Website Credibility Checklist: 40 Signals, Scored

In short

Credibility is a sum of small signals. This list groups them so you can find the ones you are missing.
Every item carries its reason. If you disagree with the reason, skip the item; if you cannot argue with it, fix it.
Score on a phone, as a stranger would, and be as harsh as a competitor would be.
Under 32 points and visitors are choosing someone else for reasons they could not name.
Most items cost nothing but an afternoon. The rest are cheap next to the calls they are costing.

How to run this checklist

A checklist only works under real conditions, and the real condition for a website is a stranger, on a phone, with no patience and no context. Do not run this at your desk in a browser that has cached every image. Run it the way the trust guide describes the ten-at-night visitor, with the honest question at each line: would a person who has never heard of me believe this?

Each item is worth the points shown after it, one or two. The two-point items move the verdict on their own. Forty items, 53 points. Total them and read the bands in the last section.

The method

1
Open the site on a phone, over cellular, in a private window.
The private window clears the cache and shows the site the way a first visitor sees it, load time included.
2
Go through each group in order and mark each item yes or no.
No partial credit. A review with a first name but no date is a no. Harsh scoring is the point.
3
Total the points and note the group with the most misses.
The lowest group is where the visitor's doubt comes from and where the first afternoon of fixes should go.

Identity: does a real business exist here?

The business name is the same on the site, on Google and on the invoice. A name spelled two ways reads as two businesses, or one that is careless. (1)
The owner's name appears on the site. A named owner is accountable. An anonymous business is not, and visitors feel the difference. (2)
The city or service area is named on the home page. A stranger needs to know you are here, not somewhere. (1)
A physical address, or for home-based businesses the city and license number, is in the footer. Scams do not list where they are. Real businesses do. (2)
The year the business started is a year, not a phrase. "Since 2014" can be checked. "Years of experience" cannot. (1)
The people who do the work have faces and first names on the site. The visitor's real question is who is coming to their house or handling their case. (2)
Logo, colors and type are the same on every page and match the truck and the invoice. Consistency signals a business with its act together; the basics guide calls this the boring half of a good site. (1)

Proof: can the claims be checked?

At least three reviews on the home page with a first name, a date and the service. Reviews without those read as written by the owner. (2)
Each service page has at least one review about that service. Proof next to the ask beats proof on a separate page. (1)
A live Google rating with the review count appears on the site. A count from a source the visitor already trusts. (1)
Photos of actual work, with a location or date, on the pages where that work is sold. A photo with a place and a time is evidence. A stock photo is a placeholder. (2)
No stock photos of people anywhere on the site. Visitors recognize the models, and then distrust everything nearby. (2)
License number, insurance carrier and any bond stated in writing. Checkable in a minute, and the visitor knows you know that. (1)
At least one specific count: jobs, years, trucks, technicians, cases. A number implies a record that a phrase does not. (1)
Any awards or certifications are real, current and named, not generic badge images. A visitor cannot verify a graphic, and some read badges as a warning. (1)

Proof is anything a skeptic could check. Everything else is decoration, and skeptics can tell the two apart faster than you would like.

Contact: is there a person at the other end?

The phone number is in the header of every page and dials when tapped. The visitor who has to hunt for it assumes you do not want the call. (2)
The phone number is the same one that appears on Google. A mismatch makes the visitor wonder which one is real. (1)
Hours are stated, including what happens after hours. "Call anytime, we answer" is a claim; "7 to 7, weekends by appointment, emergencies answered" is a fact. (1)
The main form has four fields or fewer and a button that says what will happen. Nine fields reads as a company that makes everything hard. The conversion guide has the shorter version. (1)
A submitted form gets an instant confirmation and a stated reply time. Silence after a form is the moment most leads go to the next tab. (1)
An email address and, where relevant, a map are on the contact page. Two ways to reach you and a place on the map are what a real business has. (1)

Security: does the browser trust you?

Visitors do not think about security until the browser makes them. Then it is the only thing they think about.

The address starts with https and shows a padlock on every page, with no warning. A "not secure" label next to your name ends the visit for most people. The SSL certificate guide explains it in plain words. (2)
The certificate renews automatically. An expired certificate produces a full-screen warning that reads as a hacked site. (1)
Searching your business name shows no Google warning, spam result or strange page on your own domain. Compromised sites are common on old templates, and malware removal is cheaper than the reputation cost of not noticing. (2)
A privacy policy exists and is linked in the footer. Required in several states once you collect a name and email, and expected by anyone who looks. (1)
Forms are protected from spam without making a real customer solve a puzzle. Junk submissions bury the real ones; a hostile CAPTCHA loses them. The fix does neither. (1)
The site is backed up automatically, somewhere other than its own server. Invisible to the visitor, until the day the site is gone and stays gone. (1)

Content: does the page sound like a person who knows the work?

The headline names the service and the place in plain words. A slogan tells the visitor nothing about whether you do the thing they need. (2)
No spelling or grammar errors on the home, service or contact pages. Customers mention this more than any other item. Carelessness on the page suggests carelessness on the job. (1)
Every service page says what the service is, who needs it and how it is priced. Vagueness about price reads as a business that sets the price after seeing the customer. (1)
The about page is about the customer's confidence, not the founder's journey. Who, how long, licensed for what, and who answers the phone. (1)
No page has placeholder text, sample posts or a "coming soon" notice. Template leftovers say nobody finished the site. (1)
Nothing is dated more than a year old unless it is meant to be. The newest post, the news section, the copyright line. Stale dates say the business may be stale too. (2)
The site works with a keyboard, a screen reader, and for someone who cannot tell red from green. Accessibility is a credibility signal to the people who need it and a legal exposure to everyone else; ADA compliance covers the specifics. (1)

Technical: does the site behave like it is maintained?

The home page is readable within two seconds on cellular. Slow reads as neglected before the first word. The speed guide sets the target. (2)
Every link on the main pages goes somewhere. One dead link makes the visitor doubt the live ones. (1)
Every image loads, and none is stretched, blurry or the wrong size. A broken image icon is the visual equivalent of a typo. (1)
The site fits a phone screen with no sideways scrolling, pinching or overlapping text. More than half your visitors are on a phone; the mobile guide has the test. (2)
Search engines show your real title and description, not a template default. "Home | My Website" in a result loses the click before the site loads. (1)
The site has been touched in the last ninety days, and you know what changed. Unmaintained sites collect every problem on this list one at a time. (1)

Reading your score (53 possible)

Score	What it means	What to do
45–53	Strangers trust the site. Doubt is not why you are losing calls.	Work on conversion and on being found.
32–44	The site is credible with leaks. Some visitors hesitate and you cannot see which ones.	Fix every two-point miss this week. Most take an hour each.
19–31	Visitors are choosing competitors for reasons they could not name.	A weekend with a camera and this list, then the free audit for the technical items.
Under 19	The site is costing you the calls it should be producing.	Read how to improve an old website and decide whether to repair or rebuild.

Whatever the score, the group with the most misses names the visitor's doubt. Identity misses: they are not sure you exist. Proof misses: not sure you are good. Contact misses: not sure you will answer. Fix the doubt, not the score. We run this list on every site we audit, and the design mistakes guide explains how most of the misses got there.

Free · takes a minute

Find out what your site is actually doing.

A free audit scores your site on speed, mobile, SEO and security, and lists the fixes in order of what they are worth. Delivered as a PDF to your inbox.

Run the free audit Or just ask a person

Go deeper

Free · No obligation

Want to know what makes strangers hesitate on your site?

Tell us what you suspect and we will look at the site the way a first-time visitor does, then send you the list of what is costing you the call. Free, no pitch attached.

Which of these sounds like you? (pick any)

Questions people ask

Straight answers

A credible website shows things a stranger could verify: the owner's name, a real address or license number, photos of actual work and people, reviews with names and dates, a phone number that matches Google, a secure connection, and nothing broken or out of date. Credibility is the sum of those small signals, and a site can be plain and still score well on every one.

Open it on a phone over cellular, in a private window, and go through a checklist as a stranger would: can I tell who runs this, where they are, whether the reviews are real, whether the phone number is easy to find, whether the connection is secure, and whether anything is broken or stale. Score harshly. The groups with the most misses tell you which doubt visitors have.

It removes the most damaging warning a visitor can see. Browsers label sites without one as not secure, right next to your business name, and many people leave on sight. A certificate does not make a site credible on its own, but a missing or expired one makes a site look abandoned or hacked, which is worse than any design flaw.

Three on the home page with full first names, dates and the service mentioned, and at least one on each service page about that service. More is fine if they are real and recent. Fifty anonymous quotes are worth less than three named ones, because visitors read reviews for signs of a real person and stop reading when they do not find one.

Usually because the site is missing the things a scam would not bother with: a name, an address or license, faces, dated reviews, and a phone number that appears everywhere. Or because it has the things a scam would have: stock photos, vague claims, pop-ups, and something broken. Run the checklist and the specific reason will show up in the group with the lowest score.

Where to go from here

The Website Credibility Checklist