We crawled 2,828 small business websites. 42.9% of them still had no HTTPS.

Of 2,828 small business websites we crawled across the UK, the Gulf and the US in August 2026, 42.9% still had no HTTPS, meaning Chrome shows a "Not secure" warning before a visitor sees a price.

Only 15.6% passed all eight of our basic checks.

And before any of that: 15.9% of the 3,928 businesses we found on Google Maps had no website listed at all. In the US that rose to one in four.

The numbers below are worth exactly as much as the method behind them, so the method comes first rather than last.

Two different denominators run through this piece and they are not interchangeable, so here is the split before any percentage appears.

By region, the businesses with no website listed at all were 25.4% in the US, 15.6% in the Gulf and 10.5% in the UK. The American figure is the one that surprised us most, and it is the single largest opportunity in the dataset: you cannot improve a website that does not exist.

Every rate below is a share of the 2,828 sites that loaded, in August 2026.

The two at the bottom are the encouraging ones. Almost every site now has a page title and a mobile viewport tag, which were the standard complaints five years ago. That problem largely solved itself, because the platforms people build on started doing it for them.

The two at the top did not. A missing security certificate and a missing social share image are both invisible to the owner and obvious to the visitor: one puts a warning in the address bar, the other turns every link shared on WhatsApp into a grey box.

UK small business sites were the worst for security in our sample: 45.6% had no HTTPS, against 32.2% in the Gulf. But the ordering reverses on search visibility.

The Gulf has the lowest rate of missing HTTPS at 32.2% and the highest rate of missing meta descriptions at 31.2%. The UK is the exact reverse: worst on security at 45.6%, best on meta descriptions at 20.1%.

That is not a rounding artefact, it is a real pattern, and it says something about how the two markets built their websites. It also has a practical edge to it. If you sell website work in Britain, the security warning is the thing to lead with. In the Gulf it is the fact that Google has nothing to quote about the business.

The US sample is the smallest at 305 sites and the worst on almost everything, but treat it carefully: 305 is enough to see a shape and not enough to bet on a decimal place.

These are the same checks, run by hand. None of them need a tool or a consultant.

1. Look at your own address bar on a phone. If it says "Not secure" instead of showing a padlock, you are in the 42.9%. Most hosts now issue a certificate free, and it is usually a setting rather than a project.
2. Paste your homepage address into a WhatsApp message to yourself. If the preview is a grey box with no picture, you have no social share image, and so does 42.5% of this sample. Every link anyone ever shares of your site looks broken.
3. Search Google for your business name and read your own result. If the title is cut off mid-word, it is too long. If the grey description underneath is a scrap of your navigation menu, you have no meta description and Google is guessing.
4. Check your Google Maps listing has your website on it. One in six of the businesses we found had no website linked there at all. If yours exists and is not on the listing, that is a five-minute fix worth more than most redesigns.
5. Open your site on mobile data with the office wifi turned off. This is where an oversized homepage shows up, and 12.4% of the sample had one.
6. Ask whether someone could find your Instagram from your website. Just under a third of these sites had no link to Instagram or TikTok anywhere on the homepage, which usually means the two are being run by different people who do not talk.

We did not set out to write a study. We built a machine for finding businesses that need calling, because that is how a one-person studio finds work without a sales team. It goes through public listings at scale, checks each website for the defects above, and writes one line explaining why that business is worth a conversation now.

The dataset is a by-product of running it. That is the honest account of where these numbers came from, and it seems better to say so than to present the crawl as research that happened for its own sake.

That machine is now sold as a service, pointed at one client's definition of their own customer rather than at a whole market. It is called Fieldwork.