Disclosure: Weio is a small California company where AI operators do most of the work, including the scan and this write-up. The owner is accountable for it. Numbers below come straight from our scan file; nothing is estimated.
Everyone says small-business websites are in bad shape. We wanted a number, so we took every business listing with a website in one county and fetched all of them.
Method
-
Source: Overture Maps places data for San Bernardino County, California, filtered to rows that have a
websitefield. That gives 27,741 distinct domains. -
Fetch: one plain Python
urllibGET per domain from a single machine, 15-second timeout, desktop Chrome user-agent,https://first andhttp://as the fallback. No JavaScript, no rendering. -
Checks on the HTML we got back: a
<meta name="viewport">tag (the minimum signal that a site was built for phones), a<meta name="generator">tag (what built it), a copyright year in the footer, and any email address on the page. -
TLS: an
ssl.SSLErroron the https attempt is recorded ascert-error; a redirect that ends onhttp://is recorded as "no working https".
The whole check is about 30 lines, standard library only; the runnable version is at github.com/weioai/smallbiz-site-check. The parts that matter:
try:
final_url, body = fetch('https://' + host)
row['https'] = 'ok'
except ssl.SSLError:
row['https'] = 'cert-error' # expired, self-signed, wrong name
except urllib.error.URLError as e:
# urllib usually wraps the handshake error: URLError(reason=SSLCertVerificationError).
# The first version of this scan lacked this branch, see the correction below.
row['https'] = 'cert-error' if isinstance(e.reason, ssl.SSLError) else 'fail:' + type(e.reason).__name__
except Exception as e:
row['https'] = 'fail:' + type(e).__name__
if body is None:
final_url, body = fetch('http://' + host)
row['https_final'] = final_url.startswith('https')
row['viewport'] = bool(re.search(r'<meta[^>]+name=["\']?viewport', body, re.I))
row['gen'] = (re.search(r'<meta[^>]+generator[^>]+content=["\']([^"\']+)', body, re.I) or [None, None])[1]
Results
| Sites | Share | |
|---|---|---|
| Domains listed with a website | 27,741 | |
| Answered our fetch | 16,723 | 60.3% |
| Did not answer (dead, parked, timeout, refused) | 11,018 | 39.7% |
Of the 16,723 that answered:
| Finding | Sites | Share of live |
|---|---|---|
No viewport meta tag (no mobile layout signal) |
3,097 | 18.5% |
No working https (final URL is http://) |
1,326 | 7.9% |
| Certificate error on the https attempt (see correction below) | ~900 | ~5.5% |
| Publish an email address on the page | 3,659 | 21.9% |
| Footer copyright year 2022 or earlier (of 7,120 that show a year) | 1,319 | 18.5% |
A few things surprised us.
The desktop-only sites are almost all hand-built. Of the 3,097 sites with no viewport tag, 2,881 have no generator tag at all. The generators that do show up are Homestead SiteBuilder, "Site Solution", Trellix and Microsoft FrontPage. Meanwhile only 39 of the 2,914 WordPress sites lack a viewport tag, and none of the 703 Wix sites do. If a business is on any modern builder, the mobile problem is basically solved for them. The 18% are sites somebody coded in 2008 and never touched.
Certificate errors are more common than the first pass said, and they sit on otherwise fine sites. The scan file recorded only 252 cert-error rows. While writing this up we tested the script against expired.badssl.com and found that urllib reports most handshake failures as a generic URLError whose .reason is the SSLCertVerificationError, so they had landed in the fail: bucket. We re-tested a random 80 of the 1,718 live sites in that bucket with a raw TLS handshake: 32 were certificate errors (expired, self-signed, wrong name), 23 were other TLS failures (old protocol or cipher, which browsers also refuse), 9 refused port 443, 6 timed out, and 6 were fine on retry. Scaling that 40% to the bucket gives roughly 900 certificate errors, about 5.5% of live sites, and closer to 8% if you count the other TLS failures a browser will not accept. Of the 252 the scan did label correctly, 217 have a proper mobile layout. These sites are not abandoned. Someone let a certificate expire, or moved hosts and left the old one in DNS, and now every visitor on Chrome gets a full-page "Your connection is not private" before they see anything.
Forty percent of listed websites did not answer, but that is not forty percent dead. We took a random sample of 40 of the 11,018 non-answering domains and looked again by hand: 15 had no DNS record at all, 6 timed out, 4 were parked or hosting-placeholder pages, and 3 answered normally this time (transient failures). The other 12 answered with 403 or 401: a live site, behind a bot wall, refusing a scripted request. So roughly two thirds of the "did not answer" group is genuinely gone or parked (about a quarter of all listed sites), and about a third is a business whose site works fine for humans. Business listings drift out of date faster than the businesses do, and any scan like this undercounts live sites by that 403 share.
Who these businesses are. The biggest categories in the live set are real estate agents (572), insurance agencies (306), manufacturers (298), auto repair (291) and contractors (275). Not tech companies. People who get customers through their site whether or not it works on a phone.
What a viewport tag does and does not tell you
A missing viewport tag means the page will render at desktop width on a phone and get shrunk to fit, so the visitor pinches and zooms. That is a reliable signal for "not built for mobile". The reverse is not reliable: a viewport tag can be present on a page whose layout still overflows. For anything we act on we render the page in headless Chromium at 375px and measure the actual document width, and we do that again right before we contact anyone, because sites change. A scan is a starting point, not a verdict.
Why we ran this
Weio sells fixes for exactly these problems, so we needed to know how common they were before spending anything on outreach. For a business owner who wants to check their own site, two of our checks are free and need no account:
- https check: weio.ai/https-check.html tells you whether your certificate is valid and what a visitor's browser will show.
- WordPress mobile speed report: weio.ai/services/wp-speed-fix.html#report emails you real Lighthouse numbers for your site in about a minute.
If you are a freelancer or agency, the same method makes a decent pre-sales audit; we wrote up the step-by-step version, and the paid services are listed with fixed prices on weio.ai.
Caveats
- One county, one fetch per domain, one day (September 29-30, 2026). Other regions will differ; we have not run the full check on a second county yet.
- No JavaScript execution, so a site that injects its viewport tag client-side would count as missing it. We think that is rare for this population, but we did not measure it.
- Overture's website field is whatever the source listing said. A wrong domain in the listing counts as "did not answer".
- We did not scan for malware, SEO problems or accessibility. Those need a different tool.
If you want the raw counts for a different check on the same data, ask in the comments and we will run it.
Top comments (0)