Web development best practices: a checklist for a growing business

As a business grows, its website stops being a brochure. It becomes a sales channel, a support tool and often part of the product. The practices that matter most are not exotic: fast pages, sound SEO basics, sensible security, reliable hosting and analytics that measure real conversions. This checklist covers each one in a sensible order to check them.

Performance

Speed affects both conversions and search. Google's Core Web Vitals set three targets for a good page experience, measured at the 75th percentile of page loads:

• Largest Contentful Paint (LCP): the main content appears within 2.5 seconds.
• Interaction to Next Paint (INP): the page responds to taps, clicks and key presses within 200 milliseconds.
• Cumulative Layout Shift (CLS): a score of 0.1 or less, so content doesn't jump around while it loads.

Practical ways to meet them:

• Serve images in modern formats such as WebP or AVIF, sized for the screen, and lazy-load anything below the fold.
• Ship less JavaScript. Remove unused libraries and third-party tags that nobody checks any more.
• Reserve space for images, embeds and banners so the layout doesn't shift.
• Put static files on a CDN and set long cache headers on versioned files.
• Measure with field data from real visitors, not only lab tests on a fast laptop.

Speed can change what a site is able to do. For a hospitality group selling conference and wedding venues, we built browser-based 3D venue tours that load in under 2 seconds with no app to download. Event planners could inspect venues remotely, and the group saw a 25% conversion lift and 60% lower visit costs.

SEO basics

Google uses the mobile version of a site's content for indexing and ranking, so the mobile experience is the one that counts. Beyond that, get the basics right:

• A unique, descriptive title and meta description on every page.
• One clear main heading per page, and subheadings that describe the content below them.
• Short, readable URLs that stay stable. When one has to change, add a permanent 301 redirect from the old address.
• An XML sitemap submitted in Google Search Console, and a robots.txt file that doesn't block important pages.
• Server-rendered or pre-rendered HTML for content pages, so crawlers can read the content without running scripts first.
• Structured data for your organisation, articles, products or FAQs where it applies.
• Internal links between related pages, with link text that says where the link goes.

A redesign is a common point where search traffic is lost. Before launch, map every old URL to its new one, and test the redirects on the day you go live.

Accessibility

An accessible site works for more of your customers, including people who use screen readers or navigate by keyboard. Use real buttons and links, label every form field, add text alternatives to meaningful images, keep colour contrast readable, and check that every action works without a mouse. Try the main pages with a screen reader at least once before launch.

Security

The OWASP Top 10 is a standard awareness document that lists the most critical security risks to web applications, and it makes a good checklist for any team. For most business sites, the essentials are:

• HTTPS on every page, with HSTS turned on.
• The CMS, plugins and libraries kept up to date, with alerts for known vulnerabilities.
• Multi-factor authentication on every admin account, and no shared logins.
• Rate limits and spam protection on sign-in and contact forms.
• Secrets such as API keys kept out of the code repository.
• Least-privilege access, so people and services only get the permissions they need.
• Personal data collected only when needed, stored securely and covered by a clear privacy policy.

Hosting and operations

• Choose managed hosting or a cloud platform your team can actually run. Simple and well understood beats clever.
• Keep a staging environment that matches production, and deploy through an automated pipeline rather than by hand.
• Back up the database and uploaded files automatically, keep copies in a separate location, and test a restore.
• Monitor uptime and errors, with alerts going to someone who can act on them.
• Know your traffic peaks, such as campaigns, launches or seasonal sales, and load test before them.

Analytics

Page views tell you very little. Decide what a conversion means for your business, then track it properly:

• Define your main actions: an enquiry, a demo request, a sign-up or a purchase.
• Track each one as an event, together with where the visit came from, so you know which channels bring customers and not just visitors.
• Follow the consent rules for cookies and tracking in the countries you sell to.
• Build one simple dashboard for leadership and review it monthly.
• Use the numbers to choose what to improve next, starting with pages that get traffic but don't convert.

When a website becomes a web app

Customer portals, booking flows and dashboards need everything above, plus user accounts and permissions, an API, automated tests and a plan for growth. At that point the practices in our post on scalable software development matter as much as page speed. If most of your users are on phones, a progressive web app can give them an app-like experience without an app store.

Where to start

Run your five most visited pages through PageSpeed Insights and note their Core Web Vitals. Check Search Console for indexing errors. Confirm that backups run and that someone has tested a restore. Then check that your main conversion is tracked as an event. Those four checks usually show where to spend effort first, and our web and mobile team can go through the results with you.