Why do people ask if my business is a scam?

Asking “is this company legit” before hiring someone is now normal search behaviour — most people run this check before contacting any small business, not just yours. It usually gets triggered by one of three things:

• No reviews, or too few to trust. A handful of reviews (or none) reads as unproven, even if every client you’ve had was happy.
• Thin or empty search results. If searching your business name turns up almost nothing, there’s nothing to confirm you exist as a real, ongoing operation.
• No way to verify who’s behind it. No owner name, no registration details, no consistent address or phone number across the places you’re listed.

None of these mean your business is a scam. They mean the proof a stranger needs isn’t visible yet.

Why does my business look untrustworthy online even though I’m legit?

Because trust signals are judged separately from actual legitimacy. Google, and the people using it, aren’t evaluating your business — they’re evaluating what’s visible about it, and pulling that judgement from a specific, checkable set of signals:

• Whether a Google Knowledge Panel exists for your business
• Whether your name, address and phone number match across your website, Google Business Profile and other directories
• Whether you have reviews, and how recent they are
• Whether your website has been flagged as spam — often caused by low traffic and an unverifiable owner, especially on new sites
• Whether your social media presence is active and connected to your business name

If even one or two of these are missing or inconsistent, the gap reads as a red flag — even to someone who would trust you on the spot in person.

What actually closes the gap?

Not better marketing copy. It’s building the specific, verifiable signals above: consistent business information everywhere your name appears, a growing base of reviews, and — the single strongest signal — a Google Knowledge Panel.

We’ve built this exact trust profile for small businesses and nonprofits across Central Florida, from Orlando to Tampa to the Space Coast.

Audit my search presence

What is a Google Knowledge Panel?

A Google Knowledge Panel is the information box that appears on the right side of Google search results when you look up a business, person or organisation. It shows a snapshot of verified facts — name, address, hours, images, links — pulled from trusted sources, so a searcher doesn’t have to click through multiple pages to confirm who you are.

Why do some businesses get one and others don’t?

Google builds a Knowledge Panel from verified, structured data — not from the fact that a business exists or has a website. The businesses that get one typically have:

• A claimed, fully verified Google Business Profile with consistent, accurate details
• Structured data (schema markup) on their website telling Google explicitly: this is an Organization, here is our name, address and logo
• Consistent business information repeated across multiple trusted directories and citation sources
• Third-party validation — listings or mentions in recognised, authoritative sources

Businesses without a panel are usually missing several of these at once, most commonly structured data and citations. It isn’t that Google is ignoring them — there isn’t yet enough verified evidence to build a panel from.

What results can I really expect from getting one?

A Knowledge Panel does not directly increase your Google ranking or drive new traffic on its own — it isn’t a ranking factor. What it does, directly and reliably, is increase perceived credibility and click-through when someone searches your business name specifically. It gives searchers instant, verified confirmation that you’re a real, established business, which raises the odds they call or click instead of second-guessing you.

Think of it as removing doubt at the exact moment someone is deciding whether to trust you — not as a traffic-generation tool.

See what’s verified for you

How do I get a Google Knowledge Panel set up?

There’s no direct “apply here” button. You get one by building enough verified, structured evidence that Google can confidently assemble a panel from it.

1. Claim and fully verify your Google Business Profile. Complete every field: category, hours, address, phone number, website, photos. This is the single most important input.
2. Add Organization structured data to your website. This is code that explicitly states your business name, logo, address and official social profiles — the clearest signal you can give.
3. Make your business information identical everywhere. Name, address and phone number should match exactly across your site, your Google Business Profile and every directory you’re listed in. Inconsistencies are one of the most common reasons a panel never forms.
4. Build citations in recognised, trusted directories. Industry-specific directories and local business databases add third-party confirmation that you exist and operate as described.
5. Link your official social profiles and any press or partner mentions back to your website, and vice versa. This reinforces the identity Google is trying to confirm.
6. Check the panel for accuracy once it appears, and use Google’s built-in feedback and claim tools to suggest corrections.
7. Keep monitoring. Panels can disappear or go stale if your information becomes inconsistent again. This is maintained, not set once.

There’s no fixed timeline — it depends on how much verified data already exists about your business. But skipping any of the first three steps is the most common reason the process stalls indefinitely.

Assess where I stand

What does ADA website compliance actually mean?

It means your website can be used by people with disabilities — including visual, hearing, physical, speech, cognitive and neurological disabilities — without unnecessary barriers. It applies to any business open to the public, not just theatres or retail stores: restaurants, service businesses, nonprofits and solo operators are all covered. The legal standard used to judge compliance is WCAG 2.1 (or 2.2) Level AA.

What does website accessibility mean in practice?

In practice, it means specific, fixable things on your site:

• Alt text on every image, so screen readers can describe it to visually impaired visitors
• Keyboard navigation, so someone who can’t use a mouse can still reach every link, button and form field
• Sufficient colour contrast — a 4.5:1 ratio minimum between text and background
• Labelled form fields, so a screen reader user knows what each field is asking for
• Clear, descriptive link and button text (“Learn more about our services,” not “Click here”)
• Subtitles on video, and no auto-playing video or flashing animation that can trigger seizures or discomfort

This isn’t a one-time technical fix. 1 in 4 adults in the U.S. lives with a disability, and the features that help them — larger text, clear navigation, captioned video — also improve the experience for older visitors and anyone briefly impaired, like someone with a broken arm or a bad connection.

What’s the difference between ADA compliance and WCAG compliance?

They are not the same thing, and confusing them is one of the most common mistakes business owners make.

• ADA is the law — the Americans with Disabilities Act, a U.S. civil rights statute. It’s what makes an inaccessible website a legal liability.
• WCAG is not a law. The Web Content Accessibility Guidelines are a technical standard from the W3C describing how to build accessible content. There are three levels: A (minimum), AA (the standard used in nearly all lawsuits) and AAA (the highest, rarely fully achievable).

In short: ADA tells you accessibility is legally required; WCAG 2.1/2.2 Level AA tells you what “accessible” actually looks like in code and design. Courts and regulators use WCAG AA as the practical benchmark.

Can a small business actually get sued for not being ADA compliant?

Yes — and size doesn’t provide protection. 77% of ADA website lawsuits in 2023 targeted businesses with revenue under $25 million. Most cases start with a demand letter from a lawyer rather than a courtroom filing, and around 90% of businesses take corrective action before a lawsuit is ever formally raised.

Get a free web audit

How much does it typically cost to fix website accessibility issues?

Anywhere from a few hundred dollars for a small site with minor issues to several thousand for a larger or more complex site with structural problems. The range depends on how many pages you have, how the site was built, and how many issues turn up.

Three things drive the cost:

• Site size and complexity. A five-page site with a contact form costs far less to remediate than an e-commerce site with hundreds of product pages, custom scripts or an outdated theme.
• What’s actually wrong. Some fixes are quick — alt text, form labels, colour contrast. Others require rebuilding navigation, captioning video or recoding custom-built page elements.
• Automated versus manual work. An automated scan catches roughly half of common issues cheaply. The other half — logical reading order, meaningful link text, genuine screen-reader compatibility — needs human review. That costs more, but it’s the only way to get real protection rather than a partial fix.

One cost worth ruling out up front: free accessibility widgets or plugins that claim to make a site “100% compliant” automatically. These are a common source of new lawsuits, not protection from them, because they often fail to work with screen readers at all.

The most useful way to know your real number is an audit — it tells you exactly what’s wrong on your specific site before you pay to fix anything blind.

Get a free web audit

What is DMARC and why does my business email need it?

DMARC (Domain-based Message Authentication, Reporting and Conformance) is a security setting that tells email providers what to do with messages sent from your domain that fail to verify as legitimate — reject them, quarantine them, or let them through. Your business needs it because without it, anyone can send an email that looks like it’s from you, and nothing stops it reaching your customers’ inboxes.

Two related protocols work alongside it:

• SPF (Sender Policy Framework): a list of which mail servers are allowed to send email on your domain’s behalf.
• DKIM (DomainKeys Identified Mail): a digital signature added to your emails proving they weren’t altered in transit.

DMARC sits on top of both, deciding what happens when a message fails those checks. Since February 2024, Google and Yahoo require all three for any sender pushing meaningful volume (5,000+ emails in 24 hours). Without them, your legitimate marketing and customer emails increasingly land in spam — not just the fraudulent ones.

How do I set up DMARC and SPF for my business email?

1. Identify every service that sends email on your behalf — your website’s contact form, your email marketing platform, your CRM, your mailbox provider. Missing one is the most common setup mistake.
2. Publish an SPF record in your domain’s DNS. A TXT record listing the mail servers and services authorised to send as you.
3. Set up DKIM for each sending service. Each platform gives you a key to add as a DNS record, which digitally signs your outgoing mail.
4. Publish a DMARC record, starting with a monitoring-only policy (p=none) so you can see what’s happening without blocking anything yet.
5. Review the DMARC reports you start receiving. These show who’s sending email as your domain, including anything unauthorised.
6. Move gradually to a stricter policy (p=quarantine, then p=reject) once every legitimate sender is properly authenticated.

This is DNS-level configuration. Most business owners have whoever manages their domain or hosting handle it, since a mistake in an SPF or DMARC record can block legitimate email entirely.

See our email compliance service

Should I hire a compliance specialist or a general marketing agency?

For privacy law specifically, hire a provider whose core offering is compliance — not a general marketing agency that lists it as one service among many. Privacy law changes frequently and unevenly across states, and a provider whose main focus is marketing typically treats your cookie policy and privacy disclosures as a one-time setup task rather than something actively monitored.

What a general marketing agency typically offers: a template-based privacy policy and cookie banner, installed once and rarely revisited. That covers the bare minimum, but leaves you exposed when a new state law takes effect and your policy doesn’t reflect it.

What a dedicated compliance specialist typically offers: a policy built around how your business actually operates, ongoing monitoring as state and federal privacy laws change, and automatic updates when they do. A policy that was accurate last year can be out of date without you knowing it.

How do I choose between different compliance providers?

• Customisation versus templates. Ask directly whether your policy is written from a template or built from your actual data practices. Templates miss business-specific data collection that creates real liability.
• Update model. When a new state privacy law passes, do they update your policy automatically, or is that a separate request — and a separate cost — each time?
• What’s actually included. Cookie consent management, a Data Subject Access Request (DSAR) process, and multi-jurisdiction coverage (not just California) are things to confirm, not assume.
• Pricing structure. One-time setup fee, recurring fee, or both — and what triggers additional charges.
• Legal grounding. Ask whether policies are reviewed with attorney involvement. A policy that looks complete but isn’t legally sound doesn’t protect you.

The right choice is the provider set up to treat compliance as an ongoing responsibility, not a one-time item on a longer service list.

See what’s included

The answers below are general education — what commonly creates risk, and what a typical audit checks. They are not a legal determination about any specific website. For an assessment of your own site’s actual legal exposure, consult an attorney.

How do I know if my website is putting my business at legal risk?

Your website is likely creating risk if it’s missing any of these:

• A cookie consent banner — required if you use tracking cookies or analytics
• A “Do Not Sell My Personal Information” opt-out — required in states with consumer privacy laws
• A privacy policy that reflects what data you actually collect
• DMARC and SPF email authentication — required by Google and Yahoo for meaningful email volume, and a factor in avoiding spoofing-related liability

What’s included in a website compliance audit?

• Whether a cookie consent banner and policy exist, and whether cookies are actually being scanned and categorised correctly
• Whether your privacy policy matches your real data practices, or is a generic unrelated template
• Whether required consumer rights (access, deletion, opt-out of sale) are actually functional on your site, not just mentioned in text
• Whether DMARC, SPF and DKIM are correctly configured for your email domain
• Which state and federal privacy laws currently apply to your business, based on where your customers are

How much should I budget for website compliance work?

For a complete package — cookie consent management, a custom (non-template) privacy policy, terms and conditions, disclaimers, and ongoing monitoring as laws change — expect a setup cost around $695, with an ongoing service around $359 per year (or $35 per month) to keep policies current as new laws take effect.

Setup is typically one-time, with a deposit to start and the balance due on completion. The recurring fee covers monitoring and automatic updates — not a one-time policy that goes stale.

Get a compliance audit

What is a cookie policy and do I actually need one?

A cookie policy is a public statement disclosing what cookies your website uses — tracking, analytics, advertising — and giving visitors a way to control which ones they accept. You need one if your site uses any tracking or analytics cookies, which almost every business site does, including Google Analytics and the Facebook Pixel. It isn’t optional legal boilerplate; it’s a disclosure requirement tied directly to the privacy laws below.

How do state privacy laws like CCPA affect a small business website?

If you have website visitors or customers in states with privacy laws — now including California, Colorado, Connecticut, Virginia and a growing list of others — you’re required to disclose what personal data you collect and give visitors a way to opt out of having it sold, shared for advertising, or used for profiling.

This applies regardless of where your business is physically located. It’s based on where your visitors and customers are, not where you operate. Nine states passed new data privacy laws in a single recent year, and more are actively introducing bills, so the list keeps expanding.

What actually happens if I ignore state privacy laws?

Ignoring them exposes your business to fines from state, federal or in some cases international regulators for failing to provide required disclosures and opt-out options. Beyond direct fines, non-compliant businesses face the same practical risk as accessibility non-compliance: demand letters and legal action initiated by consumers or their attorneys, often before any regulator gets involved.

Fine amounts and enforcement vary by state, which is exactly why a policy needs to be actively monitored and updated. A policy that was compliant last year can fall out of compliance as new state laws take effect.

Have my policies checked

Why is nobody finding my business on Google?

Because Google doesn’t have enough signal to confidently rank you for the searches your customers are actually using. That usually comes down to one or more of: a Google Business Profile that’s unclaimed or incomplete, a website with thin or generic content that doesn’t match what people search for, no consistent presence across directories, or too few reviews. Google can’t recommend a business it can’t confidently verify and match to a search.

Why do I have a website but no one is calling me?

A website that gets visitors but generates no calls usually has a visibility problem or a conversion problem — not both at once, so it’s worth separating the two.

If your site gets little to no traffic, the problem is visibility. If it gets traffic but no calls, the likely causes are: your phone number and contact options aren’t obvious and immediate on every page, your site doesn’t clearly state what you do and where you’re located, or nothing on the page builds enough trust in the first few seconds to make a stranger want to reach out.

Why does my Google Business listing look empty or wrong?

This happens when the profile was never fully claimed and verified, or key fields — hours, categories, photos, service area — were left blank after setup. It also happens after a business changes address, hours or name without updating the listing, and when inconsistent information across your website and other directories confuses what Google displays.

A complete, verified, consistent Google Business Profile is also one of the direct inputs Google uses when building a Knowledge Panel — so fixing this listing helps both problems at once.

Find out what’s missing

Should I hire an SEO agency or try to do it myself?

DIY makes sense if you have the time to learn it and a small, simple site. Hiring makes sense once your time is worth more than the cost of paying someone else, or your site’s problems go beyond what free tools can diagnose. It depends on your bandwidth, not just your budget.

What DIY SEO actually requires: ongoing keyword research (Google Keyword Planner and Google Trends are free), regularly updated content that matches what your customers search for, technical basics like mobile responsiveness, page speed and proper headings, and building citations and backlinks over time. It’s learnable — but it’s ongoing work, and results typically take months, not weeks.

What an agency adds: faster diagnosis of what’s actually broken rather than guessing, technical fixes DIY tools can’t easily catch, and the ongoing consistency a busy owner often can’t sustain alongside running the business.

How do I get started fixing my website’s SEO?

1. Claim and fully complete your Google Business Profile — the highest-leverage first step for any local business.
2. Identify what your customers actually search for, using Google Keyword Planner and Google Trends rather than guessing at terms.
3. Make your name, address and phone number identical everywhere you’re listed online.
4. Fix the basics on your website: works properly on mobile, loads quickly, and clearly states what you do and where.
5. Get reviews actively rather than waiting for them — ask satisfied customers directly.
6. Add original, specific content about your services and area, instead of generic descriptions that read the same as every competitor’s site.
7. Track what’s working and keep adjusting. SEO is not a one-time setup.

If steps one through four feel like more than you have time for, that’s usually the point where hiring makes sense.

Talk through where I’m starting

Should I build my own website or hire someone to design it?

Building it yourself costs less money but more of your time, and the result depends heavily on your own design and technical skill. Hiring costs more upfront but gets you a site built around your specific business goals, generally stronger technical foundations (security, mobile responsiveness, SEO structure), and someone accountable if something breaks. If your time is limited or the site needs to actively drive business rather than just exist, hiring tends to pay for itself faster.

Is a template website builder good enough, or do I need a custom site?

A template builder is genuinely good enough for a simple informational site with low traffic and no complex functionality — especially if your budget is tight and you’re comfortable maintaining it yourself.

You need a custom site once generic templates leave you more vulnerable to common security exploits, once your business needs specific features a template can’t support, or once your design and SEO structure need to be built around your business rather than a one-size-fits-all layout. Neither option is automatically better.

Agency or freelancer — which is safer for compliance?

An agency is generally the safer choice specifically for compliance-related work — accessibility, privacy policy implementation, DMARC and SPF setup — because these require ongoing monitoring as laws and standards change, which a single freelancer is less likely to track and maintain over time.

A freelancer can be a good, lower-cost choice for a straightforward design project with no ongoing compliance obligation. If compliance is part of what you need built, ask any freelancer directly whether they monitor and update for law changes after launch. If the answer is no, that work needs to sit with a provider who does.

See how we build sites