It’s 2026. Your customers have seen thousands of websites. They know what good looks like, and they’re not afraid to leave if your website doesn’t deliver in under 5 seconds.
This checklist covers what actually matters for a business website in 2026 — organized by the categories that determine whether your website works, not just whether it looks pretty.
Use this as a pre-flight check before launching a new website, or as an audit framework for an existing one.
—
## Performance
A website that loads slowly doesn’t get the benefit of the doubt. Every second of delay reduces conversions, increases bounce rates, and damages search rankings.
**Core Web Vitals (Google’s performance metrics):**
– [ ] **Largest Contentful Paint (LCP):** Does the main content load within 2.5 seconds? This is the single most important performance metric for user experience.
– [ ] **First Input Delay (FID):** Can users interact with the page within 100ms of loading? Buttons, forms, and menus should respond instantly.
– [ ] **Cumulative Layout Shift (CLS):** Do elements shift around as the page loads? Nothing frustrates users more than trying to click something that moves.
**Specific performance requirements:**
– [ ] Page load time under 3 seconds on a standard mobile connection
– [ ] Images are optimized (compressed, appropriate formats like WebP or AVIF)
– [ ] Lazy loading is implemented for below-the-fold images and content
– [ ] Code is minified and bundled
– [ ] Browser caching is configured correctly
– [ ] A CDN is used if the audience is geographically distributed
– [ ] Third-party scripts (chat widgets, analytics, marketing pixels) are loaded efficiently
**Why this matters more in 2026:** Google’s ranking algorithm now weights page experience significantly. A slow website doesn’t just lose visitors — it loses Google traffic.
—
## SEO (Search Engine Optimization)
SEO isn’t optional. If your website can’t be found, it doesn’t matter how good it is.
**Technical SEO:**
– [ ] Every page has a unique, descriptive title tag (50–60 characters)
– [ ] Every page has a unique meta description (150–160 characters)
– [ ] All images have descriptive alt text
– [ ] Heading structure is hierarchical (single H1 per page, logical H2/H3 hierarchy)
– [ ] URLs are clean, readable, and include relevant keywords
– [ ] XML sitemap is submitted to Google Search Console
– [ ] robots.txt is configured correctly
– [ ] Canonical tags are used to prevent duplicate content issues
– [ ] 404 page is custom and useful (not a default server error)
– [ ] SSL certificate is installed (HTTPS is mandatory)
– [ ] Schema markup is implemented for business information, reviews, and relevant content types
– [ ] Pagination is handled correctly (no duplicate content from page variations)
**On-page SEO:**
– [ ] Primary keyword appears in the title, first 100 words, heading, and URL
– [ ] Content is written for humans, not search engines
– [ ] Internal linking structure is logical and comprehensive
– [ ] External links go to authoritative, relevant sources
– [ ] No keyword stuffing or unnatural keyword density
– [ ] Content length matches search intent (short answers for quick queries, comprehensive guides for informational searches)
**Local SEO (critical for Malaysian businesses):**
– [ ] Google Business Profile is claimed, verified, and fully completed
– [ ] NAP (Name, Address, Phone) is consistent across the website and all directories
– [ ] Location-specific keywords are included where relevant
– [ ] Map embed is present on contact or location pages
– [ ] Reviews are actively managed on Google and other relevant platforms
—
## Design & User Experience
Design isn’t decoration — it’s communication. Every visual choice sends a message about who you are and whether you’re trustworthy.
**Visual design fundamentals:**
– [ ] Brand identity is consistent (colors, fonts, logo usage, imagery style)
– [ ] Typography is legible and hierarchy is clear
– [ ] White space is used effectively (pages don’t feel cramped)
– [ ] CTAs (calls to action) are visually distinct and obvious
– [ ] Buttons and interactive elements have clear hover and active states
– [ ] The overall design feels current (not dated)
– [ ] Dark mode or light mode options work correctly
**Navigation and structure:**
– [ ] Navigation is intuitive and self-explanatory
– [ ] The most important pages are accessible within 2 clicks from anywhere
– [ ] Mobile navigation works as well as desktop
– [ ] Search functionality works (if the site has enough content to warrant it)
– [ ] Breadcrumbs are present on content-heavy sites
– [ ] Footer navigation is comprehensive and links to important pages
**Forms and interactions:**
– [ ] Contact forms have clear labels and helpful error messages
– [ ] Form validation provides specific feedback (“Please enter a valid phone number” not just “Invalid”)
– [ ] Required fields are clearly marked
– [ ] Form submission provides confirmation (not just a silent redirect)
– [ ] No dead-end pages (pages with no way to continue or return to the main site)
– [ ] Buttons communicate what they do (“Get Quote” not just “Submit”)
—
## Content
Design gets attention. Content earns trust. Both are necessary.
**Content quality standards:**
– [ ] Every page has original, well-written content (no placeholder or AI-generated-without-review content)
– [ ] Copy is scannable (short paragraphs, bullet points, headings, adequate spacing)
– [ ] Headlines are specific and benefit-driven, not generic
– [ ] Industry jargon is minimized or explained
– [ ] Grammar and spelling are correct throughout
– [ ] Content is updated when information changes (outdated content damages credibility)
**Content completeness:**
– [ ] Homepage clearly communicates what you do and who you serve
– [ ] About page tells a story (not just “we were founded in X, we do Y”)
– [ ] Services or products pages are detailed enough to answer common questions
– [ ] Contact page has multiple ways to get in touch
– [ ] FAQs address the questions customers actually ask
– [ ] Trust signals are present (certifications, awards, client logos, accreditations)
**Blog and resources (if applicable):**
– [ ] Content is published regularly and consistently
– [ ] Content addresses actual customer questions and pain points
– [ ] Old content is audited and updated periodically
– [ ] Related content is linked appropriately
—
## Trust Signals
People decide whether to trust a website in milliseconds. Trust signals are the visual and content cues that confirm your site is legitimate, professional, and safe.
**Credibility indicators:**
– [ ] Physical address and phone number are visible and consistent
– [ ] Company registration or licensing information is displayed if relevant
– [ ] Team photos humanize the business (not stock photos)
– [ ] Client logos or case studies demonstrate real experience
– [ ] Professional affiliations or certifications are displayed
– [ ] Awards and recognition are mentioned (if applicable)
**Social proof:**
– [ ] Customer testimonials are specific and include names (not just “Great service!”)
– [ ] Reviews from Google, Trustpilot, or industry platforms are linked or displayed
– [ ] Case studies show measurable results (“increased leads by 47%” not just “improved performance”)
– [ ] Client logos are real companies, not generic “and more”
**Security signals:**
– [ ] HTTPS is active and the padlock icon is visible
– [ ] Privacy policy is present and up to date
– [ ] Terms and conditions are present if applicable
– [ ] Cookie consent banner is implemented correctly (not blocking content)
– [ ] Payment pages use recognized payment processor branding
—
## Mobile Experience
In 2026, mobile is not an afterthought — it’s the primary experience for most businesses.
**Mobile-specific requirements:**
– [ ] Touch targets are appropriately sized (minimum 44×44 pixels for tap elements)
– [ ] Font sizes are readable on small screens (minimum 16px for body text)
– [ ] Horizontal scrolling is not required to read content
– [ ] Images resize correctly or serve different versions for mobile
– [ ] Navigation works as a mobile-optimized menu
– [ ] Phone numbers are tappable and trigger a call (on mobile)
– [ ] Address triggers a map on mobile devices
– [ ] Form fields use appropriate input types (tel: for phone, email: for email)
– [ ] Swipe gestures don’t conflict with native scrolling
– [ ] Bottom-heavy content is avoided (thumb zone considerations)
**Mobile testing:**
– [ ] Tested on actual iOS and Android devices, not just browser emulators
– [ ] Tested on low-end devices (not just the latest iPhone)
– [ ] Real-world connection speeds are tested, not just localhost
—
## Security
A compromised website damages your customers, your reputation, and your search rankings.
**Security fundamentals:**
– [ ] CMS and all plugins/themes are kept up to date
– [ ] Strong passwords are required for all admin accounts
– [ ] Two-factor authentication is enabled for admin access
– [ ] File permissions are configured correctly (no writable files where they shouldn’t be)
– [ ] Backups are automated and tested (you can restore from a backup)
– [ ] A Web Application Firewall (WAF) is configured
– [ ] Security headers are implemented (Content-Security-Policy, X-Frame-Options, etc.)
– [ ] Database credentials are not stored in publicly accessible files
– [ ] User accounts follow the principle of least privilege
**For e-commerce and data-collection sites:**
– [ ] PCI compliance requirements are met for payment processing
– [ ] User data is encrypted at rest
– [ ] Data retention and deletion policies are documented
– [ ] Cookie consent is granular and respects user preferences
—
## Conversion Optimization
Your website has a job to do. Whether that’s generating leads, selling products, or building an audience — every element should support that goal.
**Conversion basics:**
– [ ] The primary conversion action is clear and obvious (one CTA per page, usually)
– [ ] CTAs appear above the fold and at natural decision points
– [ ] Friction is minimized (fewer form fields, fewer steps to conversion)
– [ ] Trust signals are placed near conversion points
– [ ] The value proposition is clear (“Why should I choose you?”)
**Lead generation sites:**
– [ ] Contact forms are in high-visibility locations
– [ ] Click-to-call is prominent on mobile
– [ ] Live chat or chatbot is available for immediate questions
– [ ] Landing pages for paid campaigns don’t link to unrelated content
**E-commerce sites:**
– [ ] Product pages include all information needed to make a purchase decision
– [ ] Add-to-cart is prominent and works reliably
– [ ] Checkout process is streamlined (minimal steps, guest checkout available)
– [ ] Shipping costs and timeframes are transparent early in the process
– [ ] Return policy is clear and easy to find
—
## Accessibility
Web accessibility ensures your website works for people with disabilities. Beyond the ethical case, accessible websites perform better for everyone and face fewer legal risks.
**WCAG 2.1 AA compliance:**
– [ ] All images have alt text (including decorative images)
– [ ] Video content has captions and transcripts
– [ ] Color contrast meets minimum requirements (4.5:1 for normal text, 3:1 for large text)
– [ ] All functionality is keyboard-accessible (no mouse-only interactions)
– [ ] Focus states are clearly visible
– [ ] Form inputs have associated labels
– [ ] Error messages are specific and accessible to screen readers
– [ ] Page titles are descriptive and unique
– [ ] Heading structure is logical (not skipped levels)
– [ ] ARIA landmarks are used correctly where HTML5 semantic elements aren’t sufficient
—
## Analytics & Measurement
If you’re not measuring, you’re not improving.
**Analytics setup:**
– [ ] Google Analytics 4 (or equivalent) is installed and tracking correctly
– [ ] Conversion events are configured (form submissions, phone calls, purchases)
– [ ] Google Search Console is connected and monitored
– [ ] Error pages (4xx, 5xx) are tracked and reviewed
**Ongoing measurement:**
– [ ] Traffic sources are reviewed monthly
– [ ] Top-performing pages and worst-performing pages are identified
– [ ] Conversion rates are tracked and benchmarked
– [ ] Page speed is monitored over time
– [ ] A/B testing is used for major conversion optimization decisions
—
## The 2026 Specific Additions
Some considerations that are particularly relevant for 2026:
– [ ] **AI-generated content disclosure:** If your site uses AI-assisted content, consider disclosure for transparency and SEO reasons (Google’s helpful content update penalizes poorly implemented AI content)
– [ ] **Core Web Vitals as ranking factor:** Performance metrics are now significant ranking factors, not just UX considerations
– [ ] **Video content integration:** Video is increasingly dominant in engagement. Static sites without video options are at a disadvantage
– [ ] **Privacy-first tracking:** With third-party cookie deprecation, first-party data collection and consent-based tracking are now essential
– [ ] **Zero-click search optimization:** Many searches now get answers directly in Google. Your content needs to be structured to be selected as a featured snippet or AI overview
– [ ] **HTTPS enforcement:** HTTP sites are flagged as “not secure” in Chrome. There is no excuse for not having HTTPS in 2026
—
## Use This Checklist the Right Way
Don’t try to fix everything at once. Start with the sections that have the biggest gap between where you are and where you should be.
For most businesses, the priority order is:
1. **Performance & Mobile** — if the site is slow or broken on mobile, nothing else matters
2. **SEO Foundations** — if no one can find the site, the best design is invisible
3. **Trust Signals & Content** — these convert visitors once they arrive
4. **Design & UX** — polish once foundations are solid
5. **Accessibility & Security** — ongoing maintenance that shouldn’t be neglected
—
## Need a Website That Passes This Checklist?
We build business websites that are fast, findable, and designed to convert. If your current website isn’t meeting this checklist, let’s talk about what it would take to fix it.
[Start a conversation with us →](/info/)