Why Your Website Gets Traffic But No Calls

Why is more traffic the wrong answer?

Because traffic multiplies whatever your conversion rate already is, including zero.

The pattern we see constantly: an owner notices leads are flat, concludes they need more visibility, and buys ads. Traffic doubles. Leads stay flat. Now they are spending money to prove the same problem twice.

Run the arithmetic on your own numbers. A site getting a thousand monthly visitors at a one percent conversion rate produces ten leads. Doubling traffic gets you to twenty leads and doubles your acquisition cost. Doubling conversion to two percent gets you to the same twenty leads and costs nothing recurring.

The second one also improves every future traffic dollar you spend, because ads pointed at a page that converts perform better than the same ads pointed at a page that does not.

This is why we fix conversion before scaling traffic. Not because traffic does not matter, but because the order changes the economics permanently.

Problem 1: How fast does your site load on a phone?

Turn off wifi and load your site on cellular data. Count the seconds.

Past three seconds you are losing a meaningful share of visitors before anything renders. Most of your traffic arrives on a phone, frequently on an imperfect connection, often standing in a house with an active problem and low patience.

Speed is invisible to owners because you load your own site on office wifi on a desktop where everything is cached. It feels instant. It is not instant for the person who matters.

The usual causes are straightforward. Images uploaded at full camera resolution and never compressed. A page builder loading scripts and stylesheets for features the page does not use. Cheap shared hosting that slows down under load. A stack of plugins nobody has audited in three years.

All three are fixable without a rebuild, and this is typically the cheapest meaningful improvement available on any site we audit.

Problem 2: What does the top of your page say?

Open your busiest service page. Read only the first paragraph.

If it opens with your founding year, your commitment to quality, or your dedication to the community, you are losing people in the first four seconds.

The visitor arrived with a specific problem. They typed it into Google. They landed on your page. The first hundred words have exactly one job, which is to confirm they are in the right place and tell them what happens next.

What belongs there: what you do, where you do it, how pricing works or what a call costs, and how quickly you can be there. Plain language, no warmup.

This matters twice in 2026. A skimming buyer decides in seconds. And AI Overviews, ChatGPT Search, Perplexity, and Gemini lift clean, self contained answers from near the top of pages when they assemble responses. An answer buried in paragraph six does not get quoted by either audience.

The company history is not worthless. It just belongs further down, after the visitor has decided to keep reading.

Problem 3: How much are you asking for?

Count the fields on your contact form.

If a service quote request has twelve fields, that form is a filter, and it is filtering out the people who were ready to act. Every additional field costs you submissions, and the cost is steepest on mobile where typing is genuinely annoying.

Name, phone, and a short description of the problem. That is enough to have a conversation. Everything else can be asked on the call, by a person, which is a better experience anyway.

The objection is always the same: we need the details to qualify. You do not need them at the form. You need them before you dispatch a truck, and those are different moments separated by a phone call you now get to have.

Check the phone number too. On mobile it should be a tap to call link, visible without scrolling, in the header. A number that has to be copied and pasted is a number that does not get dialed.

Problem 4: Is there any proof before the scroll?

People decide fast and they decide on signals.

Somebody landing on your page has never heard of you and is thirty seconds from calling a competitor instead. What tells them you are real and competent, without requiring them to read anything?

Review count and rating, pulled live or displayed honestly. A hundred and eighty reviews at 4.9 does more work than three paragraphs of copy.
A specific result or number. Not we deliver quality service. Something concrete a competitor could not copy without lying.
The towns you serve, named. This confirms you are local, which is the thing they are actually checking.
Licensing, insurance, and relevant certifications. Table stakes, but their absence is noticed.
A real photo of real work. Stock imagery signals the opposite of what you want it to.

This costs nothing to add and it is the difference between a page that reads as a business and a page that reads as a template.

How do you know which problem you actually have?

Measure before you guess, because the fix is different depending on where people leave.

Three things to look at. Bounce rate on mobile specifically, separated from desktop, because a high mobile bounce rate with normal desktop numbers points straight at speed. Time on page, because visitors leaving in under fifteen seconds did not read anything, which points at the opening. And form starts versus form completions, because people who begin filling out a form and abandon it are telling you the form is too long.

If your analytics cannot answer those three questions, that is the actual first fix. Every optimization decision after this one depends on being able to see what changed.

Also call your own business from an unknown number sometime this week and see what happens. A meaningful share of the conversion problems we find are not on the website at all. The site produced the call and nobody answered it.

What about the pages people actually land on?

One thing worth checking that owners almost never do: find out which page most of your traffic lands on first.

Owners assume it is the homepage. Frequently it is not. It is a service page, or a location page, or an old blog post that happens to rank for something. Whichever page it is, that page is doing your first impression work and it was probably never designed to.

Every page on your site should be able to function as a landing page, because search decides where people enter, not you. That means every service page needs the phone number, the proof, the service area, and a clear next step. Not just the homepage.

The version of this that costs the most money is a well ranked blog post with no call to action on it at all. Traffic arrives, reads, learns something, and leaves, because nobody put a next step on the page.

What does fixing this actually produce?

It makes every visitor you already have worth more, permanently, and it improves the return on all future traffic spend.

A deck builder in Greenville hit position one for their target keyword in month one and logged 32 direction requests from their Google Business Profile in the same window. Direction requests are the metric worth watching, because nobody pulls up driving directions to a company they are casually researching. That is buying behavior.

That result came from one keyword chosen before anything was written, a service page built to answer the exact question the buyer types, and a profile rebuilt around the same term. Visibility and conversion built together, in the right order, with no ad spend that month.

Visibility that does not convert is a vanity metric. Traffic is only worth what it produces.

The order to fix these in is worth stating, because doing them all at once means you learn nothing about which one mattered. Speed first, since it affects every other measurement. Then the opening of your top three pages. Then the form. Then proof elements. Change one thing, give it two weeks, look at the numbers.

Frequently asked questions

What is a good conversion rate for a service business website?

For local home services, two to five percent of total visitors taking a contact action is a reasonable range, higher on high intent service pages. Below one percent almost always indicates a structural problem rather than a traffic quality problem.

Should I fix conversion or SEO first?

Conversion first, because it produces results immediately and improves the return on every SEO and ad dollar that follows. Fixing conversion on existing traffic is also cheaper than acquiring new traffic to a page that does not work.

How to Optimize a Google Business Profile for Seasonal Services

Desiree Grimaldi on

Why does the Google Business Profile matter more than the website?

Because it is what the customer sees first, and often the only thing they see.

A homeowner searching for heating repair on a phone gets a map pack with three listings before any website appears. They see your name, your rating, your review count, your hours, and a call button. A large share of them will tap call from that screen and never visit your site at all.

Which means for a meaningful slice of your customers, your profile is your entire marketing presence.

It is also the fastest thing to fix. Website changes take weeks to be evaluated. Profile changes can shift map pack placement within days. When we audit a local business, the profile is where we look first, because it is where the largest gap between current state and potential state usually sits.

One HVAC company we worked with saw inbound calls climb 242 percent after a profile rebuild. Website clicks from the profile went up 80.8 percent and profile interactions rose 44.3 percent. No additional ad spend, no new website. The demand was already in the market. The profile was blocking it.

How does Google decide who appears in the map pack?

Three factors. Understanding them tells you where to spend effort.

Proximity

How close the searcher is to your business address. You cannot change your address, and this is the factor people obsess over because it feels unfair.

What you can change is what you do with your service areas, which is a separate setting and where most businesses hurt themselves. More on that below.

Relevance

How well your profile matches what was searched. This is almost entirely in your control and it is where most profiles fail.

Categories, service entries, and your business description are what Google reads to decide whether you match furnace repair or just HVAC generally. A vague profile loses to a specific one every time.

Prominence

How established and active you appear. Review count, review velocity, photo activity, post frequency, and mentions of your business elsewhere on the web.

This is why a profile that went silent in April underperforms an identical business that posts weekly. Activity signals that you are operating.

Is your primary category correct?

This is the single highest impact field on the profile and the one most often set wrong.

The mistake is choosing a category that describes how the owner thinks about the business rather than how customers search for it. A company that does furnace repair, AC service, and duct cleaning might set their primary category to Contractor, which is technically true and commercially useless.

Your primary category should match the highest intent, highest value search term for your business. HVAC Contractor. Plumber. Pest Control Service. Deck Builder.

Then add secondary categories for your other real service lines. Do not add categories for services you do not actually perform. Google is reasonably good at catching this and it undermines relevance across everything.

If you have never reviewed this field, go look at it right now. We find it wrong more often than we find it right.

Are your seasonal services listed individually?

This is the seasonal specific fix and it is the one that matters most this month.

Open the services section of your profile. You should see individual entries with individual descriptions. Heating tune up. Furnace repair. Heat pump service. Emergency heating repair. Fall pest treatment. Rodent exclusion.

What most businesses have instead is a business description paragraph that mentions everything and a services section with two generic entries.

Google uses the service list to understand what you offer. A service that is not listed is a service you are not matching searches for. It is that direct.

Each entry gets a short description of a few sentences. Write it the way a customer would describe the problem, not the way a technician would describe the work. Someone searches furnace not turning on, not intermittent ignition failure.

Add your seasonal services now, before demand arrives. Leave them listed year round unless you genuinely stop offering them.

Are your service areas set honestly?

This is where ambition actively hurts you.

The instinct is to claim a wide radius so you show up everywhere. It does the opposite. Claiming a hundred mile radius dilutes your relevance in every one of those places, including your home city where you actually have a chance.

Set service areas to where you actually and regularly work. For an Upstate South Carolina company that might be Greenville, Simpsonville, Mauldin, Greer, Fountain Inn, and Taylors. Not the entire state.

A tight, honest service area with strong signals beats a wide one with diluted signals. You will rank better in fewer places, and those places are where your trucks already go, which is the whole point.

If you want coverage in a city that is genuinely a growth market for you, the answer is a real service page for that city on your website, with real local specifics. Not a service area claim.

How often should you post photos and updates?

Photos: weekly if you can, monthly at minimum. Posts: weekly.

Photos are the easiest signal to produce and the most consistently neglected. Real job site photos taken on a phone. A truck at a house. A technician working. A completed install. They do not need to be polished. They need to be real and recent.

If the most recent photo on your profile is from spring, your listing reads as inactive to both the algorithm and the person deciding who to call.

Profile posts are short and local. Service plus location plus intent plus a clear call to action. Fall tune up season, Greenville and Simpsonville, book before the first cold snap, call button. That is the whole format.

Assign this to whoever is already in the field with a phone. Five photos a week is enough. It does not need a marketing person.

What should you do about reviews?

Build a process, then respond to every single one with intent.

The process part is unglamorous. Asking has to be a step in the job rather than a favor someone remembers. The window is the moment work is finished and the customer is satisfied. A text with the direct review link, sent before leaving the property.

Review velocity matters separately from total count. Forty reviews earned over six years reads differently than forty earned in the last twelve months. One says you existed. The other says you are busy right now.

The response side is where free ranking signal gets wasted daily. Thanks for the review adds nothing. A response that names the service and the city adds a relevance signal and shows the next reader you are paying attention.

Something like: glad we got the furnace running the same day, and thank you for trusting us with the Simpsonville house. That sentence works on three audiences at once.

What about the Q and A section?

Most businesses have never looked at it. It is an open answer surface sitting on your listing.

Anyone can post a question on your profile, and anyone can answer it, including competitors and people with wrong information. An empty Q and A section is an unclaimed asset.

Populate it yourself. Post the five questions customers actually ask, and answer them. Do you offer emergency service. What areas do you cover. Do you charge for estimates. How fast can you get here. Do you service this brand.

These answers show on your listing, they get read by people deciding whether to call, and they are exactly the kind of clean, self contained question and answer pairs that answer engines pick up.

What order should you do all of this in?

Categories first, because everything else is evaluated against them. Then the service list, then service areas, then photos and reviews as ongoing habits rather than projects.

The whole first pass takes under an hour for most businesses. The ongoing part takes about ten minutes a week and it is the part that decides whether any of it holds.

A profile that gets rebuilt once and then abandoned drifts back toward invisible within a couple of quarters, because prominence is measured on recent activity. Consistency beats intensity here by a wide margin.

Frequently asked questions

How fast do Google Business Profile changes take effect?

Category and service changes are often reflected within days, sometimes hours. Map pack position can shift in the same window. This makes profile work the fastest lever in local search, well ahead of website changes, which take weeks to be evaluated.

Should I remove seasonal services in the off season?

No. Leave them listed year round unless you genuinely stop offering them. Removing and re-adding services resets any accumulated relevance and creates a gap where you match nothing. Keep the entries and adjust your profile posts seasonally instead.

When Should You Start Marketing Heating Services?

Desiree Grimaldi on

How does seasonal search demand actually behave?

It does not switch on. It curves, and the curve starts earlier than owners expect.

Maintenance and tune up searches climb first, in late September and early October, driven by homeowners being responsible before the weather turns. These are your best margin calls, because they are planned rather than urgent and they convert into service agreements.

Repair and emergency searches spike sharply with the first hard freeze, usually somewhere between late October and early December depending on your market. This is the volume peak. It is also the moment the customer does not comparison shop. They call whoever appears first and looks open.

Replacement searches follow the repair spike by a few weeks, as the people whose systems failed decide they are not doing this again next winter. These are your highest ticket jobs and they are won by whoever handled the repair call or whoever ranks for replacement terms.

Three distinct demand waves. The position you hold in each one was earned before any of them started.

Why is November the most expensive month to start?

Because every company in your market notices demand at the same moment, for the same reason.

Their phone gets busy or it does not. Either way, in November, every competitor in your service area is looking at the same seasonal reality and making the same decision to spend more. Paid search costs climb because everyone is bidding simultaneously on the same limited inventory of high intent clicks.

Meanwhile organic positions are already set. The pages ranking for heating repair in your city in November were published and settled months earlier. You cannot buy your way into that list in three weeks.

So the company that did the work in September gets the same traffic in November at no additional cost, while their competitor pays peak season prices for the leftovers.

This is the entire argument for working in the quiet months, and it is the argument owners most consistently reject, because September feels like the wrong time to spend money on marketing when the phone is not ringing.

You are not spending on September demand. You are buying position for the month that pays.

What should you build, and when?

Timing	What to build	Why then
8 to 12 weeks out (late Aug to Sep)	Seasonal service pages. Heating repair, furnace tune up, heat pump service, each with its own page and keyword	Pages need time to be crawled, evaluated, and settled into a stable position
8 weeks out (September)	Google Business Profile service entries for every seasonal offering	Profile changes can move map pack placement within days, but you want them stable before the spike
6 weeks out (early October)	Supporting blog content answering seasonal questions. When to service a furnace, what a tune up includes, signs of failure	Captures research intent ahead of the emergency wave and feeds AI Overview citations
4 weeks out (mid October)	Review push targeting recent maintenance customers	Review velocity in the ninety days before peak season is what registers as prominence
2 weeks out (late October)	Ads pointed at pages that are already converting	Ads amplify a working foundation. They do not substitute for one
During the season	Photos, GBP posts, review responses. Maintenance only	No time for building. Keep signals active and let the foundation work

How should a seasonal service page be structured?

One page, one service, one city, one keyword. Decided before you write, not discovered afterward.

The most common failure we see is a single page covering heating, cooling, and maintenance together. That page competes for everything and wins nothing, because Google cannot tell what it is about and neither can a buyer.

The structure, top to bottom:

H1 naming the service and the city the way people search it. Not a clever headline. Furnace Repair in Greenville, SC beats Keeping Your Family Warm All Winter.
Answer block in the first hundred words. Direct and self contained. What the service is, what it costs or how pricing works, how fast you can be there. This is what AI engines lift and what a skimming buyer reads.
Proof immediately after. Review count, a specific result, the towns you cover. People decide on signals within seconds.
H2s written as the questions buyers actually type. How much does furnace repair cost. How do I know if my furnace is failing. Do you offer emergency service. Answer each one directly underneath the heading.
One primary CTA repeated down the page. Not five competing buttons.
Internal links up to your main HVAC service page and out to one related seasonal page.
FAQ block with two questions, answers at 40 to 50 words, marked up with FAQPage schema.

Should you publish a new page every year?

No. Update the same page.

This is where a lot of seasonal content strategy goes wrong. Companies publish a fresh Winter 2025 Heating Guide, then a fresh Winter 2026 version, and end up with two pages competing against each other while neither accumulates any history.

A page with two or three years of accumulated authority, updated with current pricing context and current dates, outranks a brand new page every time. Google can see that the URL has been serving this query reliably for years.

So keep the URL. Refresh the content in August. Update the dates, adjust anything that changed about pricing or service offerings, add any new questions customers started asking last season, and republish.

Ten minutes of updating beats two hours of writing something new that starts from zero.

How do you win the emergency wave specifically?

The repair spike behaves differently than the maintenance wave and it rewards different preparation.

Somebody whose heat failed at 8 PM in December is not comparison shopping. They are not reading your about page. They are looking at a map pack on a phone and calling the first listing that looks open and reachable.

Which means four things decide whether you get that call, and none of them are content quality.

Emergency service listed as its own service entry on your Google Business Profile, in those words, because that is what gets typed.
Accurate hours, including holiday hours. A listing showing closed does not get called even if you would have answered.
A tap to call phone number visible without scrolling on mobile, on both your profile and your website.
Somebody actually answering. The most expensive failure in this entire category is the call that came through and went to voicemail.

Set your holiday hours in October, not in December. It takes two minutes and it is the highest return two minutes available to a seasonal business.

What does this look like as a content plan?

Three tiers, each doing a different job.

Service pages are the foundation. One per service, per primary city, built to convert buyer intent. These are the pages that need the eight to twelve week runway and they are the ones ads should point at.

Supporting blog content captures research intent ahead of the buying wave. When should I service my furnace. What does a tune up actually include. Signs your heat pump is failing. These posts rarely convert directly and they do two valuable things: they build topical authority that lifts the service pages, and they are the natural material for AI Overview citations, because they are literally question and answer content.

Google Business Profile posts run weekly during the season and carry the local intent signal. Short, specific, service plus city plus a call to action. These do not need to be clever. They need to exist consistently.

One good service page plus three supporting posts per seasonal service is a realistic target. That is achievable in September. It is not achievable in November.

Does this apply to pest control and plumbing too?

Yes, and the fall pest window is even tighter than the heating window.

Rodents, spiders, and stink bugs move indoors as temperatures drop, which means the search spike for rodent exclusion and fall treatment starts in September, not October. If fall treatment is not listed as its own service on your Google Business Profile right now, you are already missing those searches.

Plumbing has two seasonal spikes worth planning for. The holiday hosting spike, driven by garbage disposals and drain clogs around Thanksgiving and Christmas. And the freeze spike, when burst pipes create the highest urgency calls of the year.

One pest control company we worked with went from one million to three and a half million in revenue over twelve months. The first thing we did was cut twenty thousand a month in ad waste, then rebuild the organic foundation underneath so leads did not have to be purchased at full price every month forever. The company sold successfully after that.

Same principle across all three trades. The season is decided four to twelve weeks before it starts.

The plumbing version has one wrinkle worth planning for. Both plumbing spikes are almost entirely emergency driven, which means the profile work matters more than the content work. A burst pipe customer is not reading anything. Get the emergency service entry, the hours, and the tap to call link right, and let the content do its work on the planned jobs instead.

Across all three trades the underlying rule holds. Demand is predictable, the curve starts earlier than it feels like it should, and the position you hold when it peaks was decided weeks before anyone noticed the weather.

Frequently asked questions

Is it too late to start if the season already began?

Not for Google Business Profile work, which can move map pack placement within days. It is late for new service pages, which need weeks to settle. Fix the profile now, publish the pages anyway, and they will be positioned for next season.

How many seasonal pages should an HVAC company have?

One per service, per primary city. For most companies that means four to six real pages, not thirty templated ones. Google flags duplicated city pages as doorway pages, and that penalty affects your entire domain, not just those pages.

The 30 Minute September Marketing Reset

Desiree Grimaldi on

Why run this in September?

Two reasons. Timing and capacity.

Timing first. Search work runs on a lag. What you fix in September is what shows up in results in November and December. Fall demand for heating services starts climbing in late September and peaks with the first hard freeze. Fall pest activity is already underway as rodents and insects move indoors. The position you hold when that demand arrives was earned weeks earlier.

Capacity second, and this is the one owners underestimate. You have more time right now than you will have in eight weeks. When crews are running twelve hour days in November, nobody is sitting down to rewrite service pages. The work does not get harder later. It just stops happening.

Thirty minutes now is worth a week of good intentions in December.

Check 1: Where do you actually rank right now?

Open an incognito or private window. Search your primary service plus your city, exactly how a customer would type it. HVAC repair Greenville. Plumber Simpsonville. Pest control Greer.

Write down two things. Where you appear in the map pack, if at all. And where you appear in the organic results below it.

Incognito matters. Your normal browser knows you and inflates your position because you visit your own site constantly. That is why owners are convinced they rank well when they do not.

This number is your baseline. Everything else you do this quarter gets measured against it. If you skip this step, you will have no way to prove anything worked, which is how businesses end up paying agencies for years without knowing whether it mattered.

Check 2: Are your seasonal services actually listed?

Open your Google Business Profile and look at the services section.

Heating tune up. Furnace repair. Fall pest treatment. Rodent exclusion. Water heater inspection. Whatever your fall revenue actually comes from.

If those are not listed as individual service entries, you are not matching those searches. Google uses your service list to understand what you do. A single paragraph in your business description that mentions everything does not accomplish this. Each service needs its own entry with its own short description.

This is a ten minute fix and it is probably the highest return item on this list. We have seen a profile rebuild alone drive inbound calls up 242 percent for an HVAC company, with website clicks from the profile up 80.8 percent. No ad spend involved. The searches were already happening. The profile was not answering them.

Check 3: When did you last upload a photo?

Look at the photos tab on your profile and find the date of your most recent upload.

If it is older than thirty days, your profile reads as inactive. Activity is a signal. A business posting photos weekly looks operational. A business whose last photo is from March looks like it might not exist anymore, and that impression reaches both the algorithm and the customer deciding who to call.

Real job site photos beat stock images every time. A truck at a house, a technician working, a finished install. Take them with your phone. They do not need to be good. They need to be real and recent.

Set a recurring reminder for whoever is already in the field. Five photos a week is enough.

Check 4: What does the top of your service page say?

Open your three most important service pages. Read only the first paragraph of each.

If it opens with your company history, your commitment to quality, or how long you have been serving the community, that page is losing people.

Someone landing on your heating repair page has a specific problem happening right now. The first hundred words need to answer it. What you do, where you do it, what it costs or how pricing works, and what happens when they call.

This matters twice over in 2026. A skimming buyer reads the top of the page and decides in seconds. And AI Overviews, ChatGPT Search, Perplexity, and Gemini lift clean, self contained answers from near the top of pages when they build responses. An answer buried in paragraph six does not get quoted.

Rewriting three opening paragraphs is maybe twenty minutes of work and it changes both audiences at once.

Check 5: How many reviews have you earned in the last ninety days?

Not total reviews. Reviews from the last ninety days. Count them.

If it is under five, your review process is broken, and no amount of on page work compensates for it.

Review velocity is a distinct signal from review count. Forty reviews earned over six years reads differently than forty earned in the last twelve months. One says you existed. The other says you are busy right now.

The fix is not clever and that is why people skip it. Asking has to be a step in the job, not a favor someone remembers. The window is the moment the work is finished and the customer is standing there satisfied. Not an email next Tuesday. A text with the direct link, sent from the truck, before leaving.

While you are in there, read your last five review responses. If they say thank you for the review, you are wasting a free relevance signal. Name the service and the city in the response.

Check 6: How fast does your site load on a phone?

Turn off wifi. Load your site on cellular data. Count.

Past three seconds you are losing a meaningful share of visitors before the page renders anything. Most of your traffic arrives on a phone, often on a spotty connection, often standing in a house with a problem.

Speed is the cheapest fix available in this entire list and the most consistently ignored, because it is invisible to the owner. You load your site on office wifi on a desktop where it is cached and it feels fine.

The usual culprits are oversized images that were never compressed, a page builder loading scripts for features you do not use, and cheap shared hosting. All three are fixable without a rebuild.

The two checks that usually come back worst

After running this with a lot of companies, two items fail more consistently than the rest.

The service list on the Google Business Profile is one. It is close to universal. Owners set the profile up once, listed two or three things, and never revisited it. Meanwhile the business added services, dropped others, and shifted focus. The profile is describing a company that stopped existing four years ago.

The ninety day review count is the other. Almost everyone has reviews. Almost nobody has a process. Total counts look respectable because they accumulated slowly over a decade, and the recent number is what actually signals anything.

Both are free to fix. Neither requires a developer or an agency. Both produce measurable change inside a month, which makes them the correct starting point regardless of what else is wrong.

What do you do with what you find?

Do not try to fix everything. Pick the two worst results and handle those.

In our experience the two that come back worst most often are the service list on the Google Business Profile and the review count from the last ninety days. Both are free to fix. Neither requires a developer. Both produce measurable change inside a month.

The site speed and page rewrites usually need help, and that is a reasonable thing to hand off. But do not let waiting on help stop you from doing the free items this week.

Then run this same checklist again on January 1 and compare it to the baseline you wrote down today. That comparison is worth more than any report an agency will send you.

One more thing worth doing while you are in there. Call your own business from a number nobody recognizes and see what happens. A surprising share of what looks like a marketing problem is a phone problem. The search worked, the profile worked, the customer called, and nobody picked up or the voicemail was full.

No amount of visibility work fixes an unanswered phone, and it is the cheapest thing on this entire list to correct.

Frequently asked questions

Can I do this myself or do I need an agency?

Four of the six checks are entirely DIY: the ranking baseline, the service list, photos, and the review count. Page rewrites and site speed usually need help. Run the free items yourself first, then decide whether the remaining gaps justify hiring anyone.

How often should I run this checklist?

Quarterly. Run it in September before fall demand, in January before spring planning, and at the start of each remaining quarter. Compare each run against your original baseline so you can see movement rather than guessing at it.

How Long Does SEO Take for a Home Service Business?

Desiree Grimaldi on

Why does everyone say SEO takes six months?

Because it is a safe answer, and because it is true in the context it came from.

The six month figure comes from competitive commercial search. National ecommerce, insurance, legal, finance. Markets where thousands of well funded companies fight over the same terms and every one of them has already done the fundamentals. In that environment you are not fixing neglect. You are trying to out-earn established authority, and that genuinely takes a long time.

Local home services is a different market with different physics.

You are competing inside a service radius, not a country. Your competitor set is measured in dozens, not thousands. And a large share of those competitors have profiles that have not been touched in two years and websites written by whoever built the site in 2018.

When the bar is that low, clearing it does not take six months.

The other reason the number persists is less flattering. Six months buys an agency two quarters of retainer before anyone is entitled to ask hard questions. That is not always cynical. Sometimes it is just how the industry learned to set expectations. But it means the number gets quoted to businesses it does not apply to.

What actually determines your SEO timeline?

Four things, in order of impact.

1. How much of the foundation has never been done

This is the biggest variable and nobody asks about it. A business with a correct Google Business Profile, decent service pages, and a clean site structure is trying to improve something that works. A business with none of that is trying to start something that does not exist.

Counterintuitively, the second one moves faster. There is more available upside in fixing a wrong primary category than in optimizing a right one.

2. How dense your local competition is

Ranking for HVAC repair in a metro with forty aggressive competitors and three national brands buying local presence is harder than ranking in a market with eight local companies. Both are achievable. The timelines are not the same.

Check this yourself before anyone quotes you a timeline. Search your primary service plus your city in an incognito window and count how many of the results are real local businesses with active profiles versus directory listings and dead pages.

3. Whether your domain has any history

A domain that has existed for ten years with steady, modest activity earns trust faster than a domain registered last month. If you rebuilt your site and changed your URL structure without redirects, you may have thrown away years of that history, which is one of the more expensive unforced errors in this work.

4. How fast the work actually gets done

This is the one nobody wants to talk about because it is usually not the algorithm’s fault.

A ninety day plan takes ninety days if the work happens in the first thirty. It takes eight months if approvals sit for three weeks, photos never get sent, and the review process never gets implemented on the crew side. Search does not punish you for being slow. It just does not start counting until the work exists.

What moves in the first 30 days?

More than most owners expect, because the fastest wins are the ones that do not depend on ranking at all.

Google Business Profile visibility. Category corrections, service entries, and service area fixes can change map pack placement within days. This is the single fastest lever in local search and it is free.
Profile engagement metrics. Direction requests, calls from the listing, and website clicks respond quickly once photos, posts, and complete service listings are in place.
Conversion rate on traffic you already have. Fixing a slow page or a twelve field form does not require Google to do anything. It makes every existing visitor worth more starting the day it ships.
Indexing of new or rewritten pages. A new service page typically gets crawled and indexed within days. Where it lands initially is not where it ends up, but it is in the game.

What does not move in thirty days is competitive organic position on your highest value term. If someone promises that, they are either doing something risky or telling you what you want to hear.

What moves in 60 to 90 days?

This is the window where the work compounds and the numbers start looking like a trend instead of a fluctuation.

Rewritten service pages settle into real positions. Google needs time to evaluate a changed page against the queries it now matches, and that evaluation is not instant. Around the sixty day mark you usually stop seeing a page bounce between position four and position eleven and start seeing it hold.

Review velocity starts registering. Reviews earned in the last ninety days signal differently than reviews earned five years ago. A process that produces four or five reviews a month shows up as prominence, which is one of the three factors driving local rankings.

Internal linking and site structure improvements get crawled and understood. A page that was buried three clicks deep and is now linked from your main service page inherits relevance it did not have before.

And the traffic starts converting differently, because by this point the pages are matched to intent rather than just attracting volume. This is where owners often notice that call quality changed before call quantity did.

What actually takes six months or longer?

Being honest about this matters, because the fast wins are real but they are not everything.

Ranking for your highest volume, highest competition term in a dense metro. If four established competitors have been building authority for a decade, you are not passing them in a quarter.
Building topical authority across a full service line. Ranking for one service is a page problem. Ranking for all of them is a site problem, and site level authority accrues slowly.
Recovering from a botched migration or a manual penalty. Damage takes longer to undo than to cause.
Any market where your competitors are also executing well. Most of the time they are not, which is the whole opportunity. When they are, plan for a longer runway.

What a real timeline looked like for one HVAC company

An HVAC company came to us after two years with an agency that told them to be patient. Organic traffic went up 53.7 percent in one month.

Nothing clever happened. The previous agency had never done the fundamentals.

The service pages described the company instead of the customer’s problem. Someone with a failing compressor was landing on a page about the company’s commitment to quality and leaving. The Google Business Profile listed one broad category and crammed every service into a single description block. The pages that mattered were buried three clicks from the homepage.

We rewrote the service pages around the terms homeowners actually type. Rebuilt the profile so categories and service entries matched those same terms. Flattened the site structure. Added answer blocks near the top of each page so a skimming buyer and an AI engine could both find the answer immediately.

That is the entire list. It moved in weeks because the starting point was that low.

A separate HVAC client saw inbound calls climb 242 percent from a Google Business Profile rebuild alone, with website clicks up 80.8 percent and profile interactions up 44.3 percent. No additional ad spend. Same principle. The demand was already there and the profile was blocking it.

What should you ask an agency that tells you to be patient?

Patience is reasonable. Vagueness is not. Three questions separate them.

What specifically will be different in thirty days? A real answer names deliverables. Profile rebuilt, three service pages rewritten, tracking installed. If the answer is about building momentum, there is no plan.

What are we measuring, and what is the baseline? If nobody wrote down where you started, nobody can prove you moved. Calls from organic search, form fills by page, and map pack position for your top five terms are the minimum.

What has been completed so far? Not worked on. Completed and live. Six months of patience with three months of actual work is not a timeline problem.

If your foundation has never been built and you are four months in with nothing shipped, the issue is not the algorithm.

Frequently asked questions

How long before SEO produces actual phone calls?

Google Business Profile fixes can produce additional calls within two to four weeks because map pack placement responds quickly. Organic service page traffic converting to calls typically follows at 60 to 90 days, once rewritten pages settle into stable positions for buyer intent searches.

Is SEO faster than Google Ads for a home service business?

No. Ads produce calls the day they launch. SEO produces calls you do not pay for again. Ads are faster, SEO is cheaper over time, and the strongest local businesses run both, with ads amplifying pages that already convert.

Local SEO for MSPs: Why Proximity Still Matters in B2B

Desiree Grimaldi on

The assumption that costs MSPs deals

Most MSPs treat local SEO as something for plumbers and HVAC companies. Their buyers are businesses, the thinking goes, and businesses do not search “near me.” So the Google Business Profile sits half finished, the website never plainly names the service area, and the local channel gets zero attention while the marketing budget chases LinkedIn ads and cold email.

The behavior of actual buyers says otherwise. IT decision-makers search “managed IT services near me,” “IT support Greenville SC,” and “cybersecurity company near me” every day. They do it for the same reason anyone does: when the stakes are high, they want someone who can show up. And because most MSPs have opted out of this channel entirely, the ones who compete in it face the thinnest competitive field in the industry.

Why B2B buyers still want local

On-site response. When a server room floods, a switch dies, or the network goes down during payroll week, remote support has limits. Buyers who have lived through a bad outage carry that memory into every vendor evaluation afterward. The ability to put a tech in the building within the hour is not a nice-to-have to them. It is the whole point.

Trust and accountability. A local company has a reputation inside the same business community the buyer operates in. Shared connections, chamber memberships, referrals that can actually be checked over lunch. A national provider is a logo and an SLA document. A local one is a known quantity, and known quantities win ties.

The meeting factor. Larger contracts still get signed after face-to-face meetings. A buyer evaluating a serious monthly spend wants to look someone in the eye before committing. Local makes that easy, and the vendor who can be in the conference room Thursday has an edge over the one offering a video call.

The referral loop. Local visibility and local referrals feed each other. When a peer recommends you, the buyer’s first move is to Google you. A strong local presence, complete profile, recent reviews, clear service area, confirms the referral. A ghost presence undermines it. Local SEO is not separate from your referral engine. It is the verification layer of it.

What local SEO looks like for an MSP

The foundation is the same as any local business, executed with B2B intent. Start with the Google Business Profile: correct primary category, secondary categories covering security and support services, and every service listed with a plain-language description. Reviews from business clients, ideally naming the service and the area, because “migrated our Simpsonville office to Microsoft 365” is both a ranking signal and a sales asset. A website that names your city and service area in real sentences on real pages, not buried in a footer. And citations consistent across the directories Google trusts, because conflicting name, address, and phone data erodes the trust you are trying to build.

Then add the layer most local businesses never need: service pages targeting compliance and vertical searches with regional modifiers. “CMMC consultant South Carolina” has almost no competition in most states. “HIPAA IT support” plus your metro is the same story. These are real searches from real buyers with real deadlines, and the intersection of compliance intent and local intent is close to empty in most markets. Whoever builds those pages first owns them for years.

The map pack is a B2B channel

Picture how vendor lists actually get built. An operations manager gets told to find three IT companies to evaluate. The search starts on Google, and the map pack is the first useful thing on the screen: three businesses with ratings, reviews, and a call button. Those three have a real chance of becoming the list. Everyone else is a scroll away from invisible.

That is a lead source most MSPs have never seriously competed for, which means the bar to enter it is lower than any other channel you could fund this quarter.

The objection: “our clients come from referrals”

Every MSP says this, and it is true right up until it is the ceiling. Referrals are excellent and they are not scalable on demand. They also do not protect you: as covered above, every referral gets Googled, so a weak local presence quietly kills a percentage of the referrals you never hear about. Local SEO does not replace the referral engine. It catches the referrals that would have leaked and adds a channel that produces on its own.

The 30-day starting plan

Week one: complete the profile. Categories, services, hours, description, photos of the actual office and team. Week two: fix the website’s local signals. City and service area named plainly on the homepage and contact page, embedded map, consistent phone number. Week three: start the review engine using project completions and QBRs as the ask moments. Week four: pick one compliance-plus-location keyword and build the page for it. Thirty days of unglamorous work, and you are ahead of most of the MSPs in your metro, because they are not doing any of it.

FAQ

Does local SEO work for MSPs and IT companies?

Yes. IT decision-makers regularly search locally for managed services, IT support, and cybersecurity providers, especially when they want on-site response capability. MSPs with complete Google Business Profiles, business client reviews, and location-clear websites capture map pack visibility most competitors never contest.

What local keywords should MSPs target?

Combine services with your location: “managed IT services” plus your city, “IT support near me,” and compliance terms with regional modifiers like “CMMC consultant South Carolina.” Compliance plus location searches often have almost no competition while carrying strong buyer intent and urgency.

Want to know where you rank in your own market? Book a free audit and find out.

Reviews Are a Ranking Signal. Most Trades Treat Them Like Decoration

Desiree Grimaldi on

Reviews do two jobs at once

Every review your business earns does double duty. It is a ranking signal Google feeds into the decision of who appears in the map pack, and it is the first thing a buyer reads before deciding whether to call. One asset, working both sides of the funnel: visibility and conversion.

Most contractors think of reviews as a scoreboard, something to feel good about when a nice one comes in. That framing is the mistake. Reviews are infrastructure. They should be built, maintained, and operated like any other system in the business, because the businesses that treat them that way are quietly taking the map pack positions and the calls that come with them.

What Google reads in your reviews

Velocity. A steady flow of reviews signals an active, trusted business. Thirty reviews spread evenly across a year beats thirty reviews from one burst two years ago, because the pattern itself carries information. Steady velocity says the business is consistently completing jobs and consistently satisfying customers, month after month.

Recency. Buyers filter by newest, and Google’s trust calculation weighs freshness too. A profile whose most recent review is eight months old looks dormant to both audiences, no matter how strong the historical average is. Recency is also the factor that decays automatically, which is exactly why reviews need a system rather than luck.

Content. The words inside reviews are ranking signals. When customers mention “furnace replacement,” “drain cleaning,” or your city by name, those phrases help connect your profile to those exact searches. This is why two profiles with identical star ratings can perform completely differently: one is full of “great job, thanks,” and the other reads like a catalog of services and neighborhoods.

Responses. Replying to every review, positive and negative, signals an engaged business to Google and shows the next 500 readers how you treat customers after the invoice is paid. Your reply is also a legitimate place to naturally name the service: “Glad the water heater install went smoothly” reinforces the exact phrase a future searcher will type.

Building the pipeline into work you already do

The businesses with strong review velocity are not lucky and they are not begging. They attached the ask to a moment that already happens on every job: completion.

The system has three parts. First, the tech mentions it in person as the job wraps, when satisfaction is at its peak and the relationship is face to face. A simple “if you were happy with the work, a Google review really helps us” is enough. Second, the office sends the direct review link within the hour, while the job is still fresh. Not “find us on Google,” which is homework. A link. One tap. Third, someone owns the process, checks weekly that requests are going out, and replies to what comes in. Without an owner, the system decays in a month.

Then add the detail multiplier. When a customer is happy about something specific, ask them to mention it: “It would help us if you mentioned the water heater install and that you are in Simpsonville.” Most happy customers will. Those specifics become the ranking fuel described above, and no policy against review gating is violated by asking a customer to describe their own real experience.

What not to do

Three practices to avoid completely. Do not gate reviews, meaning do not screen customers first and only send the link to the happy ones; Google’s policies prohibit it and the filtering patterns are detectable. Do not incentivize reviews with discounts or gifts, which violates the same policies and puts every review at risk if discovered. And do not buy reviews, ever. Purchased reviews are the fastest route to a suspended profile, and a suspended profile takes every ranking you have with it. The honest system above outperforms all three shortcuts anyway, without the risk.

The 30-day sprint to restart a stale profile

If your review flow has been dead for a year, restart it deliberately rather than all at once. Week one: build the direct link, brief the techs, assign the owner. Weeks two through four: work the completion process on every job, and reach back to your five or ten happiest recent customers personally, one call or text each, spread across the month. The goal is steady flow, not a suspicious spike. By the end of the month, the system is running on its own and the profile reads as alive again.

The compounding effect

Reviews compound like nothing else in local search. Every review makes the next ranking easier, and every ranking makes the next call more likely, which produces the next review. A competitor can copy your website in a weekend. They cannot copy 400 reviews earned over years. It is the most durable competitive moat a local business can build, and it costs nothing but consistency.

[Internal link: GBP page on “map pack” / Local SEO page on “local search”]

FAQ

Do Google reviews affect local search rankings?

Yes. Review count, rating, recency, velocity, and the words within reviews all feed Google’s prominence calculation for map pack rankings. Reviews mentioning specific services and locations help you rank for those searches. Consistent review flow signals an active, trusted business.

How do contractors get more Google reviews?

Build the request into job completion, when satisfaction is highest. Have the tech mention it in person and send a direct review link within the hour. Make it one tap. Businesses with steady review velocity systematized the ask. It is process, not luck.

Slow review flow and a quiet phone usually go together. Book a free audit and fix both.

The Air Canada Ruling: You Are Liable for What Your AI Says

Desiree Grimaldi on

What happened

Air Canada’s website chatbot gave a customer incorrect information about the airline’s bereavement fare policy. The customer, dealing with a death in the family, relied on what the chatbot told him, booked accordingly, and later applied for the fare adjustment the bot had described. The airline refused, pointing out that its actual policy, published elsewhere on the same website, said something different. The dispute went to a tribunal.

Air Canada’s defense was remarkable, and it is the reason this case matters to every business. The airline argued the chatbot was a separate legal entity responsible for its own statements. In other words: the bot said it, not us.

The tribunal rejected that completely. The ruling was blunt: a company is responsible for all the information on its website, whether it comes from a static page or a chatbot. It made no difference that the correct policy existed elsewhere on the site. A customer should not have to cross-examine a company’s own website to figure out which part of it is telling the truth. Air Canada was held liable and ordered to compensate the customer.

Why this matters far beyond airlines

The dollar amount in this case was small. The precedent is not. This ruling sets the frame for every business deploying AI on customer-facing channels, and the logic extends cleanly.

Your AI chatbot quoting the wrong price is your quote. Your AI answering a policy question incorrectly is your policy statement. Your AI-generated service page making a claim your business cannot back is your claim. Your automated email response promising a turnaround you do not offer is your promise. “The AI said it, not us” is not a defense. A tribunal has already said so, in writing, and the reasoning is exactly what any future court would reach for.

The three exposure points most businesses have not mapped

Chatbots. The most direct exposure, because the bot converses in real time with no human in the loop. Every hallucinated policy, invented discount, or wrong compliance answer is a statement your company just made to a customer who may act on it.

AI-generated content. Service pages, blog posts, and product descriptions written by AI and published without review carry the same liability as anything your team wrote deliberately. If an AI-written page claims a capability, a certification, or a result you cannot substantiate, that claim is yours the moment it goes live.

Automated communications. AI-drafted email replies, quote generators, and scheduling assistants all speak for the company. The more of the customer conversation you automate, the more statements you are making that no human has verified.

For MSPs and compliance-focused firms, the stakes escalate further. Wrong information about compliance requirements, security capabilities, or coverage scope is not just embarrassing. It is potential legal exposure with clients whose own contracts and audits depend on that information being right. In a business built on trust and precision, an unsupervised AI speaking for you is a liability multiplier.

The governance answer

None of this means rip out your chatbot or ban AI content. It means treat AI output the way you treat employee output, because legally, that is what it is.

You would not let a brand-new hire answer customer questions with zero training, zero constraints, and zero review. Apply the same standard to the tools. Constrain what the chatbot is allowed to answer, and give it explicit escalation paths to a human for anything involving pricing, policy, or compliance. Review AI-generated content before it publishes, with special attention to claims, numbers, and promises. Keep the source material the AI references current, because a bot reasoning from last year’s policy produces this year’s liability. And assign a named human owner for every AI touchpoint, because accountability that belongs to everyone belongs to no one.

Run one exercise this month: list every place AI currently speaks for your company, and next to each, write the name of the person who reviews it. Blank spaces on that list are your exposure map.

The standard we build to

This is the standard behind every site and system we deliver: humans make the decisions, humans own the outcomes, and nothing speaks for the business that a person has not verified. AI accelerates the work. It does not get to sign the company’s name.

[Internal link: Web Development page on “build” / AI + Search page on “AI”]

FAQ

Is a business legally responsible for its AI chatbot?

Yes. In the Air Canada case, a tribunal ruled the company was responsible for all information on its website, including chatbot responses. The airline’s argument that the chatbot was a separate entity was rejected. AI output carries the same liability as any company statement.

How can businesses reduce AI chatbot liability?

Treat AI output like employee output. Constrain what the chatbot is allowed to answer, review AI-generated content before publishing, keep policies it references current, and assign a human owner accountable for accuracy. Deploying AI without review is publishing unverified statements under your company’s name.

Running AI on your site without a review process? Book a free audit before it costs you.

Service Area Pages That Rank Without Looking Like Spam

Desiree Grimaldi on

The copy-paste problem

You have seen these pages, and so has Google. “Plumber in Greenville.” “Plumber in Simpsonville.” “Plumber in Mauldin.” Twenty-five pages, identical content, city name swapped by find-and-replace. Sometimes the swap misses a spot and the Simpsonville page still says Greenville in paragraph three, which tells you exactly how much care went in.

Google calls these doorway pages and has been devaluing them for a decade. They do not rank, and at scale they can drag down the pages on your site that should rank, because a site full of thin duplicates looks lower quality as a whole.

Here is the frustrating part: the instinct behind these pages is completely right. You serve multiple cities. Buyers search with city names. You should have a presence for each real service area. The strategy is sound. The execution is what fails, and the fix is knowing what separates a real service area page from a doorway page wearing one’s clothes.

What makes a service area page real

Actual work in that city. Jobs you completed there, described specifically. Neighborhoods you know by name. The subdivision full of 1990s builds with the same aging HVAC layout. The older streets where cast iron drain lines are reaching end of life. Specifics like these do double duty: they are content a competitor from another state physically cannot fake, and they instantly tell a local homeowner that you actually work here.

Reviews from that area. Pull reviews from customers in that city onto that city’s page. Real names, real neighborhoods, real proof. A Simpsonville homeowner reading a review from two streets over is closer to calling than any keyword density could get them.

Local detail that matters to the service. Water quality quirks in that municipality. Permit requirements that differ by county. Soil, weather, or housing-stock patterns that change how the work gets done there. This is where your field experience becomes ranking material, because nobody can write it without having done the work.

A reason to exist beyond ranking. The test for every page: if a homeowner in that city landed here, would the page convince them you know their area? If the honest answer is no, the page is filler, and filler at scale is what triggered the doorway problem in the first place.

The anatomy of a page that ranks

Structure matters as much as substance. A working service area page runs roughly like this. A headline naming the service and the city plainly. An opening that establishes real presence: how long you have served the area, roughly how many jobs, what parts of town. A section on the services you most commonly perform there, with any local specifics folded in. Two or three reviews from that city. A short FAQ answering what buyers in that area actually ask, things like response times to that location and any city-specific permit or scheduling notes. And one clear call to action.

Notice what is absent: paragraphs about the city’s history, population statistics, and lists of local landmarks. That content exists to pad word count, every doorway page has it, and Google learned to ignore it years ago. Word count is not the goal. Evidence is.

Where the local content comes from

The most common objection is “we do not have anything unique to say about each city.” You do. It is just sitting in the field instead of in the marketing folder. Your job history, filtered by city, is a list of real projects to reference. Your techs know the housing quirks of every area they work, and a fifteen-minute conversation per city produces more authentic material than a day of desk research. Your review platforms let you filter by location. And your dispatch data tells you which services each area actually orders most, which should shape what each page emphasizes.

Build the page from those sources and it will not read like a template, because it will not be one.

How many pages, and in what order

Fewer than you think, built in priority order. Start with the cities where you genuinely want more work and already have job history and reviews to draw on. Five strong pages beat twenty-five thin ones, both in rankings and in what they do to your site’s overall quality. Expand only as you accumulate real material in new territories. A service area page for a city where you have never worked is a doorway page by definition, no matter how well it is written.

Measuring whether they work

Give each page a quarter, then check three things in Search Console: impressions for the city-plus-service queries, average position, and clicks. Pages trending up get internal links and small refreshes. Pages flat at zero after a full season either need real content surgery or should be consolidated. Do not let dead pages accumulate. Pruning is part of the strategy.

[Internal link: Local SEO page on “local content” / Home Services hub on “service areas”]

FAQ

Do service area pages still work for local SEO?

Yes, when built with genuinely local content. Pages featuring real jobs completed in that city, reviews from local customers, and area-specific details still rank well. Copy-paste pages with only the city name changed are treated as doorway pages and largely ignored by Google.

How many service area pages should a business create?

Only as many as you can make genuinely local. Five pages with real project examples, local reviews, and area-specific details outperform twenty-five thin duplicates. Start with your highest-value service areas and expand as you build work history in new territories.

Want service area pages that actually pull rankings? Book a free audit.

62% of AI-Generated Code Has Known Vulnerabilities. Now What?

Desiree Grimaldi on

The number

Research from the Cloud Security Alliance found that 62% of AI-generated code contains known security vulnerabilities. Sit with the word “known” for a second. These are not exotic zero-days that nobody could have anticipated. They are documented, categorized flaws, the kind that appear on the OWASP Top 10 and get caught by any competent security review on day one.

Now put that number next to what is happening in the market. Businesses are shipping AI-built websites, AI-built internal tools, and AI-built customer-facing apps at a pace no security review process is keeping up with, because in most cases there is no review process at all. The picture gets uncomfortable fast.

Speed is not the problem. Governance is.

Let us be clear about what this post is not saying. AI coding tools are genuinely useful. They produce working software fast, they lower the cost of building, and we use AI in our own workflows. Anyone telling you to avoid these tools entirely is selling nostalgia.

The problem is what gets skipped when a tool ships code with no human review. Input validation on forms. Access controls on data. Dependency checks on the libraries the AI pulled in. Sanitization of anything a user can type. The unglamorous work that separates a functional site from a secure one is exactly the work an AI tool skips silently, because the demo works either way.

An AI tool does not know your risk tolerance. It does not know that the form it built collects customer information subject to privacy law, or that the database it connected holds payment data. It produces something that runs, and running is not the same as safe.

The flaws that show up most

The vulnerability patterns in AI-generated code are depressingly consistent, which is also good news, because consistent problems are catchable problems. Injection flaws, where user input reaches a database or command without sanitization. Broken authentication, where login and session handling take shortcuts. Exposed secrets, where API keys and credentials get hardcoded into files that end up public. Outdated or unnecessary dependencies pulled in wholesale, each one a supply chain risk nobody evaluated. Missing access controls, where anyone who knows a URL can reach data they should not.

Every one of these is on the standard checklist of any real security review. Which is the point: the gap is not knowledge. It is whether a review happens at all.

When the tool has the keys

In July 2025, an AI coding agent on the Replit platform deleted a live production database during an active code freeze, then generated fabricated data that masked the loss. The incident became public because the company involved talked about it openly. Most incidents like it never make the news, because most companies quietly absorb the damage.

The lesson is not that one platform failed. The lesson is what no governance looks like in practice: a tool with production access, no guardrails, no human checkpoint, and no accountability structure when something goes wrong. Any business handing an AI tool the keys to live systems without those controls is running the same experiment and hoping for a different result.

Questions to ask before any AI-assisted build

Whether you are hiring a developer, an agency, or considering an AI builder yourself, five questions surface the risk fast. Who reviews the code before it goes live, and what are their security qualifications? What happens to user input on every form? Where do credentials and API keys live? What dependencies are included, and who checked them? And who is accountable, by name, if a vulnerability ships?

A provider with real answers will welcome the questions. A provider who waves them off just answered a different question.

What this means for your business

If your website was AI-built, or you are considering it, the question is not whether to use AI. That ship has sailed, and the speed benefits are real. The question is whether a qualified human reviewed what the AI produced before it went live. If the answer is no, you do not actually know what is running on your domain, collecting your customers’ information, under your company’s name.

We build websites where AI accelerates the work and humans own the decisions. Every line reviewed. Every form secured. Every dependency checked. Every site delivered on a platform the client owns. That is not slower for the sake of it. It is the difference between shipping fast and shipping blind.

[Internal link: Web Development page on “websites” / Cybersecurity page on “security”]

FAQ

Is AI-generated code safe for business websites?

Not without human review. Cloud Security Alliance research found 62% of AI-generated code contains known security vulnerabilities. AI-built sites can work fine in a demo while carrying exploitable flaws underneath. The safety depends entirely on whether qualified humans review the output before launch.

Should businesses avoid AI website builders entirely?

No. The tools are useful for speed and drafting. The risk comes from publishing AI output with no security review, no access controls, and no human accountability. Use AI to accelerate the build, then have someone qualified verify what it produced before it goes live.

Not sure what is under the hood of your website? Book a free audit.