A correction. An earlier version of this post said it was based on 10,000 audits. That was wrong, and we apologise for it. This version uses only the 102 completed audits and the 216 checks our tools have on record, and every number below comes from them.
We build websites for small businesses and make them easier to find on Google, on Bing and in AI assistants. When we went back through everything our tools had recorded, the truth is that the most common problems were small ones: settings and short blocks of text that nobody on a busy small team has the time to look for. A large company has a web team to check these things every month. A small business has the owner, and the owner has customers to serve.
Let us start with how the numbers were collected, because that decides how far you can trust them.
How we got these numbers
The data comes from two Licheo tools. We queried both from our own database on 27 September 2026, reading only, and every date below is in Pacific time.
The old SEO audit. Between 30 December 2025 and 27 August 2026, our audit tool was started 132 times. 102 of those audits finished, and 30 never finished, so we left those 30 out. They cover 66 different websites, because some sites were audited more than once. For each site, the audit read up to 20 pages (the median audit read 20 pages, the average 14.4) and looked at the instructions the server sends with each page, the business details in the page code, images, links, display on phones, and more. We retired this tool on 1 September 2026. When we say "61 of the 66 websites", we mean the problem appeared in at least one audit of that website.
The Get Found Check. Our free tool, the Get Found Check, reads a website's homepage, its DNS records (the public settings that tell the internet where the website and its email live) and its security certificate (the file that lets a browser open a secure connection to the site). Gemini, Google's AI model, reads all of this and gives a letter grade. Between 31 March and 24 September 2026, it ran 216 times on 215 different websites. For the grades below, we use the latest grade of each website.
Please read these limits before you use any figure:
- Visitors and our own team chose which websites to check, by typing them into the tools. The group is therefore not a random sample of small businesses, and not every website in it belongs to a small business.
- The old audit read at most 20 pages per site. On a larger site, problems on pages the audit did not read went unseen.
- Two AI-readiness checks (one for whether AI crawlers can read the site, one for business details written for AI systems) were added to the audit later, so they ran on 27 audits only. We do not report them here.
- Every figure describes these 66 and 215 websites, and only those.
What did the audits find most often?
Across the 102 completed audits, the tool recorded 7,574 findings: 1,151 marked critical, 2,327 high, 2,636 medium and 1,460 low. The median audit score was 12 out of 100, and the average was 26.0. Every one of the 66 websites had at least one finding in the security group.
The table lists the problems found on the most websites.
| What the audit looked for | Websites where it was missing | Share of the 66 | |---|---|---| | Permissions-Policy header (which browser features a page may use) | 61 | 92.4% | | Referrer-Policy header (what the next site learns about your page) | 58 | 87.9% | | IndexNow (telling search engines at once about page changes) | 57 | 86.4% | | Content-Security-Policy header (which sources a page may load files from) | 54 | 81.8% | | X-Frame-Options header (whether other sites may show your page inside theirs) | 50 | 75.8% | | Bing Webmaster Tools verification | 50 | 75.8% | | A Google map on the site | 48 | 72.7% | | LocalBusiness structured data (business details for search engines) | 47 | 71.2% | | A reviews or testimonials section | 34 | 51.5% | | Strict-Transport-Security header (always use the secure version) | 34 | 51.5% | | A favicon (the small icon of the site) | 31 | 47.0% | | Business name, address and phone number | 25 | 37.9% | | Organization structured data | 19 | 28.8% |
Why were security settings missing on almost every site?
When a browser asks for a page, the server sends back the page with a few short instructions for the browser, called response headers. Five of them protect the visitor. Here is what each does, based on MDN, Mozilla's reference for web developers:
- Permissions-Policy allows or denies the use of browser features, such as the camera, the microphone or the visitor's location, on the page. Missing on 61.
- Referrer-Policy controls how much information about the page the browser passes on when a visitor follows a link to another site. Missing on 58.
- Content-Security-Policy lets the site owner control which files the browser may load for a page, and MDN says this helps guard against cross-site scripting, where someone slips harmful code into a page. Missing on 54.
- X-Frame-Options tells the browser whether other sites may show your page inside a frame on their own page. MDN says sites use it to avoid clickjacking, a trick where the visitor clicks something hidden. Missing on 50.
- Strict-Transport-Security (often shortened to HSTS) tells the browser to always use the secure https version of the site, and stops the visitor from clicking past a certificate error. Missing on 34.
A missing header is a security and trust matter, because it leaves your visitors with less protection. Is it also a ranking matter? Google's guide to page experience, last updated 22 September 2026, asks whether pages have good Core Web Vitals (Google's measures of how a page loads and responds), whether they are served securely, whether they display well on mobile devices, and whether they avoid distracting ads and intrusive pop-ups. None of these five headers appears on that page.
What to do: ask whoever hosts or builds your website to add the five headers. Test the site afterwards, because Content-Security-Policy decides which files the browser may load, and a policy that forgets one of your own sources will stop that file from loading.
Is your website set up for Bing?
Bing Webmaster Tools is Microsoft's free service for website owners. Before you can use it for a site, you prove the site is yours, and this step is called verification. On 50 of the 66 websites, the audit found no sign of it.
If your site is already in Google Search Console, Bing lets you import it, and Bing's own blog says the imported sites "will be automatically verified". Our guide to the free tools from Google and Bing explains what each one shows you and how to set it up.
Do search engines hear about your new pages?
You add a page for a new service. How does a search engine learn it exists? IndexNow lets your website tell search engines at once. In the words of IndexNow.org, it is "an easy way for websites owners to instantly inform search engines" about changes to their content.
The search engines taking part are Microsoft Bing, Naver, Seznam.cz, Yandex and Yep, and they agree to share every submitted address with each other. Google does not appear in that list. On 57 of the 66 websites, the audit found no IndexNow setup.
What to do: your developer creates a key (8 to 128 letters, numbers or dashes), places it in a text file at the top level of the website, and sets the site to send the address of each new or changed page.
Can search engines read your business details?
A person reads your contact page and understands that you are a bakery on Main Street, open from eight. For a search engine, the same facts can also be written in a fixed format it reads without guessing: a short block of code, invisible to visitors, called structured data. Two kinds are relevant here:
- LocalBusiness structured data. Google says it lets you "tell Google about business hours, different departments within a business, reviews" and more. Google requires two properties: the name of the business and its address. On 47 of the 66 websites, it was missing.
- Organization structured data. Google says that adding it to your home page "can help Google better understand your organization's administrative details and disambiguate your organization in search results", which means telling your business apart from others with a similar name. On 19 of the 66 websites, it was missing.
What to do: add LocalBusiness structured data with your name, address, phone number and opening hours, and Organization structured data on the home page.
Are your name, address and phone number on the site?
On 25 of the 66 websites, the audit found no business name, address and phone number on the pages it read. A customer who wants to call or visit needs these three facts in plain text, on every page. Google's LocalBusiness documentation calls the phone number "the primary contact method for customers".
What to do: write them the same way on the site and in your Google Business Profile, so a customer sees the same details in both places. For other tasks an owner can do alone, see what you can do yourself.
Do visitors see what your customers say?
On 34 of the 66 websites, the audit found no reviews or testimonials section. Two different things need to be kept apart. Reviews on Google itself matter for local search. Google's help page for business owners says local results "are mainly based on relevance, distance, and popularity", and adds: "More reviews and positive ratings can help your business's local ranking."
Reviews on your own website serve your visitors. Google's review snippet guide says that when a business controls the reviews about itself, its pages with LocalBusiness or Organization structured data are "ineligible for star review feature".
What to do: ask happy customers to leave a review on Google, and show real reviews on your site, with the customer's permission.
Does your site have its own small icon?
A favicon is the small square picture that stands for your website. Google says that "if your site has a favicon, it can be included in Google Search results for your site", and it recommends a square image larger than 48 by 48 pixels. On 31 of the 66 websites, the audit found no favicon.
What to do: make a square version of your logo and ask your developer to add it to the home page with the link tag Google describes.
How did websites grade in the Get Found Check?
The Get Found Check gives one letter grade after reading the homepage, the DNS records and the security certificate. Here is the latest grade of each of the 215 websites checked between 31 March and 24 September 2026.
| Grade | Websites | Share of 215 | |---|---|---| | A | 13 | 6.0% | | B | 30 | 14.0% | | C | 46 | 21.4% | | D | 55 | 25.6% | | F | 71 | 33.0% | | Total | 215 | 100.0% |
F was the most common grade. Together, 126 of the 215 websites (58.6 percent) received a D or an F, while 43 (20.0 percent) received an A or a B. The check reads one page and the public settings behind it, so the grade is a place to start.
What should a small business do first?
In the end, almost every gap here is a setting or a short block of text. Here is the order we would follow:
- Put your name, address and phone number in plain text on every page.
- Add LocalBusiness and Organization structured data.
- Verify the site in Bing Webmaster Tools, by importing it from Google Search Console if you use it.
- Ask your host to add the five security headers, then test the site.
- Set up IndexNow and add a favicon.
- Ask customers for Google reviews, and show real ones on your site.
After that, check your results yourself each month. Our guide to small business SEO explains the wider work, and our post on website maintenance the way large companies do it covers the monthly checks.
This routine checking is what a large company's web team does, and what Licheo does: the website, search and AI work that big companies pay whole teams for, done for your small business. Our AI agents do the work every month, and nothing goes live until you approve it. Read more about what this work costs a big company, and how a small business can now have it done, or run the free Get Found Check on your own site and see your grade in under 60 seconds.
Sources
- Licheo production database, audit and Get Found Check records, Licheo, queried read-only 27 September 2026 (dates in Pacific time).
- Understanding page experience in Google Search results, Google Search Central, last updated 22 September 2026, accessed 27 September 2026.
- Local business (LocalBusiness) structured data, Google Search Central, last updated 8 September 2026, accessed 27 September 2026.
- Organization (Organization) structured data, Google Search Central, last updated 8 September 2026, accessed 27 September 2026.
- Review snippet (Review, AggregateRating) structured data, Google Search Central, last updated 8 September 2026, accessed 27 September 2026.
- Define a favicon to show in search results, Google Search Central, last updated 28 August 2026, accessed 27 September 2026.
- Tips to improve your local ranking on Google, Google Business Profile Help, accessed 27 September 2026.
- Easily Verify Your Site in Bing Webmaster Tools by Importing from Google Search Console, Microsoft Bing Webmaster Blog, published 13 September 2019, updated June 2025, accessed 27 September 2026.
- IndexNow.org, IndexNow, accessed 27 September 2026.
- IndexNow documentation, IndexNow, accessed 27 September 2026.
- Permissions-Policy header, MDN Web Docs, Mozilla, accessed 27 September 2026.
- Referrer-Policy header, MDN Web Docs, Mozilla, accessed 27 September 2026.
- Content-Security-Policy (CSP) header, MDN Web Docs, Mozilla, accessed 27 September 2026.
- X-Frame-Options header, MDN Web Docs, Mozilla, accessed 27 September 2026.
- Strict-Transport-Security header, MDN Web Docs, Mozilla, accessed 27 September 2026.