Small business SEO in Australia: a plain-English checklist

Most SEO advice aimed at small business owners opens with a warning that your website is probably broken. The data says otherwise. The median Australian small business website scores 96/100 on Red Bridge Cyber's Visibility category — grade A+. Two in three sampled sites score A+.^* If your site was built in the last few years on Squarespace, Wix, Shopify or a recent WordPress theme, the table stakes — HTTPS, a mobile layout, a sitemap — were almost certainly set for you by the platform. You are not behind. Neither, unfortunately, are your competitors.

That is exactly why generic SEO checklists feel unsatisfying: they tell you to do things your website builder already did. The leverage now sits 1 layer deeper, in the things platforms do not set by default. One in four Australian small business websites publishes no JSON-LD structured data.^* The businesses that close that kind of gap are competing on depth while everyone else re-checks the basics. So this checklist is organised by who does the work: the 7 checks above are yours, and each takes under 10 minutes. The depth items go to your developer in a single email. And the enterprise-consultancy version of this work gets a section of its own, mostly so you can recognise it when it is pitched to you — and decline.

What to check yourself

The 7 checks at the top of this page need no tools you do not already have — a browser, your phone, and a free Google account. Work through them in order; the early ones matter more for a local business than anything further down. If you would rather a guided version with screenshots of what good and bad results look like, the 30-minute SEO health check walks the same ground at a slower pace.

Claim and finish your Google Business Profile

For a business with a physical location or a service area, this single check outweighs the other 6. Search your business name in Google and look at the panel on the right (or at the top, on a phone). If there is no panel, your Profile is unclaimed. If there is a panel but the hours are wrong, the photos are 5 years old, or the category says something vague like "Business service", it is claimed but neglected — which Google treats much the same way. Claiming and completing it is free at google.com/business and takes 1 evening, including the postcard or phone verification step. The full comparison of where the Profile beats the website and where it does not is its own article, but the short version: for "near me" searches, the Profile is your SEO.

Read your home page title the way Google shows it

Search your business name and read the blue link text Google displays for your home page. That text comes from your page title, and it is the single most-weighted piece of on-page SEO you control. The plain-English test: does it say what you do and where you do it, or just who you are? "Hartley & Co" tells Google nothing. "Hartley & Co — Bookkeeping for Tradies in Geelong" tells Google, and the customer skimming results, everything. While you are there, read the grey description text underneath — that is your meta description, and if you never wrote one, Google is improvising it from whatever text it found on the page. Both are editable in every mainstream website builder, usually under a setting called "SEO" or "page settings".

Make your contact details match everywhere

Google cross-references your business name, address and phone number across the public web — your website, your Business Profile, Facebook, industry directories, the local chamber of commerce listing from 2019. When they disagree, Google's confidence in all of them drops. The 10-minute check: search your business phone number in quotes, then search your previous address if you have moved in the last few years. Anywhere the old details appear and you can edit or request a change, do it. You will not find everything in 10 minutes; you will usually find the 2 or 3 listings that matter.

Test your speed on a phone, not your office computer

Slow pages lose customers before Google ever gets a vote, and Google's own documentation confirms page experience feeds into ranking. Run your home page through PageSpeed Insights and look at the mobile score first — your office computer on office wi-fi is the most flattering possible audience, and your actual customers are on phones in car parks. Do not chase a perfect score; a mediocre one with no red items is fine for a local business. A very poor mobile score is usually 1 of 3 things — enormous uncompressed photos, a page stuffed with third-party widgets, or cheap hosting — and the photos are the one you can fix yourself this afternoon.

Use your own site the way a customer does

Scores are abstractions; this check is not. Pick up your phone, switch off wi-fi, and do the 3 things a real customer does: find your phone number, find your opening hours, and submit your contact form. Time each one. If the number is buried in a hamburger menu, if the hours live only in a PDF, or if the form's submit button sits under a cookie banner, you have found a problem no ranking improvement will compensate for. This is also where you notice text that is too small to read and buttons too close together to tap — the things Google's mobile-friendliness checks approximate from the outside, and you can verify directly.

Count your pages in Google's index

Type site:yourdomain.com.au into Google and look at the results. You are not after a precise number — you are checking for 2 failure modes. Zero results means Google has not indexed your site at all, which is the most serious finding on this list; the 5 plain reasons a website does not rank covers what to do, and none of the fixes need an agency. A count wildly below the number of pages you know you have means whole sections are invisible. For the accurate version of this check, set up Google Search Console — it is free, it is Google telling you directly which pages are indexed and which queries you appear for, and every later decision about SEO gets easier with it running in the background.

Find 1 trusted local link

A link from another website to yours is a backlink, and links from established Australian institutions — a .gov.au council business directory, an .org.au industry association, a chamber of commerce — carry weight far beyond their traffic. The 10-minute check: list the organisations you already belong to or sponsor, visit their member or sponsor pages, and see whether they link to your site. Businesses are routinely entitled to a link they never claimed — the membership form had an optional website field, and nobody filled it in. This is the only check on the list that involves other people, and it is still mostly a matter of asking.

What to ask your developer

The next 4 items are where the real headroom is, and they are developer work — not because they are hard, but because they live in template files and server settings rather than in your website builder's editing screen. Send the list below as-is; a competent developer will recognise every item, and none of them should be a large job.

Add JSON-LD structured data — at minimum an Organization block. Structured data is a machine-readable summary of who you are, embedded invisibly in your pages, and depth here is where the real gap sits. Just over half (52%) of Australian small business websites publish an Organization JSON-LD block — and only 9% publish LocalBusiness.^* For a business with a location, ask for LocalBusiness schema as well — name, address, phone, opening hours in the exact format Google parses. This is what makes you legible not just to Google's rich results but to the AI search tools increasingly answering customer questions directly.

Confirm every page sets a canonical tag. The canonical tag tells Google which version of a page is the real one when the same content is reachable at several addresses — with and without www, with tracking parameters, and so on. 88% of Australian small business websites set a canonical tag — the biggest table-stakes Visibility signal.^* Odds are yours does too, which is why this is phrased as confirm, not add. The check takes a developer minutes; being in the other 12% quietly splits your ranking signals across duplicate addresses.

Cross-reference the sitemap from robots.txt. 94% of Australian small business websites publish a sitemap. But only 78% of Australian small business websites cross-reference their sitemap from robots.txt. The cross-link is a single line in 1 file, and it means every crawler that reads your robots.txt — not just the ones you registered with — finds your full page list immediately.

Check robots.txt is not blocking anything important. The inverse problem is rare but far more damaging: in the June 2026 edition, not a single sampled Australian small business website blocked crawl paths that should be open.^* When it does happen, the classic cause is a "discourage search engines" setting left on after a site rebuild, or a blanket rule copied from a staging server. Symptom: pages that exist, look fine, and never appear in the index count from your site: check.

What the enterprise-consultancy answer looks like

It is worth knowing what the top end of the market sells, because sooner or later someone will pitch you a scaled-down version of it. A large-firm SEO engagement typically opens with a discovery phase and stakeholder workshops, proceeds to a keyword universe mapped across the customer journey, a technical audit running to a couple of hundred findings, a 12-month content calendar with publishing velocity targets, and quarterly reporting decks — all on a retainer priced for a marketing department, not an owner-operator.

None of that is dishonest. For a national retailer competing on 10,000 keywords it is roughly the right shape. The mismatch is the audit's likely contents: nearly nine in ten Australian small business websites reach grade A or A+ on Visibility scanning.^* A 200-finding technical audit of a site in that band is mostly documenting things that are already fine, at length. Your competitive set is not the national retailer — it is other businesses in your suburb and trade, most of whom have done the basics and stopped there. The 7 checks plus the 4 developer items above cover the measurable gap between you and them. Beyond that, the methods the good agencies use are published openly — the Moz blog has documented most of the craft, free, for 2 decades — so even if you later hire help, reading a little first makes you a much harder client to oversell.

When it's time to bring in outside help

Honestly, there are real triggers, and they are worth naming precisely because the rest of this page argues you can do most of it yourself.

The checklist is done and the needle has not moved. SEO is slow even when it is working — how long SEO takes is measured in months, not weeks. But if you have completed the checks, shipped the developer items, given it a full quarter, and Search Console still shows flat impressions, something structural is wrong and a one-off diagnostic from a freelance specialist is money well spent.

You compete in a saturated vertical. Legal services, real estate, trades in metro areas — niches where every competitor has also done the basics. There the contest moves to content quality and link-building at a sustained pace, which is genuinely a part-time job. Hiring it out is reasonable; just hire deliverables ("4 service-area pages, written and indexed"), not vague retainers.

A rebuild or migration is coming. More small business rankings are destroyed by site rebuilds than by anything a competitor does — addresses change, redirects get skipped, and a "discourage search engines" toggle ships to production. If a redesign is planned, paying someone to manage the SEO side of the migration is cheap insurance.

Nobody in the business can write, and the niche demands content. Pages that answer real customer questions are the raw material of everything above. If producing them is never going to happen internally, a writer who knows your trade beats an SEO agency generating filler.

Whoever you bring in, keep the surrounding hygiene in your own hands. The Australian Cyber Security Centre's small business hub covers the access, password and update practices that protect the same website you are now investing in — and an SEO contractor with the keys to your site is exactly the kind of access worth managing deliberately.

A final honest note on what any external check — this checklist included — can and cannot see. An outside scan reads your public surface: titles, structured data, sitemaps, robots rules, canonical tags, speed. It cannot see your Search Console data, judge whether your pages actually answer what customers ask, or tell you why a competitor outranks you on a specific query. That is the part that stays yours. The Visibility category of a Red Bridge Cyber scan covers the public-surface half — the same signals this checklist walks through, checked automatically, correlated across categories, and re-checked on a schedule so a rebuild or a provider change cannot silently undo an afternoon's good work.