The Small Business Website Checklist for 2026

Confirm your site runs on HTTPS, and get a consent management platform live. HTTPS is a ranking signal and its absence shows visitors a security warning, so the cost of missing it is immediate. Consent is the item with real financial exposure attached. Those two alone put a site ahead of most small business websites.

If your site runs analytics or any ad pixel, yes. Privacy laws attach to whose data you collect rather than to your size or turnover, so a local business with visitors from Europe or California is covered the same way a large one is. The common assumption that these rules are only for big companies is where most exposure comes from.

A working day for a site that already exists, spread across a few sessions. Consent setup takes minutes with a platform doing the scan for you. What consumes the time is reviewing every page on a phone and writing unique page titles and meta descriptions, since both are manual and neither can be automated well.

Yes. Responsive means the layout technically adjusts, not that the result is good. Text can end up too small to read, buttons too close together to tap, and navigation menus that collapse but do not open. Since the majority of traffic arrives on a phone and Google ranks the mobile version first, this is worth doing page by page.

It determines it. A misconfigured consent platform means missing data, and the reports will not tell you anything is absent. This is the part people miss when they treat compliance as purely a legal chore: the same setup that keeps you lawful is what decides whether the numbers you plan against are trustworthy.

It is a consent tool Google has verified will deliver consent signals in the form its advertising products accept. It matters if you run paid ads, because uncertified or homemade banners may collect choices that never reach Google properly. Certification is what makes the connection between your banner and your campaign data reliable.

Yes, and it needs to stay current. The banner asks permission at the point of collection while the policy explains what you collect, why, and what rights visitors have over it. It should also reflect the third-party services actually running on your site, which is one reason a site scan is useful before writing it.

Submitting an XML sitemap to Google Search Console, closely followed by consent. Both get missed for the same reason: nothing visibly breaks without them. The site loads, pages look fine, and the absence only surfaces later as pages that never got indexed or a compliance gap someone else points out.