We Scanned 10,000 Small Business Websites — 95% Are Too Slow on Mobile

We wanted to know a simple thing: how good — or bad — is the typical small business website, really? So we scanned more than 10,000 of them. Real restaurants, builders, plumbers, hair salons, electricians and hotels. Not a hand-picked sample of good or bad sites — just the everyday websites of ordinary local businesses.

Then we measured two things for each one: how fast it loads (using Google's own PageSpeed engine) and how secure it is (a passive security check of the same things a browser or an attacker can see). Here's what over 10,000 scans told us.

The headline: small business websites are slow on mobile. Really slow.

The single clearest finding: 95% of the sites we scanned scored below Google's "good" speed threshold on mobile.

Across 10,697 mobile scans:

• The median mobile speed score was 60 out of 100. Google considers 90+ "good," 50–89 "needs work," and under 50 "poor."
• 95.6% scored below 90 — the bar Google actually wants you to hit.
• 24% scored below 50 — nearly one in four sites is in the "poor" band.

But the score is abstract. The number that should worry any business owner is this one: the median Largest Contentful Paint on mobile was 8.4 seconds.

Largest Contentful Paint (LCP) is the moment your main content — usually your hero image or headline — actually appears. It's the point where a visitor feels the page has "loaded." Google wants that to happen in under 2.5 seconds. The typical small business site we scanned took more than three times that long, and 96% of sites failed the 2.5-second target.

For context on why that matters so much, more than half of mobile visitors abandon a page that takes over 3 seconds to load. At 8 seconds, most people are gone before they ever see what you offer.

Desktop is much healthier — which is exactly the problem

Here's the twist. On desktop, the same sites looked far better:

• Median desktop speed score: 81 (versus 60 on mobile).
• 70.5% below 90 — still not great, but a world apart from mobile's 95.6%.
• Median desktop LCP was 1.7 seconds — comfortably inside Google's target.

This gap is the real story. Most small business owners check their own website on a laptop, see it load quickly, and assume everything's fine. But most of their customers are on phones, often on slower connections — and that's where the site falls apart. The version of your website that loses you customers is the one you probably never look at.

If you're wondering what the scores actually measure, we break it down in What Is a Good PageSpeed Score? and What Are Core Web Vitals?.

One piece of good news: layout stability

Not everything was bad. Cumulative Layout Shift — the annoying jump where buttons and text move around as a page loads, causing mis-taps — was genuinely fine. The median CLS was near zero on both mobile and desktop, well inside Google's target.

So the problem isn't that small business sites are janky or badly built. It's specifically raw load speed on mobile — almost always caused by oversized images, heavy themes and too much unused code. The kind of thing that's very fixable once you know where to look.

Security: mostly fine on the basics, almost all missing the modern protections

We also ran a passive security check on 10,477 of the sites — looking only at what any visitor's browser can already see (SSL, security headers, cookie settings, HTTPS enforcement, exposed software versions and DNS). No logging in, no probing.

The reassuring part: most small business sites have the fundamentals right.

• 58% earned an A grade, and only 2.7% scored a D or below.
• 93% had a valid, working SSL certificate — the padlock in the browser bar.

So the scaremongering version of this story — "every small business is about to get hacked" — simply isn't true, and we're not going to pretend it is.

But dig one layer down, and there's a consistent pattern: the invisible, modern protections — the ones you never see but that quietly defend your site and your customers — are missing almost everywhere:

• 81% had no Content-Security-Policy — the main defence against injected malicious scripts.
• 76% had no clickjacking protection (X-Frame-Options), which stops your site being loaded inside a scam page to trick your customers.
• 64% had no SPF record, one of the two settings that stop fraudsters sending email that looks like it came from your business.
• 53% didn't tell browsers to always use the secure version of the site (HSTS).
• 34% were leaking the exact version of the software they run on — effectively handing attackers a shortlist of known ways in.
• 8.9% didn't force HTTPS at all — meaning visitors can land on an unencrypted version of the site, where anything they type can be intercepted. That's the one genuinely serious issue, and nearly one in eleven sites had it.

None of these show up when you look at your website. They're not on the page. But they're exactly what a security professional — or an attacker — checks first. If you want to understand them in plain English, here's how to check your website's security, and a full small business security checklist.

What this means if you run a small business website

Three honest takeaways from 10,000+ scans:

1. Check your site on your phone, not your laptop. The desktop version almost certainly looks fine. The mobile version — the one most of your customers use — is where the speed problem hides, and it's costing you visitors before they ever see your offer.
2. Your biggest wins are probably a handful of oversized images and a heavy theme. The data shows the issue is load speed, not bad design. That's usually a short, well-defined fix — not a rebuild.
3. Security-wise, you're likely fine on the basics but missing the invisible protections. Adding security headers and forcing HTTPS often takes minutes, and closes the gaps that put you (and your customers' trust) at risk.

How we did this

For transparency: these numbers come from 10,697 mobile and 10,704 desktop PageSpeed scans, and 10,477 passive security scans, run on the live websites of small local businesses — primarily in the US and Australia — across trades and service industries. Speed data is Google Lighthouse lab data via the PageSpeed engine (mobile results use Google's standard mobile throttling). Security scans are passive: we only observe what any browser can see, and never attempt to log in or probe a site. Every figure above is the real result across the full dataset — no rounding up, no cherry-picking.

See where your own website stands

The averages are one thing. What matters is your site. You can run the exact same checks on your own website in about a minute — free, no signup, no card — and see your real speed and security scores in plain English.