Trust and privacy problems on small business websites
10 checks in this group, each a count from our own scanner over 6,450 free four-page scans in the last 90 days. The most common is No terms linked, on 75.5% of them.
| Finding | Share of scans | Scans | Sites | Severity |
|---|---|---|---|---|
| No terms linked | 75.5% | 4,867 | 3,968 | Low |
| No privacy policy linked | 70.8% | 4,567 | 3,728 | Serious |
| No social proof above the fold | 55% | 3,548 | 2,977 | Warning |
| No HSTS header | 48.4% | 3,121 | 2,515 | Low |
| No security headers | 45.9% | 2,963 | 2,373 | Warning |
| No obvious next step | 43.4% | 2,801 | 2,326 | Serious |
| Tracking runs with no consent notice | 41.2% | 2,659 | 2,225 | Critical |
| No visible way to reach the site | 30.9% | 1,995 | 1,648 | Serious |
| Insecure resources on a secure page | 30.4% | 1,964 | 1,627 | Serious |
| Plain http does not redirect | 7.5% | 483 | 381 | Serious |
No terms linked
75.5% of the free scans raised this: 4,867 scans across 3,968 distinct sites, 95% interval 74.2% to 76.6%. Severity: Low.
What it means
No terms or conditions page is linked from the site. Terms are what you point at when a dispute starts, and their absence reads as a business that has not thought about one.
How to fix it
Publish a terms page that says what you sell, how refunds and disputes work, and which law applies, and link it from the footer of every page.
How to check it yourself
Open the site footer and look for a link labeled Terms or Terms and Conditions. If none appears there or elsewhere on the page, none is linked.
What fixed looks like
The footer of every page carries a link to a terms page covering sales, refunds and disputes.
No privacy policy linked
70.8% of the free scans raised this: 4,567 scans across 3,728 distinct sites, 95% interval 69.5% to 72.1%. Severity: Serious.
What it means
A missing privacy policy is both a trust signal and, in many jurisdictions, a legal requirement.
How to fix it
Publish a privacy policy and link it from the footer of every page. If you use analytics or a contact form, most jurisdictions require one.
How to check it yourself
Open the site footer and look for a link labeled Privacy Policy. If it is missing from the footer and every other page, none is linked.
What fixed looks like
The footer of every page links to a privacy policy describing how visitor data is handled.
No social proof above the fold
55% of the free scans raised this: 3,548 scans across 2,977 distinct sites, 95% interval 53.4% to 56.6%. Severity: Warning.
What it means
The opening screen carries no review, customer or case-study language. First-time visitors discount claims made only by the business itself.
How to fix it
Put named testimonials, client logos or a review count near the primary call to action, where a visitor decides whether to keep reading.
How to check it yourself
Load the page and look at what is visible without scrolling. If no testimonial, client name or review count appears there, none is above the fold.
What fixed looks like
The opening screen shows a named testimonial, client logo or review count near the main call to action.
No HSTS header
48.4% of the free scans raised this: 3,121 scans across 2,515 distinct sites, 95% interval 46.6% to 50.1%. Severity: Low.
What it means
Without HSTS, a browser has no standing instruction to always use the secure version of the site.
How to fix it
Send Strict-Transport-Security: max-age=31536000; includeSubDomains once you are confident every subdomain is on https. Start with a shorter max-age if unsure.
How to check it yourself
Run curl -sI https://example.com and look for a Strict-Transport-Security line in the response headers. Its absence means no HSTS header is sent.
What fixed looks like
The curl response headers include a Strict-Transport-Security line with a max-age set.
No security headers
45.9% of the free scans raised this: 2,963 scans across 2,373 distinct sites, 95% interval 44.1% to 47.7%. Severity: Warning.
What it means
Baseline headers like Content-Security-Policy and X-Content-Type-Options are a site’s own instructions to the browser about what to refuse.
How to fix it
Add X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin and a Content-Security-Policy. The first two are one line each and break nothing.
How to check it yourself
Run curl -sI https://example.com and look for X-Content-Type-Options and Content-Security-Policy in the response headers. Missing lines mean the header is not set.
What fixed looks like
The curl response headers include X-Content-Type-Options, Referrer-Policy and a Content-Security-Policy line.
No obvious next step
43.4% of the free scans raised this: 2,801 scans across 2,326 distinct sites, 95% interval 41.6% to 45.3%. Severity: Serious.
What it means
The opening copy carries no recognizable call to action. If the page does not say what to do next, most visitors do nothing.
How to fix it
Put one primary action, phrased as a verb, in the first screen: call, book, get a quote, start a scan. One, not four, and make it look like the one thing to press.
How to check it yourself
Load the page and look at the first screen. If no single button or link tells you what to do next, there is no obvious call to action.
What fixed looks like
The first screen shows one clear action, phrased as a verb, that stands out from everything else.
Tracking runs with no consent notice
41.2% of the free scans raised this: 2,659 scans across 2,225 distinct sites, 95% interval 39.4% to 43.1%. Severity: Critical.
What it means
Analytics or advertising tags fire before any consent choice exists, and no cookie or consent mechanism was found. Tags that run before consent are a frequently litigated pattern under US state privacy laws and the EU rules, and the exposure is counted per visitor.
How to fix it
Gate marketing and session tags behind a consent choice, disclose them in the privacy policy, and load only the strictly necessary ones before the visitor decides.
No visible way to reach the site
30.9% of the free scans raised this: 1,995 scans across 1,648 distinct sites, 95% interval 28.9% to 33%. Severity: Serious.
What it means
A site with no contact route gives a visitor, and a search engine assessing trust, nothing to go on.
How to fix it
Put a real contact route in the footer of every page: an email address, a phone number, or a contact page linked by name.
How to check it yourself
Open the site footer and any obvious contact page. If none shows an email address, phone number or named contact link, none exists.
What fixed looks like
The footer of every page shows an email address, phone number or a contact page linked by name.
Insecure resources on a secure page
30.4% of the free scans raised this: 1,964 scans across 1,627 distinct sites, 95% interval 28.5% to 32.5%. Severity: Serious.
What it means
A secure page that loads even one resource over plain http breaks the padlock and the guarantee behind it.
How to fix it
Find the http:// resource on the page and change it to https://, or host it yourself. One insecure image is enough to break the padlock on the whole page.
How to check it yourself
Open DevTools, go to Console, and reload the page on https. A mixed-content warning names any resource still loading over plain http.
What fixed looks like
The DevTools console reloads clean, with no mixed-content warning and no broken padlock.
Plain http does not redirect
7.5% of the free scans raised this: 483 scans across 381 distinct sites, 95% interval 5.5% to 10.2%. Severity: Serious.
What it means
A visitor or link landing on the http address stays on the insecure version instead of being sent to the secure one.
How to fix it
Add a permanent 301 redirect from http:// to https:// at the server or CDN, for every path, so an old link cannot land anyone on the insecure copy.
How to check it yourself
Run curl -sI http://example.com and check the response. A 301 redirect to the https address means it works; staying on http means it does not.
What fixed looks like
Requesting the plain http address returns a 301 redirect to the https version, for every path.
How we measured this
A count of what our own scanner found, not a survey and not an estimate: each share above is over every free four-page scan in the last 90 days that loaded at least one page, which is 6,450 scans. Of those, 6,316 were run by Go Voltic itself, our research sweep over a pool of small-business sites and our own monitoring, and 132 came from visitors using the free scan; a site counts once in the distinct-sites figure whoever scanned it. 2 predate the label that tells the two apart and are counted in the total without a side. Deep scans are a separate population and never in this denominator. Figures on this page were computed on 2026-10-15.
The methodology explains the denominator, the distinct-sites count and the 95% interval. The benchmarks page puts these shares beside every other finding, with the whole table as CSV and JSON.
Other groups of findings
Measured on the same scans: Structure, AI and answer engines, Accessibility, Speed.
Check your own site
The free scan reads four pages and reports every finding it raises, including every one on this page. It takes about ten seconds and asks for nothing but the address.