The 30-Point Business Website Checklist for 2026
Score your site in one afternoon: 30 checks across trust, conversion, SEO, speed, mobile, legal and analytics — with fixes ranked by effort and impact for 2026.
Your website is the only salesperson who meets every prospect and never asks for a raise — and it either earns trust in seconds or loses it. Most small-business sites are not broken; they are leaking: a confusing headline, a form that asks too much, a page that loads late. Each leak is small alone; across a year they decide deals you never knew you were in.
This is the audit we run before any redesign, ad spend or SEO engagement: 30 checks across six groups, each scored 0-2, so you finish with a number instead of a vibe. The worked example follows Cascade Cycle Works, a modeled 12-person bike retailer — every check applies equally to services firms, clinics and B2B sites. Score honestly and the fix list writes itself.
Here is the short version before the point-by-point.
Key Highlights
- The average documented cart abandonment rate is about 70%, stable across roughly 49 studies (Baymard Institute).
- Extra costs revealed late are the top checkout-abandonment reason at 48%; forced account creation is second at 26% (Baymard).
- Bounce probability rises +32% as mobile load time goes from 1 to 3 seconds, and +123% by 10 seconds (Google/SOASTA study).
- A 0.1-second speed improvement lifted retail conversions 8.4% and average order value 9.2% (Deloitte, Milliseconds Make Millions).
- Google's Core Web Vitals gates: LCP 2.5s, INP 200ms, CLS 0.1, measured at the 75th percentile of real users.
- Google has crawled mobile-only since July 2024 — for indexing purposes, your mobile site is the site.
- About 53% of website traffic arrives through organic search (BrightEdge), so this checklist doubles as an SEO audit.
- In 30 modeled first audits, legal and analytics items failed most often — 87% of sites missed at least one.
Where Small-Business Websites Stand: The Baseline
Design gets the budget; plumbing gets ignored. We modeled 30 first-time audits across small retail, services and B2B sites; conversion items failed in roughly three-quarters, speed and mobile in four out of five, legal-and-analytics in almost nine out of ten.
Score each item 0 (failing), 1 (partial) or 2 (done well), for a maximum of 60 points. Audit from a visitor's position: fresh browser, no login, phone on cellular.
Key takeaway: The audit is where opinions end and arithmetic starts. Six tables, 30 checks, one score — and the fix list ranks itself.
Group 1: Trust Signals — Items 1-5
Buyers cannot inspect your warehouse, so they inspect your signals: the padlock, the address, the faces, the review count, the guarantee.
| # | Check | What good looks like |
|---|---|---|
| 1 | HTTPS on every page | Valid certificate, no mixed-content warnings, HTTP redirects to HTTPS |
| 2 | Real address, phone, hours | In footer and contact page, matching your Google Business Profile |
| 3 | Reviews with sources | A Google or Trustpilot widget showing counts; responses to negative reviews |
| 4 | Faces and names | An about page with team photos; a founder note on home or about |
| 5 | Guarantees near CTAs | Returns, warranty or satisfaction terms near every buy or book button |
Cascade added real staff photos, embedded its review count and moved its 30-day guarantee next to the booking button — three items cleared in one modeled afternoon.
Key takeaway: Strangers buy from businesses that prove they exist: five signals — padlock, address, reviews, faces, guarantees — close most of the trust gap in one afternoon.
Group 2: Conversion Basics — Items 6-11
Roughly 70% of shopping carts are abandoned, on average, across the studies Baymard Institute has documented. Extra costs appearing late lead at 48%, forced accounts follow at 26%, and slow delivery, long checkouts and hidden totals fill out the list.
The top reason is an honesty problem, not a design problem: show shipping and tax early, offer guest checkout, and let wallets like Apple Pay and Google Pay do the form-filling.
| # | Check | What good looks like |
|---|---|---|
| 6 | One primary action per page | A single CTA repeated down the page; secondary links de-emphasized |
| 7 | Five-second value headline | The hero states what you do, for whom, and the outcome — no wordplay |
| 8 | Forms under five fields | You ask only what sales actually uses; phone number optional |
| 9 | Pricing findable | Prices, ranges or honest "from" figures within two clicks of home |
| 10 | Frictionless checkout | Guest checkout, express wallets, address autocomplete, visible total before pay |
| 11 | Proof beside every CTA | A testimonial, rating or guarantee within one screen of each ask |
Cascade cut its rental form from nine fields to five and moved a rider testimonial next to the booking button; modeled bookings rose 18% the next month. Sequencing beats volume — one measured change at a time, as in our CRO experiments case study.
Key takeaway: Most conversion leaks are honesty and friction problems, not taste problems: show the total early, drop the form fields, put proof beside the ask, then measure one change at a time.
Group 3: Search Visibility — Items 12-17
About 53% of tracked website traffic arrives through organic search (BrightEdge), and the on-page basics decide whether any reaches you. Published click curves agree on the shape: position one collects several times the clicks of position three, and traffic collapses after page one.
| # | Check | What good looks like |
|---|---|---|
| 12 | Unique title tags | 50-60 characters, primary keyword first, brand suffix; no duplicates |
| 13 | Meta descriptions on key pages | Written, not auto-generated; state the value and end with a verb |
| 14 | Clean heading structure | One H1 per page; H2s and H3s in logical order; no styling headings |
| 15 | Descriptive image alt text | Describes the image for screen readers and image search |
| 16 | Internal links | Related pages link with descriptive anchor text; no orphan pages |
| 17 | Sitemap, Search Console, GBP | XML sitemap submitted, Search Console verified, Google Business Profile claimed |
Title tags and meta descriptions are the highest-leverage hour in SEO: Cascade rewrote its 20 most important pages in one modeled afternoon, and two weeks later they were earning impressions they had never qualified for before.
Key takeaway: Search visibility starts with six checks you can finish in a day — titles, descriptions, headings, alt text, internal links, a verified Search Console. Boring, cheap and decisive.
Group 4: Speed — Items 18-20
Speed is the rare fix that improves every other number on this page: Google's landmark mobile study found bounce probability climbs +32% as load time grows from 1 to 3 seconds and +123% by 10 seconds, while Deloitte measured a 0.1-second gain lifting retail conversions by 8.4%.
Google's Core Web Vitals turn speed into three pass/fail gates: LCP under 2.5 seconds, INP under 200 milliseconds, CLS under 0.1, each at the 75th percentile of real users. Miss them and rankings, ads and conversion all pay — a publisher's organic recovery in our Core Web Vitals case study hinged on these gates.
| # | Check | What good looks like |
|---|---|---|
| 18 | Core Web Vitals pass | LCP 2.5s, INP 200ms, CLS 0.1 at the 75th percentile — check PageSpeed Insights field data |
| 19 | Images optimized | WebP or AVIF, correctly sized, lazy-loaded below the fold |
| 20 | Caching and CDN | Page caching, asset caching, CDN in front; hosting that matches traffic |
Images are the usual culprit — an uncompressed hero photo can cost more than every script on the page. If vitals still fail after images, caching and a CDN, the theme or platform is the problem.
Key takeaway: Speed is a compounding asset, lifting conversion, SEO and ad efficiency at once: optimize images, add caching and a CDN, and hold the site to Google's three gates.
Group 5: Mobile Experience — Items 21-24
Mobile is not a segment of your audience; it is most of it. In a modeled 12-site cohort, mobile's share of sessions climbed from 48% in 2019 to about 63% in 2025 — consistent with StatCounter's global reading near 60% — and Google has crawled mobile-only since July 2024.
Google grades the mobile rendering, so desktop-only fixes are invisible to search. Buyers browse on phones and abandon anything that hesitates — the storefront in our headless ecommerce case study treated phone-speed pages as the product, not a feature.
| # | Check | What good looks like |
|---|---|---|
| 21 | Responsive layout and tap targets | No horizontal scroll; buttons 44px or larger; menus reachable by thumb |
| 22 | Text readable without zoom | 16px or larger base font; 16px form inputs so the keyboard does not zoom |
| 23 | Mobile page speed | Core Web Vitals passing on mobile — the only version Google now crawls |
| 24 | Mobile checkout and forms | Numeric keypads for phone and card fields; express pay defaulted on mobile |
Test like a customer, not a reviewer: your phone, cellular data, one thumb. Book the rental, buy the item, submit the form — every snag you hit, your best prospect hit yesterday.
Key takeaway: Mobile is the main stage, not the second screen: build thumb-first, keep fonts at 16px, and remember Google only ever sees the phone version now.
Group 6: Legal, Analytics and Upkeep — Items 25-30
This group scores worst in first audits and matters most when things go wrong: a regulator's letter, a data complaint, a quarter of decisions made blind.
| # | Check | What good looks like |
|---|---|---|
| 25 | Privacy policy | Plain language, current, footer-linked; states what you collect and why |
| 26 | Cookie consent that actually blocks | Non-essential tags stay blocked until consent where GDPR, UK GDPR or state laws apply |
| 27 | Policy set complete | Terms, returns and refunds, shipping — linked in the footer and at checkout |
| 28 | Accessibility basics | Color contrast passes, form labels present, alt text done; target WCAG 2.2 AA |
| 29 | Analytics and Search Console | GA4 or a privacy-first alternative installed, filters set, Search Console verified |
| 30 | Conversion tracking and backups | Form and purchase goals tested end-to-end; automated offsite backups running |
A consent banner that loads analytics before you click Accept is decoration, not compliance: where GDPR or UK GDPR applies — and several US states have their own regimes — the tags wait for the yes. Conversion tracking counts as done only when tested: submit a real form and watch it land.
Key takeaway: Legal and analytics items are the cheapest insurance on this list — a truthful policy set, consent that actually blocks, tracking you have tested.
Score It, Fix by Effort and Impact, Repeat Quarterly
Add the scores: 30 items, 60 points possible:
| Score | Reading | Move |
|---|---|---|
| 48-60 | Ship-shape | Protect it: quarterly re-audit plus monitoring |
| 36-47 | Leaky but fixable | Clear the quick wins below this month |
| 24-35 | Actively costing money | Book a proper audit; fix conversion and speed first |
| 0-23 | Foundations missing | Plan a rebuild conversation before spending on ads |
Then fix by effort versus impact, not by embarrassment:
| Quick-win fix | Effort | Impact | Why it pays |
|---|---|---|---|
| Image compression and lazy loading | Low | High | Cheapest Core Web Vitals win; no redesign needed |
| Title and meta rewrite on top 20 pages | Low | High | Free qualified clicks within weeks |
| CTA and proof pass on key pages | Low | High | Same traffic, more actions |
| Form cut to five fields | Low | Medium | More completions at the same lead quality |
| Guest checkout and express wallets | Medium | High | Account walls drive 26% of abandonment (Baymard) |
| CDN and caching | Medium | High | Compounds every other fix on the page |
| Analytics goals rebuilt and tested | Low | High | You cannot improve what is not measured |
Modeled across four businesses, a 30-day pass of these fixes moved conversion 15-30%:
Finally, make it a habit: a 90-minute quarterly re-audit, owned by one person, scores in one sheet. Websites decay quietly — plugin updates, expired certificates, drifted policies — and the pass catches decay before customers do. Our website redesign guide picks up where this checklist leaves off.
Key takeaway: Score, fix by effort and impact, re-audit quarterly. The sites that win are not redesigned more often — they are re-audited more often.
What Your Business Should Do Before Your Next Redesign
Days 1–30: Score and stop the bleeding.
- Run the 30-point audit in one afternoon; score 0-2 per item and note your three worst pages.
- Ship every low-effort, high-impact fix: title tags, meta descriptions, image compression, CTA and proof pass.
- Install or verify GA4 and Search Console, and test one conversion goal end-to-end.
Days 31–60: Clear conversion and speed debt.
- Cut forms to five fields and add guest checkout with express wallets if you sell online.
- Push Core Web Vitals under Google's gates — LCP 2.5s, INP 200ms, CLS 0.1 — images and caching first.
- Complete the legal set: privacy policy, consent that actually blocks, policies linked at checkout.
Days 61–90: Systematize and re-audit.
- Name an owner and put the quarterly re-audit on the calendar for the next four quarters.
- Fix whatever the re-audit scores lowest, and document the before-and-after numbers.
- Only then scale spend: ads, content and SEO compound on a site that converts.
The Bottom Line
A website leaks through a hundred small holes, and this checklist exists because they are findable, rankable and cheap to fix. Trust first, conversion second, speed and mobile throughout, legal and analytics underneath — then a quarterly re-audit to keep it that way.
If you want a second pair of eyes on your score, that is a good afternoon for both of us. Book a free strategy call and we will rank your fixes by effort and impact — or send us a message with your questions and we will answer within one business day.
Free download: the Learning Guide (PDF)
Everything worth keeping from this article — key numbers, tables and the action checklist — in one print-ready, fillable PDF.
Join our newsletter — more growth tips, twice a month
Playbooks from real projects. No spam, unsubscribe anytime.
FAQ
How often should I audit my website with this checklist?+
Quarterly is the right rhythm for most businesses — about 90 minutes once you know the drill. Add an off-cycle pass after major changes: a redesign, a migration, a new checkout or a traffic drop. The full sweep catches what dashboards hide.
What should I fix first if my score is low?+
The low-effort, high-impact items before anything expensive: image compression, title and meta rewrites, CTA and proof passes, form cuts. If you sell online, guest checkout and express wallets come next — account walls alone drive 26% of checkout abandonment. Save the redesign conversation until the cheap points are banked.
Do I really need a cookie consent banner?+
If you serve users in the EU or UK, yes — GDPR and UK GDPR require consent before non-essential cookies fire, and several US states now have their own regimes. The part businesses get wrong is sequencing: the banner must actually block analytics and marketing tags until the visitor accepts. Without such exposure, a truthful privacy policy may be the honest minimum — verify with counsel, not a blog post.
Can I run this checklist myself or do I need an agency?+
You can run the audit yourself — a browser, a phone and two afternoons cover most of it. Bring in specialists for the engineering-heavy items: Core Web Vitals work that survives a theme update, consent platforms wired correctly, tracking that reconciles with real orders. Good rule: self-audit quarterly, and pay for help on whatever scores lowest twice in a row.
Engineering-led team at Emerson Technology — building apps, web platforms and growth systems for ambitious businesses. Every guide comes from real client work.