Use this small business website checklist before you launch a new site, or to audit the one you already have. It covers the pages every business site needs, the legal items South African sites must include, speed, security, contact options and tracking. Work through it with your developer, or tick it off yourself. Anything unticked is a to-do, not a failure.
Domain, email and ownership
- The domain is registered in the business's name (or yours), not your developer's.
- You can sign in to the domain and hosting accounts yourself, and at least two people know how.
- Domain and hosting are on auto-renew, or renewal dates are in a shared calendar.
- Email uses your domain (
[email protected]), with SPF, DKIM and DMARC records set up so mail isn't marked as spam. - Both
yourbusiness.co.zaandwww.yourbusiness.co.zaload the site, one redirecting to the other.
If email deliverability is a problem, see SPF, DKIM and DMARC explained.
Essential pages
- Home page that says in one sentence what you do, for whom and where.
- Services or products, ideally one page per main service so each can rank in search.
- About, with real names and photos. People buy from people.
- Contact, with phone, email, WhatsApp if you use it, address or service area, and trading hours.
- Privacy policy (see the legal section below).
- Terms and conditions if you sell online or take bookings.
- A helpful 404 page that links back to the main sections.
Nice to have: FAQs, testimonials or case studies, a pricing page (even "from" prices help people qualify themselves), and a blog if you'll genuinely keep it updated.
Content quality
- Each page has one clear purpose and one main call to action.
- Text is written for customers, not for search engines. Plain language, short paragraphs.
- Prices, hours and contact details are current and consistent across all pages.
- Spelling checked, including the business name.
- Images are your own or properly licensed.
Legal and POPIA
South African websites that collect any personal information, even just through a contact form or analytics, need to handle it under the Protection of Personal Information Act.
- A privacy policy explains what you collect, why, who you share it with, how long you keep it and how people can contact you about their information.
- Forms collect only what you need. Do you really need an ID number or date of birth?
- Newsletter sign-ups have clear consent and every marketing email has an unsubscribe link.
- You know where your hosting, email and form tools store data, and whether any of it goes abroad.
- Online stores show business details, full prices including delivery, and returns and cancellation policies as ECTA and the Consumer Protection Act require.
- Your company registration number and VAT number (if registered) appear where required.
These are general points, not legal advice. For your specific situation, speak to a professional, and see the Information Regulator for official guidance.
Speed
Slow sites lose visitors, especially on mobile data.
- Images are resized and compressed (WebP or AVIF where possible), not straight from a camera.
- Pages load quickly on a real phone on mobile data, not just on office Wi-Fi.
- Hosting is close to your visitors. For a South African audience, local hosting shortens the distance every request travels.
- Caching is enabled (a caching plugin on WordPress, or the framework's caching on custom sites).
- You've removed plugins, fonts and scripts you don't use.
Speeding up your website for South African visitors goes deeper on each of these.
Mobile and accessibility
- Every page works on a small phone screen without zooming or sideways scrolling.
- Phone numbers are tap-to-call links and addresses open in maps.
- Buttons are large enough to tap.
- Text has enough contrast against the background.
- Images have alt text that describes them.
- Forms have labels and can be completed with a keyboard.
Security
- HTTPS everywhere, with a valid certificate (free Let's Encrypt is fine) and no "not secure" warnings.
- CMS, theme and plugins up to date, with a plan for who updates them.
- Admin accounts use strong, unique passwords and two-factor sign-in.
- Old user accounts (ex-staff, previous developers) removed.
- Automatic backups running, stored separately from the site, and a restore has been tested.
- Forms protected against spam.
Work through the website security checklist for more detail.
Search basics (SEO)
- Every page has a unique title and meta description.
- One clear heading per page that describes its content.
- Your town or service area is mentioned naturally where relevant.
- An XML sitemap exists and is submitted in Google Search Console.
- The site isn't accidentally blocked from search engines (common after launching from a staging site).
- Your Google Business Profile links to the website, with matching name, address and phone number.
Tracking
- Analytics installed, and your privacy policy mentions it.
- Key actions tracked: form submissions, calls from the site, WhatsApp clicks, purchases.
- Google Search Console set up so you can see search queries and errors.
- Someone looks at the numbers monthly and acts on them.
After launch
- Submit a test enquiry through every form and confirm it arrives.
- Check the site on at least one Android and one iPhone.
- Set a quarterly reminder to review content, prices, hours and team photos.
- Agree who handles updates and fixes, and put it in writing.
Frequently asked questions
What pages should a small business website have?
At minimum a home page, services or products, about, contact and a privacy policy. Add terms and conditions if you sell online or take bookings, and FAQs or testimonials when you have them.
Does a small business website need a privacy policy in South Africa?
If the site collects any personal information, including through a contact form, newsletter sign-up or analytics, you should have one to meet POPIA's openness requirements. Most business websites fall into this category.
How often should I review my website?
Check contact details, prices and hours whenever they change, and do a fuller review every quarter. Security updates should happen much more often, ideally weekly or as soon as they're released.
How do I know if my website is fast enough?
Open it on your phone on mobile data and see how long it takes to become usable. Tools such as PageSpeed Insights give more detail, including Core Web Vitals scores and specific fixes.
If your checklist has gaps in hosting, email or SSL, see our web hosting plans or contact us for help.