Learn, free

Know what you are paying for

Short guides for any business owner, before you hire anyone, including us.

Phase 1

Plan and own the foundations

Step 1

Written scope

Every page and deliverable listed and signed before design.

The scope is the written list of everything your website will include: every page, what goes on each one, who provides the text and photos, the features (forms, booking, languages) and the dates.

Why it matters: without it, "a website" can mean five pages to you and one page to the developer. Anything not on the list becomes an extra cost or a missed promise.

Good to know
  • A good scope names each page, for example Home, Services, About, Contact, Privacy.
  • It says who writes the text and who takes the photos.
  • It lists what is not included, so there are no surprises.
  • It includes the price, payment milestones and what "finished" means.
Ask your developer

Can I see and sign the list of pages and deliverables before we start?

Step 2

Domain

Rented, not bought. Registered in your own account.

Your domain is your address on the internet, like yourbusiness.com. You never buy it forever. You rent it for one to ten years at a time from a company called a registrar, and you must renew it.

Own it yourself. Your domain is property of your business. Register it in your own account, with your email and your card. If a developer or someone else registers it for you, it legally sits in their account. If it expires, anyone can buy it, and some people buy expired names to resell them or to point them somewhere else.

You may not know it yet. If you plan a business, buy the name now, even before you have a website. Names get taken every day.

Good to know

Well known registrars (we are not paid by any of them):

  • Cloudflare Registrar: sells domains at cost, with no markup. Uses Cloudflare's own DNS.
  • Porkbun: free privacy, SSL and email forwarding on every domain.
  • Namecheap: one of the largest selections of endings like .com, .co and .io.
  • Spaceship: simple, modern dashboard with low prices on major endings.
  • NameSilo: steady renewal prices and free privacy.
  • Dynadot: very wide catalog, popular with domain investors.
  • GoDaddy: the largest registrar, with 24/7 phone support.
  • Squarespace Domains: took over Google Domains customers.
  • Hostinger: often includes a free first year domain with hosting.

Before you buy:

  • Check the renewal price, not only the first year price. Many are cheap the first year and expensive after.
  • Turn on auto renewal, transfer lock and two step verification.
  • Turn on privacy so your personal address is not public.
  • Also buy common versions of your name if they matter, like .com and your country ending.

Registrar notes based on Instant Domain Search, 2026 and Cloudflare. Prices and features change, so confirm on each site.

Step 3

Business email

On your domain, with SPF, DKIM and DMARC so mail avoids spam.

A business email uses your own domain, like you@yourbusiness.com, instead of a free Gmail or Hotmail address. It looks professional and stays with the business.

How it connects to your domain: your domain has settings called DNS records. One of them, the MX record, tells the internet which email service receives your mail, for example Google Workspace, Microsoft 365 or your hosting company.

Good to know
  • MX record: where your email is delivered.
  • SPF: the list of services allowed to send email as your domain.
  • DKIM: a digital signature that proves an email really came from you.
  • DMARC: tells other email providers what to do with fake emails pretending to be you.
  • Without these three, your quotes and confirmations can land in spam. You can check them for free at mxtoolbox.com.
Ask your developer

Where does my email live, am I the administrator, and are SPF, DKIM and DMARC set up?

Step 4

Hosting

Fast, backed up off the server, with your own access.

Hosting is the computer (called a server) where your website files live, connected to the internet day and night. When someone types your domain, the domain points to your hosting, and the server sends your pages to their phone.

What good hosting does: stays online, loads fast, renews the security padlock by itself, and makes automatic backups stored somewhere else.

Good to know
  • Shared hosting: many websites on one server. Low cost, fine for most small businesses.
  • VPS or cloud: your own slice of a server. More power and control.
  • Builder hosting: Wix and Squarespace include hosting, but your site cannot leave their servers.
  • A backup kept on the same server is not a real backup. If the server fails, both are lost.
Ask your developer

Do I have my own login, what country is the server in, where are the backups, and when was a restore last tested?

Phase 2

Design, write and build

Step 5

Design

Order, not decoration. The phone screen comes first.

Good design is about order: what a visitor sees first, second and third. On a phone, before scrolling, they should see who you are, what you offer, why to trust you, a button to contact or book, and where you work.

Why phone first: most visitors arrive on a phone, often on a slow connection. A design that looks great on a big screen can be confusing on a small one.

Good to know
  • Two fonts at most, one set of colors, consistent spacing.
  • Buttons big enough for a thumb, at least 44 pixels.
  • Real photos, not generic stock photos.
  • Text dark enough to read in sunlight.
  • One main action on each page.
Ask your developer

Show me on a real phone what a visitor sees before scrolling.

Step 6

Content and photos

One real page per service, approved by you, photos licensed to you.

Content is the words, photos and videos on your site. It is what convinces people and what Google reads to decide when to show you.

One page per service: a page only about "teeth whitening" or "airport transfers" can be found by people searching exactly that. A single page listing everything rarely ranks for anything.

Good to know
  • Nothing should be published with your name on it until you approve it in writing.
  • Photos need a written license that lets you use them forever. Copying photos from Google can bring legal claims.
  • People in photos should give written permission.
  • Write in the words your clients use, not industry jargon.
Ask your developer

Who writes each page, who approves it, and who owns the photos afterward?

Step 7

Code

Builder, WordPress or custom, with forms protected and structured data.

Code is the set of written instructions that tells a browser how to show your website. Three languages do most of the work: HTML for the content and structure, CSS for colors, fonts and layout, and JavaScript for things that move or react, like menus and forms.

See it yourself: on any website, press Ctrl + Shift + I on Windows or Cmd + Option + I on a Mac to open the browser's developer tools. Press Ctrl + U (Cmd + Option + U on Mac) to see the page's source code. What you see is the copy the server sent to your browser. The original files are made by the developer and stored on the hosting server.

Ask your developer: is it a builder, WordPress or custom code? Who updates it? Does it include structured data?

Good to know

Three common ways to build:

  • Drag and drop builders (Wix, Squarespace): fast and easy to edit yourself. Limits: layouts can break on phones, pages load extra code, design stops where the builder stops, and moving away usually means rebuilding.
  • WordPress: flexible with thousands of plugins. Limits: plugins need constant updates and are the most common way WordPress sites get hacked.
  • Custom code: fastest and most secure when done well, unique design, fully yours. Limits: changes need a developer or an added editor.

Structured data is hidden code that tells Google and AI tools exactly what your business is, where it works and what it offers.

Step 8

Change history

Every change recorded in a repository you own.

A serious website keeps a record of every change: what changed, who did it and when. If something breaks, any earlier version can be restored in minutes.

Where it lives: in a code repository such as GitHub, GitLab or Bitbucket, in an account owned by your business, with the developer added as a helper.

Good to know
  • Without change history, a mistake can mean rebuilding pages from memory.
  • If a developer disappears, the repository lets someone else continue.
  • The repository stores code, not your customers' private data. That needs its own backups.
Ask your developer

Where is the repository, is it mine, and could another developer take over tomorrow?

Phase 3

Test and launch

Step 9

Preview site

You approve every page before it goes live.

A preview site is a private copy of your website where you review everything before the public sees it. Changes are tested there first, then published.

Why it matters: you catch wrong prices, typos and broken buttons before a client does.

Good to know
  • The preview should be hidden from Google so it does not compete with your real site.
  • Approve in writing, even a short email, page by page.
  • Test forms on the preview with your own email.
Ask your developer

Where do I review each page before it is published, and how is my approval recorded?

Step 10

Device testing

Real phones, slow connections, accessibility checked.

Your site will be opened on small phones, big phones, tablets, laptops and wide monitors. Testing means checking each size on real devices, not just resizing a window.

Accessibility means people with poor vision, color blindness or who use screen readers can use your site too. It also helps everyone in bright sunlight or on the move.

Try it: open your site on your phone using mobile data instead of wifi, and see how long it takes.

Good to know
  • No page should scroll sideways on a phone.
  • Every button should work with one thumb.
  • Images need text descriptions (alt text) for screen readers and Google.
  • Free tool: Lighthouse, built into Chrome developer tools (Ctrl + Shift + I, then Lighthouse).
Step 11

Speed

Main content in under 2.5 seconds on a phone.

Every extra second of loading loses visitors. Google also measures speed and uses it when ranking pages.

File compression is one of the biggest speed wins. Photos straight from a camera can be 5 to 10 MB each. Compressed and resized, the same photo can look identical at a small fraction of the size. Servers can also compress code files (gzip or Brotli) before sending them.

Check it for free: go to pagespeed.web.dev and type your address.

Good to know
  • Image formats: WebP and AVIF are much smaller than JPG and PNG for the same quality.
  • Right size: a photo shown 800 pixels wide should not be uploaded 6000 pixels wide.
  • Lazy loading: images further down the page load only when the visitor scrolls to them.
  • Fewer scripts: every chat widget, tracker and plugin adds loading time.
  • Google's targets: main content under 2.5 seconds, response to taps under 200 milliseconds, and no jumping layout.
Step 12

Profiles

Google and every directory, identical details everywhere.

Many clients find you on Google Maps, Apple Maps, Yelp, TripAdvisor or AI assistants before they ever see your website. These profiles are free and often matter as much as the site.

Identical everywhere: your business name, address, phone and hours must match letter by letter on every profile. Mismatches confuse Google and customers.

Good to know
  • Claim Google Business Profile, Apple Business Connect and Bing Places. All three are free.
  • Choose the most accurate category.
  • Add real photos and keep hours updated, including holidays.
  • Ask for reviews every week and reply to every one.
  • See our free guide on the Marketing Engineering page.
Ask your developer

Who owns my Google Business Profile, and which email was it created with?

Step 13

Launch checklist

"Done" means every item checked and every key in your hands.

Before a site goes public, a checklist is reviewed item by item: speed, phones, forms, email, privacy policy, cookie banner, broken links, redirects from old pages and the security padlock.

"Done" means every item is checked and you hold every password and login: domain, hosting, email, analytics and profiles.

Good to know
  • Forms: a form collects a visitor's details and sends them to your inbox or system. It must check the details are complete, block spam robots, show a clear success message and a helpful error message.
  • Cookies: small pieces of information a website stores in the visitor's browser. Some are needed for the site to work, like remembering a language choice. Others track visitors for analytics or ads. In many countries you must ask permission before using tracking cookies, which is why sites show a cookie banner.
  • Privacy policy: explains what information you collect and why. Required by law in many places.
  • HTTPS: the padlock in the address bar means information sent to the site is encrypted.
  • Search Console and analytics: free Google tools that show which searches bring visitors.
Ask your developer

Can I see the launch checklist with every item marked?

Phase 4

Grow and protect

Step 14

Maintenance

Monthly checks and a short report.

A website is never finished. Software needs security updates, certificates renew, links break, prices change and Google keeps changing how it ranks pages.

A good routine: every month check speed, broken links, form delivery and reviews. Every quarter review your content. Every year renew the domain and review passwords.

Good to know
  • Most hacked small business sites were simply not updated.
  • Test your contact form once a month by sending yourself a message.
  • Keep a list of every login in a password manager.
  • Add new pages when you add new services.
Ask your developer

What report do I get each month, and what happens to the site if I stop paying?

Step 15

Exit plan

What you take with you if the work ends, written from day one.

From the first day, write down what happens if you end the contract, if the provider closes, or if you stop paying: what files and accounts you receive, how fast, and who holds the backup keys.

Why it matters: many business owners discover their domain, site or Google profile was never really theirs only when they try to leave.

Good to know
  • You should receive the code, content, photos and all logins.
  • The contract should say you own the design, text and photos you paid for.
  • Red flags: "I will register the domain for you", "you don't need access", "pay everything up front".
Ask your developer

If we stop working together, what do I get, in how many days, and how many hours of help moving are included?

Builder, WordPress or custom code?

Drag and drop (Wix, Squarespace)WordPressCustom code
Best forSimple sites, fast startContent heavy sites, many featuresSpeed, security, unique design
PhonesLayouts can shift or overlapDepends on theme and pluginsBuilt phone first
SecurityHandled by the platformPlugins need constant updatesVery small attack surface
Can you move it?Wix cannot leave Wix servers. Squarespace exports only partYes, to any hostYes, the files are yours
Ongoing costSubscription for lifeHosting plus paid pluginsHosting

What drag and drop and AI cannot do for you

Builders

  • Hand placed layouts break on small screens
  • Heavy code slows every page
  • Design stops where the builder stops
  • Leaving usually means rebuilding

AI tools

  • Does not know your prices, permits or clients
  • Sounds like every competitor
  • Does not test on real phones or check links
  • Cannot own your domain, email or profiles
  • Cannot take responsibility when something breaks

What makes a good website

  • Domain, hosting, email and profiles in your name
  • Loads fast and works with one thumb
  • Who, what and where clear in five seconds
  • One obvious next step on every page
  • Two fonts, one palette, consistent spacing
  • Real photos and only true claims
  • Found on Google, Apple Maps and AI assistants
  • Backed up, updated and reported monthly

What every website knows about you

On our home page you may have seen the temperature where you are. Most visitors never notice how much a website can learn in the first second. Here is what, and how businesses use it.

  • Approximate location. From your internet connection (IP address) or your device's time zone. Usually right to the region or city, not your street.
  • Device. Phone or computer, browser and screen size.
  • Language and time zone. From your device settings.
  • How you arrived. From Google, social media, an ad, an email or a direct visit.
  • Real estate portals show listings near you first.
  • Hotels and stores switch to your currency and shipping times.
  • CRMs record which city a lead came from and alert the right sales agent.
  • Ads are shown only to people in the regions a business serves.

What OONSITE does: our weather badge uses only your device's time zone to pick the nearest major city, then shows its temperature. We do not store it, and it is not linked to you. See our Privacy Policy.

Which CRM should you use?

A CRM keeps every visitor request, conversation and follow up in one place. There is no single best one. The right choice depends on the size of your business and what you sell.

By size

Salesforce

The largest CRM company in the world and the most powerful. Built for large companies, expensive, and usually needs a specialist to set up.

HubSpot

The easiest to use, with a strong free plan. Connects your website, email and marketing in one place. A common first choice for small businesses.

Zoho CRM

Strong value. Many features for a low price, from a company with more than a million paying customers across its products.

Pipedrive

The simplest. Your sales pipeline appears as cards you drag from stage to stage. Good for one person or a small team.

By industry

  • Real estate: Follow Up Boss and Lofty, built for agents and lead follow up.
  • Vacation rentals and hotels: Guesty and Hostaway, which handle bookings, guests and owners.
  • Trades and home services: Jobber and Housecall Pro, for quotes, scheduling and invoices.
  • Nonprofits: Bloomerang, built around donors and fundraising.
  • Medical and dental: a practice management system with patient privacy protections. A regular CRM is not enough for patient data.

Free or paid?

What free gives you
  • A contact list with notes and history
  • A sales pipeline with stages
  • Website forms that save leads automatically
  • Basic email tracking
  • A phone app
What paid adds
  • Automatic follow up emails and reminders
  • No company logo on your forms and emails
  • Reports on where clients come from
  • More users, contacts and email volume
  • Connections to WhatsApp, calendars, booking and accounting
  • Support from a real person
The catch with free
  • Free plans are built to upsell. The most useful features sit behind the paywall.
  • The first paid plan can cost much more, and prices usually go up per user.
  • Your data lives on their servers. Check how easy it is to export before you commit.
When to pay

When you lose leads because you cannot follow up fast enough, or when you have a team to manage. A paid CRM makes sense when one extra client a month covers its cost.

We do not earn anything from these companies. Plans and prices change often, so check each company's current pricing page before you choose. Want to own your data instead? We can also build a simple CRM on your own hosting.

Get found for free

Sometimes a complete profile with great reviews speaks for itself. Claim Google Business Profile, Apple Business Connect and Bing Places, keep your details identical everywhere, and answer every review.

Read the full free guide
Free Assessment