The State of Small Business Websites 2026.

Most homepages make the visitor go looking for a way to ask.

The job of a small business homepage is usually simple: a call, a booking or an enquiry. We checked each homepage for a form a visitor could fill in (not a search box or a newsletter sign-up, and including embedded form and booking tools) and for a phone number that dials when tapped.

61.6% of the 1,003 homepages had no form on the page, and 54.8% had no tap-to-call link. 37.1% had neither. Nearly all of them did link to a contact or booking page somewhere, so the way in existed; it was one or more taps away from where visitors land.

WhatsApp links were rare. Counting them as well, 52.2% of homepages still had no way to call or message the business in one tap.

Phone layouts are mostly solved. Page weight is not.

The good news first: 9.7% of homepages were not set up for phones, meaning they lacked a mobile viewport setting or the page could be scrolled sideways at a 390 pixel screen width. Modern themes and site builders handle this by default, and it shows.

Weight is where phones still pay. The median homepage downloaded 2.27 MB on its first load as a phone, and one in four was over 4.2 MB. 20.5% were over 5 MB and 8.9% over 10 MB. Full-size photos, background videos and stacks of scripts are the usual sources of weight like this. The median homepage made 64 separate requests.

Weight is not speed, but it is the part of speed an owner controls, and it does not depend on our connection. On a weak mobile signal a 5 MB page takes many seconds to arrive.

The real business is often missing from its own website.

Before designing anything, our team writes a short description of each business's current site: what it is built on, how many pages it has, what photos and words it uses. We searched those 1,340 written notes for a few plain things.

35.7% describe stock or stock-looking photography in prominent places (including named libraries such as Unsplash, Pexels, Shutterstock, iStock, Getty and Adobe Stock). 7.8% mention generated images. 15.2% mention placeholder or demo content still live: sample testimonials, "lorem ipsum" text, template demo pages or empty sections.

A smaller group had a problem the owner may not have known about: 9 sites (0.7%) had been hacked or had casino, pharmacy or other spam pages injected into them, and 3 more businesses had let an old domain lapse, after which it was taken over by unrelated spam or gambling pages.

At the same time, 90.6% of all 1,568 businesses had usable photos or films of their own somewhere online, on Instagram, Facebook, YouTube or their Google listing: job photos, short films, the team at work. The gap is rarely what the owner has. It is getting it onto the site.

These counts come from written notes, so they are a floor: a note that does not mention stock photos does not prove the site had none.

One in seven had no website of its own.

228 of the 1,568 businesses (14.5%) had no website of their own. They ran on Instagram, Facebook, a link-in-bio page, a marketplace profile or a directory listing.

Of the 1,251 business domains we tried to open on 1 November 2026, 61 did not load at all (the address no longer existed, refused the connection or returned a server error) and 17 showed a parked, for-sale, suspended or "coming soon" page. That is 7.2% of the domains we could test. 170 more blocked automated visits or failed to load in our browser within 30 seconds, and we left those out of the measurements rather than guess.

WordPress still leads, and the builders follow.

We detected the platform from each homepage's code and the services it loaded. WordPress ran 38.8% of the homepages we measured. Squarespace, Wix and Shopify came next. A large share (32.2%) showed no known platform signature: hand-coded sites, frameworks such as Next.js, and builders that leave no trace.

Our written notes, which also cover sites that did not load on the day, agree: 38.5% of sites were on WordPress, and 23.4% were built with a page builder such as Elementor, Divi or WPBakery.

A ten minute check of your own site.

Open your homepage on your own phone, on mobile data, and go through this list. None of it needs a new website, and every point is something we saw missing on real small business sites this autumn. Our free website grader runs most of these checks for you in about 20 seconds.

How we got these numbers.

Who is in the sample. Small businesses that replied to Astra Labs' outreach about their website between 28 September and 1 November 2026, and whose site we then studied to design a new one. That makes this a sample of businesses open to a new website, not a random sample of all businesses. Few tech companies and web agencies are included, because we rarely design for them. One business counts once: we removed duplicate addresses and second contacts of the same company, leaving 1,568 businesses from 1,579 research files.

The written reviews. For every business our team recorded what the business sells, its market and a description of its current website. Section 3 and the "no website of their own" figure count those descriptions using fixed word lists (for example "stock photos", "stock hero", "Unsplash", "Pexels", where "stock" meaning a default theme or layout does not count; "placeholder", "lorem ipsum", "demo"). The lists are in the published script.

The phone check. On 1 November 2026 we opened each business's homepage once in Google Chrome (headless) set up as a phone: 390 by 844 pixels, touch, an iPhone browser identity, from one server, without speed throttling. We waited for the page to load and then for the network to go quiet (at most 30 seconds). We recorded the data downloaded, the number of requests, the mobile viewport setting, whether the page scrolls sideways, tap-to-call and WhatsApp links, forms (ignoring search boxes and single-field email sign-ups), embedded form and booking tools, the main heading, meta description, structured business data, the footer year and platform signatures. A separate check requested the secure (HTTPS) and plain (HTTP) addresses.

What we left out. 170 domains blocked automated visits or did not finish loading, and we did not count them in the homepage measurements. We excluded the sites of our own paying clients. Down and parked domains are reported separately and are not part of the homepage percentages.

Limits. One visit per site, on one day, from one place. Weight changes with cookie banners, sliders and adverts. Forms on other pages are not counted as homepage forms. Platform detection misses platforms that leave no trace in the page. Country comes from the market described for each business. Small groups (any trade, and countries outside the US and UK) carry wide uncertainty.

Reproducing it. The scripts that join the records, run both checks and compute every figure on this page, with their outputs, are kept by Astra Labs. Journalists and researchers can ask for the aggregate data at hello@astralabs.store. We never publish which business had which result.