Site Decay
Research · October 2026

State of Small-Business Websites, October 2026

16.6% of the 55,142 local small-business websites we checked live in Atlanta, Dallas–Fort Worth, Miami and San Antonio have a problem their visitors can see: no secure version, no phone layout, a security warning page, or spam from a hack.

Sites checked live55,142
No secure (https) version13.7%
No phone layout5.9%
Contact form not secure4.9%

By city

RegionSites checkedVisible problemNo httpsNo phone layoutForm not secureSecurity warningHacked
Atlanta14,67217.0% 13.8%6.8%4.6%0.7%0.2%
Dallas-Fort Worth20,08416.4% 13.4%5.7%5.0%0.8%0.2%
Miami15,42217.3% 14.4%5.8%5.4%0.7%0.3%
San Antonio4,96414.4% 11.8%5.1%4.2%0.6%0.1%

By trade, across the US

From our crawl of every US business website we can classify by trade: the share showing signs of neglect (a copyright year 6+ years old, or no secure version). These are signs, not live-checked problems, so they run lower than the live figures above.

TradeWebsitesShowing signs
Auto shops36,53511.3%
Dental practices325,44510.7%
Restaurants and bakeries45,85110.3%
Salons149,47810.0%
Childcare centers22,7129.9%
Accounting firms82,1509.9%
Contractors343,5749.8%
Law firms57,0959.4%
Barbershops48,9679.2%
Towing companies36,2589.1%
Roofing companies148,8569.0%
Plumbing companies110,0009.0%
Chiropractors61,7628.7%
Real estate398,3218.4%
Physical therapy clinics16,9058.1%
Landscaping companies75,4128.1%
Electricians30,5897.6%
Florists34,0877.3%
Hvac companies91,2337.2%
Insurance agencies23,3076.4%
Cleaning companies54,8495.5%
Veterinary practices15,6593.8%

How we measured

Our crawler reads small-business websites across the US and places each one by the address or phone number on its own pages. For each region we take the local businesses within about 35 miles of the city center, leaving out chains, institutions, parked and placeholder pages, franchise satellite sites and lead-generation networks.

Every site counted here was checked live in October 2026: one visit to the homepage and one check of its security certificate, the way a browser sees them. Sites that were down or sent visitors to another domain on that visit aren’t counted. “No https” means the homepage loads only over plain http; “no phone layout” means the page has no viewport setting; “contact form not secure” means a form with typing fields on a plain-http page; “security warning” means the site is served over https with an expired, self-signed or wrong certificate; “hacked” means spam words (casino, pharmacy, betting) on an otherwise normal business page.

Figures are rounded to one decimal and refreshed monthly. Questions about the data, or need a different cut (a city, a trade)? Ask us.

Citing this

Site Decay, “State of Small-Business Websites”, October 2026. https://sitedecay.com/report

Own a business?

See what your visitors see. The check-up is free and takes a minute.

Check my site free

Run a web agency?

Get the businesses behind these numbers near you, checked live, with the proof.

Leads for agencies