What a startup website needs: pages, legal pages, analytics and speed

A first website has one job. A stranger who heard your name should be able to tell, in a few seconds, what you sell, who it's for, what it costs, and how to get in touch. Most first sites miss that by doing too much. They have a blog with two posts, a careers page with no openings and a hero image that explains nothing.

This guide is a checklist for the site you launch with. It covers the pages to build now and the ones that can wait, the legal pages US and EU rules actually call for, analytics that don't need a cookie banner, and the speed targets Google measures. I use this site, StartupStead, as the worked example, since it had to pass the same list before launch.

The pages to launch with

The home page carries the most weight. Write the headline as a plain sentence about the customer's problem or result, not a slogan. Put one clear call to action above the fold, such as booking a call, starting a trial or joining a waitlist, and make every other link secondary to it.

Pricing deserves its own page even when the answer is "it depends." Buyers look for it early, and a page that explains how a quote works, with a typical range, keeps people who would leave if the answer were hidden. An about page that names the founders, with real photos and a line on why they started the company, does more for trust than a list of values.

Pages that can wait

Some pages look standard but only help once they have content behind them.

• A blog. Start one when you can publish regularly. Three posts from launch week and nothing since tells visitors the company may have stalled.
• Careers. Add it when you're hiring. Until then, a line on the about page saying how to get in touch is enough.
• Press, investors and partners. These follow the news and relationships that fill them.
• Documentation and status pages. Essential for a software product with paying customers, premature before it.

Legal pages

A privacy policy

California's Online Privacy Protection Act, CalOPPA, requires the operator of a commercial website that collects personally identifiable information from California residents to post a privacy policy conspicuously. The policy has to list the categories of information collected and the kinds of third parties it's shared with, explain how visitors are told about changes, give an effective date, and say how the site responds to browsers' Do Not Track signals.^⁠[1]

A contact form or a newsletter sign-up is enough to collect personal information, and any site can have California visitors, so in practice every startup site with a form needs a policy. Several other states have their own privacy laws, and California's broader Consumer Privacy Act applies once a business passes thresholds such as $26,625,000 in annual gross revenue, the figure in effect since January 1, 2025.^⁠[2] Most new companies are well below that, but the policy you write now should be easy to extend.

Write it in plain words, and make it true. A template copied from a large company describes tracking and data sharing you don't do, which is worse than saying less. List what you actually collect, which services process it, and how someone can ask you to delete it.

Terms of use

No general US law requires terms on a marketing site, but they're worth having. Terms set the rules for using the site, limit your liability for what it says, and name the state whose law applies. If you sell a product or a service online, the terms of sale matter far more, and that's the document to have an attorney review.

A cookie notice, if you need one

No US federal law requires a cookie banner. The rule most banners exist for is European. Under Article 5(3) of the EU's ePrivacy Directive, a site needs consent before it stores or reads information on a visitor's device, which covers cookies and similar technologies, unless that storage is strictly necessary for a service the visitor asked for.^⁠[3] Analytics and advertising cookies aren't strictly necessary, so a site with EU visitors that uses them needs consent first.

The simplest answer is not to set those cookies at all, which brings us to analytics.

An affiliate or sponsorship disclosure

If your site earns money from links or reviews, the FTC expects the disclosure close to the recommendation. Its guidance says the closer the disclosure is to the recommendation, the better, and a single disclosure on a separate page isn't enough on its own, because readers may not make the connection.^⁠[8]

Analytics without a cookie banner

You need to know how many people visit, where they come from and which pages they read. You probably don't need to follow individuals across visits.

Cloudflare Web Analytics is one free option built that way. Cloudflare says it uses no client-side state such as cookies or localStorage for analytics, doesn't fingerprint visitors by IP address or user agent, and has no traffic limits.^⁠[4] It also works without moving your DNS or routing the site through Cloudflare's proxy.^⁠[5] Paid privacy-focused tools work on the same principle, with more reporting.

Whatever you use, set up Google Search Console as well. It's free, it shows which searches bring people to the site, and it tells you when Google finds a problem with a page.

Speed and Core Web Vitals

Google measures three things about how a page feels to use, called the Core Web Vitals. Its guidance on web.dev sets these targets:^⁠[6]

Each is judged at the 75th percentile of page loads, separately for mobile and desktop, so most visitors on ordinary phones have to get a good result, not just you on office Wi-Fi.

A new site rarely fails these for complicated reasons. The usual causes are large images, web fonts that block the first paint, and third-party scripts for chat widgets, heatmaps and tag managers. Size images to the space they fill, give each one a width and height so the layout doesn't jump, load one or two font weights rather than six, and treat every third-party script as a cost you have to justify.

A static site, where every page is built ahead of time and served as a file, starts with a large advantage. Most website builders and frameworks can produce one, and for a marketing site there's rarely a reason not to.

Accessibility

The Department of Justice's guidance, published in March 2022, says the ADA's requirements apply to everything a business open to the public offers, including what it offers on the web, and points to the Web Content Accessibility Guidelines (WCAG) as a helpful standard.^⁠[7] The fixes are cheapest at the start, before there are hundreds of pages to correct.

The basics cover most of it. Every image that carries meaning needs alt text, text needs enough contrast against its background, every form field needs a label, and the whole site should work with a keyboard alone. Use real headings in order rather than bold text styled to look like them.

Getting found

A site nobody can find doesn't do its job. Three things help a new site get indexed:

• A sitemap, submitted in Search Console's Sitemaps report and listed in your robots.txt file. Google says it uses the last-modified dates in a sitemap only when they're consistently accurate, so let them change only when a page really does.^⁠[9]
• A unique title and description for every page, written for the person searching rather than stuffed with keywords.
• Links from places that already exist, such as your social profiles, directory listings and the people you work with.

Mistakes that cost the most

• A headline nobody understands. If a visitor can't say what you do after reading it, nothing below it gets read.
• A copied privacy policy. It describes practices you don't have and misses the ones you do.
• A cookie banner you didn't need. It adds friction to every first visit for analytics you could have collected without cookies.
• Too many scripts. Each widget slows the page and may set cookies of its own.
• Forms that go nowhere. Test every form from a phone, and make sure someone reads what comes in.

Before you announce the site

• Read every page on a phone, out loud. Fix anything you stumble over.
• Submit every form and confirm the message arrives.
• Check the privacy policy against what the site actually collects.
• Run the home page and your most important page through PageSpeed Insights.
• Tab through the site with the keyboard only.
• Submit the sitemap in Search Console.

The site will need a domain and an email address that matches it. Our guides to setting up business email on your own domain and to the startup tech stack cover both, and our comparison of Framer and Webflow helps if you're choosing a builder.