Small business website mistakes: what we found checking 1,000 small businesses

The most common mistakes on small-business websites aren’t about design. They’re missing basics that take minutes to fix. On October 5, 2026, we checked the homepages of 1,000 small businesses drawn at random from the Small Business Administration’s public database. Of the 747 that had a working site, 59.3% had no tap-to-call phone link, 30.1% had no meta description, and 22.7% of those showing a copyright year still showed 2024 or earlier. Only 28.2% got all five of the basics we tested right.

The rest of this post covers how we checked, what we found, what Google itself says about each item, and what to fix first.

Where the usual numbers come from

On October 5 we read the ten pages a web search returned for “small business website mistakes.” Nine loaded, and none of them reported checking any websites. The only figures in that set about small-business sites came from a Social Media Today article published Nov. 10, 2015: “93% of small businesses don’t even post an email address where customers can write with queries” and “60% of small businesses websites don’t work on smartphones.” The article credits an infographic from Column Five Media for MyCase and gives no sample size or method.

Our numbers for 2026 look different. 93.0% of the live sites we checked were set up for phones, and 54.2% showed or linked an email address on the homepage. Phones and email are no longer where most sites fall short.

How we checked

We used the same random sample as our email study: 1,000 businesses that self-certify as small in the SBA’s public Small Business Search and list a website on their own domain, 125 from each of eight states (Pennsylvania, Massachusetts, Ohio, Minnesota, Georgia, Tennessee, Arizona, and Oregon, two per Census region). We stored only each domain, its state, and its industry code. No business is named here or anywhere else.

For each domain we loaded the homepage the way a browser would, tried the plain http:// address to see whether it forwards to the secure one, and read the site’s robots.txt and sitemap. We read the page’s HTML as the server sent it and didn’t run any of its scripts, so anything a site fills in with JavaScript after loading was invisible to us. Errors were treated as errors: a site that timed out or blocked our check isn’t counted as missing anything.

Of the 1,000 domains, 747 had a live business site. Most numbers below use those 747, and the limits of the method are listed near the end.

About one in seven web addresses led nowhere

Before counting mistakes on live sites, the plainest one: 138 of the 1,000 addresses (13.8%) led to nothing a customer could use. 61 domains no longer existed, 30 were parked or for sale, 30 returned an error page (13 of them were Wix’s “domain not connected” message), 14 showed a placeholder such as “coming soon,” and 3 had no web address at all. Another 46 forwarded to a different domain, which may be a new name for the same business, so we didn’t count those.

If your business is listed anywhere with a web address, in a directory, on a profile, or on a printed card, open it from your phone and make sure it still goes somewhere.

Mistake 1: no tap-to-call link

Only 40.7% of the live homepages had a tap-to-call link, meaning the phone number is coded as a tel: link rather than plain text. Mozilla’s HTML reference describes what that does: “Cellular devices autodial the number.”

32.7% of the live homepages had neither a tel: link nor an email address shown or linked. That doesn’t mean those businesses can’t be reached. Many have a contact page or a phone number in plain text. It does mean the homepage makes the customer do the work.

The gap was wide between industries. 60.4% of construction businesses had a tap-to-call link on the homepage, against 27.6% of professional, scientific, and technical services firms.

Fix: make the main phone number a tel: link in the header or the first screen of the homepage.

Mistake 2: no meta description

30.1% of the live homepages had no meta description, the short summary that can appear under your page’s title in search results. Google’s snippet documentation is clear that it doesn’t rely on it: “Snippets are primarily created from the page content itself.” It also says “Google sometimes uses the meta description HTML element if it might give users a more accurate description of the page than content taken directly from the page.”

So a missing description isn’t a penalty. Writing one is your chance to suggest what people see under your name.

Fix: write one or two plain sentences for the homepage that say what you do and where.

Mistake 3: headings, and where the usual advice overstates it

26.9% of the live homepages had no H1 (the main heading in the page’s code), 48.5% had exactly one, and 24.6% had more than one. This is a common item on SEO checklists, and Google’s own SEO starter guide plays it down:

Having your headings in semantic order is fantastic for screen readers, but from Google Search perspective, it doesn’t matter if you’re using them out of order.

The same guide says “There’s also no magical, ideal amount of headings a given page should have.” A clear main heading still helps the person reading the page, and it helps people using screen readers. It isn’t the ranking fix it’s sometimes sold as.

Fix: give each page one plain heading that says what the page is about. Don’t pay anyone to restructure headings for search.

Mistake 4: a copyright year that stopped

We found a copyright year on 488 of the live homepages. 65.0% showed 2026, and 22.7% showed 2024 or earlier. 7.8% showed 2020 or earlier, and the oldest was 2008.

We found nothing from Google saying a footer year affects rankings, so we’re not claiming it does. The reason to fix it is the visitor. A homepage that says © 2019 raises a fair question about whether anyone is still minding the business. Some builders update the year automatically, which is why a current year proves less than an old one.

Fix: update it, or set the footer to print the current year automatically.

Mistake 5: security that’s almost right

Most sites got the main part right. 96.6% served a valid secure (HTTPS) connection. The gaps were in the details:

• 7.1% still served the page over plain http:// without forwarding visitors to the secure version.
• 2.6% had a certificate error: 10 sites had an expired certificate and 9 had one issued for a different name.

Google’s 2014 announcement said “we’re starting to use HTTPS as a ranking signal,” and called it “a very lightweight signal” affecting “fewer than 1% of global queries” at the time. Its current page experience guidance still lists it: “Check if you’re serving secure HTTPS pages and what to fix, if you’re not.”

Fix: ask your host or builder to turn on automatic certificate renewal and to forward every http:// request to https://.

Mistake 6: telling Google to stay away

This one was rare, and it can keep a homepage out of Google entirely. 12 of the live sites (1.6%) told search engines not to index their homepage or blocked crawlers from it. Ten of those had a noindex tag on the homepage. Google’s documentation says the tag “is used to prevent indexing content by search engines that support the noindex rule, such as Google.”

One way it gets there is a builder setting meant for sites still under construction. WordPress’s Reading settings include a box labeled “Discourage search engines from indexing this site,” which its documentation says asks “search engines not to index this site.” If nobody unticks it at launch, the site stays hidden.

Fix: search your homepage’s source for the word “noindex.” If it’s there and you want to be found, remove it, or ask whoever built the site.

Two that depend on the platform

Business details for search engines. 24.9% of the live homepages carried LocalBusiness structured data, code that tells search engines the business’s name, address, and phone in a standard format. Google’s documentation explains the payoff: “When users search for businesses on Google Search or Maps, Search results may display a prominent Google knowledge panel with details about a business that matched the query.” Whether a site had it mostly depended on the builder. 74.2% of Squarespace sites had it, against 9.1% of WordPress sites.

Sitemaps. 87.1% of live sites had a working sitemap, but only 59.5% of custom-built sites did. Google’s sitemap guide says you might not need one if your site is “small,” which it defines as “about 500 pages or fewer,” so this one matters less for most small businesses than checklists suggest.

Here’s how the five most common platforms compared:

	WordPress (264)	Custom or unknown (168)	Wix (78)	GoDaddy (72)	Squarespace (66)
Secure by default	95.8%	78.7%	100.0%	94.4%	98.5%
Meta description	63.6%	77.4%	75.6%	61.1%	68.2%
Tap-to-call link	50.8%	34.5%	35.9%	45.8%	27.3%
LocalBusiness data	9.1%	19.0%	51.3%	41.7%	74.2%
All five basics	35.0%	26.8%	29.5%	30.6%	18.2%

“Secure by default” means a valid HTTPS connection and the http:// address forwarding to it.

What we tested, and how many passed

We picked five basics that any small-business homepage should have and that anyone can check: secure by default, set up for phones (a viewport tag with width=device-width), a real page title rather than a placeholder like “Home,” a meta description, and a tap-to-call link. Google says it “uses the mobile version of a site’s content” for indexing and ranking, which is why the phone setup is on the list.

209 of 742 live sites (28.2%) passed all five. Without the tap-to-call link, 61.1% passed the other four. 27.6% missed two or more.

The limits

• We read each homepage’s HTML as the server sent it, without running scripts. Anything a site adds with JavaScript after loading, which can include copyright years, headings, and phone links, was invisible to us.
• 49 sites blocked automated requests, so we couldn’t check them. Many looked like managed WordPress hosting, so WordPress is probably undercounted.
• One homepage per site, checked once, on October 5, 2026.
• The sample is businesses listed in the SBA’s Small Business Search, a directory of firms registered to pursue federal contracts, in eight states. They may differ from small businesses in general.
• We didn’t measure page speed.

Our figures come with 95% confidence intervals; for example, the share with all five basics is 28.2% with an interval of 25.0% to 31.5%. We’re glad to share the full tables with anyone writing about small-business websites.

A five-minute check for your own site

1. Type your address with http:// in front and see whether it switches to https://.
2. Look at the footer year.
3. Right-click the homepage on a computer, choose “View page source,” and search for tel:, “description,” and “noindex.” The first two should be there and the last one shouldn’t.
4. Open every web address you’ve listed anywhere, on your phone, and make sure each one still loads your site.

If you’d rather someone else looked, or the check turns up more than a quick fix, that’s the kind of work we do on website design and rebuilds.