Small business website launch checklist

Content: does every page say something a customer needs?

• No placeholder text. Search every page for "Lorem", "Your text here", "[", and the template's demo business name.
• Every service or product has a price or a starting price. "Contact for pricing" everywhere sends the visitor to the competitor who publishes one.
• One clear call to action per page, repeated at the top and bottom: call, book, order or request a quote.
• About page names real people, with a photo, years in business and qualifications or licences. This is the trust page search engines and AI assistants weigh.
• Proof exists: at least three reviews or testimonials with first names, or a portfolio or case study.
• Spelling matches the market (colour or color, licence or license) and currency symbols are right.

Contact details: identical everywhere

• Phone number is correct and tap-to-call (an href beginning with tel:). Call it from the live site.
• Address, phone and hours match Google Business Profile exactly, including abbreviations ("St" vs "Street") and the format of the hours. Mismatches hurt local ranking and confuse customers.
• The map pin is on the right building. Embedded maps default to approximate positions.
• Every form has been submitted as a test and the message arrived at an inbox someone checks daily. Set the reply-to and an auto-acknowledgement.
• WhatsApp, SMS or chat link opens the right number with a sensible pre-filled message; the WhatsApp link generator builds one.
• Business email on the domain is set up and the website's contact address is not a personal Gmail.

Mobile and speed: test on a phone over mobile data

• Every page loads in under three seconds on a phone using mobile data, not Wi-Fi. Run the website speed test; the usual fix is images.
• Images are compressed to under 200 KB each and sized for their container; the image compressor does both.
• Nothing overflows on a 360-pixel-wide screen: tables, long words, wide images, embedded maps.
• Buttons are tappable with a thumb and not stacked against each other.
• No pop-up covers the content on mobile; Google treats intrusive interstitials as a ranking negative and customers treat them as a reason to leave.

Security and reliability

• SSL is active on every page: the padlock shows and http:// redirects to https://. Managed builders issue certificates automatically; self-hosted WordPress needs it switched on at the host.
• Backups exist and you know how to restore one. Managed hosting includes daily backups; self-hosted needs a plugin or host backups.
• Admin login uses a strong unique password and two-factor authentication. WordPress sites are attacked within hours of going live.
• Software is current: platform, theme and plugins updated, and unused plugins deleted.
• The domain is registered in the business owner's name with auto-renew on and a valid card. Our security basics post expands this group.

Search basics: can Google and AI assistants read it?

• No noindex tag or robots block on the live site. View the page source and search for "noindex"; open yourdomain.com/robots.txt and make sure it does not disallow everything. This is the single most common launch disaster. The robots.txt generator produces a safe file.
• Every page has a unique title under 60 characters and a description under 160, with the business type and location in the homepage title. Check with the title tag length checker and snippet preview.
• One H1 per page that says what the page is about.
• A sitemap exists at yourdomain.com/sitemap.xml and is submitted in Google Search Console and Bing Webmaster Tools. The sitemap generator builds one for hand-made sites.
• LocalBusiness structured data is on the homepage or contact page with name, address, phone, hours and URL; the schema generator writes it. Managed builders including Neweb add this automatically.
• Images have alt text describing what is in them.
• Old URLs redirect if this site replaces a previous one; see the migration guide.

Legal pages: required almost everywhere

• Privacy policy explaining what data the site collects (forms, analytics, cookies) and why. Required under GDPR and the UK GDPR, by several US state laws, by Australia's Privacy Act for many businesses, and by Canada's PIPEDA. The privacy policy generator drafts one to adapt.
• Cookie consent notice if the site uses analytics or marketing cookies and serves UK or EU visitors.
• Terms and conditions if the site sells, books or takes deposits; the terms generator gives a starting point.
• Business identity in the footer: legal name, registered address and company or tax number where local law requires it (UK companies, for instance, must show the registered name and number).
• Accessibility basics: readable contrast, alt text, keyboard-reachable forms. Legally required for some businesses and good practice for all.

This group is general guidance, not legal advice; check the rules for your country or ask an adviser if the site handles payments or health data.

Measurement and the first week

• Google Analytics 4 is installed and recording a visit from your own phone. Our guide to setting up GA4 takes ten minutes.
• Google Search Console is verified, the sitemap submitted, and the homepage requested for indexing. Same for Bing Webmaster Tools.
• Form submissions and calls are tracked as conversions, or at least counted by hand for the first month.
• Google Business Profile links to the site, with the same hours, and the first post announces the new site.
• The link is everywhere: Instagram and Facebook bios, LinkedIn, email signatures (the signature generator helps), invoices, WhatsApp Business profile, Apple Business Connect and Bing Places.
• A one-week review is in the calendar: check Search Console for coverage errors, re-test the forms, read the first analytics, and fix what the first visitors found.