We checked 34 small-business websites. Most make phone customers wait.

In late September we ran 34 small-business websites through the Sitecomb checker. On a phone test, only one of the 25 we could time showed its main content inside Google's 2.5-second target.

By Sitecomb Research · Checked and edited by Sitecomb on 29 September 2026 · Last updated 29 September 2026

The sites belong to cafés, solicitors, plumbers, dentists, B&Bs and bakeries. Most are in Ireland and the US. None is a big brand, and we name none of them here.

Below are the six problems that came up most. For each one, you get what we found and why it matters to your customers. Then how to check your own site for free.

1. Your site keeps phone customers waiting

What we found: 18 of the 25 sites we could time took over 4 seconds to show their main content. Google calls that "poor". The middle site took 7.9 seconds. Only one made it inside 2.5 seconds.

Why it matters: a customer looking you up on a phone sees a blank or half-drawn page while they wait. Every extra second is a chance for them to go back to the search results.

Check it yourself: put your web address into Google's free PageSpeed Insights and open the Mobile results. Look for "Largest Contentful Paint". Under 2.5 seconds is good. Over 4 is poor.

Ask your web person: the slow part is often one large photo at the top of the page. So ask: "What is the biggest thing on our home page, and can it load faster?"

A fair warning about these numbers. This is a lab test on a simulated mid-range phone, not your real customers. Results move between runs, sometimes a lot. So we timed 22 of the 25 sites more than once and used each site's fastest run. Nine sites couldn't be timed at all, and they're left out.

2. The phone number can't be tapped

What we found: 28 sites showed a phone number on the home page. On 12 of them, the number was plain text, not a tap-to-call link.

Why it matters: your customer has to copy the number or remember it. That's one more step between them and your phone ringing. Some phones spot a number and make it tappable anyway, but you can't count on it.

The groups are small, so treat this lightly. All 6 trades sites got it right: three plumbers, a builder, a roofer and an engineering firm. Five of the 8 law firms and accountants didn't.

Check it yourself: open your site on your phone and tap your number. The dialler should open with the number already filled in.

Ask your web person: "Can you make our phone number a tap-to-call link everywhere it appears?"

3. Shared links show no picture

What we found: 20 of the 34 sites had no preview picture set for shared links. Eight had no preview details at all.

Why it matters: customers share links on WhatsApp and Facebook. Without this setting, the preview may show no picture, or a random one from your page. A clear photo and title look like a real, busy business.

Check it yourself: send your web address to yourself on WhatsApp and look at the preview.

Ask your web person: many website builders have a social sharing setting for this. Ask: "Can you set our Open Graph title, description and image?"

4. Nothing stops fake emails in your name

What we found: 19 of the 34 web addresses had no DMARC record. Another 9 had one set to watch only, not to block.

Why it matters: DMARC tells other mail servers what to do with fake email that claims to be from you. Without it, a fake invoice "from" your address is more likely to reach your customers.

Check it yourself: the UK's National Cyber Security Centre has a free email security check. Type in your web address and read the DMARC line.

Ask whoever runs your email: "Do we have SPF, DKIM and DMARC set up?"

One trade-off to know about: blocking too early can stop your own real email. The usual route is to start on watch only, read the reports, then tighten it.

5. Google gets no description from you

What we found: 12 of the 34 home pages had no meta description. That's the short summary you can write for search results.

Why it matters: to be honest, Google doesn't always use it. It often builds its own snippet from your page. But when it does use yours, you choose the words people read before they click.

Check it yourself: search Google for your business name and read the lines under your link. Do they say what you do and where?

Ask your web person: "Does our home page have a meta description that says what we do and where?"

6. The padlock is broken

What we found: 5 of the 34 sites had no working secure version. Three had a certificate issued for a different web address. One certificate had expired. One site refused a secure connection outright.

Why it matters: since 2018, Chrome has labelled every page without https "Not secure". An expired or wrong certificate is harsher still. Anyone who types the https address gets a full-page warning before they see you.

A big caveat here. All five were among the sites we'd picked because they looked weak (see "How we checked"). We found none in the other 13. So don't read this as normal.

Check it yourself: type your address with https:// in front, on your phone and your laptop. The page should load with no warning page and no "Not secure" label.

Ask your host: "Is our certificate valid for our exact web address, and does it renew by itself?"

What surprised us

We expected the technical parts to be the mess. They weren't. 29 of the 34 sites had a sitemap for Google, and 29 had a robots file. Most website builders make these for you, as Google itself points out.

The gaps were in the things a person has to add. A description. A tap-to-call link. A preview picture. Each is a small job. But no platform can guess your words or pick your photo.

Check your own site

Start with our free 10-point check. It takes about 15 minutes and needs only your phone.

Want it all in one go? A Sitecomb report runs every check above and explains each result in plain English. It tells you what's wrong and what to ask for. You, or your web person, make the changes.