DEV Community: Zehlm Web Development LLC

The Technical Guide to Google Business Profile Setup for Morganton, NC Business Owners

Zehlm Web Development LLC — Sun, 14 Jun 2026 23:25:43 +0000

Most "how to set up your Google Business Profile" guides amount to: claim it, fill in the blanks, add some photos, done. That's the surface. Underneath, Google is running a verification process that's gotten significantly stricter, cross-referencing your business data against everything else it can find about you on the web, and slotting your listing into a fixed taxonomy that determines which searches you're even eligible to show up for.

If you're a business owner in Morganton or anywhere in Burke County, here's what's actually happening when you set up a profile — and where the real mistakes get made.

Verification: It's Not Just a Formality Anymore

Verification is Google's process for confirming you're a real business at a real location, run by someone authorized to manage it. For years this meant a postcard in the mail with a code. That's changed.

Video verification has become the dominant method in 2026, used in roughly eight out of ten cases according to local SEO professionals tracking the rollout. The video verification process checks three things in a single recording: that it confirms the listed address, shows real operations at that location, and demonstrates management access.

A few technical details worth knowing:

Verification methods are automatically determined by Google based on your business type, public information, region, and hours — you can't request a specific method
If video is offered, record one continuous take on a mobile device — exterior signage and street context first, then interior, then something that demonstrates you actually operate there (inventory, equipment, staff)
If you edit your business name, address, or category while a verification code is pending, that code becomes invalid — finish verification before making any other profile changes
Any future edit to name, address, or category can trigger re-verification, so get these fields right the first time rather than treating them as easy to tweak later

For service-area businesses especially — which covers a lot of Burke County's contractors, electricians, HVAC techs, and similar trades — video verification gets extra scrutiny because there's often no public storefront to point a camera at. Google still requires a real address behind the listing even when it's hidden from public view, and the video needs to demonstrate that the address is a legitimate operating location, not just a residence with no connection to the business.

Category Selection: You're Choosing From a Fixed List

Google maintains its own taxonomy of business categories — you don't get to type in whatever you want. This matters more than most business owners realize, because your primary category determines which features your profile is eligible for — things like a Services tab, booking integration, menu support, or service-area display.

The mistake we see most often: businesses pick a broad category ("Marketing Agency," "Contractor") because it feels safer or more impressive, when a more specific category in Google's list ("Website Designer," "Fence Contractor," "Roofing Contractor") is both more accurate and more likely to surface for the exact searches people are running.

Secondary categories add reach, but the primary category is the one doing the heavy lifting for relevance — which is the first of three things Google's local algorithm evaluates.

NAP Data and the Entity Graph

Here's the part that connects your Google Business Profile to everything else happening with your website and citations.

Google doesn't treat your GBP as an isolated record. It's trying to build a confident picture of your business as an entity — and it does that by cross-referencing your business Name, Address, and Phone number (NAP) everywhere it appears: directory listings, chamber of commerce pages, your own website.

Two technical pieces that feed this directly:

LocalBusiness schema on your website. If your site has JSON-LD structured data marking it up as a LocalBusiness (or a more specific subtype), the name/address/phone in that schema needs to match your GBP exactly — same formatting, same suite number, same phone format. A sameAs property linking to your GBP URL and social profiles helps Google connect the dots between your website and your profile as the same entity.

Citation consistency. Every directory listing — Chamber of Commerce, BBB, industry-specific directories — is another data point Google checks your NAP against. Inconsistencies don't get your listing rejected, but they lower Google's confidence in the entity, which shows up as weaker local pack performance even when everything else looks fine.

If you've ever wondered why two businesses with seemingly similar profiles perform differently in the map results, citation consistency is one of the most common invisible differences.

Service Area vs. Storefront

If customers come to your location, set up a storefront listing with your real address public. If you go to customers — most home services fall here — set up a service-area business (SAB) profile instead.

Technical points that matter:

An SAB still requires a real address on file with Google, even though it's hidden from public view — this is what verification is checking
You define service areas by city, zip code, or county — Google's own guidance is to avoid setting areas beyond where you can realistically provide same-day service, since overly broad service areas are a common red flag in the verification and spam-detection process
For Burke County businesses, this usually means Morganton plus the surrounding towns you actually serve — not "all of Western North Carolina" unless that's genuinely true

Services and Products: Structured Data That Surfaces in Search

The Services section isn't just a list — each entry can include a name, description, and price or price range. This is structured data that Google can pull directly into search results when someone searches for that specific service.

A generic "Web Design" entry with no description does almost nothing. "Custom Website Design — starting at $X, includes mobile-responsive design and basic SEO setup" gives Google something concrete to match against a specific search, and gives the searcher a reason to click through to you specifically.

The Three Pillars: Relevance, Distance, Prominence

Google's local ranking algorithm comes down to three factors, and it's worth knowing which setup decisions affect which pillar:

Relevance — how well your profile matches what someone searched for. Category selection, service descriptions, business description, and regular posts all feed this.
Distance — how close you are to the searcher (or, for service-area businesses, how well your defined area matches their location). This is largely fixed by your actual location and service area settings.
Prominence — your overall presence and reputation: review count and quality, citation consistency, and the authority of your website (backlinks, content). This is the slowest to build and the hardest to fake — which is exactly why it's the most valuable signal.

A perfectly configured profile with zero reviews and no citations will still underperform a decent profile backed by real prominence signals. Setup gets you eligible to compete; prominence is what you compete with.

Reading Your Performance Data

Once verified and active, your profile's Performance section (formerly "Insights") gives you real data: how people found you (direct search for your business name vs. discovery search for what you do vs. branded searches), what actions they took (website visits, calls, direction requests, messages), and how your photos compare to similar businesses.

This data is the feedback loop. If discovery searches are low relative to direct searches, your category or service descriptions likely aren't matching the searches people are actually running. If photo views lag behind similar businesses, that's a concrete, fixable gap.

Duplicate Listings: The Hidden Technical Problem

Duplicate listings — often created accidentally when a business changes hands, rebrands, or gets listed by a data provider in addition to being self-claimed — split your reviews and signals across two profiles instead of consolidating them into one. From Google's side, it also muddies the entity graph: two listings claiming to be the same business at the same address is itself a signal that gets scrutinized.

If you suspect a duplicate exists, search for your business on Google Maps under slightly different name variations or old addresses. Duplicates can be flagged via "Suggest an edit" → "This place doesn't exist" on the listing that shouldn't remain.

Setting this up correctly the first time avoids re-verification headaches down the line, and gets your profile contributing to relevance and prominence from day one instead of fighting an uphill battle against its own data.

If this all sounds like more than you bargained for when someone told you to "just claim your Google listing" — that's because it is. This is the kind of setup work we handle as part of local SEO for clients at Zehlm Web Development, based right here in Morganton, NC.

We Got Blacklisted Because of a Banking Trojan We Didn't Even Have

Zehlm Web Development LLC — Sun, 14 Jun 2026 22:58:23 +0000

One morning, email on our primary domain just... stopped working.

No bounce messages. No error a normal user would ever see. Outgoing mail vanished into nothing, and nothing was coming in either. For a small agency where half of new business arrives by email, that's not a minor inconvenience — that's the front door nailed shut.

Opening the Ticket

First instinct was to check the obvious stuff: DNS records, mail server config, SPF/DKIM — all fine. So we opened a support ticket with our hosting provider and waited.

The answer that came back wasn't what we expected: our server's IP address had landed on the Spamhaus blacklist — one of the most widely used spam-reputation lists in the world. Once an IP is on it, a huge percentage of mail servers worldwide will silently drop or reject anything coming from that address. That's why we weren't seeing bounces — recipient servers weren't even bothering to tell us.

Here's the part that stung: it wasn't anything we did. According to the hosting provider, another account on the same shared server had a banking trojan running on it, generating exactly the kind of malicious outbound traffic that gets an IP flagged. We were sharing an IP address with a compromised neighbor, and Spamhaus doesn't care whose account is actually infected — it blacklists the IP.

The Real Problem: Shared Infrastructure, Shared Reputation

This is the part that's actually worth internalizing if you're running anything important on shared hosting: your domain's email deliverability is tied to the security hygiene of every other account on that server — accounts you have no visibility into and no control over.

You can have a spotless setup. Strong passwords, clean code, no vulnerable plugins. None of that matters if the account two slots over from yours gets compromised and starts spraying spam or malware traffic from the same IP. You inherit their blacklist.

For most small businesses, this risk is invisible until the day it isn't.

The 48-Hour Move

Once we understood the actual cause, staying on that shared IP wasn't really an option — even after cleanup, a blacklisted IP can take time to get delisted, and there was zero guarantee another account on the same server wouldn't cause the same problem again next month.

So we moved fast:

Spun up a dedicated VM on Google Cloud Platform — our own IP, our own environment, no neighbors
Transferred the domain to Cloudflare's registrar for better control over DNS and security settings
Set up mail through Zoho Mail with a PHPMailer relay, so outbound mail from the server goes through a reputation-managed provider instead of relying on the VM's raw IP reputation

That last point matters as much as the migration itself — even on a dedicated server, we didn't want our deliverability resting entirely on one IP's reputation again.

Locking It Down

Once we were on infrastructure we fully controlled, we hardened it properly — things that aren't possible (or aren't your job) on shared hosting:

Fail2ban with guaranteed uptime. Fail2ban watches logs and bans IPs showing brute-force or scanning behavior, but if the service itself crashes, you're unprotected. We added a systemd override so it restarts automatically:

# /etc/systemd/system/fail2ban.service.d/override.conf
[Service]
Restart=always
RestartSec=10

Persistent firewall blocks. Known-bad IPs get dropped at the firewall level and the rule survives reboots:

sudo iptables -A INPUT -s <malicious-ip> -j DROP
sudo netfilter-persistent save

reCAPTCHA Enterprise on every form. Not directly related to the blacklist, but part of the same "stop being an easy target" push — bot traffic and automated form abuse are exactly the kind of noise that can snowball into the next incident.

What We'd Tell Anyone on Shared Hosting

You don't need to migrate to a VM tomorrow to take one useful thing from this. Periodically check whether your mail server's IP is on a blacklist — it takes thirty seconds:

check.spamhaus.org — Spamhaus's own lookup
mxtoolbox.com/blacklists.aspx — checks dozens of blacklists at once

If you're on shared hosting and you ever see mail mysteriously stop arriving with no errors, this is the first thing to check — and it's worth knowing before it happens, not during a support ticket at 9am with clients trying to reach you.

These are the same lessons we apply to every infrastructure decision at Zehlm Web Development — a custom web design and digital marketing agency based in Morganton, NC.

5 PageSpeed Optimizations That Took My Client Sites from 56 to 92 on Mobile

Zehlm Web Development LLC — Wed, 10 Jun 2026 22:09:57 +0000

If you're building sites for small businesses, PageSpeed scores matter more than ever. Google uses Core Web Vitals as a ranking factor, and a 56 on mobile is quietly killing your client's SEO. Here's exactly what moved the needle for us.

1. Fix Your LCP Image First

The single biggest win on every project. Largest Contentful Paint is almost always the hero image. Two things that made an immediate difference:

Convert to WebP. We target ~45KB desktop, ~22–28KB mobile using a <picture> element with separate srcset values.
Add fetchpriority="high" to the <img> tag. This tells the browser to prioritize it above everything else.

<picture>
  <source srcset="hero-mobile.webp" media="(max-width: 768px)" type="image/webp">
  <source srcset="hero-desktop.webp" type="image/webp">
  <img src="hero-desktop.jpg" fetchpriority="high" alt="Hero image">
</picture>

Don't lazy-load your LCP image. Ever.

2. Load Your Critical CSS Synchronously

This one surprises people. We had async preload on our main stylesheet to speed up initial load — it was actually causing CLS (Cumulative Layout Shift) because the page rendered before styles applied.

The fix: load site.css as a standard synchronous stylesheet. Yes, it blocks render slightly, but it eliminates the layout shift entirely and the CLS score goes to zero.

<!-- Do this -->
<link rel="stylesheet" href="/css/site.css">

<!-- Not this for critical CSS -->
<link rel="preload" href="/css/site.css" as="style">

Reserve async preload for non-critical CSS only.

3. Defer Third-Party Scripts Aggressively

Google Analytics was costing us 0.3–0.5s on every page. We moved GA4 behind Cloudflare Zaraz with a 2-second blocking trigger — it fires after the page is interactive, not during load. Scores jumped immediately.

For anything you can't defer through a tag manager, use the defer attribute at minimum:

<script src="analytics.js" defer></script>

If it doesn't affect the visible page on load, it shouldn't block render. No exceptions.

4. Preload Your Custom Fonts

If you're self-hosting fonts (and you should be — Google Fonts adds a render-blocking request), preload them in the <head> with font-display: swap in your CSS.

<link rel="preload" href="/fonts/opensans.woff2" as="font" type="font/woff2" crossorigin>

@font-face {
  font-family: 'Open Sans';
  src: url('/fonts/opensans.woff2') format('woff2');
  font-display: swap;
}

font-display: swap ensures text renders in a fallback font immediately while the custom font loads, eliminating invisible text flashes that tank your FCP score.

5. Enable OPcache and HTTP/2 on Your Server

Front-end optimizations only go so far. On the server side, two quick wins that most shared hosting setups miss:

OPcache — caches compiled PHP bytecode in memory. On a PHP 8.x stack this alone can cut TTFB by 40–60ms.
HTTP/2 — enables multiplexing so the browser loads multiple assets in parallel over a single connection instead of queuing them.

On Apache, confirm both are active:

php -i | grep opcache.enable
apache2ctl -M | grep http2

If OPcache isn't enabled, add this to your php.ini:

opcache.enable=1
opcache.memory_consumption=128
opcache.max_accelerated_files=10000

Results

Combining all five on a roofing company site: 56 → 92 mobile, 91 → 99 desktop. Core Web Vitals went all green within two weeks of Google recrawling.

These aren't tricks — they're fundamentals that get skipped when you're moving fast. Slow down on these five and your clients will notice the difference in rankings.

These are the same techniques we use on every build at Zehlm Web Development — a custom web design and SEO agency based in Morganton, NC.