How fast should a small business website load?

A small business website should show its main content within 2.5 seconds, the target Google's web.dev sets for Largest Contentful Paint, which measures when the largest visible part of the page appears. Web.dev suggests measuring at the 75th percentile of page loads, on mobile and desktop separately, so that three out of every four visits meet the target.

What is Interaction to Next Paint?

Interaction to Next Paint is Google's measure of how quickly a page responds when a visitor taps, clicks or types. Web.dev says that to provide a good user experience, pages should have an Interaction to Next Paint of 200 milliseconds or less. It is one of the three Core Web Vitals, beside loading time and visual stability.

Do Core Web Vitals affect Google rankings?

Core Web Vitals do count in Google's rankings, according to Google's page on page experience, which says Core Web Vitals are used by its ranking systems. Google also says there is no single page experience signal: its core ranking systems look at a variety of signals. Google adds that it always tries to show the most relevant content, even when the page experience is poor.

Does a small business website need structured data?

Structured data helps a small business website, because Google says it uses structured data to understand the content of a page. Google recommends the JSON-LD format in most cases. In Licheo's old audit tool, 47 of 66 tested domains had no LocalBusiness structured data; those sites were typed in by visitors and the Licheo team, so they form no random sample.

Which accessibility standard should a small business website follow?

A small business website should follow WCAG 2.2, the latest version of the Web Content Accessibility Guidelines from the W3C. WCAG 2.2 was published on 5 October 2023, with an update on 12 December 2024. The W3C encourages everyone to use the latest version, and says content that meets WCAG 2.2 also meets WCAG 2.1 and WCAG 2.0.

What is HSTS, and does my website need it?

HSTS, short for HTTP Strict Transport Security, is a setting that tells browsers to always open your site through the secure connection. Google's web.dev lists it among the security headers recommended for all websites. In Licheo's old audit tool, 34 of 66 tested domains had no HSTS header, measured on sites that visitors and the Licheo team chose to test.

What does the X-Frame-Options header do?

The X-Frame-Options header tells browsers whether another website may show your page inside its own page. Web.dev says to use it to prevent your documents from being embedded by a malicious website, and recommends it for all documents that are not designed to be embedded. In Licheo's old audit tool, 50 of 66 tested domains lacked this header.

How often do small business websites miss security headers?

In Licheo's old audit tool, every one of 66 tested domains, 66 of 66, had at least one security finding. The most common gaps were a missing Permissions-Policy header on 61 domains and a missing Referrer-Policy header on 58. The sites were typed in by visitors and the Licheo team, the audit read at most 20 pages per site, and the group is no random sample.

Five website features big companies have, and how a small business site can have them

A big company's website has a team behind it. The Bureau of Labor Statistics reports that the median annual wage for web developers in the United States was $92,650 in May 2025, and on a large site the developers work next to designers, writers and analysts. With that team comes a list of features that sit behind the visible page.

Here is the good news, and it is the reason for this article. The standards those teams follow are public. Google publishes them on web.dev and in its Search documentation. The W3C, the body that develops web standards, publishes the accessibility guidelines. Anyone can read them for free, and a small business site can meet every one of them.

Let us go through five features, one by one: the public standard, what it means in plain words, and what Licheo's own audit tool found when people tested their sites.

What are the five features, and where is each standard written?

| Feature | What it does for your visitor | The public standard | A free way to check | |---|---|---|---| | Fast, stable pages | The page appears fast, responds to taps and stays still while it loads | Core Web Vitals on web.dev: 2.5 seconds, 200 milliseconds, 0.1 | Chrome Lighthouse | | Labels for search engines (structured data) | Google understands what the page is about: a business, an address, opening hours | Google Search Central, with JSON-LD recommended | Google's Rich Results Test | | Access for everyone | People with disabilities can read and use the site | WCAG 2.2 from the W3C | A review against WCAG | | Security settings | The connection is secure and other sites cannot misuse the page | HTTPS, and the security headers listed on web.dev | Search Console's HTTPS report | | Honest measurement | You know how people find the site and what they do there | Google Search Console and Google Analytics, both free | The reports themselves |

A word on our own data

Several figures below come from Licheo's old SEO audit tool, retired on 1 September 2026. It completed 102 audits of 66 distinct domains between 30 December 2025 and 27 August 2026 (Pacific time). Three caveats matter, and we state them plainly. The websites are whatever visitors, and the Licheo team when testing, typed into the tool, so they form no random sample of small businesses, and some of them are no small business at all. The audit read at most 20 pages per site. And the figures describe 66 domains, nothing more.

With that said, the pattern is useful, because it shows which standards are easy to miss.

How fast should the pages be?

Google's web.dev names three Core Web Vitals, and gives a target for each:

Loading: Largest Contentful Paint, the moment the largest visible part of the page appears, "should occur within 2.5 seconds of when the page first starts loading."
Response: Interaction to Next Paint, the delay between a tap or click and the page's reaction. Pages "should have a INP of 200 milliseconds or less."
Stability: Cumulative Layout Shift, a score for how much the page jumps while it loads. Pages "should maintain a CLS of 0.1. or less."

Web.dev adds how to measure: "a good threshold to measure is the 75th percentile of page loads, segmented across mobile and desktop devices." In plain words, three out of every four visits should meet the target, on phones and on computers separately.

Does speed matter for Google? Google's page on page experience says: "Core Web Vitals are used by our ranking systems." The same page is careful to add that "There is no single signal", because its core ranking systems look at many signals together. Google also writes that it always tries to show the most relevant content, even when the page experience is poor. Speed helps, then, and it helps visitors first.

In our old audit tool, 59 of the 66 domains had at least one performance finding. Our post on website speed to a big-company standard goes deeper.

What are the labels that help search engines read a page?

Structured data is a short block of labels, invisible to visitors, that tells search engines what each part of a page means: this is the business name, this is the address, these are the opening hours. Google explains that it "uses structured data that it finds on the web to understand the content of the page". It supports three formats and says JSON-LD is the easiest to implement and maintain "in most cases". Its Rich Results Test checks whether the labels are valid.

Two figures from our audit tool: 47 of the 66 domains had no LocalBusiness structured data, the label type that describes a local business, and 19 had no Organization structured data, which describes the company itself.

One honest note on AI search. Google says that to appear in AI Overviews and AI Mode, "There's also no special schema.org structured data that you need to add." Structured data helps Google understand your page in ordinary search; the AI features need no extra, special kind.

What does access for everyone mean?

Accessibility means that people with disabilities can use the site: people who use a screen reader, who cannot use a mouse, who see colours differently. The standard is the Web Content Accessibility Guidelines, known as WCAG, developed through the W3C process "with a goal of providing a single shared standard for web content accessibility."

The current version is WCAG 2.2. The W3C writes that "WCAG 2.2 was published on 5 October 2023, and an update was published on 12 December 2024", and that it "encourages you to use the latest version of WCAG." A useful detail for owners: "Content that meets WCAG 2.2 also meets WCAG 2.1 and WCAG 2.0."

In our old audit tool, 52 of the 66 domains had at least one accessibility finding. A small business can make it part of the site from the start. Our post on website accessibility to a big-company standard explains the practical steps.

Which security settings does a website need?

The first setting is the secure connection, HTTPS, the padlock beside the address. Google lists it among the parts of a good page experience and offers "Search Console's HTTPS report" to "check if you're serving secure HTTPS pages and what to fix".

The second group is less visible. Security headers are short instructions that a website sends to the browser together with each page, telling the browser how to protect the visitor. Google's web.dev keeps a quick reference, and it lists these headers as "recommended for all websites": X-Content-Type-Options, X-Frame-Options, Cross-Origin Resource Policy, Cross-Origin Opener Policy and HTTP Strict Transport Security (HSTS). Two of them, in plain words:

HSTS "informs the browser that it should never load the site using HTTP and use HTTPS instead." Every visit uses the secure connection.
X-Frame-Options stops another website from showing your page inside its own page. Web.dev says to use it "to prevent your documents from being embedded by a malicious website."

Web.dev recommends a third header, Content Security Policy, "for websites that handle sensitive user data", such as sites with logins or payments. It limits "which scripts can be executed by the page", which means which small programs are allowed to run on it.

Security is the area where our old audit tool found gaps on the largest share of domains: every one of the 66 had at least one security finding.

| Security header missing | Domains in Licheo's old audit (of 66) | What web.dev says | |---|---|---| | Permissions-Policy | 61 | Our audit's own check, outside web.dev's list for all websites | | Referrer-Policy | 58 | Our audit's own check, outside web.dev's list for all websites | | Content-Security-Policy | 54 | Recommended for websites that handle sensitive user data | | X-Frame-Options | 50 | Recommended for all websites | | HSTS | 34 | Recommended for all websites |

Read the table with the caveats above in mind: 66 domains, chosen by the people who tested them, at most 20 pages read per site. And notice that the two most common gaps are headers that web.dev's quick reference leaves out of its list for all websites. The headers web.dev recommends for everyone, X-Frame-Options and HSTS, were missing on 50 and 34 domains. These settings are added once, in the settings of the hosting or of the website, and a developer or the hosting company can add them.

How do big companies measure their websites?

The last feature is measurement. A big company measures how people find its site and what they do there. A small business can know the same, for free: Google Search Console is "a free service offered by Google", and Google Analytics gives its tools "free of charge". Google "strongly" encourages every owner to use Search Console, because its data comes "directly from Google Search itself." Visits from Google's AI Overviews and AI Mode are counted there too, under the "Web" search type. We describe the free tools one by one in the free tools.

How can a small business site have all five?

In the end, most of this work is done once, at the start, and then checked from time to time. A big company pays a team for it, as our page on what big companies pay for shows line by line. A small business can do it with a careful developer, with a patient afternoon and the free tools, or with a service.

Licheo offers the website, search and AI work that big companies pay whole teams for, done for your small business. Its agents build the website and make it findable on Google and in AI assistants, and nothing goes live until you approve it. You can read what the agents do, and what they leave to people, in what AI agents do, and the idea behind all of this in how big-company marketing became possible for small businesses.

To start, run the free Get Found Check. It reads your homepage, your domain records and your security certificate, and returns a grade in under 60 seconds. For honesty, here is how those grades have fallen so far: across the latest grade for each of 215 domains checked between 31 March and 24 September 2026 (Pacific time), 13 received an A, 30 a B, 46 a C, 55 a D and 71 an F. The same caveat applies: these are the sites people chose to check, and some belong to larger companies.

Sources

Web Developers and Digital Designers, Occupational Outlook Handbook, U.S. Bureau of Labor Statistics, Last modified 27 August 2026, accessed 27 September 2026.
Web Vitals, web.dev (Google), Published 4 May 2020, last updated 31 October 2024, accessed 27 September 2026.
Understanding page experience in Google Search results, Google Search Central, Last updated 22 September 2026, accessed 27 September 2026.
Intro to how structured data markup works, Google Search Central, Last updated 10 December 2025, accessed 27 September 2026.
AI features and your website, Google Search Central, Last updated 10 December 2025, accessed 27 September 2026.
WCAG 2 Overview, W3C Web Accessibility Initiative, Updated 17 September 2026, accessed 27 September 2026.
Security headers quick reference, web.dev (Google), Last updated 18 May 2021, accessed 27 September 2026.
About Search Console, Search Console Help, Google, accessed 27 September 2026.
Google Analytics, Google Marketing Platform, Google, accessed 27 September 2026.
Google Search's guidance on using third-party SEO tools, services, and advice, Google Search Central, Last updated 5 June 2026, accessed 27 September 2026.
Licheo audit tool data (retired SEO audit, 102 completed audits of 66 domains, 30 December 2025 to 27 August 2026 PT) and Get Found Check data (216 checks of 215 domains, 31 March to 24 September 2026 PT), queried read-only from Licheo's production database on 27 September 2026.