The state of Canadian small business websites 2026: what we found on 1,209 sites

Key findings

We checked 1,209 Canadian small business websites listed on Google Maps in ten cities on 1 November 2026. 9.2% were broken or gone. Of the 1,030 working sites, only 6.4% passed all ten basics we tested, 42.8% had no click-to-call link and 42.2% had no form or booking tool on the homepage.

This is an original study. We built the sample ourselves from Google Maps listings, made one polite request to each homepage, and measured what a customer, a search engine and a security scanner would see. Every number below is a count from that data, with the base it was taken from. Nothing here names a business.

The short version for an owner: most Canadian small business sites now clear the technical floor. 92.7% force HTTPS and 94.2% are built for phones. The gaps are in the parts that turn a visit into a call or a booking, and in upkeep. That is good news, because those are the cheapest things to fix. If you want to put a number on what a better site or a booking tool would return, the free software ROI calculator does the arithmetic in two minutes.

Why we ran this study

Most published figures about small business websites answer a different question. They tell you how many businesses have a site. Statistics Canada, for example, found that 74.7% of small-size private sector enterprises had a company website in 2023, and 45.0% of micro-size enterprises did. What those surveys cannot tell you is whether the site works, whether a customer can call from it, or whether anyone has touched it in three years.

We build websites and custom software for small businesses, and the same handful of problems turn up in almost every first call. We wanted to know whether that was our sample or the market. So we measured the market.

The study is designed to be useful in three ways:

• Owners can check their own site against a real Canadian baseline, by city and by industry, instead of against a vendor's marketing claim.
• Journalists, associations and researchers get a dated, reproducible dataset with its method and limits written down.
• Anyone deciding between fixing a site, rebuilding it or building custom software can see which problems are common, which are rare and what each one costs to put right.

Ethics came first. We never name a business with a flaw, we publish only totals and anonymised breakdowns, we honoured robots.txt, and we did not probe login pages, admin paths or anything that is not a normal public homepage.

Who is in the sample

The sample is 1,302 unique Canadian small business domains drawn from Google Maps listings in ten cities and twenty categories. 1,209 could be tested, and 1,030 were working sites with enough HTML to analyse.

We picked categories that match the businesses we work with most: trades, clinics and dentists, restaurants, retail, real estate, law and accounting, salons and nonprofits. Cities run coast to coast so the results are not a Toronto story.

Chains are not small businesses, so we removed any domain that appeared in more than one city and any listing whose web address pointed at a store-locator or branch page, which is the usual sign of a franchise. What is left is mostly independent, local businesses with their own domain.

51.7% of the working sites use a .ca domain. 14.4% show signs of a second language version, rising to 58.1% in Montreal.

How many listed websites actually work?

9.2% (111 of 1,209) of the websites linked from Google Maps listings were broken, gone or parked. That is a customer who found the business, chose it, tapped the website button and hit an error.

The biggest single group is the simplest failure. For 50 listings (4.1% of those tested), the web address on the listing does not exist at all: no DNS record, so a browser shows a 'site can't be reached' page. A second check through a public DNS resolver confirmed all but four of them. Usually the domain was allowed to lapse, or the business moved to a new address and never updated the Google Business Profile.

The rate varied by sector: 2.9% of health sites in our sample were broken, against 10.9% of trades, 11.3% of professional services and 12.0% of consumer businesses such as restaurants, salons and shops. By city it ranged from 6.3% in Winnipeg to 13.7% in Ottawa.

What to do about it

1. 1Open your Google Business Profile on a phone and tap your own website button. Do it today.
2. 2Check the renewal date and auto-renew setting for your domain with your registrar.
3. 3If you changed domains, keep the old one and point it at the new site with a permanent (301) redirect. Old links keep working and keep their search value.

HTTPS, certificates and security headers

HTTPS is nearly universal now: 92.7% (955 of 1,030 working sites) sent visitors to a secure page. 5.5% (57 of 1,030) had a valid certificate but still served the plain http:// version without redirecting, and 1.7% (18 of 1,030) had no working HTTPS at all. Only one site in the sample served an invalid certificate.

Certificates are short-lived already. Of the 955 HTTPS sites, 87.5% (836 of 955) were using a certificate valid for 90 days or less, most of them from Let's Encrypt (593 sites) or Google Trust Services (232). The median certificate had 61 days left. 31 had under 30 days left, which is normal for an automatic 90-day renewal cycle, and none had expired.

This matters because certificate lifetimes are shrinking for everyone. The CA/Browser Forum adopted ballot SC-081v3 on 11 April 2025, cutting the maximum life of a public TLS certificate from 398 days to 47 days in steps between March 2026 and March 2029. The published schedule is 200 days from 15 March 2026, 100 days from 15 March 2027 and 47 days from 15 March 2029. 2.8% (27 of 955) of HTTPS sites in our sample still carried a certificate valid for more than 200 days, issued before the first step. Those sites are the ones that will need a renewal process that runs several times a year, ideally automated, before their current certificate runs out.

Security headers are where the gap is. These are short instructions a server sends with each page that tell the browser to behave more safely. 37.5% (386 of 1,030 sites) sent none of the six we checked, and only 26.3% (271 of 1,030) sent three or more.

Who hosts the site makes most of the difference. Hosted builders send these headers for you: 100% of Wix sites and 97.5% of Shopify sites in our sample sent at least two. Only 18.4% of WordPress sites did, because on WordPress it depends on the host and on whoever set the site up. The same is true of version leaks: 21.6% (222 of 1,030 sites) announced their server or PHP version number in their headers, which saves an attacker a step.

Out-of-date PHP

15.8% (163 of 1,030 sites) revealed which version of PHP they run. Of those, 38% (62 of 163) were on a version that no longer gets security fixes. PHP 7.4 reached end of life on 28 November 2022, 8.0 on 26 November 2023 and 8.1 on 31 December 2025, according to php.net. PHP 8.2 stops getting security fixes on 31 December 2026, eight weeks after this study.

Only sites that publish their version can be counted, so the true share of out-of-date PHP across all sites is unknown. It is a reasonable guess that sites careless enough to announce the version are also more likely to be behind on it, so do not scale this figure up to the whole sample.

What Canadian small businesses build on

WordPress is the most common platform by a wide margin, on 39.5% of working sites (407 of 1,030). Wix (10.3%), Squarespace (7.2%), GoDaddy's website builder (6.6%) and Shopify (3.9%) follow. About a quarter of sites were hand-built or used a platform we could not identify from the homepage.

Among WordPress sites, 41.3% (168 of 407) used the Elementor page builder, 11.1% (45 of 407) Divi and 10.6% (43 of 407) WPBakery. 58.7% (239 of 407 WordPress sites) published their version number. Most were current: 170 of those 239 were on 7.1, the branch released on 19 August 2026. But 20.9% (50 of 239) were still on a 6.x release or older, and a handful were several years behind.

Platform choice shows up in the results in a clear pattern. Hosted builders handle the plumbing well and leave the selling to you. WordPress gives you more control and more ways to get the plumbing wrong.

Two notes on that table. Wix, Squarespace and GoDaddy include visitor statistics in their dashboards, so a low share of analytics tags in the code does not mean those owners are blind. And the high stale-copyright figure on Wix comes from templates that print a fixed 'year by business name' line when the site is first built.

Mobile and search basics

Almost every site is set up for phones: 94.2% (970 of 1,030) set a mobile viewport. The 60 that did not are mostly older hand-built sites. Since July 2024 Google has crawled virtually every site with its mobile crawler, so a site that is unusable on a phone is unusable to Google too.

A less visible problem is more common. 14.3% (147 of 1,030 sites) stop visitors from pinching to zoom, through a viewport setting such as user-scalable=no. That makes small text unreadable for anyone with weaker eyesight, and standard audit tools such as Lighthouse and axe flag it as an accessibility failure because it stops people enlarging text (WCAG success criterion 1.4.4). Ontario's AODA has required WCAG 2.0 AA websites from businesses and nonprofits with 50 or more employees since 1 January 2021.

Search basics were patchier than the mobile ones:

• 26.9% (277 of 1,030) had no meta description, so Google writes its own snippet from whatever text it finds.
• 23.1% (238 of 1,030) had no H1 heading on the homepage, and 25.1% (259 of 1,030) had more than one.
• 71.8% (740 of 1,030) carried some structured data, but only 31.5% (324 of 1,030) described the business as a LocalBusiness or a specific type such as Dentist, Plumber or Restaurant. That markup is how search engines and AI assistants read your hours, address and services without guessing.
• 72.2% (744 of 1,030) pointed to a sitemap from robots.txt, and 1.4% (14 of 1,030) told search engines not to index the homepage at all, almost always a setting left on from the build.
• 4% (41 of 1,030) blocked OpenAI's GPTBot in robots.txt, and 4.8% (49 of 1,030) blocked at least one named AI crawler. For a local business that wants to be recommended by AI assistants, that is usually a setting someone else chose.

Text matters too. The median homepage carried about 601 words of visible text, but 6.7% (69 of 1,030) had under 80 words in the HTML because the content is drawn by JavaScript after the page loads. Google can usually render those, but many AI crawlers and link previews cannot.

Can a customer act? Calls, forms and booking

This is where most sites lose business. 42.8% (441 of 1,030 working sites) had no click-to-call link anywhere on the homepage. Of the 779 sites that printed a phone number, 27.3% (213 of 779) did not make it tappable, so a customer on a phone has to memorise or copy it.

42.2% (435 of 1,030) had no contact form and no booking tool on the homepage. Many of those link to a contact page instead (76.3% of all sites had a contact link), which is fine, but every extra tap loses some visitors. 17.6% (181 of 1,030) had no form, no booking tool, no tap-to-call link and no email link on the homepage at all.

Booking and ordering

Only 12.8% (132 of 1,030) of all sites embedded a real-time booking or ordering tool, and 29.8% (307 of 1,030) had any 'book', 'schedule', 'reserve' or 'order' button or link. Among appointment-based businesses (dentists, physio and chiro, medical clinics, optometrists, salons and spas) the picture splits sharply by category.

Physiotherapy and chiropractic clinics are the outlier: 48.9% embed a live booking tool, and Jane, a Canadian clinic platform, accounted for 42 of those 43. Dentists usually have a 'book an appointment' button, but only 2 of 92 dental sites connected it to live availability; the rest lead to a request form or a phone number. Overall, 34.6% (121 of 350) of appointment-based businesses had no online booking path of any kind on the homepage.

Trades did better on the basics that matter to them: 65.2% (184 of 282 trade sites) had a tap-to-call link and 74.1% (209 of 282) offered a quote request, a form or a booking tool. Only 4.3% (12 of 282) linked to a field service booking tool such as Jobber, Housecall Pro or ServiceTitan.

Other tools were rare: 13.4% (138 of 1,030) showed a reviews widget, 3.1% (32 of 1,030) ran a live chat or chatbot, and 26.2% (270 of 1,030) offered a newsletter sign-up.

If your clinic or salon is in the 'neither' column, an off-the-shelf booking tool is usually the cheapest first step. If your booking rules are unusual, such as multi-room scheduling, deposits, staff skills or intake forms that feed your records, that is where custom booking software pays for itself. Our ROI calculator will show whether the hours saved cover the cost.

Measurement and privacy

42.9% (442 of 1,030 working sites) had no analytics or advertising tag of any kind in their homepage code. Excluding hosted builders that include statistics in the dashboard, 32.6% (235 of 720 sites) had no way to measure visits at all. 42.7% (440 of 1,030) used Google Analytics 4 or Google Tag Manager.

A further 6.8% (70 of 1,030) had only the old Universal Analytics tag. Google says standard Universal Analytics properties stopped processing data on 1 July 2023, so those sites have been collecting nothing for more than three years while the owner may believe they are measuring. 11.6% (119 of 1,030) still carried the old tag in some form.

8.4% (87 of 1,030) ran a Meta (Facebook) pixel and 8.3% (86 of 1,030) a Google Ads tag.

Consent banners and privacy links

Only 9.6% (99 of 1,030) showed a recognisable cookie consent tool, and 41.8% (431 of 1,030) linked to a privacy policy from the homepage. Of the 599 sites running a tracking tag, 87.1% (522 of 599) had no consent tool we could detect.

Quebec is the exception, and the law is why. Montreal sites were about twice as likely to show a consent tool: 17.9% (21 of 117) against 8.5% (78 of 913) elsewhere. Quebec's Law 25, most of which took effect in September 2023, requires organisations to tell people when they use technology that can identify, locate or profile them, and says those functions must be off by default. We only detected whether a consent tool was present, not whether it complies, so read this as a signal and not as a compliance rate.

For owners outside Quebec, the federal privacy law still expects you to say what you collect and why. A short, plain privacy page and a tag manager that respects consent are an afternoon's work. Our explainer on Bill C-36 and Canadian privacy law covers what is changing.

Is anyone home? Copyright years and upkeep

A copyright line is a cheap test of whether a site is maintained. 57.1% (588 of 1,030 sites) showed a copyright year or generated one automatically. Of the 570 with a fixed year, 33.5% (191 of 570) showed a year before 2026, and 18.6% (106 of 570) showed 2023 or earlier.

An old year is not a fault by itself. The problem is what it suggests to a visitor, and what usually travels with it: old prices, old staff photos, a service you stopped offering, a plugin nobody has updated. Visitors notice. In our data, stale copyright years were most common on law firm sites (62.1% of those with a fixed year) and least common on retail sites (6.5%), most of which run on platforms that update the line automatically.

Upkeep shows up in the technical results too. Sites with older PHP, no security headers and stale copyright lines tend to be the same sites. That is a sign of a website nobody owns, which is a business decision, not a technical one.

Page weight and speed

From the HTML alone, the median homepage was 147.4 KB of HTML and referenced 37 scripts, stylesheets, images and frames directly. The heaviest tenth carried more than 757 KB of HTML and more than 103 direct references. 17.5% (180 of 1,030 sites) shipped more than 500 KB of HTML before a single image loaded, usually from page builders that inline their styles and settings.

Servers were generally quick. The median time to first byte from our Toronto server was 268 ms; one site in four took longer than 603 ms, and 129 took more than one second. 94.9% (977 of 1,030) compressed their HTML. 35.2% (363 of 1,030) sat behind Cloudflare. 36.6% (377 of 1,030) used a modern image format such as WebP or AVIF and 56.4% (581 of 1,030) lazy-loaded images.

Lighthouse is Google's open-source page audit. We ran it on a random subsample of 60 working homepages, chosen by a fixed seed before any results were seen. We used the mobile preset with Lighthouse's default simulated slow 4G and CPU slowdown, from a server in Toronto.

Treat the performance score as a lower bound. Lighthouse scores move with the power of the machine running them, and ours is a shared two-core server. Page weight and request counts do not depend on the machine, so those are the numbers to compare. For context, the HTTP Archive Web Almanac 2024 put the median mobile page at 2,311 KB and the median mobile homepage at 70 requests in October 2024.

The most common failed Lighthouse checks on those homepages were:

• text with too little colour contrast: 42 of 60
• browser-reported issues: 37 of 60
• links with no readable name: 35 of 60
• headings that skip levels: 32 of 60
• third-party cookies: 32 of 60
• browser console errors: 27 of 60
• no main landmark: 27 of 60
• link-text: 24 of 60

The ten basics score

To give owners one number to aim at, we scored every working site on ten basics that any small business site should pass, whatever its platform. Each is cheap to fix. Only 6.4% (66 of 1,030) passed all ten. The median site passed 8 and 16.5% (170 of 1,030) passed five or fewer.

Better basics went with more reviews. Sites passing eight or more basics had a median of 52.5 Google reviews on their listing (482 sites). Sites passing five or fewer had a median of 17 (141 sites). This is a correlation, not proof that a better site causes more reviews. Busier businesses can afford better sites. But a site that makes it easy to call and book is also a site that turns more searchers into customers who later leave reviews.

Want to know your own score? Check each row of the first table against your homepage. If you want the gaps closed, ask for a free quote and list the rows you failed.

Results by city

Differences between cities were smaller than differences between categories. No city stood out as much better or worse on the ten basics, with average scores between 7.0 and 7.4 out of 10. The differences that do show up have clear local reasons.

• Montreal had the most bilingual sites (58.1%), one of the two highest shares of consent tools (17.9%, behind Ottawa at 19.1%) and the fewest embedded booking widgets (1.7%).
• Calgary had the highest share of LocalBusiness structured data (45.2%) and the lowest share of stale copyright years (23.6%).
• Saskatoon had the lowest share of sites with valid, forced HTTPS (89.3%), and Vancouver the highest (95.4%).
• Edmonton had the most meta descriptions (84.2%) and the fewest homepage contact forms (39.6%).
• Halifax had the highest share of mobile viewports (98.9%).

Each city has between 93 and 117 working sites, so differences of a few points are within normal sampling noise. Read the table for patterns, not rankings. We have software development pages for each of these cities if you want local context.

Results by category

Category told us far more than city. Health businesses ran the tidiest sites. Nonprofits, landscapers and restaurants had the most room to improve.

• Dentists scored best overall: 70.7% passed eight or more basics, 85.9% had tap-to-call and 91.3% had a meta description. Their gap is live booking.
• Physio and chiro clinics led on online booking (48.9% with a live booking tool).
• Nonprofits had the weakest results: only 25.0% passed eight or more basics, 23.7% had tap-to-call and 9.2% had LocalBusiness-type structured data. Many are run by volunteers on donated or very old sites. We run a free website offer for nonprofits for that reason.
• Restaurants had few contact forms (28.0%), which is expected, but only 52.0% offered a way to order or reserve from the homepage.
• Law firms had valid HTTPS on every site but the highest share of stale copyright years (62.1%).
• Electricians (83.1%) and HVAC contractors (85.7%) had the lowest shares of valid, forced HTTPS.
• Salons and spas had the lowest share of analytics tags (32.8%), mostly because so many run on builders with statistics in the dashboard.

Categories under 40 sites (optometrists, other health and other trades) are shown for completeness but carry wide margins of error.

What this means for small business owners

Answer first: most small businesses do not need a new website. They need the one they have to do five or six specific things properly. The data says the common gaps are tap-to-call, a form or booking tool, a meta description, structured data, analytics that actually record and basic upkeep.

Here is the order we would fix things in, based on how often each gap appeared and how directly it costs you customers:

1. 1Make sure the website on your Google listing loads. 9.2% did not.
2. 2Make every phone number a tap-to-call link. 42.8% of sites missed this.
3. 3Put a short form or a booking button on the homepage, above the fold on a phone.
4. 4If you take appointments, connect booking to real availability. In most categories a monthly booking app is enough.
5. 5Check that your analytics records visits today, not a tag from 2019.
6. 6Add LocalBusiness structured data with your hours, address and service area.
7. 7Write a meta description for the homepage and each service page.
8. 8Ask your host to turn on HSTS and the basic security headers, and to move you to a supported PHP version.
9. 9Replace the fixed copyright year with one that updates itself, and review the page for anything out of date.
10. 10Let people zoom on phones.

None of those is a rebuild. Most are an afternoon of work for a competent developer, and several you can do yourself. If your site runs on WordPress, the care plans at our WordPress studio exist for owners who would rather someone else kept the list ticked.

A website that cannot take a call or a booking from a phone is a brochure. The fix is usually small. The cost of leaving it is every customer who gave up.

Fix, rebuild or build custom: what it costs

The decision comes down to three questions. Is the platform sound? Does the site do what customers need? Does the business have a process that off-the-shelf tools handle badly?

• If the platform is sound and the gaps are the items in this study, fix them. Do not pay for a rebuild to get a tap-to-call link.
• If the site fails five or more basics, runs end-of-life PHP or a builder you have outgrown, a rebuild is usually cheaper than patching. A typical small business site is a small, fixed project.
• If booking, quoting, dispatch, intake or records are where your staff lose hours each week, and the apps you have tried do not fit, that is when custom software earns its cost.

For a sense of scale, here are Four Cents' typical price bands. Every project gets a fixed written quote after scoping, so treat these as ranges, not offers.

Build or buy, the arithmetic is the same: compare the yearly cost of the tool or build with the hours it saves and the customers it stops you losing. The software ROI calculator runs those numbers, and our guides to what a website costs and custom software versus off-the-shelf go deeper. When you are ready for a real number, ask for a free quote.

How this compares with national data

Our study measures quality, not adoption, so it complements the official numbers rather than replacing them.

Statistics Canada's figures come from its Survey of Digital Technology and Internet Use, which asks businesses directly. The two studies sample different populations, so their figures should be read side by side rather than multiplied together.

Methodology

Sampling

On 1 November 2026 we pulled 1,600 Google Maps business listings through the DataForSEO Business Listings API: 40 listings for each of four category groups in each of ten cities (Toronto, Montreal, Vancouver, Calgary, Edmonton, Ottawa, Winnipeg, Halifax, Hamilton and Saskatoon), within 15 km of each city centre, keeping only listings with a website. The four groups were trades (plumber, electrician, HVAC contractor, roofing contractor, landscaper), health (dentist, physiotherapist, chiropractor, medical clinic, optometrist), professional (law firm, accounting firm, real estate agency, insurance agency, non-profit organisation) and consumer (restaurant, hair salon, beauty salon, clothing store, florist).

We removed listings whose website field was a social profile or third-party booking page, deduplicated by domain, removed domains that appeared in more than one city, and removed listings that pointed at a store-locator or branch path. That left 1,302 domains. Each site was assigned to a category from its primary Google category.

Collection

For each domain we first fetched robots.txt and skipped the site if it disallowed our agent or all agents at the homepage (26 sites). We then made one request for the homepage, starting from http:// so we could see whether the site redirected to HTTPS, and followed redirects. Where the final page was not HTTPS we opened a single TLS connection to port 443 to check whether a valid certificate existed. Requests identified themselves as FourCentsResearchBot/1.0, ran at most eight at a time, and timed out after 15 seconds. We did not request any other page, login screen, admin path or file.

Sites that answered with a bot-protection page (67) were excluded from every figure rather than counted as broken. A site was counted as broken if its domain did not resolve, it did not answer within 15 seconds, it returned a 4xx or 5xx status, or it served a parked or placeholder page.

Measurement

All signals were read from the homepage HTML, the response headers and the TLS certificate. Platforms were identified from asset paths and markup signatures. Booking tools were identified from embedded scripts and links for over 40 named providers. 'Contact form' means a form on the homepage with an email, phone, message or text-area field, or a known form plugin. Copyright years were read from the visible text after removing scripts and tags. Security headers are counted as present when the header exists, without judging its configuration.

The Lighthouse subsample was chosen at random with a fixed seed from sites that returned a 200 status, then run one at a time with Lighthouse 13.5 in mobile mode.

Data and reproducibility

We hold the raw data privately because it would identify individual businesses. Aggregates by city, category and platform are available on request for research or reporting, along with the detection rules. A business that wants its own results can ask, and we will send them only to that business.

Limitations

• Google Maps listings with a website are not a random sample of all Canadian small businesses. Businesses with no site, or with no Maps listing, are not here, and Maps ranks listings by its own measures, which favour established businesses.
• We looked at one page per site. A site with no form on the homepage may have a good one on its contact page, so homepage figures understate what the whole site offers.
• Detection is pattern-based. A booking tool loaded only after a click, an analytics tag loaded by a consent manager, or a heavily customised platform can be missed. We spot-checked samples by hand and corrected the copyright rule after one such check, but some error remains in both directions.
• Category sizes range from 24 to 92 working sites. For a share near 50%, a group of 60 sites carries a margin of error of roughly plus or minus 13 points at 95% confidence, so small differences between categories or cities are not meaningful.
• Sites behind bot protection (67) and sites that asked bots not to crawl (26) are excluded, and they may differ systematically from the rest.
• Response times were measured from one server in Toronto, so they favour sites hosted in eastern Canada.
• Lighthouse performance scores depend on the test machine. Ours is modest, so scores are conservative. Page weight and request counts are not affected.
• This is a snapshot of 1 November 2026. Sites change daily.

Cite this study

You are welcome to quote and republish any figure from this study with a link to this page.

Four Cents (2026). The State of Canadian Small Business Websites 2026. A study of 1,302 small business domains from Google Maps listings in ten Canadian cities, collected 1 November 2026. https://fourcents.ca/blog/small-business-website-statistics-canada

Journalists and researchers can contact us for the aggregate tables, the detection rules or an interview. We do not share data that identifies a business.