Let us begin with a small confession. When a business has been around for nineteen years, has earned a national welding certification, and has taken home a major industry award for excellence in construction, you expect to see a website that reflects that history. You expect craftsmanship online to mirror craftsmanship offline. And sometimes — more often than I would like to admit — what you find instead is a website that would have felt dated in 2017, scoring 44 out of 100 on a technical audit, invisible on Google for every keyword the business actually cares about.
This is the story of one such audit. The company is real. The findings are real. The name, out of respect, stays out of this article.
What follows is the full teardown — what we looked at, what we found, and the twelve-week plan we designed to repair nineteen years of accumulated neglect.
The business, in broad strokes
A metal fabrication company in the Metro Vancouver area. Two founders, both still active. Nearly two decades of operation. CWB-certified (the Canadian Welding Bureau certification that separates serious structural fabricators from the rest), and holders of a regional VRCA Award of Excellence. They build staircases, railings, gates, and commercial structural steel. They work with architects, general contractors, and the occasional homeowner who has seen a floating staircase on Instagram and decided they must have one.
It is, in other words, a very good business. The kind of business that ought to have contractors and architects finding it on Google every single day.
And yet.
The audit, piece by piece
We ran the full technical audit — the same one we run on every prospect — and the results were, diciamo, not flattering. Let me walk you through what we found, because the pattern here repeats itself on hundreds of small business websites I have seen in the last year.
Security: worse than it looked from the outside
The site runs on WordPress, which in itself is not a crime. WordPress still powers roughly 43% of the web, and when it is maintained properly, it is a perfectly respectable choice. The problem is the "maintained properly" part.
What we found was Elementor at version 3.35.7 — an old release, with at least one documented security vulnerability that has been patched in newer versions. Yoast SEO at 27.1.1, again behind the current release. A handful of abandoned plugins that had not received an update in over a year. Mixed content warnings, meaning some assets on the site were being loaded over HTTP instead of HTTPS — a small thing on its own, but modern browsers flag it, and Google notices. And no HSTS header, no Content-Security-Policy, no basic defensive posture.
The truth is, a website with this kind of plugin sprawl is not a website — it is a liability. One compromised plugin is all it takes, and suddenly your decades of reputation are attached to a site redirecting visitors to a Russian pharmacy.
Analytics: the double-counted tragedy
This one made me laugh, and then it made me sad. Someone, at some point, had installed Google Analytics 4 through Google Tag Manager. Someone else, later, had installed GA4 again directly on the site through a plugin. Both tags were firing on every page load.
What does this mean, in practice? Every single visit was being counted twice. Every conversion, doubled. Every session, inflated. For years, the owners had been looking at their traffic numbers and believing them — because why would you not? The numbers were on the dashboard. Google produced them. They must be accurate.
They were not accurate. They were exactly half of what the dashboard claimed. And this is, of course, the kind of error that only gets discovered when someone actually looks.
Performance: the 40 CSS files problem
On desktop, the homepage took somewhere between five and eight seconds to become interactive. On mobile, worse. The root cause was not mysterious — we could see it in the network tab of the browser. Forty-something individual CSS files, loaded one after another. Each one tiny. Each one requiring its own connection setup. Each one blocking render until it arrived.
This is what happens when a WordPress site accumulates plugins over many years. Each plugin adds its own stylesheet. Nothing ever gets consolidated. Nothing ever gets purged. The site keeps working, more or less, but every new visitor pays the tax of every historical decision.
Five to eight seconds, naturally, is catastrophic for mobile traffic. Google's own research suggests that the probability of a mobile visitor bouncing rises by 32% as page load time increases from one to three seconds, and by 90% between one and five. A visitor who arrives at this site on their phone during a coffee break is almost certainly gone before the hero image finishes loading.
SEO rankings: the brutal part
Here is where it gets genuinely painful. Using Ahrefs and a combination of manual SERP checks, we went through every primary service keyword the business would want to rank for. "Steel fabrication Burnaby." "Custom metal stairs Vancouver." "CWB certified fabrication Vancouver." "Commercial steel stairs Vancouver." "Custom railings Vancouver."
For not a single one did the site appear anywhere in the top ten organic results. Not on page one. Not on page two in most cases. For some queries, the site did not appear in the top one hundred at all.
Their competitors — and I will not name them, but Metro Vancouver readers will know who I mean — occupy those positions instead. None of those competitors hold the CWB certification. None hold the industry award. They are, on paper, less qualified businesses. But they have websites that Google understands, and this one did not.
AI search visibility: the newer problem
We also ran the site through our generative engine optimization check — how does this site appear when someone asks ChatGPT, Perplexity, or Google's AI Overviews about metal fabrication in Vancouver? The score came back at 65 out of 100, a C. Not catastrophic, but not good.
The main issues: no structured Q&A content of the kind that AI engines love to quote, thin topical coverage (a page for "services" rather than individual pages for each service), and no schema markup beyond a basic Organization tag. AI search is not traditional search — it rewards pages that answer specific questions in quotable chunks, and this site had almost none of that.
What was actually there
Now, here is the thing that made this audit interesting rather than merely depressing. The business owned two domains. The primary one, with the company name. And a second one — an exact-match domain for one of their core services. "Vancouver something-plural-noun." It existed. It had a site on it. The site was, if anything, in worse shape than the primary — a single-page marketing brochure from what looked like 2014.
Most SEO consultants, upon finding a situation like this, would recommend consolidating. Pick the stronger domain, redirect the weaker, move on. It is the tidy answer.
But the tidy answer is not always the right one.
The dual-brand strategy
Exact-match domains are a genuinely strange corner of SEO. Google spent the better part of a decade trying to devalue them after the 2012 EMD update, because spammers had abused them aggressively. And yet — research from 2024 and 2025 suggests that exact-match domains still comprise roughly 25% of top-three Google results for commercial queries, and that they require meaningfully less domain authority to rank locally than brand-name domains do. The ghost of the EMD has never quite been exorcised.
So instead of consolidating, we proposed the opposite. Keep both domains. Operate them as complementary brands. The primary domain handles the full service portfolio — structural steel, commercial work, railings, gates, architectural metal — targeting architects, contractors, and developers. The exact-match domain specializes exclusively in one high-intent consumer service, targeting homeowners and interior designers.
The benefits compound in ways that are not obvious at first. Two domains means two Google Business Profiles, each one optimized for its own service category. Two sets of citations to build. Two positions in the SERP for overlapping queries — because a SERP with both domains present crowds out a competitor. Two separate surfaces for AI search engines to cite. And, critically, the exact-match domain inherits the "keyword-in-domain" advantage that no amount of on-page optimization can replicate for the brand-name site.
It is a more work-intensive approach. It is also, I believe, the right one.
The twelve-week plan
From the audit, we built a plan. Not a vague one — a week-by-week operational plan that we could actually execute against.
Weeks one through three are the rebuild. Both sites, from scratch, as static sites with no CMS attack surface. This collapses page load from five-to-eight seconds to under one and a half. It removes the entire plugin-security category of problems in one stroke. It consolidates the forty CSS files into two or three. Analytics gets rebuilt properly, with a single clean GA4 implementation through GTM, and conversion tracking wired to every form and phone click. The new sites launch with proper schema (LocalBusiness, Service, FAQPage), with meta descriptions written for each page rather than auto-generated, with structured navigation that Google can actually crawl.
Week four is the technical foundation. Two separate Google Business Profiles, one per domain, each with fully filled-out categories, service areas, products, hours, photos, and Q&A sections. Two separate Search Console properties. Sitemap submission. Rank tracking set up across fifty target keywords. This is the instrumentation phase — without it, the next eight weeks cannot be measured.
Weeks five through eight are visibility. Service pages for every individual offering on each domain — not one "services" page but ten. Location pages for the primary service areas (Burnaby, Richmond, Surrey, North Vancouver), each written specifically for that community rather than generated from a template. Internal linking architecture, built deliberately, so that Google understands which pages are authoritative on which topics.
Weeks nine through twelve are authority. Blog content at a cadence of two posts per week per site — technical guides on welding standards, design guides for stairs and railings, case studies of past projects. Enhanced schema. Topical authority clusters. The first round of link building through industry partnerships, supplier relationships, and local business associations.
By the end of week twelve, the goal is a site that scores 85+ on the technical audit, that loads in under one and a half seconds, that ranks on page one for eight to twelve commercial keywords, and that shows up reliably in AI search results for the kinds of questions prospective clients actually ask.
What this teaches us about small business SEO in general
The specific findings in this audit are not unique. I have run a version of this audit perhaps three hundred times in the last eighteen months, and the pattern repeats itself almost verbatim. WordPress site, installed five to fifteen years ago. Plugin sprawl. Performance collapse. Analytics errors that nobody noticed. Zero meaningful rankings for commercial keywords. A business that is, by every offline measure, successful and respected, with a digital presence that actively undermines that reputation.
The reason this happens is not incompetence on the part of the owners. It is that small business websites are treated as one-time builds rather than ongoing properties. You hire someone in 2015 to make you a website. They make it. It works. Five years pass. The plugins age. The CSS accumulates. The competitors update theirs every year. Yours does not. And then one day you look, and nineteen years of reputation are represented online by a site that looks and performs like something from another era.
The fix, most of the time, is not complicated in principle. A clean rebuild on modern static infrastructure. Proper analytics. Proper schema. A content strategy that targets the actual commercial keywords your business cares about. Patient, month-over-month execution.
It is not glamorous work. It is, however, the work that moves the needle.
A note on what we did not do
I want to be clear about one thing, because it is important. We did not promise the owners of this business that they would be ranking number one for every keyword in three months. We did not tell them that SEO would double their revenue by Q3. We told them exactly what we expected: a technical score above 85 within three weeks, eight to twelve page-one rankings within ninety days, steady improvement thereafter, and a foundation that would compound over years rather than produce a spike and then decline.
The truth is, most SEO promises are fiction. The work is slower than the proposals suggest, harder than the case studies imply, and less predictable than anyone in this industry wants to admit. What you can promise, honestly, is the work itself — that the audit findings will be fixed, that the content will be written, that the rankings will be tracked, and that at the end of every month there will be a report showing what was done and what it produced.
That is what we promised. It is, in my experience, the only promise that ever holds up.