What a business website needs in 2026: speed, schema, accessibility, AI search

A business website in 2026 needs to load fast on a phone, tell Google and AI assistants clearly who you are and what you do, work for people with disabilities, stay secure and legal on privacy, and make it obvious how to buy or get in touch. Underneath that, you need to own it: the domain, the hosting account and the content should be in your name, and your team should be able to edit it without calling a developer. Design trends come and go. These requirements do not.

Below is the checklist we use when we audit a site or plan a new one, with what each item involves, how to check it yourself and what it costs to get right.

The short version

1. Speed you can measure

Google’s Core Web Vitals give you three numbers to aim at: Largest Contentful Paint (the main content appears) under 2.5 seconds, Interaction to Next Paint (the page responds when tapped) under 200 milliseconds, and Cumulative Layout Shift (things do not jump about) under 0.1. Google uses data from real Chrome users, mostly on phones, so a site that feels quick on your office broadband can still fail.

Most slow business sites we audit are slow for the same handful of reasons: oversized images, a page builder loading code the page does not use, a dozen plugins each adding scripts, cheap shared hosting and no caching. None of these needs exotic technology to fix. We target a Lighthouse score of 95 or more on every template we build. For a full walk-through see Core Web Vitals explained, and for WordPress specifically, the fixes that take a site from 40 to 95.

2. Structured data (schema)

Structured data is a block of code, invisible to visitors, that states facts about your page in a format machines read reliably: your business name, address, phone number, opening hours, prices, reviews, the author of an article. It is written in a vocabulary called Schema.org, usually as JSON-LD.

Which types matter depends on the business:

• Organization or LocalBusiness on every site, with your real name, address and phone number matching your Google Business Profile exactly.
• Product and Offer for shops, so prices and stock can appear in search results.
• Article with author details for blog posts and guides.
• BreadcrumbList to show where a page sits in the site.
• Event, Course or Service where they genuinely apply.

A note on FAQ markup: since 2023 Google only shows FAQ rich results for a small set of authoritative government and health sites, so adding it to a business site will not get you the expandable questions in search any more. It does no harm and still helps machines understand the page, but do not pay anyone extra for it on the promise of rich results.

3. Content written for people and for AI search

Google’s AI Overviews, ChatGPT search, Perplexity and Copilot all read web pages and summarise them. Nobody outside those companies knows exactly how they pick sources, and anyone selling a guaranteed “AI SEO” method is guessing. What we can say from watching which pages get cited is that the same habits that work for human readers work for machines.

Answer the question early

If a page is about what a boiler service costs in Leeds, say the price range in the first paragraph. Explanation and caveats come after. Pages that bury the answer under an introduction get skipped by people and by summarisers.

Be specific

“High-quality, affordable solutions” says nothing. “Five-page website, delivered in about two weeks, £350 plus VAT” says a lot. Prices, timescales, areas covered, materials, qualifications and named examples are what make a page quotable.

Show who is behind it

A real name on articles, a short author bio, a proper About page, your company number and a physical address. These build trust with readers, and Google’s guidance on helpful content puts weight on demonstrable experience and expertise.

Keep your details consistent

Your name, address and phone number should be identical on your website, Google Business Profile, Companies House listing and the directories you appear in. Inconsistent details confuse search engines and the AI tools built on top of them.

You may have heard of llms.txt, a proposed file that tells AI tools what is on your site. It costs almost nothing to add, but there is no evidence yet that the major AI search products rely on it. We treat it as optional.

4. Accessibility to WCAG 2.2 AA

Around one in four people in the UK report a disability, according to the government’s Family Resources Survey. Many more have temporary problems or simply struggle with small grey text on a phone in sunlight. An accessible site works with a keyboard, with a screen reader and with zoom; it has enough colour contrast, labelled form fields, real headings and meaningful link text.

The legal position: private businesses have a duty under the Equality Act 2010 not to discriminate against disabled people, which courts can apply to websites and online services. Public sector sites have specific rules under the 2018 accessibility regulations. If you sell to consumers in the EU, the European Accessibility Act has applied to many e-commerce services since 28 June 2025. WCAG 2.2 level AA is the standard all of these point to, and it is what we build every template to. Our guide to website accessibility and UK law covers the detail.

5. Mobile-first design

For most consumer-facing businesses the majority of visits come from phones, and Google ranks your site on its mobile version. Designing the phone version first, rather than shrinking a desktop design, changes what goes at the top of each page, how forms work and how big the buttons are. See mobile-first web design for a ten-minute test you can run on your own site.

6. Security as standard

Small business sites are attacked by automated bots, not by people who have chosen you. Bots scan for out-of-date plugins and weak passwords all day long. The basics stop nearly all of it:

• HTTPS on every page, with HTTP redirected.
• WordPress core, theme and plugins updated at least monthly, and security patches within days.
• Fewer plugins. Every plugin you remove is one less thing to patch.
• Two-factor authentication on every admin account, and no shared logins.
• Daily backups stored somewhere other than the web server, and a restore tested at least once.
• A firewall in front of the site. We put most client sites behind Cloudflare.
• If you handle customer data, consider Cyber Essentials, the government-backed certification scheme. Some public sector and corporate clients ask for it.

If you take payments or hold sensitive data, a proper security test is worth paying for. We explain what one covers in website penetration testing for small businesses, and our cybersecurity services page covers the rest.

7. Privacy done properly

Under UK GDPR and the Privacy and Electronic Communications Regulations (PECR), non-essential cookies and trackers, including most analytics and all advertising pixels, need consent before they load. A banner that says “we use cookies” while Google Analytics and the Meta pixel are already running is not compliant, and the ICO has been writing to sites about exactly this.

The Data (Use and Access) Act 2025 relaxes some of this, including exemptions for certain low-risk analytics cookies, and raises the maximum PECR fines to UK GDPR levels. Those changes are being brought in in stages, so check the ICO’s current guidance before you remove a consent step. Our article on cookie banners and UK law explains what is required today.

8. A clear route to action

Every important page should make the next step obvious: call, book, buy, request a quote. On a phone that means a tap-to-call link and a main button visible without scrolling. Forms should ask only for what you need to reply. A quote form for a kitchen fitter in Glasgow needs a name, a contact method, a postcode and a short description; it does not need a budget drop-down and twelve checkboxes.

Then make sure the enquiries arrive. We regularly find contact forms whose emails have been landing in spam for months. Test your own form every month, and send form data to a second place (a spreadsheet, a CRM or a simple log) so nothing is lost if email fails.

9. Editable by your team

If changing an opening time needs a developer, the website will drift out of date. A good content management system lets the people who know the business update text, images, prices, team members and news themselves, within a design that does not break when they do. That is why we build on WordPress with a hand-built theme and a fixed set of content blocks rather than a free-for-all page builder; we explain the reasoning in custom WordPress development.

10. Owned by you

Check these today:

• The domain is registered in your company’s name, and you have the login for the registrar.
• The hosting account is in your name, or your contract says you can move the site whenever you want with a full copy of files and database.
• You are an administrator (not just a user) on Google Analytics, Google Search Console and Google Business Profile.
• You have admin access to the website itself.
• Your contract assigns you the copyright in the design and code written for you.

We set every client site up this way as standard. It is the single most common problem we see when people come to us from another supplier.

What it costs to get this right

Every item above is included as standard in our builds, not sold as an extra. Our current fixed-price packages, excluding VAT:

Worked example: upgrading an existing site. If your current site is sound but missing structured data, has slow images, a non-compliant cookie banner and a few accessibility failures, that is typically 15 to 20 hours of WordPress work. At 20 hours: 20 × £50 = £1,000, less the 15 % volume discount = £850, plus VAT of £170 = £1,020. You can buy hours online through hire us; they never expire. If the audit suggests more than about 30 hours of fixes, a rebuild on one of our packages is usually cheaper over the next few years.

Where to start if your site is a few years old

Do it in this order, because the first items are cheap and the later ones build on them:

1. Sort out ownership: domain, hosting, analytics access.
2. Fix security: updates, backups, two-factor login.
3. Fix the cookie banner so trackers wait for consent.
4. Check speed and mobile on your three busiest pages.
5. Rewrite the top of each key page so it answers the visitor’s question straight away.
6. Add structured data and run an accessibility check.

If you would like a second opinion, our team in St Albans works with businesses across the UK. Send your web address through our contact page and we will tell you which of these ten points your site passes, what it would cost to fix the rest, and whether patching or rebuilding is the better use of your money. You can also see how we approach builds on our web development page.

Photo: Hal Gatewood via Unsplash