The small business website checklist.

• The domain is registered in your nameICANN tells registrants to keep their contact details accurate and up to date. If an agency put its own name on your domain, ask to have it moved to yours.ICANN
• You can log in yourself, with two-step loginThe FTC lists multi-factor login as a question to ask a web host. Turn it on for every account that can change the site.FTC
• You know who makes changes after launchThe FTC says to settle this from the beginning. Can you edit the site, or does every change go through the provider?FTC
• You can get a copy of the siteGet it in writing: who owns the design, the text and the code if you ever leave.Our advice

• The first screen says what you do and whereA visitor should know right away if they found the right business.Our advice
• Each main service has its own pageOne page per service gives each one its own title and its own shot at a search.Our advice
• Phone, email and hours are easy to findPut them on a contact page and in the footer of every page.Our advice
• Every page has one clear next stepCall, book or send a message. Pick one and make it the biggest button.Our advice
• The contact form really worksSend yourself a test message from your phone and check that it reaches the inbox.Our advice
• Every review and testimonial is realThe FTC rule on fake reviews and testimonials took effect on 21 Oct 2024, and a business that posts fake testimonials on its own site could be liable.FTC

• Everything is there on a phoneGoogle uses the mobile version of a site for indexing and ranking, so it should hold the same content as desktop. Pew finds 91% of US adults own a smartphone.Google
• The main content shows within 2.5 secondsGoogle's target for Largest Contentful Paint. PageSpeed Insights tests it for free.Google
• The page reacts to a tap in under 200 msGoogle's target for Interaction to Next Paint.Google
• Nothing jumps while the page loadsGoogle's target for Cumulative Layout Shift is less than 0.1.Google
• No popup blocks the pageGoogle asks whether your pages avoid intrusive interstitials and ads that get in the way of the main content.Google

• Every page has its own titleUnique, clear and true to the page. There is no length limit, but Google cuts long titles to fit the screen.Google
• Every page has its own short descriptionGoogle says a good one is short, unique to the page, and covers its most relevant points.Google
• Images have alt textA short, useful description of the picture. Google warns that stuffing it with keywords can make a site look like spam.Google
• Your business details are in structured dataLocalBusiness markup can tell Google your hours, departments and more. Name and address are the two required fields.Google
• Every page loads over httpsGoogle asks if your pages are served securely, and the FTC says to check that TLS comes with your hosting plan.Google, FTC
• The site is in Search ConsoleFree, and meant for anyone with a website. Google suggests looking at it about once a month.Google

The ADA applies to businesses open to the public. The Justice Department has no regulation with detailed web standards for them, and calls WCAG helpful guidance.

• Text has enough contrastWCAG level AA asks for at least 4.5:1, or 3:1 for large text.W3C
• Buttons and links are big enough to tapWCAG level AA asks for at least 24 by 24 CSS pixels, with a few exceptions.W3C
• Forms have labels and clear errorsThe Justice Department names inaccessible online forms as a barrier.ADA
• The whole site works with a keyboardThe Justice Department also lists mouse-only navigation as a barrier.ADA
• Videos have captionsVideos with no captions are on its list of barriers too.ADA

• Someone is making backupsThe FTC says to back up important files offline, on an external drive or in the cloud. Ask who does it for your site, and where the copies are.FTC
• Someone is updating the softwareThe FTC calls up-to-date security patches essential, and says to find out if that job is yours or your host's.FTC
• Business email has SPF, DKIM and DMARCWithout them, scammers can send email that looks like yours. If your provider cannot set them up, the FTC says to consider another one.FTC
• There is a privacy pageYour form collects names and emails, so say what you do with them. California's CCPA covers businesses over $25 million in revenue or those trading in large amounts of personal data, and other laws may apply to you. SourceOur advice