For small and medium businesses across the UK, this is a genuine shift in how customers find you. Your next customer might not see a list of ten blue links. They might ask ChatGPT for a good local service, get a Perplexity answer with three cited sources, or read a Google AI Overview that answers their question before they ever scroll to the organic results. If your business isn’t part of those answers, you’re invisible to a growing share of your market, even if your traditional rankings are strong.

This isn’t a reason to panic. But it is a reason to understand what’s happening and take some sensible steps.

What is Generative Engine Optimisation?

Generative Engine Optimisation, or GEO, is the practice of making your content discoverable and citable by AI-powered search engines. These engines, including ChatGPT, Perplexity, Claude, Gemini and Google AI Overviews, generate answers by drawing on and synthesising multiple sources rather than simply linking to them.

That last bit matters. Traditional SEO is about getting your page to rank so someone clicks on it. With GEO, the goal shifts: you want to be cited in AI-generated answers. It’s the difference between appearing on a shelf and being the product an expert recommends by name.

GEO doesn’t replace SEO. It adds a new layer of visibility for a search environment where AI engines summarise, compare and recommend before users click. Think of it as an extension of the work you’re already doing, not a complete overhaul.

Why this matters for UK SMEs right now

The numbers tell a clear story. According to BrightEdge research, AI Overviews now appear on approximately 48% of tracked queries, up from 31% a year earlier. That’s nearly half of all searches generating an AI-written summary before any organic result. And according to BrightLocal’s 2026 Local Consumer Review Survey, the use of generative AI for local recommendations climbed from just 6% to 45% of consumers in a single year.

The tricky part is that your Google ranking and your AI visibility are measured completely separately. According to SOCi’s 2026 Local Visibility Index, which analysed over 350,000 business locations, ChatGPT recommends just 1.2% of local businesses. By comparison, those same businesses appear in Google’s local 3-pack 35.9% of the time. That’s roughly a 30-fold gap. Gemini recommended 11% of locations; Perplexity, 7.4%. The same study found that strong performance in Google’s local results does not automatically translate into AI visibility. In retail, fewer than half the brands performing well in traditional local search also appeared in AI recommendations.

For a Cardiff plumber who’s worked hard to rank on page one, that’s a sobering thought. You can be sitting at position two in organic results and still be completely absent from the AI answer a potential customer reads instead.

How AI engines decide who to cite

AI Overviews don’t pull listings. They construct an answer and then decide which sources to credit for it. So the question becomes: what makes a source credible enough to cite?

The signals are fairly consistent across platforms. AI systems favour content that is well-structured, factually clear and backed by a trustworthy website. A scrappy five-page site with thin content and no clear about page is unlikely to make the cut, regardless of how good the business behind it is.

Your business information also needs to be consistent everywhere it appears online. AI systems cross-reference sources to verify whether a business is real and reliable. Your Google Business Profile doesn’t live in isolation. Google’s AI and others pull in data from your connected listings and social profiles to confirm that your business is active, consistent and legitimate.

Five practical steps you can take today

1. Write content that directly answers real questions

AI tools mirror how people talk and ask things, so your content should match how customers phrase their questions. That means going beyond “here’s what we do” and writing pages that address the specific things your customers actually search for. A Cardiff accountant might write a clear page answering “what can I claim as a sole trader expense?” A local bathroom fitter could answer “how long does a bathroom installation take in the UK?”

Take your most important service and location pages and restructure them so the most useful answer appears near the top, not buried in paragraph five. Add a clear summary, sharpen your headings and make sure each page addresses a specific question rather than describing your business in general terms. AI systems extract answers, so give them something worth extracting.

2. Use structured data and schema markup

Research by SE Ranking found that 65% of pages cited by Google AI Mode and 71% of pages cited by ChatGPT include structured data. That’s a meaningful pattern. Schema markup is code added to your website that tells search engines and AI systems exactly what your content means, not just what it says.

For a service business, getting Organisation and LocalBusiness schema in place is a solid starting point. It’s worth being honest here, though: schema is foundational hygiene, not a citation multiplier on its own. Structured data provides the machine-readable layer that AI platforms need to understand your content, but it won’t guarantee citations by itself. It’s one piece of the puzzle, not the whole answer. Note that FAQPage rich results are no longer supported by Google for most businesses outside government and health, so concentrate your efforts on Organisation, LocalBusiness and Article schema first.

3. Keep your business information consistent across the web

Your business name, address, phone number and trading hours need to match exactly across your website, Google Business Profile, Bing Places, Yell, Checkatrade, industry directories and anywhere else you’re listed. AI systems cross-reference these sources to verify whether a business is real and reliable. If your information is missing or contradictory, AI simply skips you.

ChatGPT often relies on Bing data and other web results for local searches, so your visibility in Bing and a complete Bing Places listing can improve your chances of being mentioned. Most small businesses ignore Bing entirely. That’s worth revisiting.

4. Earn credible mentions and citations

AI engines don’t just look at your website in isolation. They look at what the rest of the internet says about you. Getting mentioned in local press, trade publications, community websites and relevant directories gives AI systems more corroborating evidence that you’re a trustworthy source.

Reviews matter too. For local-intent queries, active review management is critical to winning AI visibility. Encourage satisfied customers to leave genuine reviews and respond to them. It signals that your business is active and engaged, and there’s strong evidence that brands with healthy, well-maintained review profiles are considerably more likely to be cited in AI-generated answers than those with none.

5. Sort out the technical foundations of your website

Check your robots.txt file. Some security plugins and CDN settings block AI crawlers like GPTBot, PerplexityBot, ClaudeBot and Google-Extended by default. If you want AI visibility, make sure you’re not locking the crawlers out. It’s a deliberate business decision, not something to leave to a plugin’s defaults.

Page speed, mobile performance, clean HTML structure and clear site navigation all affect how easily AI systems can read and understand your content. A slow, cluttered website built on a poor technical foundation is harder for both traditional search engines and AI to parse. Our web development work always includes these technical foundations because they underpin everything else you do to market your business online.

GEO builds on your existing SEO, not around it

There’s a temptation to treat GEO as a separate project, something you bolt on after you’ve done everything else. It isn’t. GEO values factual depth over keyword density, structured data over raw backlink volume, and content freshness. But the two disciplines are complementary: solid SEO foundations help AI crawlers discover your content, while GEO structuring helps AI models decide whether to cite it.

Put simply, if your website has thin content, a slow load time, poor internal linking and no credible backlinks, chasing AI citations before fixing those basics is wasted effort. The good news is that solid SEO strategy serves both purposes. A well-structured page that answers a question clearly, loads quickly and sits on an authoritative domain is exactly what both Google’s traditional algorithm and its AI Overview system are looking for.

Your search visibility in 2026 depends on three things: can search engines crawl and understand your content? Can AI engines extract direct, useful answers? And can generative engines trust your brand enough to mention or cite it? These aren’t three separate questions. They’re layers of the same question, and a good SEO strategy should be building towards all three.

How your website design affects AI visibility

This is something a lot of business owners don’t immediately connect. Semantic HTML, meaning using the right tags for headings, lists and paragraphs rather than styling everything with divs and custom classes, makes pages far easier for AI crawlers to interpret. A well-designed, well-built website uses clean markup, clear heading hierarchies and logical page structures that both humans and machines can navigate. These design and development decisions have direct consequences for how AI reads and represents your business.

Structured data acts as a translation layer between your content and AI systems. Rather than forcing AI to guess meaning through natural language processing alone, schema provides explicit signals about what your content represents. The quality of the underlying HTML matters just as much, though, so the two need to go hand in hand.

What to measure when rankings no longer tell the full story

Traditional SEO metrics like organic rankings, click-through rate and impressions don’t capture AI engine visibility. You need to start looking at different signals.

The most practical starting point is simply asking the engines directly. Open ChatGPT, Perplexity and Google in separate windows and search for your services the way a customer would. “Reliable heating engineer in Newport” or “small business accountant Cardiff prices.” See what comes up, and see whether you’re in it.

In June 2026, Google added a generative AI performance report to Search Console, showing how often your pages appear in AI Overviews and AI Mode. If you haven’t checked your Search Console recently, that’s a good reason to do it today.

Over time, you can track what specialists call mention rate and citation rate: how often your brand name appears in AI-generated answers, and how often those answers include a link back to your site. These are things Google Analytics simply can’t measure, but there are specialist tools emerging that can. The strongest options cover multiple engines, measure share of voice and monitor citations across platforms.

Start with a simple audit

You don’t need to do everything at once. The most useful thing you can do this week is run a quick audit of where you actually stand. Search for your core services in your area using ChatGPT, Perplexity and Google. Check your Google Business Profile is complete and up to date. Pull up your website on your phone and ask yourself honestly whether it clearly answers the questions a customer would come with.

If the answer to any of those is “not really,” you’ve got a clear starting point. If you’d rather not tackle it alone, we work with small and medium businesses across the UK on exactly this kind of challenge, from search visibility strategy to the technical site work that underpins it. The businesses that act now, before AI search habits solidify, will have a real advantage over those who wait.

The post How to Get Found in AI Search Results appeared first on Cardiff Web.

Usually the real problem is simpler and more fixable: visitors didn’t feel confident enough to get in touch. They landed on your site, looked around for reassurance, couldn’t find it quickly enough, and clicked away. That’s not a traffic problem. It’s a trust problem.

We see this constantly when working with UK SMEs on website design built around generating enquiries. The site might look reasonable. It might even rank well. But the subtle cues that signal “we’re a real, credible business and you can trust us” are missing or buried. Visitors feel it, even if they couldn’t tell you why, and they leave.

What is a trust signal, exactly?

A trust signal is any element on your website that reduces a visitor’s perceived risk of contacting or buying from you. It’s the visual and written evidence that confirms you are who you say you are, that other people have worked with you and been happy, and that you’ll handle their enquiry professionally.

Think about how you’d feel walking into an unmarked office with no receptionist, no company name on the door, no certificates on the wall. You’d probably turn around. A website without trust signals creates exactly that feeling, only faster.

The web is now full of AI-generated content and template sites that look superficially polished but have no substance behind them. UK buyers have become more sceptical as a result, and they’re actively looking for proof that a business is genuine before they’ll hand over their contact details.

Why service-business visitors need more convincing

If you run a service business, whether that’s a Cardiff plumbing company, a Swansea accountancy practice or a Bristol IT support firm, you’re asking someone to take a bigger leap of faith than they would buying a pair of trainers. There’s no product to touch, no Amazon returns policy, and no instant refund if things go wrong. The cost of getting it wrong feels very real.

A YouGov survey from late 2025 found that most UK consumers take active steps to verify a business before making contact, with checking customer reviews or ratings among the most common first moves.
Separate research from the same period found that 68% of UK consumers now turn to online reviews as their primary source for purchasing decisions, ahead of recommendations from family and friends.
If your site doesn’t make it easy to find that reassurance, visitors will simply go and find it on a competitor’s site that does.

The 7 trust signals UK SME visitors look for

1. Reviews and social proof

Around 93% of consumers read online reviews before making a purchase decision.
That’s not just retail shoppers. It applies equally to someone choosing a solicitor, a web agency or a local builder.

The catch is that simply having reviews isn’t enough. A handful of five-star ratings from three years ago can actually undermine trust rather than build it, because it implies the business has stopped asking for feedback, or that recent customers haven’t been happy enough to leave one. You need a steady stream of recent, genuine feedback displayed prominently, ideally pulled through from Google rather than typed up manually on the site. Reviews that live only on your own website carry considerably less weight than those on independent platforms, because visitors know you control what appears there.

2. Real photography instead of stock images

A stock photo of a smiling model holding a spanner tells a visitor nothing about you. A photo of your actual van, your actual engineer, and a completed job in someone’s kitchen tells them everything. Generic stock imagery triggers doubt, often subconsciously, the moment a visitor clocks that your “team” looks suspiciously like a Getty Images search result.

This doesn’t mean spending a fortune. A few hours with a decent photographer, or even a competent smartphone shooter, can give you a library of genuine images that will do far more for enquiries than any professional stock photo.

3. Accreditations and memberships

If you’re Gas Safe registered, a member of the Federation of Master Builders, or accredited by any professional body, that logo needs to be visible on your website, not buried in a footer few people ever scroll to. These are shorthand signals for credibility. They tell a visitor that a third party has verified you, which is a much stronger statement than anything you can say about yourself.

The key is relevance. Two or three genuine, meaningful badges placed near your call to action work well. Plastering six or eight generic “100% secure” seals across the page has the opposite effect and starts to look like you’re trying too hard. Pick the ones that actually mean something to your audience and show them where they count.

4. Clear, prominent contact details

This sounds obvious, but a surprising number of SME websites make you hunt for a phone number. It should be in the header, visible without scrolling, on every single page. A named email address (not a generic info@ address), a local phone number, and a physical address where relevant all help. They signal that there’s a real business behind the site, with real people who will actually pick up the phone.

5. An About page with real people

For a service business, people are buying you as much as they’re buying the service. An About page with photos of the actual team, brief bios that feel human rather than corporate, and a genuine explanation of why you do what you do builds a connection that no amount of clever copywriting on a services page can replicate. If your About page is currently three vague paragraphs about “delivering excellence” with no names and no faces, it’s working against you.

6. Case studies and portfolio evidence

Telling someone you’re good at something is one thing. Showing them is quite another. A good case study doesn’t have to be long. It just needs to show the problem, the process and the result. A local accountant could describe how they saved a client four hours a week and spotted a tax saving they hadn’t noticed. A kitchen fitter can show before-and-after photos with a short description of the project. This kind of evidence converts hesitant browsers better than almost anything else on the page.

7. GDPR and privacy transparency

This one gets overlooked, but it matters to UK visitors more than people realise. Visitors want to know what data gets collected and where it goes. A clear, plain-English privacy policy, a properly implemented cookie consent mechanism, and a short reassurance message near your contact form (“We’ll never share your details”) all reduce the anxiety people feel about handing over their information.

The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025, and all provisions affecting data protection law are now in force.
It’s well worth making sure your privacy notices are current and that your cookie setup reflects the latest requirements, particularly around low-risk analytics cookies.

Where on the page these signals need to appear

Placement matters as much as presence. The same trust signal can work hard in one spot and do almost nothing in another.

Above the fold on the homepage: Your star rating or review count, a key accreditation logo, and your phone number should all be visible before anyone scrolls. This is your first impression, and it needs to answer the subconscious question “can I trust this site?” within a few seconds of arriving.

On service pages: Relevant case studies or portfolio examples, specific reviews that mention the service in question, and appropriate accreditations should all sit close to the call to action. Reviews tucked away at the bottom of the page, or on a separate page nobody navigates to, are largely wasted.

On the contact page: This is where anxiety peaks. People are about to hand over their details. A reassurance message, a realistic response-time promise, a photo of the person who’ll respond, and a privacy note right next to the form can all make a real difference to whether someone actually presses submit.

Common mistakes that silently kill enquiries

The most common one is having all the right ingredients but hiding them. Reviews are real but sit on a page nobody navigates to. The accreditation logo is on the About page, which gets a fraction of the traffic of the homepage. The team photos exist but only appear in the footer.

Then there’s the stock-image trap. Many SME websites look credible at first glance but fall apart the moment a visitor notices that the “team photo” is clearly a library image. Once you’ve spotted it, the trust is gone and it’s very hard to get it back.

Finally, the anonymous website. No team names, no faces, no address, just a contact form. For local service businesses especially, this is a conversion killer. People want to know who they’re dealing with before they’re willing to pick up the phone.

How design itself signals credibility

Design quality is itself a trust signal, and it kicks in before a visitor has read a single word. A site that looks cluttered, outdated or difficult to read on a phone creates an immediate impression of a business that doesn’t care about its presentation. And if it doesn’t care about its website, what does that say about how it’ll treat the customer?

Generous whitespace, a clear visual hierarchy, and readable typography all send a signal of professionalism and confidence. Consistent colours and fonts across the site suggest an organised business. A fast-loading, mobile-friendly experience suggests a business that’s on top of its technology.

None of this requires a flashy design. In fact, overly complex or gimmicky sites can undermine trust just as much as a neglected one. Clean, clear and professional is what you’re aiming for, and those qualities reinforce every other trust signal on the page. This is why good SEO alone won’t plug the gap: you can rank on page one and still lose every visitor if the site doesn’t feel trustworthy when they arrive.

A quick audit you can do today

Go through your site and honestly score yourself on the following. It doesn’t need to be perfect, but be honest.

• Is your phone number visible in the header on every page, without scrolling?
• Do you have a good number of recent Google reviews (posted within the last six months), with a score of 4.5 or above, displayed or linked prominently?
• Does your homepage use real photographs of your team, work or premises, rather than stock images?
• Are your relevant accreditations or memberships displayed near your main call to action?
• Does your About page have real names, faces and a human story?
• Do your service pages include at least one case study, client story or before-and-after example?
• Is there a plain-English privacy reassurance near your contact form?
• Does your site load quickly on a mobile phone?
• Does the overall design look current and consistent, or does it feel dated?

If you’re ticking fewer than six of those boxes, you’re almost certainly losing enquiries every week to businesses that tick more. The good news is that most of these things are fixable without rebuilding the entire site.

When to bring in professional help

If you’ve done the audit above and the list of problems is long, or if the issues go deeper than adding a few reviews and swapping stock images, it’s probably time to think about a proper redesign rather than patch repairs. A site that was built without conversion or trust in mind will often fight against you no matter how much you tweak it.

That’s where working with a team who understands professional web development focused on real-world results makes a difference. It’s not about making things look nicer. It’s about building a site where the layout, the content, the imagery and the trust signals all work together to give a visitor every reason to pick up the phone, and no reason to leave.

We work with SMEs across the UK who know their service is good but whose websites aren’t reflecting that. If that sounds familiar, we’d be happy to take a look and give you an honest view of what’s holding things back.

The post Why UK Visitors Leave Without Enquiring appeared first on Cardiff Web.

Most SME owners treat website security as an IT problem. Something for a developer to worry about. A box to tick when the site goes live and then, largely, forget about. If that sounds familiar, you’re not alone, and you’re also sitting on a financial risk that’s easy to underestimate until it bites you.

WordPress websites make up a huge proportion of UK small business sites, and that popularity makes the platform the most targeted on the web. Patchstack’s State of WordPress Security in 2026 counted 11,334 new vulnerabilities in the WordPress ecosystem in 2025, a 42% increase over the year before, with 91% of those found in plugins.
Around 13,000 WordPress sites are compromised every single day.
The overwhelming majority of those attacks aren’t clever, targeted operations aimed at your business specifically. They’re automated, opportunistic and indiscriminate. If your site has an unpatched flaw, a bot will find it.

This article isn’t about scaring you. It’s about giving you an honest, itemised picture of what a compromise actually costs, because once you see the full picture, the case for proactive maintenance and security becomes very obvious very quickly.

How WordPress sites get hacked

WordPress core is actually well maintained and regularly patched.
Of all the vulnerabilities discovered in 2025, 91% were found in plugins and 9% in themes. Only six vulnerabilities were reported in WordPress core, and all were considered low risk.
The risk comes from everything bolted on to it.

Forty-six percent of those vulnerabilities weren’t fixed in time for disclosure, meaning nearly half were made public whilst the affected plugin remained unpatched.
Think about that. Nearly half the known flaws had no fix to apply even if you’d wanted to update immediately.

The weighted median time from vulnerability disclosure to first exploitation was just five hours.
That’s the window between a flaw being announced and automated scanners actively targeting every WordPress site running the affected plugin. Five hours is not long.

Other common entry points include nulled (pirated) themes and plugins, which frequently come pre-loaded with hidden backdoors, and inactive plugins that sit unupdated on a site for months because nobody remembers they’re there. Every inactive plugin is an attack surface with zero upside.

What happens in the hours after a breach

The immediate aftermath of a hack often isn’t obvious. Many attacks are designed to be invisible. Malware can sit on a site for weeks, quietly doing its work, before anything visibly wrong appears. Without the technical knowledge to spot the changes, most business owners have no idea anything has happened.

If a site does get infected, there’s a good chance the malware will simply rewrite itself after cleanup.
Attackers inject posts, create hidden admin accounts, plant malicious options rows and schedule rogue cron jobs, all specifically so they can return later.
The Patchstack 2026 report also highlights that highly exploitable vulnerabilities increased by 113% year-on-year, and that attackers are now injecting code into legitimate WordPress core, plugin and theme files rather than dropping standalone malicious files.
That makes detection significantly harder.

In more visible cases, your site gets defaced, redirected to a spam or phishing page, or taken offline by your hosting provider. Compromised sites are routinely used to send spam through the site’s mail server, which gets the sending IP and domain blocklisted. Your email stops working. Customers can’t reach you. And you probably don’t know any of this has happened until someone tells you.

Cost item 1: Emergency recovery fees

The first bill that arrives is the developer’s. Emergency malware removal is specialist work and it doesn’t come cheap, especially when you need it done quickly.

For a simple brochure site, basic clean-up work starts at a few hundred pounds and covers malware removal and getting the site back online, but typically won’t include root cause investigation, backdoor verification or any kind of re-infection guarantee. If your site generates revenue or processes personal data, you’ll need a more thorough forensic package, and the cost rises accordingly. Serious incident response on an e-commerce site can run into several thousand pounds.

And that’s just the clean-up.
If a site does get infected, there’s a good chance the malware will simply rewrite itself after cleanup,
which is why clean backups need to be verified before restoring. Many backups already contain the backdoor. If the only backups you have are from after the compromise started, restoring just resets the timeline without solving anything. If you have no usable backup at all, you may be looking at a full rebuild.

Cost item 2: Downtime and lost revenue

Every hour your site is offline or serving malicious content is an hour you’re not generating enquiries, sales or leads. For a Cardiff plumber who gets ten calls a week from the website, even two days offline during a busy spell is meaningful lost revenue. For an online shop, it can be devastating.

Around 69.6% of hacked WordPress sites contain unauthorised backdoors.
That means detection speed directly affects total recovery cost. A site that’s compromised for weeks before anyone notices accumulates far more damage than one caught on day one, which is exactly why monitoring matters.

Cost item 3: Google blacklisting

This is the one that tends to hurt most, and the one business owners least expect. Google’s Safe Browsing system continuously scans sites for malware, phishing content and deceptive redirects. If your website is found to be hosting something harmful, even without your knowledge, it’s added to the database of unsafe sites. Visitors trying to reach your pages through Chrome, Firefox, Safari or any major browser will encounter a large, alarming warning screen telling them the site may be dangerous.

A blacklisted site can lose the overwhelming majority of its organic traffic overnight. Most visitors see that red warning page and leave immediately. Getting removed isn’t instantaneous either. Malware removal itself can take days, and Google’s review and delisting process can take up to a fortnight. SEO recovery, meaning your rankings and traffic actually bouncing back, can take weeks to months after that.

The knock-on effect for your search engine rankings can persist long after the technical issue is resolved. Rankings you’ve spent months building don’t simply snap back when Google removes the flag. Links shared on social media or sent in email campaigns may also be blocked or flagged whilst the blacklisting is active, effectively killing any marketing activity that drives traffic to your site.

Cost item 4: Reputational damage and GDPR

If your site collects any personal data, whether that’s contact form submissions, customer accounts, newsletter sign-ups or payment information, a hack becomes a data breach. And in the UK, that brings legal obligations on top of everything else.

Under UK GDPR, you must notify the ICO within 72 hours of becoming aware of the breach, where feasible. If the breach is likely to result in a high risk of adversely affecting individuals’ rights and freedoms, you must also inform those individuals without undue delay.
That means writing to your customers to tell them their data may have been compromised. Even if you handle it perfectly, the conversation damages trust.

Think about a local accountancy practice whose client portal gets compromised, or a small online retailer whose customer email list is exposed. The phone calls, the apologies, the lost clients, the reputational dent in a close-knit business community. That’s hard to put a number on, but it’s very real. For smaller businesses with limited resource, the proportional impact is often far worse than the headline cost figure suggests.

Cost item 5: The recurring vulnerability problem

Here’s the part that catches a lot of business owners out. You pay for a clean-up, the developer fixes the visible damage, the site comes back online. Job done? Not necessarily.

With around 70% of hacked sites containing unauthorised backdoors, a surface clean without proper forensic investigation simply resets the clock. The attacker’s access route is still there. Cheap, quick clean-ups that don’t investigate and close the original entry point are money wasted. You’ll be back in the same position within weeks.

This is why the total cost of a hack is so much higher than most people expect. Factor in emergency developer time, downtime, lost revenue, potential GDPR fines, and the months of SEO work required to undo injected spam links and recover from a Google penalty, and what looked like a one-off clean-up bill grows very quickly into something far more serious.

What prevention actually looks like

Basic security hygiene stops roughly 90% of attacks.
Most attackers are opportunistic. A site that looks harder to compromise than average simply gets skipped. Prevention comes down to a few consistent habits:

• Keep everything updated. Plugins, themes and WordPress core, updated promptly when security releases come out.
  Vulnerable plugins cause 91% of WordPress security issues.
  Staying current closes the most common door.
• Remove unused plugins. Every plugin you’re not actively using is a liability. If it hasn’t been updated by its developer in over twelve months, replace it.
• Use strong, unique passwords and two-factor authentication on all admin accounts. Credential stuffing is automated and relentless; 2FA makes it largely irrelevant.
• Run automated daily backups stored off-site. A clean backup from before the compromise is the fastest way to recover. Without one, you’re at the mercy of however far the damage has spread.
• Monitor for changes. Activity logging, file integrity monitoring and anomaly alerts are the difference between catching a compromise in hour one and discovering it three months later when Google sends a penalty notice.
• Use a Web Application Firewall (WAF) built for WordPress.
  Two separate pentesting studies conducted in 2025 found that standard hosting defences blocked only 12% of known exploited vulnerability attacks
  against WordPress sites, so relying on generic hosting security is not enough.
• Keep your SSL certificate current and make sure your site redirects cleanly from HTTP to HTTPS.

DIY maintenance vs handing it over

If you’re technically minded and genuinely set aside time each week to review and action plugin updates, check security logs and verify your backups, DIY maintenance can work. Most business owners are honest with themselves about whether that actually happens.

The reality for most SMEs is that maintenance tasks drift. A plugin update gets skipped because the site owner is busy. An alert goes unnoticed. A backup stops running silently and nobody checks. When that happens, a site that was well configured the day it launched quietly accumulates risk month by month.

Professional maintenance removes the human error from the equation. It also means that if something does go wrong, there’s someone already familiar with your site who can respond quickly, rather than you scrambling to find a developer at short notice and paying emergency rates.

How we can help

At Cardiff Web, keeping websites secure, updated and performing is a core part of what we do. Our web development and maintenance service covers plugin and theme management, security configuration and backup monitoring, so that the sites we build don’t become liabilities the moment we hand them over.

If you’re running a WordPress site and you’re genuinely unsure when it was last properly updated, or you don’t know where your backups are stored, it’s worth having a conversation sooner rather than later. A quick audit of your current setup costs far less than an emergency recovery. And unlike a hack, it doesn’t come with weeks off Google.

If you’d prefer to start fresh with a new website built with security baked in from day one, we’re happy to talk that through too. Get in touch and we’ll give you an honest assessment of where things stand.

The post What a Hacked WordPress Site Really Costs You appeared first on Cardiff Web.

If that sounds familiar, you’re not alone. It’s one of the most common conversations we have with UK business owners. The spreadsheet isn’t wrong, exactly. It got you here. But there’s a point where it starts costing you more than it saves, and knowing when you’ve crossed that line is genuinely useful.

This is a practical guide to help you work out whether your spreadsheet-based processes are holding you back, what the realistic alternatives look like, and whether bespoke software built around your business is the right next step.

How spreadsheets quietly become a liability

The trouble with spreadsheets is that they’re brilliant right up until they’re not. They’re flexible, familiar, and free. But they were designed for calculations and data analysis, not for running operational processes across a team. When you push them into that role, a few things tend to go wrong.

Errors creep in and nobody notices. A formula breaks when someone adds a row. A cell gets overtyped. A lookup pulls from the wrong column. In a personal finance sheet, that’s annoying. In a system calculating job costs or customer quotes, it can mean you’re pricing work at a loss for weeks before anyone catches it.

Version control becomes a full-time job. Once more than one person is working in a shared file, things go sideways fast. Who has the current version? Did someone email an old copy to a client? Did the changes Dave made on Thursday get saved over by what Sarah did on Friday morning? Cloud tools like Google Sheets help, but they don’t solve the underlying problem when the logic is complex and the stakes are high.

You have no real-time visibility. A spreadsheet shows you what someone typed in, last time they remembered to type it in. It doesn’t alert you when a job is overdue, a stock level drops below a threshold, or a customer hasn’t been followed up. You’re always looking at a snapshot of the past, not the live state of your business.

Onboarding new staff takes forever. The spreadsheet works because one or two people understand its quirks. New starters can’t just open it and go. There’s an undocumented mental model, a set of unwritten rules, and usually one person whose absence makes everything grind to a halt. That’s a fragile way to run anything.

Which processes tend to hit their ceiling first

Not every spreadsheet needs replacing. A simple reference table or a one-person expense tracker is fine. But certain processes tend to outgrow a spreadsheet faster than others.

Job scheduling and field management are a common early target. A Cardiff-based plumbing or electrical contractor managing twenty jobs a day across six engineers on a shared sheet will find it becomes a bottleneck almost immediately, once you’re tracking job status, engineer availability, parts required and customer updates all in the same place.

Quoting and estimating is another. If your quotes involve multiple variables, material costs, labour rates and margin calculations, doing that reliably in a spreadsheet is genuinely risky. A custom quoting tool ensures the logic is consistent, locked down and auditable.

Stock and inventory tracking often starts in a spreadsheet and stays there longer than it should. When you’re manually updating quantities after every sale or delivery, the data is always slightly out of date, and that leads to either over-ordering or running out at the wrong moment.

Client portals and approval workflows are increasingly what growing professional services firms need. An accountancy practice or a small consultancy sharing documents, getting sign-off on deliverables and tracking client requests via a spreadsheet and email threads is just asking for things to fall through the gaps.

Off-the-shelf SaaS vs bespoke software

Before we talk about going bespoke, it’s worth being honest about the alternatives, because bespoke isn’t always the right answer and we’d rather tell you that upfront.

Off-the-shelf SaaS tools (project management platforms, CRM systems, scheduling apps) are often the right starting point. They’re fast to set up, reasonably priced per user, and well-supported. If your process is fairly standard and the tool does 90% of what you need, use it.

The problem comes when the tool does 70% of what you need and the other 30% is business-critical. You end up bending your process to fit the software, bolting on workarounds, and ironically maintaining a spreadsheet alongside it to cover the gaps. Custom software shaped around your actual workflow eliminates that problem entirely, because it’s built around how your business genuinely operates, not how a SaaS vendor wishes you operated.

The honest answer is: start with off-the-shelf if it fits. Move to bespoke when it demonstrably doesn’t, and when the cost of the workarounds outweighs the cost of building something that actually works.

The honest cost comparison

The upfront cost of bespoke software is the thing that makes most SME owners hesitate. Fairly so. A focused single-purpose custom application from a reputable UK agency typically starts from around £10,000 to £30,000 for a simple internal tool, covering one core workflow, one or two integrations and a small user base. That’s roughly the right level for replacing a specific spreadsheet-based process or building a lightweight portal. More complete builds for established SMEs commonly fall in the £15,000 to £80,000 range depending on complexity.

Those numbers sound significant. But consider what the spreadsheet workaround is actually costing you right now. Think about the hours spent manually re-entering data across systems, the time lost to version disputes, the mistakes that need unpicking, and the senior staff time tied up managing a process that should be automated. For many businesses, that hidden cost is substantial in lost productivity and errors. It just never appears as a line item.

It’s also worth building in around 15 to 25 per cent of the original build cost each year for ongoing maintenance and support, so factor that into your calculations. A £20,000 tool might cost you £3,000 to £5,000 a year to keep current. Compare that honestly against your current situation.

It’s also worth knowing that the HMRC R&D tax relief scheme, which now operates as the merged RDEC scheme alongside the Enhanced R&D Intensive Support (ERIS) scheme for qualifying R&D-intensive SMEs, can offset some development costs depending on your circumstances. It’s worth speaking to your accountant about eligibility before you write off the investment.

A simple self-assessment before you commission anything

Before you pick up the phone to any developer, ask yourself these five questions honestly.

1. Is this process genuinely business-critical? If the system fails or produces wrong data, does it directly affect revenue, compliance or customers? If yes, it deserves proper infrastructure, not a spreadsheet.
2. Are more than two or three people involved? Multi-user processes in spreadsheets are where errors and version conflicts multiply. If your team is growing, this pain will only get worse.
3. Have you tried an off-the-shelf tool and found it lacking? If a well-regarded SaaS product handles your process cleanly, use it. If you’ve already tried and found yourself back in a spreadsheet six months later, that’s a strong signal.
4. Can you clearly describe your process, start to finish? Bespoke builds go best when the business owner understands their own process well. If you can walk someone through exactly what happens from trigger to outcome, you’re ready to have a productive conversation with a developer.
5. Is the cost of doing nothing higher than the cost of fixing it? Calculate what the current chaos is costing you in hours per week, then multiply by your hourly rate. Be honest. That number often surprises people.

If you answered yes to three or more of those, it’s worth having a conversation about what a bespoke solution could look like.

What the build process actually looks like

A lot of SME owners are put off by the idea of commissioning software because they assume it’s a long, technical, expensive affair where they hand over a vague brief and six months later get something that doesn’t quite work. That’s understandable, but it doesn’t have to be the experience.

For a focused SME tool, the process tends to look something like this.

Discovery. A good agency starts by understanding your process deeply before writing a line of code. What does your current spreadsheet actually do? What are the inputs, outputs and edge cases? Who uses it and how? This is the stage that separates a solid build from an expensive misunderstanding. Expect one to three focused sessions.

Build and review. Development happens in stages, with working prototypes shown to you early so you can give feedback before anything is set in stone. You don’t need to understand the code. You need to know whether what you’re seeing reflects how your business works.

Handover and support. A proper handover includes documentation, staff training and a support arrangement so you’re not left stranded when something needs updating. A focused tool at the simpler end of the scale typically takes four to eight weeks to deliver.

The businesses that get the most from this process are the ones who stay engaged throughout, bring the people who actually use the current system into the conversation, and are honest about what’s working and what isn’t.

Choosing the right partner

Custom software for UK SMEs is no longer a luxury reserved for businesses with enormous tech budgets. It’s the practical answer when off-the-shelf tools built for the average business don’t fit the way your business actually runs. But the partner you choose matters as much as the decision to build.

Look for an agency that asks more questions than it answers in the first conversation. One that pushes back if your brief is vague, suggests starting smaller if that’s the sensible approach, and has genuine experience working with businesses of your size rather than primarily enterprise clients.

At Cardiff Web, we work with UK SMEs on exactly these kinds of projects. We bring together web development expertise with a practical understanding of how small businesses actually operate, and we’ll tell you honestly if a simpler or cheaper solution would serve you better. If you’re at the point where a spreadsheet is costing you more than it’s saving, it’s worth a conversation.

What’s possible might surprise you

You don’t need a fully formed specification to start. Most good projects begin with a business owner describing a problem, not a technical document. If you’re managing something genuinely important on a spreadsheet and it’s starting to feel like a liability, talk to us about it.

Take a look at our bespoke software services for UK SMEs and get in touch. No jargon, no hard sell, just a practical conversation about what would actually help.

The post When Your Spreadsheet Becomes a Business Risk appeared first on Cardiff Web.

There’s a good chance E-E-A-T is part of the answer. It’s not a magic algorithm switch or a technical setting anyone can flick. It’s Google’s way of asking a simple question about every website it indexes: does this site deserve to be trusted? If the answer isn’t clearly yes, your pages are going to struggle, no matter how well you’ve researched your keywords.

What E-E-A-T actually stands for

E-E-A-T stands for Experience, Expertise, Authoritativeness and Trustworthiness. Google added the first E for Experience in December 2022, recognising that first-hand, lived experience with a topic is a meaningful quality signal. Before that it was just E-A-T, which had been part of Google’s thinking since 2014.

Here’s what each letter means in plain terms, with a real example for each.

Experience is about whether the person behind the content has actually done the thing they’re writing about. A Cardiff-based plumber writing about boiler faults they’ve fixed themselves is demonstrating experience. A piece of generic copy that could have been written by anyone, about anyone, anywhere, is not.

Expertise is about depth of knowledge. You don’t need formal qualifications to have it. A plumber with 20 years of hands-on experience is an expert. What matters is that your content and your service pages show you genuinely know your subject, not just that you can string industry terms together.

Authoritativeness is about whether others recognise your expertise. It’s the external validation: who links to you, who mentions you, what your reviews say. A local accountancy firm that gets mentioned in a regional business publication is building authority. One that exists only within its own website is not.

Trustworthiness is the foundation the other three rest on. Google’s own guidelines make clear that without it, the rest does not save you. It covers things like whether your site is secure, whether your contact details are accurate and findable, and whether your business generally behaves like a legitimate operation.

Why Google introduced E-E-A-T

Google’s old approach was largely about matching keywords. Type in “emergency plumber Cardiff” and Google would find pages that contained those words. The problem was that anyone willing to stuff those phrases into a page could game the system, and some genuinely harmful content, particularly in health and finance, was ranking well as a result.

That’s where YMYL comes in. It stands for “Your Money or Your Life” and refers to content that can directly affect a person’s health, financial wellbeing, safety or happiness, including medical advice, financial guidance and legal information. Google holds YMYL pages to a significantly higher E-E-A-T standard, because poor information in these areas can cause real harm.

E-E-A-T was Google’s answer to the keyword-gaming problem. Rather than just reading what a page says, Google’s systems now look at your entire digital footprint, not just what’s published on a single URL.

It’s also worth understanding how this works behind the scenes. Google’s Search Quality Rater Guidelines are a 182-page manual that trained human contractors use to score search results. The current version dates from September 2025. Raters don’t change your rankings directly; their scores help train Google’s algorithms over time. So E-E-A-T isn’t a single ranking factor you can tick off a checklist. It’s a set of signals baked into how the whole system thinks about quality.

Why it matters more in some industries

If you run a financial planning firm, a legal practice, a private health clinic or a pharmacy, E-E-A-T is non-negotiable. The March 2026 core update reinforced this: sites in health, finance and legal categories without strong E-E-A-T signals saw rankings drop, with Google favouring content that demonstrates clear, verifiable expertise and authorship. YMYL content continues to attract the highest scrutiny.

But don’t assume it doesn’t matter if you’re a florist, a letting agent or a joinery business. Every SME website is being assessed by these signals now. The difference is simply how severely Google penalises a weak score. E-E-A-T also shapes which pages appear in AI Overviews alongside traditional search results, which means even a local Cardiff tradesperson’s website is being evaluated for credibility every time Google recrawls it.

Experience: showing Google you’ve actually done the work

This is where a lot of small business websites fall down. The “we provide great service and quality workmanship” homepage copy that most SMEs inherited from a template tells Google nothing about real-world experience. Compare that to a roofing company that publishes before-and-after photos of an actual job in Newport, explains why they recommended a particular tile type for that property, and names the team member who did the work. That’s experience in action.

Clear author bios, original photos or videos, documented processes and real examples all help signal that your content comes from lived involvement rather than research alone. Case studies, project write-ups and honest FAQs based on questions customers actually ask are all ways to build this without a big budget or a developer.

Content that demonstrates genuine first-hand experience, through specific details, original outcomes and real author credentials, consistently outperforms comprehensive but impersonal information pages. That’s good news for small businesses willing to share what they genuinely know.

Expertise: demonstrating you know your subject

Expertise shows up in the quality and depth of your content. A clear, well-written services page that explains what you do, who it’s for and what the process looks like is a start. A blog post that answers a specific question your customers ask every week is better still.

The danger to avoid is thin content. Pages coasting on keyword density, shallow coverage or bulk AI-generated copy have dropped following recent core updates. A 300-word service page that says nothing specific, or a blog post that could apply to any business anywhere, is actively working against you.

Think about what a local accountant in Cardiff actually knows that a general finance website doesn’t. They know the quirks of running a limited company as a sole trader in Wales. They know what questions clients ask at their first meeting. They know what HMRC tends to query for their type of client. That knowledge, written up clearly, is exactly the kind of expertise Google can recognise and reward.

If you’re thinking about how your website content strategy fits into your broader search engine optimisation efforts, expertise-led content is one of the most durable foundations you can build on.

Authoritativeness: earning recognition beyond your own website

You can write the most authoritative content imaginable, but if the rest of the web doesn’t acknowledge you exist, Google has less reason to trust you. Authoritativeness is largely an off-site game, and it’s the one most generic E-E-A-T guides tend to under-cover.

For a small business, this doesn’t mean building hundreds of backlinks through shady directories. What counts is link earning: creating content that others choose to pick up and reference, supported by a sensible approach to digital PR. A mention in a genuine industry publication carries far more weight than a dozen low-quality directory listings.

Practical steps for SMEs include getting listed on reputable UK trade directories relevant to your sector, encouraging satisfied customers to leave reviews on Google and Trustpilot, looking for local press opportunities (a regional business story or a comment in a trade publication works well), and making sure your Google Business Profile is complete and regularly updated. None of these cost much. All of them add up.

Trustworthiness: the signals that reassure Google and your visitors

Google’s own guidelines describe Trust as the most important member of the E-E-A-T family. A page can show genuine expertise and still receive a poor quality rating if it isn’t trustworthy.

Some of this is technical. Your site needs HTTPS, meaning it loads over a secure connection and shows the padlock in the browser bar. If your site still loads over plain HTTP in 2026, that’s a basic credibility failure and a straightforward fix.

NAP consistency matters too. Your name, address and phone number should be identical across your website footer, Google Business Profile, social profiles and any directory listings. Discrepancies suggest an unmaintained or possibly unreliable business.

Beyond the technical, think about whether your site looks and feels like a legitimate operation. A clearly written privacy policy, a genuine About page that explains who you are and where you’re based, and visible, consistent contact details all contribute to this. A visitor, or a Google quality rater, should never have to wonder whether your business is real.

If your site’s design is undermining your trust signals, that’s a conversation worth having. Good website design isn’t just about looking nice. It’s a direct input into whether Google and your visitors trust you enough to stay.

Common E-E-A-T mistakes UK small businesses make

Most of the issues we see are surprisingly straightforward to fix once you know what to look for.

• Anonymous content with no author attribution. Blog posts and service pages that don’t say who wrote them or who the business is run by. Add author bios with a real name, a brief background and a photo.
• No About page, or a vague one. “We’re a passionate team dedicated to excellence” tells Google nothing. Name your key people, explain your background and be specific about where you operate.
• Stock photos everywhere. Generic images signal nothing about your actual work. Use real photos of your team, your premises or completed projects wherever you can.
• Thin service pages. A page that says “we offer X service in Y area, contact us” is not competing with a page that explains the process, common questions, pricing guidance and who it’s suitable for.
• No reviews, or reviews only on one platform. Spread your review gathering across Google, Trustpilot and any sector-specific platforms. The volume and recency of reviews both matter.
• Outdated content left to go stale. Regular audits and updates to old pages help keep trust signals strong over time. A blog post from 2019 with incorrect information is worse than no blog post at all.
• HTTPS not in place. Still surprisingly common on older sites. Check your browser bar. If it shows a warning rather than a padlock, this needs fixing today.

A practical E-E-A-T audit any SME owner can run today

You don’t need an SEO agency to do an initial check. Work through this list on your own site and be honest about what’s missing.

1. Does every page of content have a named author or clearly attributed business? Are there bios with real credentials?
2. Is your About page specific? Does it name key people, explain your background and make clear where you’re based?
3. Do your service pages go beyond a sentence or two? Do they answer the questions a new customer would actually have?
4. Do you have real photos of your work, your team or your premises, rather than stock images?
5. Is your site running on HTTPS? Check the padlock in your browser bar.
6. Is your business name, address and phone number identical everywhere it appears: on your site, your Google Business Profile and any directories?
7. Do you have a privacy policy and clear contact details accessible from every page?
8. Are you actively collecting reviews on Google and at least one other relevant platform?
9. Have you had any backlinks or mentions from credible external sites, local press or trade publications in the past year?
10. Are there any pages on your site that are thin, outdated or essentially duplicates of each other?

If you’re ticking most of these boxes and your rankings still aren’t moving, the issues are likely more technical or structural. That might mean web development problems affecting crawlability, or a more strategic SEO gap that needs proper analysis.

If the basics are covered but rankings are still flat

E-E-A-T shifts the fundamental question from “what keywords am I targeting?” to “why should Google trust me?” That’s a more honest question, and it tends to produce better websites as a side effect.

The good news is that most of what it takes to improve your E-E-A-T is just good business practice made visible. Real experience, genuine expertise, a professional-looking site and a reputation you’ve earned. You probably already have those things. The work is in making them legible to Google.

If you’ve worked through the checklist above and things still aren’t moving, it’s worth getting a proper look under the bonnet. Our SEO services are built around exactly this kind of analysis, helping UK SMEs understand where their trust signals are falling short and what to do about it.

The post What Is E-E-A-T and Why Does Google Care appeared first on Cardiff Web.

Research shows that around 94% of first impressions are design-related, with users forming opinions in as little as 50 milliseconds. Visual quality signals overall brand quality and trustworthiness.
The cues your site gives off in that window either earn trust or erode it.

For UK small businesses, this matters enormously. A Cardiff plumber, a Swansea accountant, a Bristol online gift shop, they’re all competing against bigger brands with polished marketing teams. Trust signals are often the difference between a visitor who clicks away and one who picks up the phone. Getting them right isn’t complicated, but it does require deliberate design decisions. And that’s exactly what most SME websites get wrong.

What trust signals actually are

A trust signal is any element on your website that answers the question a sceptical visitor is silently asking: “Can I rely on these people?” It might be a review, a photo of your actual premises, a Gas Safe logo, a visible phone number, or plain-English language about what happens if something goes wrong. Every single element sends a signal. The question is whether those signals are working for you or against you.

Trust signals aren’t just a few padlock icons and a Google badge. They include your photography, your reviews, your physical address, your accreditations, your guarantees, the language you use, and even how easy it is to find your contact details. Together, they either build a picture of a credible, real business, or they don’t.

The seven trust signals that matter most

1. Reviews and testimonials

This is the big one.
According to BrightLocal’s 2024 survey, 79% of consumers trust online reviews as much as personal recommendations from friends and family.

And 77% of consumers always or regularly read reviews when browsing online.
Your visitors trust strangers more than they trust your own marketing, and that gap isn’t narrowing.

Research shows products with 50 or more reviews see 37% higher conversion rates, as higher review volumes signal an established business and reduce the perceived risk of buying.
For a UK service business, Google reviews are particularly important. Make it easy for happy customers to leave them, and make sure those reviews are visible on your website, not just buried on your Google Business Profile.

2. Professional photography versus stock images

Stock photos of people shaking hands in a glass-walled office don’t fool anyone.
Users trust images of real people 20% more than stock photos.
Real photos of your team, your premises, or your work tell a visitor there’s a genuine human business behind the website. A plumbing firm that shows their actual engineer in uniform, standing next to a real van, will beat a site full of generic stock every single time. This matters most on your homepage and About page, where first impressions count most.

3. Accreditations and industry memberships

If you’re a Gas Safe registered engineer, an ICAEW member, or an FCA-authorised firm, those logos need to be visible. For a visitor who has no prior knowledge of you, third-party validation from a recognised body does real heavy lifting.
Too many trust badges can backfire; the best approach uses strong, familiar trust elements that address specific customer concerns at key decision points.
A legal services firm needs different accreditations on display than a kitchen fitter, so be selective and stay relevant.

4. Clear contact details and a physical address

This seems obvious, but you’d be surprised how many SME websites bury their address in a tiny footer or hide behind a contact form only. For a UK business serving local customers, showing your town or city upfront says: we’re real, we’re local, and we’re here. Your contact details should be visible on your homepage, your footer, and your contact page. A PO box alone doesn’t cut it, and neither does a generic enquiry form with nothing else around it.

5. SSL/HTTPS and security indicators

If your website still shows “Not Secure” in the browser bar, visitors will notice, consciously or not.
A secure HTTPS connection, fast page load times, and a smooth user experience show both users and Google that your site is safe and reliable.
For a service business with a contact or booking form, this applies just as much as it does for an e-commerce shop. It’s a basic requirement in 2026, not a nice-to-have.

6. Guarantees and transparent policies

A clear, plain-English satisfaction guarantee or refund policy reduces the perceived risk of getting in touch or buying. For a small business without a household name behind it, a simple “not happy, we’ll put it right” statement can shift hesitant visitors into active enquirers. Keep the language human. “We’ll always respond within one working day” is far more reassuring than a dense block of terms and conditions nobody reads.

7. Case studies and social proof

Case studies increase B2B landing page conversions by 22%.
A brief case study doesn’t need to be an essay. Even a short paragraph explaining the client’s problem, what you did, and the outcome is far more convincing than a generic list of services. For a B2B business especially, specific proof of outcomes wins over vague claims every single time.

Placement is as important as presence

Here’s the mistake most SME websites make. They collect the trust signals, tick the boxes, and then put them all on a page nobody scrolls to. A “Testimonials” tab buried in the navigation, a row of logos hidden in the footer, an accreditation badge visible only if you scroll past the third section. The signals are technically there. They’re just not working.

The first screen is where visitors decide whether to keep reading. Put one high-quality proof element beside your primary call to action. Think of it as a confidence nudge rather than a proof dump. Short, genuine testimonials near the top of the page, not a dedicated section below the fold, make a real difference. Similarly, security reassurances and guarantee statements work best right next to your calls to action, where hesitation naturally lives.

Think of each page as having a job to do. Your service page needs reviews specific to that service. Your contact page needs a visible address, phone number, and a reassuring line about response times. Your pricing page, if you have one, needs a guarantee front and centre.

Good website design is precisely about making these decisions intentionally, not just dropping elements onto a page and hoping for the best. The layout, the visual hierarchy, and the positioning of each element all determine whether a visitor feels confident or confused.

Common trust signal mistakes

There are a few errors we see regularly on SME websites that actively damage credibility rather than building it.

• Generic badge overload. A row of ten padlock and shield icons from unknown providers doesn’t say “secure,” it says “desperate.”
  Your site works better with one or two strong, recognisable signals instead of dozens of logos.
• Fake-looking stock photos. Smiling models in sterile offices are instantly recognisable and instantly off-putting. Use real images wherever you possibly can.
• Stale testimonials.
  Standards are rising: 68% of consumers now require a minimum 4-star rating, and 74% look for reviews from the last three months.
  A testimonial with no date raises questions rather than answering them. Keep them current and, where possible, link to verified third-party reviews on Google or Trustpilot.
• Invisible contact information. If a visitor can’t find a phone number or address in under ten seconds, you’ve lost them. This is especially damaging for service businesses where personal contact is part of the proposition.
• Vague social proof. “Trusted by thousands” without any supporting evidence is meaningless. “142 five-star Google reviews” is believable. “Trusted by thousands of happy customers” is not.

How trust signals connect to SEO

Getting your trust signals right isn’t just good for conversions, it also matters for how your site performs in search.
In 2026, Google’s E-E-A-T framework (Experience, Expertise, Authoritativeness, Trustworthiness) directly shapes which pages surface in search results. The difference between a page that ranks and one that doesn’t often comes down to four signals: who wrote it, who links to it, what customers say about the business, and whether the content reflects real-world experience.

Trust signals including reviews, brand mentions, and citations now impact SEO more directly than they used to.
For local businesses in particular, Google Business Profile reviews, consistent name and address data across directories, and local mentions all feed into the signals Google evaluates for local rankings. A small business with strong reviews and a well-maintained profile can outrank a larger competitor with a bigger budget but less local credibility.

A page that’s genuinely credible, with real author credentials, verified reviews, and clear business details, also earns links from other sites more naturally, which supports rankings further. Trust isn’t just a conversion lever. It’s an SEO asset too.

A quick self-audit: five questions to check your site right now

Open your website homepage on your phone and honestly answer these five questions.

1. Can you see a genuine customer review above the fold, without scrolling? If not, move one up.
2. Is there a phone number or email address visible on the first screen? If it’s only in the footer, that’s not enough.
3. Are the photos real images of your actual business, team, or work? If the answer is “mostly stock,” that’s worth fixing.
4. Does your contact or booking form have any reassurance near the submit button? “We’ll never share your details” or a visible SSL indicator does more than you’d expect.
5. Is your most relevant accreditation or industry membership visible without hunting for it? If it’s only on your About page, you’re probably not getting the benefit.

If you answered “no” to two or more of those, your site is almost certainly losing enquiries it should be winning.

It’s also worth making sure your web development setup is solid on the technical side. Fast page loads, a valid SSL certificate, and a mobile-friendly layout all contribute to the overall impression of a trustworthy, professional business, and none of them are optional in 2026.

If your site isn’t earning trust, it isn’t earning enquiries

Trust doesn’t happen by accident. It’s the result of deliberate design choices, genuine proof, and putting the right signals in front of the right visitor at the right moment.
Displaying a well-known security seal alone can sometimes produce dramatic results, one case study recorded a 42% increase in conversions from adding a single trust badge to a page.
For a small business, even a modest improvement in enquiry rates from existing traffic makes a real difference to the bottom line.

At Cardiff Web, conversion-focused website design is built around exactly this kind of thinking. We don’t just make sites look professional, we make sure every page is structured to reduce doubt and encourage action. If you’d like an honest view of where your trust signals are helping or hurting you, get in touch.

The post Website Trust Signals That Win More Customers appeared first on Cardiff Web.

You spend a few thousand pounds on a new website. It launches, it looks great, the team is pleased, and then nothing. It sits there. Months pass, maybe years. Nobody updates the plugins, nobody checks the backups are actually working, and the only time anyone logs in is to change a phone number.

This is the single most common website mistake we see from UK small and medium businesses. The site was treated as a project with a finish line, rather than an asset that needs ongoing care. And the thing is, it usually looks fine right up until the moment it doesn’t. A form stops working. A plugin update quietly breaks the homepage. Or, worse, the site gets hacked and the first you hear about it is a panicked call from a customer asking why your website is serving up pharma spam.

A proper web development and maintenance service treats your site as a living system, not a one-off deliverable. That shift in thinking is what a website care plan is all about.

What a website care plan actually is

A website care plan, sometimes called a website maintenance plan or managed website plan, is a recurring monthly service that keeps your site secure, up to date, fast and functional. It covers the technical work that needs doing whether or not anything has visibly gone wrong.

What it is not is a retainer for redesigning pages on demand, writing your blog posts, or running your social media. Those are separate services. A care plan is closer to a service contract on a company car. You’re paying so that someone qualified is keeping the engine healthy, the tyres inflated and the MOT current. You’re not paying for a new paint job every month.

The components that matter most are hosting, security monitoring, software updates, automated and tested backups, uptime monitoring, and a small allowance of developer time each month for minor fixes and tweaks. If a plan you’re looking at is missing any of those, it has gaps.

The real cost of not having one

The honest argument for a care plan is financial, not technical. Consider what goes wrong when maintenance is skipped.

Security breaches. According to the UK Government’s Cyber Security Breaches Survey 2025/2026, 43% of UK businesses identified a cyber security breach or attack in the last 12 months. Outdated website software, particularly unpatched plugins and themes, is one of the most common ways attackers get in. Cleaning a hacked website costs between £500 and £3,000 for most small business sites, and that is the technical work alone. It does not include lost revenue from being offline, reputational damage, or the weeks it can take for Google to re-index a site that was temporarily blacklisted for malware.

Emergency developer rates. Ad hoc developer support in the UK typically runs at £50 to £150 per hour. If you have no maintenance plan and something breaks, that is what you pay. Over a year, ad hoc support nearly always costs more than a monthly plan, even if you only call on it occasionally.

Broken forms and missed leads. A Cardiff plumber whose contact form stops submitting has no idea how many enquiries have disappeared into the void until they notice the phone has gone quiet. A small accountancy firm running a booking form that returns an error every Tuesday afternoon is quietly losing clients to competitors. These things happen, and they happen more often on sites that are not being actively monitored.

Downtime. Being offline, even briefly, costs you enquiries and revenue. Add in the reputational hit if customers reach a broken page or a security warning, and the sums mount quickly. Most of this is entirely preventable with basic uptime monitoring and prompt support.

What a proper plan must include

Not all care plans are equal. Here is what a genuinely useful plan covers, and why each element matters.

Managed hosting. Your hosting environment is the foundation everything else sits on. Slow, unreliable shared hosting is a real risk, not least because site speed now directly influences your search rankings. Good managed hosting on quality infrastructure should be part of any plan worth signing up to.

Security monitoring and software updates. WordPress, WooCommerce and other CMS platforms release updates regularly, and those updates frequently patch known vulnerabilities. An unpatched plugin is an open door. A plan should include regular, human-reviewed updates rather than just automated pushes that nobody checks.

Backups and restore testing. This one is underrated. Almost every basic plan includes backups. Far fewer actually test that those backups restore correctly. A backup you have never tested is not a backup, it is a hope. Your plan should specify how often backups run, how long they are retained, and whether restore testing is included.

Uptime monitoring. You should not have to rely on a customer telling you the site is down. Uptime monitoring alerts you the moment the site becomes unavailable, so problems get fixed in minutes rather than hours or days.

A monthly developer time allowance. Small things come up every month. A link needs updating, a PDF needs replacing, a phone number changes. Having a small block of developer time in the plan means these get done promptly rather than sitting on a to-do list for three months.

What cheap plans quietly leave out

Budget plans at the lower end of the market, typically under £40 per month, can look appealing on a spreadsheet. But the economics only work through automation and volume. Updates are pushed automatically, support goes through a ticket queue, and the service is largely hands-off. For a very simple site that rarely changes, it might be adequate. For most SME sites, it is not.

The gaps that turn into nasty surprises include: no human review of updates before they go live, meaning a plugin conflict breaks your homepage and nobody notices until a customer emails you; no actual restore testing of backups; no developer time allowance, so every small fix becomes a separate billable job; slow or non-existent support response times; and hosting bundled in from the cheapest possible provider to protect the plan’s margin.

At a minimum, website maintenance should cover CMS core, plugin and theme updates; regular backups with a tested restore process; basic security monitoring; and domain and SSL certificate renewal management. Anything that does not clearly cover all of those is leaving things out.

The three main tiers and what suits each business

For most UK small and medium businesses, professional website maintenance costs somewhere between £50 and £350 per month. There are broadly three tiers.

Basic (roughly £40 to £80 per month). At this level you are getting automated plugin and theme updates, scheduled backups, uptime monitoring and basic security scanning, with little or no human review involved. This suits a simple brochure site for a local service business that rarely changes and does not process payments or bookings online.

Managed (roughly £80 to £200 per month). This tier includes everything in the basic tier, plus human-reviewed updates, tested backups, a monthly developer time allowance for minor fixes, and faster support response times. This is the right level for most active SME websites: a services company running lead generation forms, a trade business with a portfolio, a local e-commerce shop, or a professional services firm where the website actively wins clients.

Premium (roughly £200 to £500 per month). At the higher end you are buying dedicated account management, regular strategy reviews, more developer time, priority support and in some cases SEO health checks or content updates. This level suits businesses where the website is a primary revenue channel and any downtime or performance drop has a direct financial impact.

DIY maintenance and what it actually costs you

Some business owners choose to handle maintenance themselves to avoid the monthly cost. It is a fair decision, but it is worth being clear-eyed about what you are taking on.

Maintenance is not passive. It requires real time, real attention and real expertise every single month. For a typical WordPress site, running and reviewing updates, checking backups, monitoring security alerts and dealing with minor issues takes a minimum of two to three hours per month once you factor in testing. If something goes wrong during an update, or a backup turns out to be corrupt, you are suddenly looking at an afternoon of your time or an emergency call to a developer at those ad hoc hourly rates.

For most SME owners, their time is worth more than the cost of a care plan. A solicitor, a plumber or an accountant billing at a professional rate is almost certainly not saving money by doing their own plugin updates at 9pm on a Sunday.

How your care plan connects to SEO and site performance

A poorly maintained website does not just risk downtime. It quietly damages your search rankings too.

Google’s March 2026 core update made Core Web Vitals significantly more consequential. The headline change is structural: performance is now evaluated across your entire site rather than page by page. A handful of slow-loading templates can drag down rankings across your whole domain, even on pages that individually load quickly. Early tracking data following the rollout showed affected sites experiencing meaningful traffic drops, with some losing over 50% on their worst-hit sections.

An unmaintained site tends to slow down over time as database bloat accumulates, image libraries grow unoptimised and plugins multiply. A good care plan includes periodic performance checks and optimisations to keep your site in the shape it needs to be in to compete. This is where SEO and ongoing maintenance naturally overlap. You cannot rank well with a slow, broken or compromised site, no matter how strong your content is.

Five questions to ask any provider before you sign up

1. Is hosting included, and what infrastructure does it run on? Managed hosting bundled into the plan is a strong positive. Generic shared hosting is not.
2. Are updates reviewed and tested by a human before they go live? Automated-only update plans leave you exposed when a plugin update conflicts with your theme or breaks a key page.
3. How are backups stored, how often do they run, and do you test restores? Ask specifically whether restore testing is included, not just backup creation.
4. What is the support response time, and how do I contact you in an emergency? A ticket queue with a 48-hour SLA is not the same as a phone number and a four-hour response commitment.
5. Is there a monthly developer time allowance, and what does it cover? Know upfront what is included and what triggers an additional charge. Surprises on an invoice are avoidable if the scope is clear from the start.

How Cardiff Web approaches ongoing website support

We work with small and medium businesses across Wales and the wider UK, and ongoing website support is a natural extension of the work we do building and developing sites. If we built your site, we already know how it is structured, which makes maintenance faster and more effective. If you have a site built elsewhere, we are happy to take it on after an initial audit.

Our approach to web development and ongoing support is grounded in the idea that a website is a business asset, and assets need managing. That means proper hosting, security that is actually monitored, backups that are tested, and a real person who picks up the phone or responds promptly when something needs attention.

We also understand how maintenance connects to broader digital performance. A site we look after is one we can advise on from a performance and search visibility perspective too, because the two are inseparable. And if a site has grown beyond what maintenance can solve and genuinely needs new functionality or a rebuild, we offer bespoke software development to take things further.

If you are not sure what level of care your current site needs, the best starting point is a conversation. Get in touch and we will take a look, give you an honest assessment, and explain exactly what we would recommend and why.

The post Website Care Plans What UK SMEs Actually Need appeared first on Cardiff Web.

Then you grow. The workarounds start. Someone builds a spreadsheet to fill the gap between two tools that won’t talk to each other. A new team member means another monthly licence fee. You spend forty minutes every Friday manually copying data from one system into another because there’s no integration. Sound familiar?

This is the hidden cost of making do, and it catches a lot of growing UK businesses off guard. The question isn’t whether off-the-shelf software was the right call at the start. It almost certainly was. The question is whether it’s still the right call now, and how you work out when it isn’t.

What ‘off the shelf’ actually means

Off-the-shelf software, sometimes called Commercial Off The Shelf or COTS, refers to ready-made tools built to serve a broad market. Think Salesforce for CRM, Sage for accounting, Shopify for e-commerce and Microsoft 365 for productivity. These products are used by thousands or millions of businesses and are maintained and updated by the vendor.

Most of the SaaS (Software as a Service) subscriptions your business uses fall into this category. You pay a monthly or annual fee, you get access to a hosted product, and the vendor handles the infrastructure, security patches and new features. It’s a genuinely good model for a lot of tasks.

Bespoke software, by contrast, is custom-built specifically for your business, designed to match your exact workflows, integrate with your existing systems and solve your specific problems. In the UK we tend to say bespoke; internationally the same thing is called custom software. Same idea.

Why off the shelf is the right starting point

It genuinely is, and it’s worth saying that clearly before anything else. Off-the-shelf software is the right answer for most small businesses most of the time. You pay a monthly fee, get a working system in days rather than months, and let the platform handle the infrastructure while you focus on your actual business.

You also benefit from a product tested by thousands of other businesses, with proper support documentation and regular updates baked in. The development costs are spread across a huge user base, which is why the monthly price feels so reasonable.

A Cardiff-based accountancy firm with five staff doesn’t need a custom-built bookkeeping system. A plumber with two vans doesn’t need a bespoke job management platform from day one. Standard tools do the job, and spending money on custom software before you’ve outgrown the standard tools would be a waste.

When the cracks start to show

The trouble is, the tipping point sneaks up on you. Here are five signs your off-the-shelf stack is becoming a brake on your business rather than a foundation for it.

1. The workarounds are piling up

If your team has developed a series of manual steps, spreadsheets or copy-paste routines to make their software do what they actually need, that’s a signal. Those workarounds aren’t free. They take time, they introduce errors, and they scale badly as you hire more people. When a business starts operating around its tools instead of its outcomes, something has gone wrong.

2. Per-user licence costs are spiralling

Per-seat pricing means every new hire adds to your monthly bill, often automatically. A few pounds per user per month sounds trivial until you’re running five tools and your team has grown. Bespoke software carries no per-user licensing fees, so you can add fifty or five hundred users at the same infrastructure cost. At a certain team size, that distinction matters enormously.

It’s also worth auditing what you’re actually paying for. Most businesses accumulate SaaS subscriptions over time without ever stopping to check which tools are still being used or whether they’ve upgraded to tiers they don’t need. Add it up across a year and the figure is often a surprise.

3. Integrations are poor or non-existent

If you’re running five different tools and none of them communicate properly, you’re not running one efficient operation. You’re running five separate operations and hoping they add up to one. Integration problems are one of the most common reasons businesses start thinking about bespoke software, because the hidden cost of stitching tools together, whether that’s staff time, third-party connectors or manual data entry, compounds quickly.

4. Your processes are shaped around the software, not your business

This one is subtle but important. If your sales team has changed how they qualify leads to fit the CRM’s fields, or your operations team runs jobs in a way that suits the project management tool rather than the actual job, you’ve already ceded control of your own processes to a vendor. The real question isn’t whether you need software. It’s whether you should keep bending your business around existing tools, or build software that bends around your business instead.

5. A feature you genuinely need is stuck on the vendor roadmap

Vendor roadmaps are built for their most common customers, not for you. A feature request that a bespoke developer could build in a few weeks may sit on a vendor’s list for years, or never arrive at all. And if the vendor is acquired, pivots or discontinues the product, your business carries the consequences. You have no control over any of that.

The real cost comparison

Most businesses compare the upfront subscription cost of SaaS against the upfront build cost of bespoke software, and conclude that SaaS is cheaper. That comparison is usually incomplete, because it ignores total cost of ownership.

The true cost of a SaaS stack goes well beyond the headline monthly fee. Implementation, integrations, support tiers and per-user upgrades all add to the bill. Layer on top of that the staff time lost to workarounds and manual data entry, and the cost of third-party connectors to stitch tools together, and the real figure often looks quite different.

Bespoke software development has higher upfront costs, but no recurring licence fees at scale, no per-user penalties and no dependency on a vendor’s pricing decisions. Over a three to five year horizon, the numbers often look very different to the initial comparison. That’s not always the case, but it’s worth doing the maths honestly before you assume SaaS is cheaper.

What bespoke software actually costs in the UK in 2026

This is the question most people want a straight answer to, so here it is. Bespoke software development in the UK currently costs anywhere from around £10,000 to £500,000 or more, depending on complexity. For most SME-scale projects, the range is considerably narrower than that.

A focused, single-purpose tool, replacing a specific spreadsheet-based process or providing a lightweight portal for a defined use case, typically sits in the £5,000 to £15,000 bracket. The most common range for established UK SMEs commissioning custom software is somewhere between £15,000 and £80,000, covering multi-user systems with role-based permissions, a custom database, reporting dashboards, several integrations and GDPR-compliant data handling.

More complex platforms with polished front-end design, stronger reporting, tailored workflows and multiple user types tend to land between £50,000 and £150,000. This is the range where many growth-stage businesses invest when the software needs to improve operations significantly or deliver a better customer journey.

On top of the build cost, budget for ongoing maintenance. A reasonable expectation for most UK bespoke projects is around 15 to 25 per cent of the original build cost per year. That’s not a surprise charge; it’s the cost of keeping your software updated, secure and evolving with your business.

Our bespoke software service covers everything from scoping and specification through to build, testing and launch. We work with SMEs across the UK to find the right scope for their budget, rather than over-engineering from the start.

The hybrid model most growing businesses actually use

Here’s the thing: it’s rarely a binary choice between all-in on SaaS or going fully bespoke. The most practical approach is using off-the-shelf tools where they make sense, and custom software where it delivers the most value.

Think about a Cardiff-based facilities management company. Their accountant uses Xero, their email runs on Microsoft 365, and their HR platform handles payroll. None of those need to be custom-built; they’re commodity tasks that standard tools handle perfectly well. But the way they schedule engineers, track job status, invoice clients and manage compliance documentation is entirely specific to how they operate. That’s where bespoke software pays for itself, because no off-the-shelf job management tool will ever quite fit their model.

The same logic applies to an e-commerce business that runs its storefront on Shopify but needs a custom-built order management and fulfilment system on the back end to handle its specific stock rules and supplier integrations. Standard at the front, bespoke where it counts.

A well-designed bespoke system should also sit alongside your wider digital presence. If you’re investing in custom software to improve how customers interact with your business, it makes sense to ensure your website design and your software are built to work together, rather than presenting a patchwork of disconnected systems to your users.

Are you actually ready? Questions to ask first

Before you commission anything, honest answers to these questions will tell you a lot.

• Can you describe your problem clearly? If you can’t write down in plain English what the software needs to do and why your current tools don’t do it, you’re not ready to brief a developer. Get specific first.
• Have you added up the real cost of your current setup? Total up your monthly SaaS subscriptions, plus a rough estimate of staff time lost to workarounds each week. Multiply that out over three years. You may be surprised.
• Is this process stable enough to build around? Building software around a workflow that’s about to change is expensive. If your process is still being figured out, stay on flexible tools a little longer.
• Is this a genuine competitive differentiator? If the thing you want to automate is the core of how you make money and serve customers better than your competitors, bespoke software is a strategic investment, not just an IT purchase.
• Do you have someone internally who can own the project? You don’t need a CTO, but you do need one person on your side who can be the decision-maker, attend review calls and give clear feedback. Without that, projects drift.
• Are you thinking long term? The best software decisions look beyond features and price, and ask how a solution supports your business over the next three to five years.

It’s also worth knowing that some bespoke software projects may qualify for R&D tax relief under HMRC’s current merged scheme, which can offset a portion of your development costs. The qualifying bar is not trivial, so it’s worth asking your accountant about this before you start rather than assuming it applies.

Good web development and good bespoke software share the same foundation: understanding what a business actually needs before writing a single line of code. The best projects we work on start with a conversation, not a specification document.

Making a confident build-vs-buy decision

The honest answer is that most small businesses should stay on off-the-shelf tools until those tools are genuinely getting in the way of growth, not just occasionally frustrating. Commissioning bespoke software too early, before your processes are clear and stable, is a common and expensive mistake.

But once you’re past that point, once the workarounds are costing more than they save, the licence costs are climbing, and you’re running your business around your software rather than the other way around, staying put has its own cost. It just tends to be invisible.

The right question isn’t simply what bespoke software costs. It’s what staying with the wrong system is already costing you.

If you’re at that point, or think you might be getting there, we’re happy to have an honest conversation about whether a custom solution makes sense for your business, what it might involve, and whether the numbers actually stack up. No obligation and no sales pitch. Just a straight conversation. Take a look at our bespoke software service or get in touch with the team at Cardiff Web to start that discussion.

The post When Off-the-Shelf Software Stops Fitting Your Business appeared first on Cardiff Web.