Google Analytics 4."
Every one of these fifteen points is built into every site we ship — and we'll audit an existing site against this checklist for free.