The Digital Marketing Checklist for Small Businesses

A small business's digital presence usually gets built one piece at a time. An acquaintance built the website, a former employee opened the Instagram account, the Google listing appeared on its own, and nobody is quite sure who holds the password to the ad account. Each piece works after a fashion, but no one is looking at the whole.

This guide is written to help you look at that whole. It splits your digital presence into ten areas and, for each one, tells you what to check and why that item matters. We stay out of the technical detail; at the end of each area we point you to the guide that covers the topic in depth.

When you finish the list you will have three things: an inventory that shows where your gaps are, a priority order that tells you which gap to close first, and a 90-day action plan.

1. The foundations: are your domain, email and accounts really yours?

This is the area people talk about least, and the one that costs the most when something goes wrong. Whoever's account your domain name (your web address) is registered in decides where your website and your email point. If the registration sits in the account of a former employee, an acquaintance, or a company you no longer work with, the title deed to your business's digital property is in someone else's pocket.

Picture an auto repair shop in Tuzla. The site was built years ago by an acquaintance, and the domain name was bought through that person's account. The renewal notice goes to an email address they no longer check, nobody sees it, and the domain expires. The same day the site goes down, the email address printed on the business cards stops working, and the website link on the Google profile leads to an empty page.

The scenario is made up, but the situation is a familiar one. In our work with GK Therapy, the job began with building a solid digital foundation from scratch to replace an old domain name that had expired.

• ✓The domain name is registered in the business owner's own account. Whoever holds the registration has the final say; a registration in someone else's name makes you dependent on that person.
• ✓Auto-renewal is on, and you know the renewal date. An expired domain takes the website and the email down together, and getting it back is not always possible.
• ✓Renewal and billing notices arrive at an address you actually read. If the warning lands in the wrong inbox, you only notice the problem when the site goes offline.
• ✓You use business email (in the form name@yourbusiness.com). It builds trust in quotes and invoices, and when an employee leaves, the correspondence stays with the business.
• ✓You hold the 'owner' role on your Google Business Profile. Manager access can be granted and taken back; if someone else is the owner, the final decision over the profile is theirs too.
• ✓You opened the social media, advertising and analytics accounts yourself and gave others access. If an agency or an employee opens the account, the history and the followers can leave with them.
• ✓Two-step verification is on for every critical account. Recovering a stolen Instagram or ad account can take days, and the damage grows the whole time.
• ✓An account inventory is kept in one secure place. Which account, which email it was opened with, who has access; without this list every staff change turns into a crisis.

How do you verify ownership?

Ask yourself one question for each account: can I sign in to this account right now, without calling anyone, using my own details? If the answer is no, the item is not done. Handing accounts over is easy while the working relationship is good; once the relationship sours, the same job can take weeks.

When you work with an agency or a freelancer, the right arrangement is this: you open the account, and you give the other party manager or editor access. When the work ends you remove the access, and the account and its history stay with you.

2. Can your website turn visitors into customers?

Your website is the only place online that belongs entirely to you. A social media account and a Google profile sit on someone else's platform, and that platform sets both the rules and the visibility. A website has two jobs: to show visitors within a few seconds that they are in the right place, and to move them to call, message or come in.

Speed and mobile use

Someone looking for a local service is usually on a phone and has no intention of waiting. Google assesses page experience with three measures it calls Core Web Vitals. A value counts as "good" when the main content loads (LCP) in 2.5 seconds or less, the page responds to a tap (INP) in 200 milliseconds or less, and the amount the page shifts while loading (CLS) is 0.1 or less. The original definitions are on the Web Vitals page at web.dev.

To measure your own site, all you need to do is type your address into Google's free PageSpeed Insights tool. We explained how to read the report it produces, and the most common causes of slowness, in our guide to website speed and SEO.

Contact options and trust signals

A site that loads fast but hides the phone number is useless. The test for this section is simple: hand your phone to someone who has never seen your site and say "call this business." Watch how many seconds and how many taps it takes them.

• ✓The site is comfortable to use one-handed on a phone. Text should be readable without zooming and buttons large enough to tap with a thumb; otherwise the visitor hits the back button.
• ✓Core Web Vitals are in the 'good' range. A slow page drives visitors away and can leave you behind the competition in search results.
• ✓The first screen says what you do and where you are. Visitors should know they have come to the right place without scrolling; a 'welcome' line does not do that job.
• ✓The phone number is tappable, and WhatsApp and directions buttons appear on every page. If contact details live only on the 'Contact' page, some of the demand gets lost along the way.
• ✓Every service has its own page. Ten services squeezed onto one page neither persuade the visitor nor show a search engine that you are serious about any one of them.
• ✓The contact form works and the inquiry reaches a person. Fill in the form yourself; see which inbox the notification lands in and how many minutes it takes.
• ✓Real photos, team information and reviews are on the site. Stock photos do not build trust; visitors want to see who they will be dealing with.
• ✓The site opens over HTTPS. A 'not secure' warning in the address bar is enough to put off a visitor who was about to fill in a form.
• ✓Opening hours, address and phone number match your Google profile exactly. Conflicting information makes both the customer and the search engine doubt you.
• ✓You can update prices, hours and announcements yourself. Having to wait for someone for every change is the most common reason a site goes stale.

Picture a hair salon in Kartal. The site is full of beautiful photos, but the only way to book is a form at the very bottom of the page. A visitor on a phone can't be bothered with the form, switches to Instagram, and gets a late reply to their message there too. The problem is not the design; it is that the route to contact sits in the wrong place. Putting a tappable phone number and a WhatsApp button at the top of every page often gets results faster than commissioning a new site.

3. Is your Google Business Profile complete and up to date?

Your Google Business Profile is the information card that shows up on the map and in search results when someone looks for your business. For a local business it is often the first point of contact: before they ever visit your site, people see your phone number, your hours, your photos and your reviews there. The profile is free.

Google ranks local results on three factors: relevance (how well your profile matches what was searched for), distance (how close you are to the person searching), and prominence (how well known your business is). You can't change distance. Relevance improves when you fill in the profile accurately and completely; prominence grows through reviews, the strength of your website and your footprint across the web. The official explanations are in the Google Business Profile help center.

• ✓The profile is verified. On an unverified profile you can't fully manage your information, and the changes you make may not go live.
• ✓The primary category describes your business in the narrowest, most accurate way. The category is one of the strongest fields in deciding which searches you are a candidate for.
• ✓The business name matches the name on your sign. Adding a district or a service keyword to the name goes against Google's guidelines and can get the profile suspended.
• ✓Opening hours, and special hours for public and religious holidays, are current. A customer who arrives at a closed door usually does not come back, and leaves a negative review on top of it.
• ✓The services or products list is filled in. These fields give Google extra clues about which searches your profile should match.
• ✓There are recent, real photos. The exterior, the interior, the team and the work itself; customers want to see what they will find before they come.
• ✓The phone, website and booking links work. A broken link on the profile loses you the most ready-to-buy customer at the final step.
• ✓Updates are posted to the profile regularly. Posts about announcements, offers or a new service show that the profile is looked after.

We have prepared a separate list that walks through every item in this area step by step: the Google Business Profile optimization checklist.

4. Local SEO and content: do you have an answer to the question your customer is asking?

Local SEO is the sum of the work you do to show up in searches made by people near you. Searches such as "dentist in Pendik" or "carpet cleaning near me" belong here. Your profile is one leg of this work; your website and your consistency across the web are the other.

On the content side, the starting point is not inspiration but record keeping. For one week, note down the questions people ask you on the phone, on WhatsApp and at the counter. That list is the list of topics your website needs to answer.

• ✓Name, address and phone number are identical, letter for letter, everywhere. Inconsistencies between the site, the Google profile, social media and directories weaken the trust a search engine places in your business.
• ✓The districts and neighborhoods you serve are stated clearly on the site. Neither the search engine nor the customer should have to guess where you work.
• ✓Every service page is original and specific to that service. Template pages cloned by changing only the district name create no value and often do harm.
• ✓Page titles and descriptions are written for each page. Those two lines, shown in the search result, decide whether you get the click.
• ✓The questions customers ask most are answered on the site. Questions such as what determines the price, how long it takes and how to prepare are useful both in search and at the point of persuasion.
• ✓You have a content pace you can keep up. One careful article every three months beats daily posting that lasts two weeks and then stops.
• ✓Your other map and directory listings are correct. An old phone number on sources such as Apple Maps, Yandex Maps and Bing sends the customer to the wrong place.
• ✓The site has structured data. This code marks up your business type, address and hours in a form search engines can read, and helps your information be understood correctly.

Picture a veterinary clinic in Kurtköy. The site has a single paragraph under the heading "our services." Yet the same questions come in by phone every day: the vaccination schedule, care after neutering, what to do in an emergency at night. Writing a clear, short page for each of those three questions opens new doors in search and cuts down the repetition on the phone.

We explained the logic and the steps of local SEO from start to finish in our local SEO guide for small businesses.

5. Are your reviews and reputation being managed?

Reviews are the last thing a stranger looks at before choosing you. A good review profile does not build itself: a happy customer usually doesn't think to write, while an unhappy one does. A business that doesn't ask for reviews regularly ends up with a rating below its real level of customer satisfaction.

The trick is timing. Ask for the review at the moment the customer thanks you, not weeks after the service is finished. A QR code on the counter or a short link sent over WhatsApp cuts the job down to two taps.

• ✓Asking for reviews is part of the daily routine. If it isn't clear who asks, at what moment and with which link, this gets forgotten in the first busy week.
• ✓A review link or QR code is ready. If you make customers search for the profile, most of those who meant to write will give up halfway.
• ✓Every review gets a reply. A reply speaks less to the person who wrote the review than to those who read it later; it shows that you are an attentive business.
• ✓Negative reviews get a calm, short reply. Getting into an argument looks bad even when you are right; an apology, an explanation and a way to get in touch are enough.
• ✓Replies do not share the customer's personal information. In healthcare especially, revealing the service a person received creates both an ethical and a legal problem.
• ✓No discount or gift is offered in exchange for a review. Google's policies prohibit incentivized reviews; if they are detected, the reviews can be removed.
• ✓You search for your business name and look at the first page. If complaint sites, old news items or listings you did not create show up there, you need to know.
• ✓Selected reviews also appear on your website. Carrying the social proof from your profile over to the site is the cheapest way to persuade an undecided visitor.

If you would like your review routine and your profile upkeep handled in one place, take a look at what our Google Business Profile management service covers.

6. Are your social media accounts doing anything for you?

On social media, the first decision is not which platform to be on but which ones to stay off. Keeping neglected accounts on four platforms is worse than being consistent on one. Be wherever your customers spend their time and wherever you can produce content regularly.

For a local business, social media is usually a shop window and a way to confirm trust. Someone who finds you on Google will look at your Instagram before calling, to answer the question "is this place still open, and how do they do their work?"

• ✓The account is a business (professional) account. Only this account type gives you statistics, contact buttons and the option to advertise.
• ✓The bio says what you do and where you are. A plain line such as 'Pediatric dentistry in Pendik' does more work than a slogan.
• ✓The link in the profile works and goes to the right place. The website, the booking page or WhatsApp; a link to a campaign page that has since closed is a common leak.
• ✓The latest post is recent. An account that stopped months ago leaves visitors with the impression that the business has stopped too.
• ✓There is a written content calendar. How many posts a week, which topics, who prepares them; if it isn't written down, it slips in the first busy period.
• ✓It is clear who answers incoming messages and how quickly. A message left unanswered is a lead that got away.
• ✓Accounts on platforms you don't use are closed or redirected. An abandoned account is a poor business card that shows up when someone searches for your name.
• ✓Logo, colors and tone of voice are consistent across all accounts. Accounts that look different make people doubt that they belong to the same business.

We covered which types of content work for a local business, and how to set up a calendar you can sustain, in our social media guide for local businesses.

7. Are you ready to advertise?

Advertising is an accelerator: it grows a setup that works and makes a setup that doesn't work expensive. Sending paid visitors to a slow site with no phone number in sight is a waste of budget. That is why advertising is the seventh area on this list.

The two main options work differently. Google Ads search ads appear in front of someone who is looking for that service at that moment; the demand already exists. Meta Ads (ads on Instagram and Facebook) reach people who are not searching but might be interested; you create the demand. We discussed which one suits you in our comparison of Google Ads and Meta Ads.

• ✓The page the ad leads to is ready. A page that explains a single service, with call and message buttons at the top, usually performs better than sending people to the home page.
• ✓Conversion tracking was set up before the ads. Without seeing which click turned into a call or a form, you can't know where to shift the budget.
• ✓The ad account belongs to the business. If the account is the agency's, the campaign history and the learned data stay there when you part ways.
• ✓The target area is limited to where you really serve. A campaign left open to all of Istanbul pays for clicks from people who will never be able to come.
• ✓There is a negative keyword list. Excluding searches that have nothing to do with you, such as 'free', 'job openings' or 'course', reduces wasted spend.
• ✓The daily budget and the trial period are decided in advance. A campaign that starts with 'let's see what happens' is either shut down too early or left running longer than it should be.
• ✓The search terms report is reviewed regularly. The searches people actually used when they saw your ad are often different from what you guessed.
• ✓The campaign is built as a structure with a clear goal. The 'boost' button under a post is easy, but its targeting and measurement options are limited.

We showed step by step how to read where the budget goes, and how to cut wasted spend, in our article on Google Ads budget efficiency.

8. Tracking: can you see what is working?

Without tracking, every decision is a guess. The difference between "Instagram seems to be working" and "most of last month's inquiries came from the Google profile" decides where you put your budget. The setup is done once; the benefit shows up every month.

The path a small business needs to follow has four steps.

1. Visibility

   You appear in search, on the map or in an ad

2. Visit

   They open your profile or your site

3. Inquiry

   They call, message, fill in a form or ask for directions

4. Customer

   They come in and buy the service

Most businesses watch the first two steps and don't measure the third. Yet the inquiry is the step that should drive your decisions.

• ✓Google Analytics 4 is installed, and the account is yours. It shows who comes to the site, where they come from and what they do; if the account is someone else's, so is the historical data.
• ✓Google Search Console is verified. This is the only place you learn which searches people use to find you and which problems Google sees on your site.
• ✓A sitemap has been submitted to Search Console. It makes it easier for Google to notice your new pages.
• ✓Conversions are defined: form, phone click, WhatsApp click. Visitor numbers alone tell you nothing; what matters is how many people got in touch.
• ✓Google Business Profile performance data is reviewed monthly. Calls and direction requests made through the profile happen without the person ever visiting your site.
• ✓New customers are asked 'how did you find us?' The customer tells you what the tools can't see; only this question separates word of mouth, the sign outside and search.
• ✓A one-page summary is produced once a month. Putting the same few numbers side by side every month is the simplest way to see what has changed.
• ✓Tracking works in line with cookie consent. Visitors who don't give consent aren't measured, so read your reports knowing that the numbers will sit a little below reality.

What should the monthly summary page contain?

Five lines are enough: the number of site visitors, the number of inquiries (forms, calls and WhatsApp combined), the number of calls and direction requests through the profile, the number of new reviews, and ad spend. As a sixth line, add by hand the number of new customers you won that month. Once you have filled in this table for three months, you will see which channel brings in business instead of guessing.

9. Are you ready for AI search?

Some people now type their question into AI assistants such as ChatGPT and Gemini instead of a search box. Google also shows an AI-generated summary above the results for many queries. The work of being included as a source in those answers is called GEO, which stands for generative engine optimization.

Honesty is called for here: no one can guarantee that an AI assistant will recommend you. What you can do is make the information about your business clear, consistent and easy to read. The good news is that most of this preparation is also the right work for classic SEO.

• ✓Who you are, what you do and where you are is written on the site in plain sentences. AI quotes a clear defining sentence, not an ornate slogan.
• ✓Frequently asked questions are written as a clear question and a short answer. This is the format best suited to an assistant lifting the answer and passing it on directly.
• ✓Structured data has been added. Markup for business information, services and frequently asked questions reduces the chance that machines misread your content.
• ✓Your information is consistent across the web. Assistants look at many sources, not one; a conflicting address or opening time becomes the source of a wrong answer.
• ✓You know whether you are blocking AI crawlers. If the robots.txt file on your site shuts these crawlers out, your content can't be read; the choice should be a deliberate one.
• ✓You ask the assistants about your business regularly. The answers to 'who offers this service in Pendik' and 'what do you know about this business' show you what is missing and what is wrong.
• ✓Your articles carry an author, a date and update information. Who the content belongs to and how current it is are among the signals of a trustworthy source.

Our article explaining the concept from the ground up is What is GEO; you will find the steps to take in this area laid out there in order.

10. Legal basics: are your KVKK privacy notice and cookie consent in place?

If your site has a contact form, if you collect customer details over WhatsApp, or if analytics and advertising tools run on your site, you are processing personal data. In Türkiye this is governed by KVKK, the country's personal data protection law (Law No. 6698 on the Protection of Personal Data). It is the area small businesses skip most often, because the gap goes unnoticed until a complaint arrives.

• ✓The site has a privacy notice, and it describes what you actually do. It should say which data you collect, for what purpose, and who you share it with; a text copied from another site does not protect you.
• ✓A link to the privacy notice sits next to your forms. People should be able to find out how their information will be used before they hand it over.
• ✓The cookie notice really works. Analytics and advertising cookies should switch on only after the visitor gives consent; a banner that is there purely for decoration does nothing.
• ✓Rejecting cookies is as easy as accepting them. Designs that hide the reject option damage trust and make the validity of the consent questionable.
• ✓Permission for bulk SMS and email has been clarified. Sending commercial messages is subject to separate rules and to registration with İleti Yönetim Sistemi, Türkiye's commercial message management system; get advice before you send.
• ✓You know where customer data is kept. The phone's contact list, an Excel file, the booking software; if it isn't clear who has access, you won't notice a leak either.
• ✓Permission is obtained for customer photos and videos. Before-and-after posts, especially in health and beauty, should not be published without explicit consent.
• ✓If you process special categories of data such as health data, you have taken separate advice. The rules for this type of data are stricter, and general templates are not enough.

Registration and notification obligations (the data controllers' registry, for example) vary with the size of the business and what it does. Ask your lawyer or your accountant whether they apply to you; don't decide on the basis of general answers found online.

Which items come first? A priority matrix and a 90-day plan

Once you have marked all ten areas, you may be looking at a long list of gaps. Trying to close them all at once is the shortest route to finishing none of them. Set the order with two questions: how much does this item affect the business, and how much effort does it take to complete?

The impact and effort matrix

The logic of the table is clear: high-impact, low-effort tasks go into the first week. The high-effort ones are spread across the plan. Advertising comes last, because ads run before the earlier rows are complete deliver poor returns.

Five things to do in the first week

1. Try to sign in to your domain, Google profile, social media and ad accounts with your own details; list the ones you can't get into.
2. Turn on two-step verification on every account you can get into.
3. Check the hours, category, phone number and website link on your Google profile; add five new photos.
4. Fill in the form on your own site, and tap the phone and WhatsApp buttons from a phone.
5. Get your review link and send it to three customers who left happy this week.

None of these five tasks requires technical knowledge or a budget.

The 90-day action plan

1. Week 1

   Secure ownership and the basic information

   Draw up the account inventory and start the handover process for the accounts you can't access. Complete the Google profile, test the contact options on the site, and start asking for reviews.

2. Weeks 2–4

   Set up tracking and the legal basics

   Connect Analytics and Search Console, and define form submissions, calls and WhatsApp clicks as conversions. Have the privacy notice and cookie consent prepared. Fill in your first monthly summary page.

3. Weeks 5–8

   Strengthen the website

   Fix speed and mobile problems, and put a visible contact button on every page. Write separate pages for the three services that bring in the most revenue. Draft your first question-and-answer content from customer questions.

4. Weeks 9–12

   Build the routine, test advertising

   Put the social media calendar in writing and start following it. Ask the AI assistants about your business and fix what is missing. If the foundations are ready, start a small ad test with a single service and a narrow area.

5. Day 90

   Mark the list again from the top

   Go back over the ten areas and put your three monthly summary pages side by side. Look at which channel brought in inquiries and set the priority for the next three months.

What can you do yourself, and where should you get help?

You don't have to outsource everything, and you don't have to do everything yourself either. Three criteria help with the decision: is the task one-off or ongoing, what does a mistake cost, and are the hours you would spend on it being taken from your core work?

For every task you get help with, the rule from the first area applies: the account is yours, the access is theirs.

Common mistakes

Starting with ads. Ads run before the site and the tracking are ready bring clicks, not inquiries. The conclusion people reach is "ads don't work," when the problem is not the ads at all.

Letting someone else open your accounts. An account that an agency or an employee opened with their own email for convenience becomes a bargaining chip on the day you part ways.

Trying to be on every platform. Opening six accounts and running none of them consistently makes a worse impression than running two well.

Looking at visitor numbers without measuring inquiries. If visits are going up and the phone isn't ringing, the problem is not visibility; it is the site's power to persuade. Only conversion tracking shows you that.

Leaving reviews to look after themselves. When a business doesn't ask for reviews and doesn't reply to them, its profile is shaped by its few angriest customers.

Updating information in one place and forgetting the others. When a phone number or opening time changes, the site, the profile, social media and directories should all be updated on the same day.

Setting it up once and never looking again. A digital presence is not a sign you put up and walk away from. Marking this list from the top every three months lets you catch problems before your customers do.

Copying legal texts. Another site's privacy notice describes how that site processes data. If it doesn't describe how you do, it does not achieve compliance even on paper.

Terms used in this checklist

Domain name

Your site's address on the internet, for example yourbusiness.com. It is rented by the year, and control lies with whoever's account holds the registration.

Google Business Profile

The free information card that appears in Google Search and Maps when someone looks for your business.

NAP

Short for name, address and phone number. Writing these three the same way across the web is the foundation of local SEO.

Core Web Vitals

The three measures Google uses to assess page experience: loading (LCP), interactivity (INP) and visual stability (CLS).

Conversion

A visitor taking an action that is valuable to you: submitting a form, or tapping the phone or WhatsApp button.

Search Console

Google's free tool that shows how your site is doing in search and what technical problems it has.

Structured data

Markup code, invisible to visitors, that tells search engines and AI systems what the information on a page is.

GEO

Generative engine optimization. Work aimed at being included as a source in the answers of AI assistants.

Privacy notice

Under KVKK, the text that explains to the person concerned who processes their personal data, for what purpose and how. Its Turkish name is aydınlatma metni.

Your first step this week

Print the list or copy it into a spreadsheet, and mark only the first area: can you sign in to your domain, your Google profile and your ad account with your own details? Everything else is built on the answer to that question.

If you would like to go through the list together and pin down the priority order for your business, you can write to us for a free analysis.