The Complete Custom Website Checklist: Business, Corporate & Local Service Websites (SEO + Security)

Business and corporate sites — agencies, local service providers, professional firms, portfolios — get built custom more often than any other category, and precisely because there's no off-the-shelf template enforcing best practice, they're where fundamentals get skipped most often. This checklist covers the full scope for a general business website, including the local and lead-generation considerations that apply to most sites in this category.

Pre-Launch Technical Foundations

[ ] XML sitemap is generated, accurate, and submitted to Search Console
[ ] Robots.txt is correctly configured and isn't blocking pages that should be indexed
[ ] Canonical tags are correctly set on every page
[ ] HTTPS is enforced site-wide with a valid, current certificate
[ ] URL structure is clean and descriptive across service, location, and informational pages
[ ] 404 handling returns a genuine 404 status with a helpful, on-brand error page
[ ] Staging environments are noindexed and not accidentally left publicly accessible after launch

> Tool tip: Run the SEO Audit tool before launch to catch foundational issues while a fix is still simple and inexpensive.

On-Page SEO Essentials

[ ] Every page has a unique title tag and meta description, including deep service and location pages
[ ] Exactly one H1 per page, reflecting the actual page topic
[ ] Dedicated pages exist for each core service, rather than one generic "services" page covering everything
[ ] Internal linking connects related service, location, and content pages deliberately
[ ] Homepage clearly and immediately communicates what the business does and for whom

> Tool tip: Check your titles and descriptions with the Meta Tags Analyzer across your service pages specifically, since these are commonly left with generic, templated metadata.

Local SEO (If the Business Serves a Local or Regional Market)

[ ] Google Business Profile is claimed, fully completed, and actively maintained
[ ] Business name, address, and phone number (NAP) are identical across the website, Business Profile, and any directory listings
[ ] LocalBusiness structured data is implemented and accurate
[ ] Dedicated, genuinely distinct location pages exist for each served area, not a templated city-name swap
[ ] Contact information is easy to find and consistent on every page, not just a single contact page

Trust, Credibility & Conversion Elements

[ ] Genuine client testimonials or case studies are present, with real names or companies where permission allows
[ ] Team or about page includes real photos and credentials, not generic stock imagery alone
[ ] Portfolio or work samples are specific and detailed, not vague generic descriptions
[ ] Clear calls to action are present on every key page, not just the homepage
[ ] Contact and quote-request forms are short, clear, and genuinely easy to complete

Content & Blog (If Present)

[ ] Blog or resources section targets genuine, researched keyword opportunities relevant to the business
[ ] Content connects clearly back to relevant service pages through internal linking
[ ] Author or publisher information is present for credibility
[ ] Content is reviewed and refreshed periodically rather than published once and abandoned

Security Essentials

[ ] CMS, plugins, themes, and any custom code are kept current with security patches
[ ] Admin accounts use strong, unique credentials with two-factor authentication
[ ] Login attempts are rate-limited against brute-force attacks
[ ] Automated, tested backups run regularly and are stored securely off-server
[ ] Security headers are configured: Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options
[ ] Unused plugins, forms, or old landing pages are removed rather than left dormant and unpatched
[ ] File and directory permissions follow least-privilege principles

> Tool tip: Run a Google Malware Checker and Blacklist Lookup scan periodically — a compromised business site can quietly damage both search visibility and client trust before anyone notices.

Form & Lead Protection

[ ] Contact and quote-request forms are protected against automated spam submissions
[ ] Form submissions are routed reliably, with a tested fallback if the primary notification method fails
[ ] Submitted lead data is stored and transmitted securely, not passed or stored in plain text unnecessarily
[ ] Email addresses displayed on the site are protected against basic scraping where feasible

Privacy, Legal & Accessibility

[ ] Privacy policy is published and accurately reflects actual data collection, including any forms and analytics
[ ] Cookie consent is implemented where legally required for your audience's location
[ ] Terms of service or terms of use are published where relevant to the business's offerings
[ ] Basic accessibility standards are met: sufficient color contrast, keyboard navigability, descriptive alt text, accessible form labels
[ ] An accessibility statement is published if the business has made specific accessibility commitments

DNS, Domain & Infrastructure

[ ] Domain registration is current and set to auto-renew, with correct, up-to-date ownership contact information
[ ] DNS records are documented and don't rely solely on one person's institutional memory
[ ] Email authentication (SPF, DKIM, DMARC) is correctly configured if the domain sends any business email
[ ] Hosting provider and server configuration are documented for continuity if the original developer becomes unavailable

> Tool tip: Use Find DNS Records and the Whois Checker to confirm your domain and DNS setup is accurate and current, especially after any hosting or provider change.

Performance

[ ] Page load speed is tested on both mobile and desktop
[ ] Core Web Vitals are within acceptable thresholds across key page templates
[ ] Images are compressed and appropriately sized rather than served at full original resolution
[ ] Third-party embeds (chat widgets, booking tools, video embeds) are audited for their actual performance cost

> Tool tip: Check both the Page Speed Checker and Pagespeed Insights Checker on your homepage and your most important service or landing pages specifically.

Analytics & Tracking

[ ] Analytics tracking is installed and verified as actually firing correctly
[ ] Search Console is verified with an accurate sitemap submitted
[ ] Form submissions, phone clicks, and quote requests are tracked as defined conversions
[ ] Google Business Profile insights are reviewed alongside website analytics, not in isolation

Post-Launch Monitoring & Maintenance

[ ] A recurring schedule exists for checking Search Console for indexing or manual action issues
[ ] Broken link checks run on a regular cadence as pages are added, changed, or removed
[ ] NAP consistency across the web is periodically re-verified, since directory listings drift out of sync over time
[ ] Old campaign landing pages are reviewed periodically and either updated, redirected, or removed

Next step: Run the SEO Audit tool as part of a regular maintenance routine, not just at launch — business sites are often updated by multiple people over time, and a periodic audit catches drift before it quietly costs you leads.