How to build a website in 2026: every step, and when you do not need an agency.

Most guides to building a website are written by somebody who sells one particular route: a website builder, a hosting company, or an agency that needs the answer to be “hire us”. We are an agency, so we have the same temptation, and this guide is written to resist it. It walks through how to build a website in 2026 the way a small-business owner actually has to: deciding what the site is for, registering a domain, choosing between a website builder, WordPress and a custom build, writing the copy, designing the pages, getting the technical and legal basics right in the EU, and launching. Prices come from the vendors’ own pages, checked in October 2026, and the time estimates are honest ones. Along the way it says plainly where doing it yourself is the right answer — which, for a lot of small businesses, it is.

Three ways to build a website, side by side

Prices from the Wix, Squarespace and Hostinger pricing pages, checked October 2026. Wix and Hostinger show localised prices, so yours may differ. Time estimates are ours, for a five-to-ten-page site whose copy and photos are ready.

Step 1: Decide what the site has to do

Before you open any tool, write one sentence: what should a visitor do on this site? For most small businesses the honest answer is one of three things — call or send an enquiry, book an appointment, or buy something. Everything else on the site exists to bring the right people to that action, or to reassure them enough to take it.

That sentence decides more than people expect. A plumber whose customers search on a phone in a hurry needs a phone number at the top of every page and a page for each service. A consultant who is judged on credibility needs case studies and a proper about page. A shop needs product pages, a checkout and a returns policy long before it needs a blog. If you cannot write the sentence yet, what a website is actually for is a better place to start than any template gallery.

Write down, too, how you will know it worked: enquiries a month, bookings, sales. A number chosen before launch is the only thing that will tell you later whether the site is doing its job or merely existing.

Step 2: Plan the pages before you pick a tool

A small-business site rarely needs more than a handful of pages: a home page, one page per service or product group, an about page, a contact page, and the privacy information covered in step 10. One page per service is the part people skip, and it matters — someone searching for “boiler repair” wants to land on a page about boiler repair, not on a home page that lists eleven things.

Sketch the structure as a plain list, with the address each page will have: /services/boiler-repair, /about, /contact. Short, readable addresses help visitors, and they are what Google’s own starter guide recommends. Decide now whether you want a blog. A blog you will not write for is worse than none, because the date on the last post tells every visitor when you stopped.

The list is also the cheapest scoping document there is. It tells you whether a builder template has room for what you need, and if you end up asking agencies for quotes, it is the single thing that makes those quotes comparable.

Step 3: Register a domain you own

Your domain is the one part of the site you should never let anybody else own. Register it in the business’s name, on an account whose login you hold, with a registrar you chose — not in the name of a developer, a nephew or the agency that built the site. Moving a website is a project. Losing control of its domain is a crisis.

Domains cost less than the marketing suggests and more at renewal than the first year shows. For .com, the registry operator Verisign charges registrars $10.26 a year wholesale, rising to $10.97 on 1 November 2026, and each registrar adds its own margin on top. If your customers are local, the country domain — .ro, .de, .fr — is usually the clearer signal; if you sell across borders, .com or .eu.

Builders often bundle a domain: Wix and Squarespace both include one free for the first year on annual plans. Read the small print. Wix’s voucher applies only to a new domain bought through Wix and must be redeemed within 60 days — so check what the renewal will cost before year two arrives. A domain kept with the platform is also one more thing to untangle if you ever leave it.

Step 4: Choose one of three routes

There are three realistic ways to build a small-business site in 2026. A website builder such as Wix or Squarespace gives you hosting, templates and an editor in one subscription. WordPress — free, open-source software installed on hosting you rent — gives you far more freedom and makes you responsible for it. A custom build means paying a developer or an agency to design and build the site for you, on WordPress or on a framework such as Next.js.

WordPress is still the default. W3Techs counted it on 40.2% of all websites on 2 October 2026, against 4.2% for Wix and 2.4% for Squarespace, while 31.5% of sites use no content management system it can detect. That popularity is a real advantage — every host supports it and almost every problem has already been solved by somebody — and it is also why WordPress gets the attention from attackers that step 9 comes back to.

Pick the route by who will look after the site in its second year, not by how fast it can go live in its first week. A builder looks after itself. WordPress needs somebody to apply updates and check backups every month. A custom build needs a developer you can call. The full trade-off between a builder and custom code is in website builder vs custom website, the case for and against a modern CMS in headless CMS vs WordPress, and what the new AI generators actually hand you in AI-generated websites. If a builder is the route, our builder test measures how fast each platform’s own showcase sites load.

Step 5: Sort out hosting

On a website builder there is nothing to set up: the hosting is the subscription. Squarespace’s plans cost €11, €17 and €29 a month billed annually, or €15, €24 and €42 month to month, and the cheapest one takes 2% of online-store sales. Wix shows prices by country; the version of its plans page we were served listed Light at about $17 a month and Business Elite at about $160, billed yearly.

For WordPress you rent hosting yourself, and the first rule is to read the renewal price. Hostinger’s cheapest WordPress plan, for example, is advertised at $2.99 a month — on a 48-month term, paid up front, renewing at $10.99. It is still cheap; just compare hosts on the renewal figure, not the headline one. Whichever host you choose, check that it runs what WordPress itself recommends — PHP 8.3 or newer and MySQL 8.0 or MariaDB 10.11 or newer — and that it keeps backups you can restore yourself.

A custom build is usually hosted wherever the developer recommends, and two questions are worth asking before you agree: whose name is the hosting account in, and what happens to the site if you part ways? The right answers are “yours” and “nothing” — the same principle as the domain. If you would rather have somebody set it up properly from the start, that is what hosting and deployment covers.

Step 6: Write the copy before the design

Small-business sites that take months instead of weeks are rarely held up by technology. They are held up by words nobody has written. A design built around placeholder text has to be reworked when the real text arrives, because real text is always longer, shorter or differently shaped than the filler — the pattern how long a website project takes traces week by week.

Write each page to answer the questions a customer actually has, in the order they have them: what do you do, for whom, where, roughly at what price, why should I trust you, and how do I get in touch. Use the words your customers use — “emergency plumber”, not “comprehensive hydraulic solutions” — and put the most important sentence first, because the top of the page is the part everybody sees.

Gather real photographs now: of you, your team, your premises, your work. Stock photos of smiling strangers in a meeting room tell a visitor nothing, and an AI-generated picture of a tradesman who does not exist is worse. If enquiries are what the site is for, the copy is also where most of the persuading happens, which is the subject of why a website isn’t converting.

Step 7: Design the pages

If you use a builder or a WordPress theme, choose the template by its structure, not by its photographs. The photographs will be replaced by yours; the structure — where the navigation sits, how a service page is laid out, whether the header has room for a phone number — is what you will live with. Pour your own copy into the template early and see whether it still looks good.

Keep the design decisions few and consistent: one or two typefaces, a small palette with one colour reserved for buttons, generous spacing, and text dark enough against its background to read on a phone in sunlight. Design for the phone first, because that is where a cramped layout fails first, and leave decoration for last.

With a custom build, the design normally comes before the code, as page designs you review and approve. Whether that still has to mean a full Figma file for every page, or whether some of it can now be designed straight in the browser, is a fair question, answered in design before development.

Step 8: Get the technical basics right

HTTPS is not optional, and it should not cost anything. Let’s Encrypt, a nonprofit certificate authority, issues free certificates to more than 700 million websites, and every builder and any decent host will install one for you. If a host wants to charge for a basic certificate, that tells you something about the host.

Speed matters to people before it matters to Google. Google’s Core Web Vitals give the targets: the main content should appear within 2.5 seconds, the page should respond to a tap within 200 milliseconds, and the layout should not jump about — a layout-shift score of 0.1 or less — all measured on three visits out of four. On a small site, speed problems usually come from two things: photos uploaded straight from a camera, and plugins or widgets nobody needed. Resize images before uploading, and add nothing you would not miss. If you want to go further, getting a 100 PageSpeed score explains what that number does and does not measure.

Then test on a real phone, not only in a narrowed desktop browser: tap every button with your thumb, fill in the contact form, and check that nothing important hides behind a cookie banner or a chat bubble. Google uses the mobile version of a site for indexing and ranking, so as far as search is concerned, the phone version is the site.

Step 9: Plan for updates, backups and security

A website is not finished at launch. It is software, and software needs maintenance. On a builder, the platform does it for you. On WordPress, you do. Patchstack counted 11,334 new vulnerabilities in the WordPress ecosystem in 2025, 42% more than in 2024; 91% were in plugins and 9% in themes, with only six in WordPress itself, and 46% were still unfixed when they were made public.

The practical rules follow from those numbers. Install as few plugins as you can, from developers who still update them. Turn on automatic updates. Keep a backup somewhere other than the server, and actually try restoring it once. Use a password manager and two-factor login for every admin account. None of this is difficult; all of it has to happen every month, and that is the real cost of the WordPress route.

If that sounds like a job you will not do, it is not a reason to avoid WordPress — it is a reason to pay somebody to do it, or to choose a builder instead. An unmaintained WordPress site is worse than any of the three routes done properly.

Step 10: Privacy pages and cookie consent

If your site has a contact form, it collects personal data, and in the EU that means privacy information: who you are, what the form collects, why, how long you keep it, who else receives it and what rights the person has. Article 13 of the GDPR sets out the list and requires it at the moment the data is collected, so the privacy page has to exist on launch day and be linked from the form.

Cookies are where small sites most often go wrong. Anything stored on a visitor’s device that is not strictly necessary for the service they asked for — typically analytics, advertising pixels, embedded videos and maps — needs consent first. In January 2023 the EU’s data-protection authorities, working through the EDPB’s cookie-banner taskforce, agreed a common position: pre-ticked boxes do not produce valid consent, and a banner that offers “Accept” on its first layer with no way to reject there is a problem. A banner whose only real button is “Accept” is not consent; it is decoration.

The simplest compliant site is one that needs no banner at all. Some analytics tools are built to work without cookies — Plausible, for example, says it uses none, processes no personal data and needs no consent banner, though that is the vendor’s own reading. The moment you add Google Analytics, an advertising pixel or a YouTube embed, a proper consent banner becomes the default, and it has to hold those scripts back until the visitor says yes.

Step 11: Make it accessible

Accessibility is part of building a site properly, not an extra. The basic checks take an afternoon: every image has a sensible text alternative, headings run in order, text has enough contrast with its background, every form field has a visible label, and the whole site works with a keyboard alone — press Tab and see whether you can reach, and see, every link and button.

For some businesses it is also the law. The European Accessibility Act came into effect in June 2025 and requires, among other things, that e-commerce in the EU be accessible to people with disabilities. Whether your site is covered, what exemptions exist and what conformance with WCAG 2.2 actually involves are set out in our guide to the European Accessibility Act.

Templates and themes vary widely here. One that looks clean can still fail on contrast or keyboard access, so test the template you chose rather than trusting a badge in its description.

Step 12: Analytics, Search Console and search basics

Measure the one action from step 1, and very little else. Install an analytics tool — Google Analytics, or a lighter cookie-free one such as Plausible, which costs $9 a month for up to 10,000 monthly page views — and record the form submission, the phone-number tap or the booking as a goal. A monthly report that says “14 enquiries, 9 from search” is worth more than a dashboard of thirty charts nobody reads.

Then add the site to Google Search Console. It is where Google shows which of your pages it has indexed, what people searched for when they found you, and what is broken. It is also where you submit a sitemap — a file listing the pages you want found — which Google recommends but does not require.

Search optimisation for a new small site is mostly doing the obvious things carefully. Give every page a unique title that says what the page is and, where it matters, where you are: “Boiler repair in Bucharest” beats “Home”. Write a short, specific description for each page, use descriptive addresses, and give images text alternatives. Google’s own SEO Starter Guide covers exactly this list, and notes that Google does not use the meta keywords tag at all, so skip it. If you serve a local area, set up a Google Business Profile with the same name, address and phone number as the site.

Then be patient. Google says some changes take effect within hours and others take several months, and that you should usually wait a few weeks before judging whether a change worked. A new site on a new domain starts with no reputation; genuine links from local directories, suppliers, clients and associations, and pages that answer real questions, are what build one.

Step 13: Go through the launch checklist

Before you announce the site, use it the way a customer would, on a phone and on a computer. Send a test enquiry through every form and confirm it arrives in an inbox somebody reads, not the spam folder of an address nobody checks. Click every link. Read every page aloud once — it is the fastest way to find the typo in a headline.

Then the invisible list. HTTPS works on every page, with and without “www”. The privacy page is linked from the footer and from the form. The cookie banner blocks what it says it blocks until someone accepts, and analytics records a visit after consent. The sitemap is submitted in Search Console. A 404 page exists and links somewhere useful. A backup has been taken and you know how to restore it. And every account — domain, hosting or builder, analytics — is in the business’s name, with the logins in your password manager.

If the new site replaces an old one, the most expensive mistake is forgetting the redirects. Every old address that had visitors or links pointing at it needs a permanent redirect to its closest new page, or the rankings the old site earned disappear along with it. Make the list of old addresses before you switch anything off.

Money and time, route by route

Done yourself on a builder, a simple site costs the subscription — from €11 a month on Squarespace’s cheapest annual plan — plus the domain after its free first year, and the time to write the copy and assemble the pages. With copy and photos ready, a few evenings to two weeks is realistic for five pages. Without them, it takes as long as the writing does.

Done yourself on WordPress, the money is still small — hosting, a domain, perhaps a premium theme and a paid plugin or two — but the time is larger: learning the dashboard, choosing and configuring plugins, and then the monthly updates and backups that never stop. Two to six weeks of part-time work to launch is a fair expectation for a first-timer, plus an hour or two every month afterwards.

Paid for, the price depends on scope far more than on page count, which what a website costs explains factor by factor, and the timeline depends mostly on how fast content and feedback arrive. For reference, these are our own fixed prices. A one-page Landing Page is €499, delivered in 5 business days. WordPress Starter is €999 for five pages on a premium theme, in 10 business days. Business Website is €1,999 for up to ten pages with a custom WordPress design, GDPR and cookie consent, and a month of support after launch, in 15 business days.

When doing it yourself is the right answer

If the site’s job is to confirm that you exist — what you do, where, and how to reach you — a builder and a couple of weeks of evenings is the right answer, and an agency that tells you otherwise is selling. That describes a lot of small businesses: a tradesperson, a therapist, a local restaurant, a consultant whose work arrives by referral. The site matters to them, but it is not where the money is made.

Doing it yourself is also right when you are testing an idea and do not yet know whether it works, when the budget is genuinely close to zero, or when you enjoy it and will keep the site current because you like doing so. A simple site that is updated every month beats an expensive one nobody touches.

The one condition is that you actually finish it. A half-built site with “coming soon” on the services page costs more in lost trust than the fee you saved. If three months pass and it is still not live, that is your answer.

When it isn’t

Pay for help when the site is how the business makes money: when most new customers find you through search, when the site takes bookings or payments, when it has to connect to a CRM, a booking system or an invoicing tool, or when it has to work in more than one language. Those are the places where builder limits, plugin conflicts and small technical mistakes cost real revenue.

Pay for help, too, when your own time is the expensive part. If an hour of your work is worth more than an hour of a developer’s, the weeks of evenings on the WordPress route are the most expensive option on the list — it just never arrives as an invoice. Web development is what we do, and we would rather tell you that a builder will do than build you a site you did not need.

And whichever way you go, keep the ownership rules from steps 3 and 5: the domain, the hosting, the content and the code belong to the business. A site you own outright can always be moved, rebuilt or handed to somebody else. A site you do not own can only be rented.

Sources

Prices come from each vendor’s own pricing page, checked in October 2026; Wix and Hostinger show localised prices, so the figures you see may differ. Legal and technical points come from the regulators’ and standards bodies’ own pages. The time estimates in this article are our own judgement, not taken from a source.

• W3Techs — Usage statistics of content management systems ↗

  Updated daily; on 2 October 2026, WordPress was used by 40.2% of all websites, Wix by 4.2%, Squarespace by 2.4%, and 31.5% used no content management system W3Techs detects.

• WordPress.org — Download ↗

  WordPress is free, open-source software (version 7.1.2 at the time of checking); recommends PHP 8.3 or greater and MySQL 8.0 or MariaDB 10.11 or greater on the host.

• Wix — Premium plans ↗

  Four premium plans, Light, Core, Business and Business Elite, shown at about $17 to $160 a month billed yearly in the version served to us; Wix states that prices and currency vary by location. Yearly plans include a one-year domain voucher, valid only for a new domain bought from Wix and redeemable within 60 days. A free plan exists.

• Squarespace — Pricing ↗

  Basic, Core and Advanced at €11, €17 and €29 a month billed annually, or €15, €24 and €42 billed monthly; Basic charges a 2% fee on online-store sales; annual plans include one year of free domain registration; 14-day free trial.

• Hostinger — WordPress hosting ↗

  Premium WordPress plan at $2.99 a month on a 48-month plan, renewing at $10.99 a month; includes a domain free for the first year.

• Domain Name Wire — VeriSign raising wholesale .com prices ↗

  April 2026: the registry-level wholesale price of a .com registration or renewal rises 7%, from $10.26 to $10.97 a year, effective 1 November 2026.

• Let’s Encrypt ↗

  A free, automated and open certificate authority run by the nonprofit Internet Security Research Group, providing TLS certificates to more than 700 million websites.

• web.dev — Web Vitals ↗

  Google’s Core Web Vitals thresholds for a good experience: Largest Contentful Paint within 2.5 seconds, Interaction to Next Paint of 200 milliseconds or less, Cumulative Layout Shift of 0.1 or less, measured at the 75th percentile of page loads.

• Google Search Central — Mobile-first indexing best practices ↗

  Google uses the mobile version of a site’s content, crawled with the smartphone agent, for indexing and ranking.

• Google Search Central — SEO Starter Guide ↗

  Recommends unique, descriptive page titles and meta descriptions, readable URLs, an optional sitemap and Search Console; says Google Search does not use the keywords meta tag, and that changes can take from a few hours to several months to show, so waiting a few weeks before assessing them is sensible.

• Patchstack — State of WordPress Security in 2026 ↗

  11,334 new vulnerabilities in the WordPress ecosystem in 2025, a 42% increase on 2024; 91% in plugins, 9% in themes and six in WordPress core; 46% were not fixed in time for public disclosure.

• GDPR Article 13 — Information to be provided where personal data are collected from the data subject ↗

  The text of the regulation: at the time personal data are obtained, the controller must give its identity and contact details, the purposes and legal basis, the recipients, the retention period and the person’s rights, including the right to complain to a supervisory authority.

• EDPB — Report of the work undertaken by the Cookie Banner Taskforce ↗

  Adopted January 2023: the common position of EU data-protection authorities on cookie banners, covering the absence of a reject option on the first layer, pre-ticked boxes (which do not produce valid consent under the GDPR or Article 5(3) of the ePrivacy Directive) and deceptive banner design.

• Plausible Analytics ↗

  The vendor states it uses no cookies, processes no personal data and needs no cookie banner, with data hosted in the EU; its Starter plan costs $9 a month for up to 10,000 monthly pageviews.

• European Commission — The EU becomes more accessible for all ↗

  July 2025: the European Accessibility Act came into effect in June 2025, and e-commerce platforms are among the services that must now be accessible to persons with disabilities.