A small business website design checklist in 2026 comes down to five questions. Is it clear about what you do? Is it fast on a phone? Can Google and AI assistants understand it? Does it prove you can be trusted? Is it safe and legal to run? Design trends come and go. Those five decide whether the site brings in enquiries.
The short answer
- A small business website has one job: turn the right visitors into enquiries or sales. Every design decision serves that job.
- Google indexes and ranks the mobile version of your site, so check every item on this list on a phone first.
- Speed has a published standard: main content within 2.5 seconds, a response to taps within 200 milliseconds, and a layout that doesn’t jump.
- Proof sells. 97% of consumers read reviews for local businesses, according to BrightLocal’s 2026 survey of US adults.
- In 2026 the site also has to be readable by AI answers, which now sit above the links people used to click.
Why does a small business need a website in 2026?
A small business needs a website because it is the one place online you own and control. Social profiles, directories and marketplaces can change their rules overnight. Your website is where search engines and AI assistants check who you are, what you do and whether you’re credible before they send anyone your way.
When I first published this checklist in December 2016, the common question was whether a Facebook page was enough. It wasn’t then and it isn’t now, for the same reason: you don’t own it. What has changed is how people arrive. Australians spent a record $82.6 billion online in 2025, up 14% on the year before, with 9.8 million households shopping online, according to the Australia Post eCommerce Report 2026. Buyers research online even when they end up calling you.
In Pew’s March 2025 US browsing sample, traditional-result clicks were less common on visits with an AI summary. That does not establish the change for an Australian small business or prove each remaining visitor is worth more. I would measure qualified enquiries and visits separately.
What should a small business website checklist include?
A small business website checklist should cover nine areas: a clear offer, an obvious next step, mobile, speed, search and AI visibility, proof, security, accessibility and privacy. Each one has a simple test you can run yourself in under ten minutes. Run them all before you pay for a redesign, because most gaps are fixable on the site you already have.
| Area | What good looks like in 2026 | How to check it |
|---|---|---|
| Clear offer | The first screen says what you do, for whom and where | Show the homepage to someone for five seconds, then ask what you sell |
| Next step | Phone, email, location and one main call to action on every page | Submit your own form and time how long the reply takes |
| Mobile | Everything on the desktop version is also on the phone version | Use your own phone, on mobile data, not office wi-fi |
| Speed | Largest Contentful Paint 2.5 s or less, Interaction to Next Paint 200 ms or less, Cumulative Layout Shift 0.1 or less | PageSpeed Insights, or the Core Web Vitals report in Search Console |
| Search and AI visibility | One page per service you sell, area pages only where you have something local and specific to show, plain answers to buyer questions, a Google Business Profile that matches the site | Search your main service and suburb, then ask ChatGPT who to call |
| Proof | Reviews, real case studies and specific numbers near each call to action | Count the pages that show proof before they ask for an enquiry |
| Security and upkeep | HTTPS, current software, PHP 8.3 or newer with the latest security release applied, backups that have been test-restored | Tools, then Site Health in WordPress; ask your host, in writing, for the exact PHP version and when it was last patched |
| Accessibility | WCAG 2.2 level AA as the target | Use the site with a keyboard only, then run an automated checker |
| Privacy | A privacy policy that matches what your forms and tracking actually collect | List every form and tracking script, then compare with the policy |
Is the design simple and clear about what you do?
A good small business design is simple: one clear headline about the problem you solve, navigation with a handful of obvious items, contact details that are easy to spot, and one main action on each page. Visitors decide in seconds whether they’re in the right place. If they have to work it out, most won’t.
After more than 20 years of building websites, the mistake I still see most is a homepage that talks about the business instead of the buyer. “Welcome to our website” and a paragraph of history tell the visitor nothing they came for. Lead with what you fix and for whom, then show how to take the next step.
- Use the buyer’s words. Write the headline the way customers describe the problem on the phone, not the way your industry names the service.
- Make calls to action specific. “Book a free measure and quote” tells people what happens next. “Click here” and “Submit” don’t.
- Prefer numbers you can prove. “We reduce your inventory costs” is a claim. A specific result from a named case study is evidence. Only publish numbers you can back up.
- Keep navigation short. Services, proof, about and contact cover most small businesses. Everything else can live in the footer.
- Skip decoration that slows the page. Earlier versions of this checklist recommended GIFs and animations. On a phone, most of them now cost more in speed than they earn in attention.
Does the site load fast on a phone?
A fast small business site shows its main content within 2.5 seconds on a phone, responds to a tap within 200 milliseconds and doesn’t shift while it loads. Those are Google’s Core Web Vitals, measured on real visitors. Test on a mid-range phone over mobile data, because that is how many of your customers will meet you.
The thresholds come from Google’s Core Web Vitals guidance, measured at the 75th percentile of page loads on mobile and desktop separately. Interaction to Next Paint replaced the older First Input Delay metric in 2024, so advice that still mentions FID is out of date. And because Google uses the mobile version of a site for indexing and ranking, the phone version needs the same content as the desktop one. Tucking content into accordions or tabs to save space is fine, and Google suggests it over cutting content. Two conditions: the content has to be in the page when it loads, not fetched only after a tap, and the accordion has to open for someone using a keyboard or screen reader. What disappears is content you remove from the phone version altogether.
When I review a business site, I start with the route from a phone visit to an enquiry. Can I read the offer, open the menu and complete the form without fighting the page? A large desktop screen can hide all three problems. My team uses performance data to choose the technical fixes, then checks the actual visitor journey. You can start with the free tools in my guide to website speed testing.
Can Google and AI assistants find and understand your site?
Help intended crawlers discover useful pages, answer distinct buyer needs clearly and keep business details accurate. Google’s AI features require ordinary Search eligibility and the effective inclusion setting, while other assistants have different retrieval and crawler arrangements. These foundations support discovery without guaranteeing display or citation.
- Give each service its own page with a title that matches how buyers search. Give an area its own page only when you genuinely serve it and have something specific to show there: local jobs, reviews from that area, who turns up and how fast. A set of cloned pages with the suburb name swapped is what Google’s spam policies call doorway pages.
- Answer the question first, then explain. AI answers quote complete, self-contained sentences.
- Keep your business name, address and phone identical on the site, your Google Business Profile and directories.
- Write a blog only if it answers real buyer questions. Five pages that answer what customers ask on the phone beat fifty posts written for a keyword tool.
Google says llms.txt files do not improve visibility in Search, including its AI features. That is not a verdict on every tool’s use of such a file. I would prioritise useful pages, reliable discovery and actual measurement, and maintain extra machine-readable guides only for a concrete supported need.
Does your website prove you can be trusted?
A trustworthy small business website shows proof before it asks for anything: real reviews, named case studies with results, photos of real people and work, and complete contact details. Buyers believe other customers more than they believe you, so put that proof next to every call to action rather than on one testimonials page nobody visits.
The BrightLocal Local Consumer Review Survey 2026 found that 97% of consumers read reviews for local businesses, 41% “always” read them, and 93% have made a purchase after reading reviews. It surveyed 1,002 US adults, so treat it as a strong signal rather than an Australian measurement. The older advice to link out to every client’s website from your testimonials for SEO doesn’t hold up. Link to a case study on your own site instead, where the proof can do its job.
Is your website secure, accessible and compliant?
A secure, accessible and compliant small business site runs on HTTPS and current software, is updated and backed up on a schedule, works for people using a keyboard or screen reader, and has a privacy policy that matches what it collects. None of this shows in a design mock-up, which is exactly why it gets skipped.
- Software. Check WordPress’s current requirements and a supported patched stack. The October 2026 PHP security releases and follow-up configuration advisory require an exposure assessment: a bare “PHP 8.3” label does not establish vulnerability, patch status or a vendor backport. Ask the host which advisory affects the actual runtime/configuration and what was done.
- Plugins. Patchstack’s State of WordPress Security in 2026 counted 11,334 new vulnerabilities in the WordPress ecosystem in 2025, and 91% of them were in plugins. Patchstack sells security services, but the direction is clear: fewer, maintained plugins.
- Accessibility. WCAG 2.2 is the current W3C Recommendation. Level AA is the sensible target for a business site.
- Privacy. Under the Privacy Act, most businesses with annual turnover of $3 million or less are exempt, but health service providers and businesses that trade in personal information are covered regardless. Even if you’re exempt, your forms collect personal details, and visitors judge you on how you handle them.
What should you check before and after launch?
Before launch, keep useful unchanged URLs returning their pages and permanently redirect changed paths to relevant replacements. Check authorised form delivery, analytics and indexability on the actual deployed configuration. After launch, monitor meaningful cohorts and faults, with a named owner for fixes.
Here’s why the launch checks matter. My team was called in by a specialty retailer whose new website had gone live with fresh technical SEO problems, and its rankings slid further after the redesign, not up. The fix was unglamorous: a full audit, then bringing WordPress, the theme, the plugins and PHP up to date, and sorting out image quality. A redesign that skips these checks can cost you the search traffic it was meant to grow.
After launch, the work is routine: updates, a backup you have actually restored, and a monthly look at speed, forms and Search Console. Nobody gets excited about it, which is exactly why it gets dropped.
Keep three evidence columns beside the checklist: expected result, observed result and the person who accepts the fix. An attempted form submit is not proof of receipt, and a lab audit is not real-user performance. Mark unknowns plainly rather than giving the site a perfect score because every box has text in it.
What to do next
- Run the nine checks in the table above on your phone, over mobile data. For each one, write down the date, the result and who owns fixing it. A checklist without an owner is a wish list.
- Test your homepage and your most important service page in PageSpeed Insights.
- Search your main service and suburb on Google, then ask ChatGPT who to call for it. Note who shows up instead of you.
- Fix the three biggest gaps on the site you have before you price a rebuild. My website design cost guide explains what drives the price if you do need one.
- If you need a new site, see how I approach small business website design, or book a free call with me and my team for a second opinion.
Frequently asked questions
Do I need a new website or can I fix my current one?
Usually you can fix the current one first. Slow pages, unclear headlines, broken forms and missing proof can all be fixed without a rebuild. A rebuild makes sense when the site can’t be edited safely, runs on software that can’t be updated, or the business has changed so much that the structure no longer fits.
Is a Google Business Profile enough without a website?
No. A Google Business Profile is essential for local search, but it is a listing you don’t control, with limited room to explain your services or show proof. Use it to send people to a website that answers their questions and makes the next step easy. The two work best together, with matching details.
How often should a small business website be updated?
Use a routine update schedule and a separate urgent path for exposed security issues. Keep content current when facts change; a date stamp by itself proves nothing. An unchanged page can still be useful, and an old blog post is not automatically evidence that the business is inactive.
Should a small business website have a blog?
Only if you’ll use it to answer the questions buyers actually ask. A handful of genuinely useful articles, kept up to date, can bring in search traffic and get quoted by AI assistants. A blog with three posts from years ago does the opposite. It tells visitors the business may not be active.
What is the most important item on the checklist?
A clear offer with an obvious next step. Speed, search and security all matter, but if a visitor can’t tell what you do and how to contact you within a few seconds, nothing else on the list can rescue the enquiry. Fix the first screen of your homepage before anything else.
