Small Business Website Statistics 2026: We Audited 255 Local Sites

Small Business Website Statistics 2026: We Audited 255 Local Sites

On 23 October 2026 we ran 255 small business websites through our own audit engine and Google PageSpeed Insights. The sites belong to dentists, law firms, hair salons, auto repair shops, home service trades and accountants in Austin, Denver, Columbus, Charlotte and Portland. Every number on this page comes from that run. Nothing is estimated or borrowed from another survey.

The short version: most local business websites get the visible basics right, then fall down on things owners never see. Mobile speed, email protection and security headers are where the gaps are. And a surprising share of the website addresses listed for these businesses no longer lead anywhere useful.

Key Findings

• 13% of listed website addresses no longer led to the business. Of 255 addresses listed for these businesses on OpenStreetMap, 25 pointed to domains that no longer exist, 3 now show online gambling spam, 2 show a placeholder and 4 send visitors to a larger company or a booking page.
• The median mobile PageSpeed score was 62 out of 100. Only 12 of 157 homepages we could test (8%) scored 90 or higher, the range Google labels good.
• Only 7 of 157 homepages (4.5%) loaded their main content within 2.5 seconds in Google's mobile lab test. The median was 9.0 seconds.
• 48% of businesses that use email on their domain have no DMARC record (70 of 145). Only 23% (33 of 145) have a DMARC policy that actually blocks or quarantines fake emails sent in their name.
• 62% of sites send no HSTS security header, and 40% send none of the four common security headers we check.
• 25% of homepages have no meta description and 19% have no H1 heading.
• 24% of sites have no structured data at all, so search engines get no machine readable business details from them.
• Only 2 of 167 sites (1.2%) block any AI crawler in robots.txt. AI search tools can read almost every small business site we checked.

How We Ran the Study

We took every dentist, law office, hair salon, auto repair shop, plumber, electrician, HVAC company, roofer and accountant with a website listed on OpenStreetMap in five US cities. That gave 1,101 listings. We removed chains and franchises, national companies, store locator pages and listings that only pointed to a Facebook or booking page. That left 732 independent businesses, and we picked 255 of them at random, spread evenly across the cities.

Each site went through the same engine as our free website audit tool, with its default settings: up to five pages per site and 73 named checks covering search, speed, mobile, security, accessibility and content. Each homepage also went through Google PageSpeed Insights on the mobile setting. 167 sites returned a working page we could audit in full, and PageSpeed returned a result for 157 of them.

The full method, the exclusions and the limits of this data are at the end of this page, together with a CSV of every figure.

More Than 1 in 8 Listed Websites No Longer Worked for the Business

Before looking at what the working sites get wrong, it is worth saying what happened to the rest. This is what we found at the 255 website addresses we tried:

Adding up the domains that no longer exist, the spam, the placeholders and the moved businesses gives 34 addresses, or 13% of the sample, that no longer led a customer to the business they were listed for.

Auto repair shops and hair salons had the most: 11 of 45 auto repair addresses and 10 of 45 salon addresses no longer led to the business. Home services and accountants had 2 each.

Three of these are worth a closer look. Each domain once belonged to a local business and now shows online gambling spam. When a business lets its domain lapse, someone else can buy it, and every old listing, directory link and printed card then sends customers to whatever the new owner puts there.

OpenStreetMap is edited by volunteers and some of these entries may be years old, so this figure says as much about stale listings as about the businesses themselves. The lesson for owners is the same either way: check where your listings point, and keep your domain renewed even if you change websites.

The 33 sites that blocked our scanner are not broken. Many use security services that challenge automated visitors, which is a reasonable choice. We left them out of the figures below because we could not see their pages.

Mobile Speed Is the Biggest Weak Spot

The median mobile PageSpeed score across 157 small business homepages was 62 out of 100.

Largest Contentful Paint (LCP) is the time until the biggest piece of content, usually the main image or headline, appears on screen. Google treats 2.5 seconds or less as good. In the lab test:

• Only 7 of 157 homepages (4.5%) reached their LCP within 2.5 seconds.
• 122 of 157 (78%) took longer than 4 seconds.
• The median was 9.0 seconds, and the slowest 10% took over 22 seconds.

There is an important catch. PageSpeed's lab test simulates a mid range phone on a slow mobile connection, so it is harsher than what most visitors experience. Google only shows real visitor data for sites with enough Chrome traffic, and just 21 of the 157 sites (13%) had it. Of those 21, 14 had a good real world LCP. So the lab score overstates how slow these sites feel for many people, but it is the same test Google shows owners, and it points at real problems.

The homepage code shows where the time goes:

• 56% serve images only in older formats like JPEG and PNG rather than WebP or AVIF.
• 52% load scripts in the page head that block the page from drawing until they finish.
• 43% have images without width and height set, which makes the layout jump as they load. Even so, 89% stayed under Google's layout shift limit of 0.1.

Law firm homepages were the fastest, with a median mobile score of 68. Accountants were the slowest at 58.

Search Basics: Mostly There, With Gaps

Two thirds of the sites (110 of 167, 66%) had a title, a meta description, an H1 heading and a mobile viewport tag on their homepage. The rest were missing at least one.

A missing meta description does not stop a page ranking. Google writes its own snippet instead, often from navigation text or an address block, and that snippet is usually less persuasive than one the owner writes. Across all the pages we crawled, not just homepages, 48% of sites had at least one page without a meta description.

Other search findings across the whole site:

• 24% had no structured data at all. Structured data is the code that tells search engines a business name, address, phone number, opening hours and reviews in a form they can read without guessing.
• 14% had at least one broken internal link among the pages and links we checked.
• 7% had no XML sitemap we could find, and 19% had a sitemap that robots.txt does not mention.
• 22% showed a plain error page for missing URLs, with no links back into the site, so a visitor who follows an old link has nowhere to go.

If you want to work through these on your own site, our website audit checklist puts them in the order worth fixing, and the on page SEO checklist covers titles, descriptions and headings in detail.

Email Protection: Half Have No DMARC

70 of the 145 businesses that receive email on their own domain (48%) have no DMARC record. DMARC is a short DNS record that tells mail providers what to do with emails that claim to come from your domain but did not. Without it, anyone can send convincing fake invoices or appointment reminders in your name, and they are more likely to land in an inbox.

A monitor only record is a sensible first step, but it does not block anything. That means 77% of these businesses have no DMARC protection that actually stops spoofed email. SPF, the older companion record, was missing for 21 of 145 (14.5%).

Since 2024, Gmail and Yahoo have required DMARC from anyone sending large volumes of email. Most small businesses fall below that line, but the same record protects them from impersonation, and it takes minutes to add.

Security Headers Are Rarely Set

Almost every site uses HTTPS. Only 1 of 167 lacked it entirely, and 8 (4.8%) did not redirect the plain HTTP version to HTTPS. Beyond that, the extra protection most web servers can send with a single setting is usually missing.

None of these headers will change rankings on their own. They matter because small business sites are common targets for automated attacks, and a site that gets hacked can end up serving spam, which does hurt rankings. 22% of sites also told visitors exactly which server software version they run, which saves attackers a step.

AI Search Can Read Almost Every Site

Only 2 of 167 sites (1.2%) block any AI crawler in robots.txt. The other 165 block none of the 10 AI crawlers and AI training controls we check, from OpenAI, Anthropic, Perplexity, Google, Apple and Common Crawl.

That is the opposite of the trend among large publishers, many of which now block AI crawlers. For a local business, being readable by ChatGPT search, Perplexity and similar tools is usually what you want, since people increasingly ask these tools for a dentist or plumber near them. But being readable is only half of it. The 24% of sites with no structured data and the 25% with no meta description give these tools less to work with when they describe the business.

Social profiles help here too. 25% of sites link to no social profile at all. Another 32% link to their profiles but do not list them in structured data, which is one of the ways search engines and AI tools confirm that a website and a social account belong to the same business.

Results by Trade

Each trade has between 25 and 31 working sites, so treat the differences as a pointer, not a ranking. Two patterns stand out. Accountants had the weakest sites on almost every measure: nearly half had no meta description and 60% had no structured data. Hair salons were most likely to be missing an H1 heading (31%) and a meta description (35%), which often happens on sites built from visual templates where the main heading is an image.

On our 100 point audit the median site scored 87. The high median reflects that most sites pass the visible basics. The categories with the lowest medians were security (67) and performance (83), which matches the findings above.

What to Fix First

If you run a small business website, these are the fixes that the data says most sites need, in the order we would do them:

1. Check your listings. Search for your business on Google Maps, Apple Maps, Yelp and OpenStreetMap and make sure the website address works. Renew your old domain even if you have moved to a new one, so it cannot be bought and reused.
2. Add a DMARC record. Start with p=none so you can see reports, then move to quarantine once your real email passes. Your email provider's help pages will have the exact record.
3. Write a meta description and one clear H1 for your homepage. Say what you do and where, in plain words.
4. Add LocalBusiness structured data with your name, address, phone number, opening hours and links to your social profiles.
5. Make your main image smaller. Convert it to WebP, set its width and height, and stop loading scripts in the page head that the first screen does not need.
6. Turn on HSTS and the basic security headers. On most hosts and on Cloudflare this is a setting, not a code change.

You can run the same checks we used on your own site with the free website audit tool. It takes about a minute and needs no signup. If you would rather have someone go through the results with you, our website audit services list what each audit covers and what it costs.

Frequently Asked Questions

What percentage of small business websites have no DMARC record?

In our October 2026 audit of small business websites in five US cities, 70 of the 145 businesses that receive email on their own domain (48%) had no DMARC record. Another 41 (28%) had a record set to monitor only, so 77% had no DMARC policy that actually blocks or quarantines email faked in their name.

How fast are small business websites on mobile?

The median Google PageSpeed Insights mobile score across 157 small business homepages was 62 out of 100. Only 12 (8%) scored 90 or higher. In Google's mobile lab test only 7 homepages (4.5%) showed their main content within 2.5 seconds, and the median was 9.0 seconds. Real visitors on good connections usually see faster loads than the lab test.

What is the most common problem on small business websites?

Missing security headers and slow mobile loading were the most common. 62% of the 167 sites we audited send no HSTS header, and 92% of homepages scored below 90 on mobile PageSpeed. Among search basics, the most common homepage gap was a missing meta description, at 25% of sites.

How many small business websites listed online no longer work?

Of 255 website addresses listed for local businesses on OpenStreetMap, 34 (13%) no longer led to the business: 25 domains no longer existed, 3 showed online gambling spam, 2 showed a placeholder and 4 pointed to a larger company or a booking page. Another 19 servers did not respond to our scanner.

How was this small business website study done, and can I use the data?

We randomly sampled 255 independent dentists, law firms, hair salons, auto repair shops, home service trades and accountants listed on OpenStreetMap in Austin, Denver, Columbus, Charlotte and Portland, and audited them on 23 October 2026 with the DevelopersMatrix audit engine and Google PageSpeed Insights. 167 returned a working site. The figures are free to use under CC BY 4.0 with credit to DevelopersMatrix and a link to the study, and a CSV is available on the page.

Methodology

Sample. We queried OpenStreetMap on 23 October 2026 for businesses with a website tag in Austin (TX), Denver (CO), Columbus (OH), Charlotte (NC) and Portland (OR), in these categories: dentist, lawyer, hairdresser, accountant and tax advisor, car repair, plumber, electrician, HVAC and roofer. Plumbers, electricians, HVAC companies and roofers are grouped as home services because OpenStreetMap lists too few of each to report separately. We removed listings with a brand tag, any domain listed more than once, store locator pages, national companies, car dealerships and links to social media or booking platforms. From the 732 independent businesses left, we drew a random sample spread evenly across the cities, capped at 45 per trade. Two further sites were removed before auditing because they turned out to be a national law firm and a process server, leaving 255. Audit. Each site was audited on 23 October 2026 with the DevelopersMatrix website audit engine using its default settings: the homepage plus up to four more pages found from it, 73 named checks, up to 40 internal links and 20 outbound links tested per site, and DNS lookups for SPF and DMARC. Homepage figures use only the homepage. Site figures count a site if the issue appeared on any page we crawled. Sites that did not respond were tried a second time. We looked up every failed domain in public DNS to separate domains that no longer exist from servers that did not respond. Speed. Each working homepage was tested once with the Google PageSpeed Insights API on the mobile setting. Lab results from a single run can vary by a few points between runs. Real visitor data comes from Google's Chrome User Experience Report, which PageSpeed includes when a site has enough traffic. Exclusions after auditing. We removed sites that returned a bot check or an empty page, sites whose text only appears after JavaScript runs, and domains that had changed hands, as listed in the table near the top. 167 sites remained. Limits. OpenStreetMap is volunteer edited, so the sample leans towards businesses that someone took the time to map, and some listings are old. Five cities do not represent the whole country. Trade groups of 25 to 31 sites are small. Our engine reads the HTML a server sends and does not run JavaScript, so a site that adds its title or headings with JavaScript would show as missing them. We name no individual business in this study.

Download the Data and Cite This Study

Download the full figures as a CSV. It contains every percentage on this page with the number of sites affected and the number checked, plus the results by trade. It contains no business names.

The figures are published under the Creative Commons Attribution 4.0 license (CC BY 4.0), so you are welcome to use them. Please credit them as: DevelopersMatrix, Small Business Website Statistics 2026, October 2026, with a link to this page. Map data © OpenStreetMap contributors.