Your Website Looks Good. That's Not the Same as It Working.

Plenty of small businesses have a website they're genuinely happy with. It looks tidy, the photos are decent, the colours are right, and nobody's ever complained about it. And it still isn't bringing in work.

That's the gap worth understanding. Looking good is the part everyone can see and judge, so it's the part that gets all the attention. Almost everything that actually determines whether a website earns its keep sits underneath that, invisible to the person who owns it. Here's what that actually involves.

Short version: how a site looks decides whether someone trusts it once they land on it. Everything else decides whether they ever land on it at all, and whether the business behind it holds up when they start checking.

Being findable comes before anything else

A beautiful website nobody finds is an expensive business card. Search engines need to be able to read and understand your site properly, which means real headings that describe what's on the page, page titles that say what the page actually is rather than "Home" and "Page 2", and text that plainly states what you do and where you do it. A site built entirely out of images and clever design, with very little actual readable text, can look excellent to a visitor and be nearly invisible to Google at the same time.

The practical version for most small businesses: say what you do, say where you do it, and say it in normal words that match what someone would actually type into a search. That's most of it.

Google Search Console tells you what's actually happening

Most business owners have never opened this, and it's free. Google Search Console shows you which pages Google has actually indexed, what searches people are using to find you, which pages get clicked, and whether Google has run into problems reading anything on your site.

Without it, you're guessing. A page can quietly fail to get indexed for months, meaning it simply doesn't exist as far as search is concerned, and nothing about the site looking fine tells you that's happening. Setting it up is a one time job, and even glancing at it once a month tells you more about whether the site is working than any amount of looking at it.

Your Google Business Profile does a lot of the heavy lifting

For local businesses, the profile that appears in Google Maps and the local results often gets seen more than the website itself. Keeping it complete and current, correct hours, real photos, right categories, and making sure the details on it match the website exactly, matters as much as anything on the site. Mismatched phone numbers or business names between the two create doubt about which is right, and that doubt has a real cost.

Trust signals: the things people check without realising

Once someone lands on your site, they're deciding whether you're real and worth contacting. Most of that happens on instinct, but it's driven by specific things: a business email address on your own domain rather than a free personal one, a phone number that actually works, a physical address or at least a clear service area, real photos of real work instead of stock imagery, reviews they can trace back to actual people, and an NZBN or company details somewhere findable.

None of these are design decisions. All of them affect whether someone picks up the phone.

Policy documents aren't just legal box ticking

This is the part most small business websites skip entirely, and it's worth understanding properly.

Under the Privacy Act 2020, New Zealand businesses that collect personal information need to be transparent about how they handle it. That threshold is lower than most people assume. A contact form collecting a name and email address counts. So does an enquiry form, a booking system, a mailing list signup, or analytics that record IP addresses. If your website has a contact form, you're almost certainly collecting personal information.

A privacy policy is the practical way to meet that transparency expectation. There's no single mandatory template under New Zealand law, which is exactly why copying a generic one off the internet is a bad idea. A policy that describes things your business doesn't actually do, or fails to describe things it does, creates a problem rather than solving one. It should reflect what genuinely happens with the information you collect: what you gather, why, where it's stored, who else sees it, and how someone can ask to access or correct it.

It's also worth knowing that some privacy breaches are notifiable under the Act, meaning there are actual obligations if something goes wrong, not just reputational fallout.

Beyond privacy, if you sell anything online, terms and conditions covering payment, delivery, returns, and what happens when something goes wrong protect you as much as the customer. Most people never read them. They matter enormously the one time there's a dispute.

The usual place for all of this is a clear link in the footer, plus a reference wherever you're actually collecting information, like next to a contact form or at checkout.

Security, especially if there's anything behind the scenes

A simple brochure site with no logins and no data storage has a small attack surface. Anything more, an online booking system, a customer login, an online store, a content management system you log into, has a real one.

The basics that genuinely matter: an SSL certificate so the site loads over HTTPS rather than showing a "not secure" warning, which also affects how Google treats it. Software and plugins kept up to date, since most small site compromises come through known vulnerabilities in outdated components rather than anything sophisticated. Strong, unique passwords with two factor authentication on any admin access. Backups that actually exist and have actually been tested, because a backup nobody's ever restored from is a theory rather than a safety net.

If your site takes payments, that's a different level again, and the right answer for most small businesses is using an established payment provider that handles card details on their end, so those details never touch your site at all.

It also has to actually work

Fast loading, usable on a phone with a thumb, forms that genuinely send, links that go somewhere. These are covered in more depth in why is my website slow? how to test and fix it and 5 signs your website is losing you customers, but they belong on this list, because a site can be beautiful, findable, and legally sound while still quietly failing because the contact form has been broken for six months and nobody knew.

Where this leaves you

None of this makes design unimportant. How a site looks is genuinely the first thing that decides whether someone stays or leaves, and that matters. The point is that it's the visible portion of a much larger job, and it's the only portion most business owners are ever in a position to assess.

If you've got a site you like the look of but it isn't bringing in work, the problem is almost always somewhere in the list above rather than in how it looks. Most of it is checkable for free in an afternoon: open Search Console, compare your website against your Google Business Profile line by line, fill in your own contact form, look for a privacy policy and read whether it actually describes your business.

If you'd rather have someone go through it with you, that's a conversation we're happy to have, whether or not it ends with us building anything.