Back

We Audited 100 Small Business Websites in 2026. Here’s What We Found.

Over the past year, we’ve performed detailed technical audits for more than 100 small business websites as part of our free audit service. The sample spans professional services, e-commerce, local businesses, and B2B companies across North America and Europe.

The patterns are striking — and mostly depressing. Here’s what we found, by the numbers.

Performance: Only 12% Pass Core Web Vitals

88% of the sites we audited failed at least one Core Web Vitals metric. The breakdown:

  • LCP (Largest Contentful Paint) failing: 71%
  • INP (Interaction to Next Paint) failing: 58%
  • CLS (Cumulative Layout Shift) failing: 43%

The most common culprit for LCP failures: unoptimized hero images. We saw 8MB images serving as backgrounds on sites where the same visual result could be achieved with a 200KB WebP file. The second most common: no preload directive on the LCP element.

Average mobile PageSpeed score across all audited sites: 46. The range was 11–91. Only 9 sites scored above 80 on mobile.

Security: 34% Had Active Vulnerabilities

We found at least one active security vulnerability in 34% of sites — meaning a plugin, theme, or WordPress core version with a known CVE. In 12% of cases, the vulnerability was rated high or critical severity.

The most common source: abandoned plugins that had been deactivated but not deleted (inactive plugins can still be exploited), and premium themes running versions that were 2–3 major releases behind.

SEO: The Basics Are Still Being Missed

  • 67% had no structured data markup of any kind
  • 54% had duplicate content issues (usually from URL parameters or WWW/non-WWW inconsistencies)
  • 48% had meta descriptions missing on key pages
  • 41% had internal links pointing to redirect chains
  • 38% had Google Search Console showing crawl errors that had never been addressed

The SEO problems weren’t sophisticated. They were basics — the kind of things that get addressed in the first month of any proper SEO engagement and then maintained. The businesses with these issues weren’t ignoring SEO deliberately; they’d just never had a clear picture of where they stood.

Content: Thin Pages Dominate

69% of sites had at least one key service or product page under 300 words. For competitive searches, this is essentially invisible — Google needs enough content to understand what a page covers and how authoritatively it covers the topic.

The average word count on homepage content was 340 words. The average on service pages was 280 words. Both are significantly below what we see ranking for any moderately competitive term.

What the 12% Who Passed Were Doing Differently

The sites performing well shared several characteristics:

  • All were on managed WordPress hosting (not shared hosting)
  • All had a maintenance service or dedicated technical resource
  • All had made deliberate content investment in the past 12 months
  • Average active plugin count: 16 (vs. 29 for underperformers)

The common thread is deliberate investment — in infrastructure, in maintenance, and in content. None of them were doing anything exotic. They were just doing the basics consistently.

What You Should Do With This

If you’re running a WordPress site and haven’t had a proper technical audit in the past 12 months, there’s a good chance you have some of the above issues. Most of them are fixable — sometimes in an afternoon, sometimes over several months.

We offer a free audit that covers performance, security, and SEO foundations. No obligation, no sales pitch — just a clear picture of where your site stands.

This website stores cookies on your computer. Cookies Policy