German small business websites: 150 checked

A small business website check is an automated test of a company homepage against the basics that cost customers, money, or legal trouble when they fail: legal texts and consent, email authentication, accessibility, and how search engines and AI assistants read the site.

On 28 October 2026 we ran 150 small business websites from Germany, Austria, and Switzerland through our free Website Check: electricians, roofers, tax advisors, dentists, driving schools, restaurants, and fifteen more trades, found the way customers find them, by searching for trade and city. 144 could be checked. The median score is 79 out of 100, and only 12 sites reach 90. The gaps sit where owners rarely look: legal texts that cite repealed law, email domains anyone can forge, and pages that fail basic accessibility.

Signal	Share of small business sites
Cite outdated law (German sites)	54.7%
Still link the closed EU dispute platform (German sites)	23.4%
Analytics, ads, or social tracking before consent (German sites, real browser)	24.2%
Load Google Fonts from Google’s servers before consent (German sites, real browser)	17.2%
No DMARC record	45.8%
No DMARC enforcement (missing or p=none)	75.7%
At least one WCAG 2.1 AA violation	88.7%
No Organization or LocalBusiness schema	47.2%
No preview image for shared links	48.6%
llms.txt	0%

55% of German small business sites cite outdated law

The rules behind the Impressum and the privacy policy changed in November 2020, May 2024, and July 2025, and many legal texts are older than that. Of the 128 German sites, 70 still cite at least one rule that no longer exists:

Outdated reference	Replaced by	German sites
Link to the EU online dispute resolution (OS) platform	Nothing: the EU shut it down on 20 July 2025	23.4%
“§ 5 TMG” or “§ 55 RStV” in the Impressum	§ 5 DDG (since 14 May 2024), § 18 MStV (since November 2020)	30.3% of readable Impressum pages
“TTDSG” or “Privacy Shield” in the privacy texts	TDDDG (since 14 May 2024), EU-US Data Privacy Framework	25.8% of readable privacy policies

The dead OS link matters most. The platform no longer exists (Regulation (EU) 2024/3228), and a link to it can be read as misleading under § 5 UWG. The fix takes five minutes: delete the paragraph and the link from the Impressum, the terms, and any marketplace profile. The separate notice on consumer arbitration under § 36 VSBG is a different rule and stays where it applies.

The TMG and TTDSG references are cosmetic by comparison, but they show a legal text nobody has read since 2024. Naming the law is not required, so the simplest fix is to drop the citation.

This is not legal advice. Our Abmahn-Check lists every reference it finds on a page.

24% start tracking before anyone consents

The Cookie Scanner opened each German site in a real browser, the way a visitor does, and recorded what loaded before any click on the banner. On 31 of 128 sites (24.2%), analytics, advertising, or social media tracking ran before consent, or a tracking cookie was set. Google Analytics alone did so on 17 sites. Nine of the 31 show no consent banner at all; on the others the banner is there, but the tags do not wait for it.

Consent, measured in a real browser (German sites)	Share
Analytics, ads, or social tracking before consent	24.2%
Tracking cookie set before consent	18.8%
Google Fonts requested from Google before consent	17.2%
Still load Google Analytics, Google ad servers, Meta, or X after Reject	25.4% of 63 sites with a reject button we could click

The last row is the expensive one. After a click on Reject and a reload, 16 of the 63 sites still loaded Google Analytics, Google’s ad servers (often through an embedded YouTube video), Meta, or X. Part of this is Google’s Consent Mode, which loads Google’s tags after a refusal by design and sends pings without cookies. Whether that is allowed without consent is disputed in Germany; the visitor’s IP address reaches Google either way. Our cookie consent mistakes post covers the usual causes, and the Cookie Scanner shows what a site loads before and after each click.

76% of the domains do not stop forged email

DMARC is a DNS record that tells receiving mail servers what to do with email that claims to come from your domain but fails the SPF and DKIM checks. Without it, or with the policy p=none, a forged invoice in your name is judged by each receiver alone.

Email setup (144 domains)	Share
No DMARC record	45.8%
DMARC with p=none (monitoring only)	29.9%
DMARC with quarantine or reject	24.3%
No SPF record	13.9%
Neither SPF nor DMARC	6.9%
MTA-STS (encrypted delivery enforced)	0%

Gmail and Yahoo have required DMARC from bulk senders since February 2024, and Germany’s BSI lists SPF, DKIM, and DMARC as the state of the art in TR-03182. For a small business the point is simpler: invoice fraud in the company’s name, sent to its own customers. A DMARC record is one line of DNS. Start with p=none and a report address, read the reports for two weeks, then move to quarantine. Our DMARC checker comparison lists free tools for the reports.

89% fail automated accessibility tests

We tested 141 homepages with axe-core against WCAG 2.1 AA in a real browser. 125 had at least one violation, 122 at least one rated serious or critical. The median site breaks two rules on eight elements, so the fixes are usually small.

WCAG rule (141 homepages)	Sites failing it
Text contrast too low	74.5%
Links without a name (icon links, empty links)	45.4%
Zoom disabled on mobile	17.7%
Images without alt text	12.8%
Links that only differ by color	12.1%

The pattern matches the WebAIM Million 2026, which found detectable WCAG failures on 95.9% of the top million homepages and low contrast on 83.9% (with a different tool, WAVE).

The Barrierefreiheitsstärkungsgesetz (BFSG) has applied since 28 June 2025, but not to every site: it covers consumer services sold online, such as shops and bookings that form a contract, and exempts micro-enterprises (fewer than ten people and at most €2 million turnover) that offer services. A dentist with an information site is usually outside it. The contrast and the unnamed links still cost that dentist patients who cannot read the page. Our accessibility checker comparison covers the free tools.

Nearly half never tell AI search who runs them

AI assistants such as ChatGPT and Perplexity have to attribute what they quote. A schema.org block that names the business, its address, and its profiles is the cheapest way to be attributable.

Signal (144 sites)	Share
No Organization, LocalBusiness, or Person schema	47.2%
No JSON-LD at all	33.3%
No sameAs links to other profiles	78.5%
No preview image for shared links (og:image)	48.6%
Not exactly one H1 on the homepage	33.3%
Block an AI crawler in robots.txt	0.7%
llms.txt	0%

Small businesses do better here than the big German sites: 60.4% of the 1,000 most-linked German websites have no Organization schema, against 47.2% in this sample. Half of the small business sites run on WordPress, and its SEO plugins write the block by default: 63% of the WordPress sites have one, against 41% of the rest. Most of these blocks are a bare Organization, though. Only 34 sites (23.6%) use a local business type such as LocalBusiness, Dentist, or Electrician, the type built for address, opening hours, and service area. Almost none block AI crawlers (27% of the big sites do).

Half of the sites also have no og:image. A link to them in WhatsApp, LinkedIn, or Slack shows a gray box or a random picture from the page.

44% have buttons an AI agent cannot find

AI agents such as ChatGPT agent book appointments and fill in forms by reading the page’s accessibility tree. On 62 of 140 homepages, at least one element looks and acts like a button but is a styled div, so an agent (and a screen reader) does not see a control there. 64 have buttons or links without a name. Both fixes are a line of HTML each; see what makes a website agent-friendly.

How we measured

• Sample: 22 web searches for a trade and a city (for example “Elektriker Krefeld”, “Installateur Graz”, “Treuhand Luzern”), 20 German cities plus Graz and Lucerne. From each result list we took the businesses’ own websites and left out directories, review portals, franchise pages, and companies with more than 250 employees. 150 domains: 134 German, 9 Austrian, 7 Swiss.
• Checks: the seven areas of the public Website Check, same code and scoring: AI Visibility Check, Abmahn-Check, SEO Site Audit, BFSG-Check (axe-core in headless Chrome), AI Agent Readiness Check, Email Setup Check, and Social Preview Check. For consent, the Cookie Scanner opened each German and Austrian site in headless Chrome, recorded what loaded before consent, clicked Reject where it found the button, and reloaded; 128 German sites completed that scan.
• Coverage: 144 of 150 sites were checked. Not checked: three domains that no longer resolve (still found by search), one site that answers only over plain HTTP, one that returned HTTP 500, and one whose firewall drops automated connections. Two more worked only with www in front; we checked that address. The accessibility and agent checks failed on three and four sites.
• German law on German sites: the legal numbers cover the 128 checked German sites. Email, accessibility, AI, and sharing cover all 144.
• Limits: homepage only, automated, one run per site. Search results favor sites that rank, so the sample leans toward businesses that invest in their website. Sector groups are small (2 to 17 sites), so we do not rank trades.
• No per-site data: we do not publish which business failed what. A list of small businesses with legal gaps is a target list for Abmahnung mills. Each owner can check their own site in a minute.
• Our own fixes: the study showed that our tools reported a site without HTTPS, and one where HTTPS works only with www, as unreachable. Both cases now get their own message with the fix. It also showed that our SEO Site Audit counted decorative images (alt="") as missing alt text, which wrongly flagged 81 sites. We fixed it and re-ran the SEO area on 29 October; every number here comes from the corrected version.

What to fix first on a small business website

1. Read the Impressum once. Delete the OS-platform paragraph, replace “§ 5 TMG” with “§ 5 DDG” or drop it, and replace “TTDSG” and “Privacy Shield” in the privacy policy. Fifteen minutes.
2. Publish DMARC. One DNS record, p=none with a report address first, quarantine two weeks later.
3. Nothing from Google before consent. Host fonts on your own server and load analytics and maps only after opt-in.
4. Fix contrast and name every icon link. Usually a theme setting and an aria-label per icon.
5. Say who you are. A LocalBusiness JSON-LD block with name, address, opening hours, and sameAs links, plus an og:image for shared links.

FAQ

How good are small business websites in Germany? Better than their reputation on the technical basics, worse on the details. The median score in our check of 144 sites is 79 of 100, 12 sites reach 90 or more, none scores above 94. SEO basics are mostly in place; legal texts, email authentication, and accessibility are not.

Do I still need the link to the EU online dispute resolution platform? No. The EU shut the OS platform down on 20 July 2025, and the duty to link it ended with it. 23.4% of the German small business sites in our check still link it. Remove the link and its paragraph; the separate consumer arbitration notice under § 36 VSBG is not affected.

What is DMARC, and does a small business need it? DMARC is a DNS record that tells mail servers to reject or quarantine email that fakes your domain. Without it, criminals can send invoices in your name to your own customers more easily. 45.8% of the domains we checked have no DMARC record at all.

Does the BFSG apply to my website? Only if you sell consumer services online, such as a shop or a booking that forms a contract, and you are not a micro-enterprise (fewer than ten people, at most €2 million turnover) offering services. An information site usually falls outside it. This is not legal advice.

Can I check my own website? Yes. The Website Check runs the same seven checks on any URL in under a minute, free and without signup, and ranks the fixes by what they are worth. The German version is at kant.dev/de/tools/website-check.

Most of these fixes take an afternoon. When the website is one part of a bigger job (forms that feed the CRM, bookings that reach the calendar, email that arrives), write to us.