The state of Grand Strand business websites
This month we audited 66 websites belonging to businesses across Myrtle Beach, Conway, Surfside, Murrells Inlet and North Myrtle Beach: restaurants, law offices, contractors, shops, clinics. Here is what we found, with no business named.
How we did this, and what it doesn’t say
Every site was checked from the outside, the way any visitor sees it: public pages, public DNS records and Google’s own mobile test, between October 8 to 22, 2026. Nothing was logged into or tested against. Some checks were added partway through the month, so each figure says how many sites it covers.
These are sites owners asked us to look at, or that we chose to audit because they looked out of date, so they lean toward sites that need work. Read the numbers as what’s common around here, not as an average of every business in the area.
Security
30 of 33 sites were missing at least one of the standard browser protections.
24 of them were missing most of them.
29 of 33 sites don’t stop someone sending email that looks like it came from them.
7 had no email protection records at all.
12 of 23 sites of the WordPress sites we checked plugins on ran a plugin version with a published flaw.
5 of 5 sites of the sites that announced their PHP version were missing the October 21 security fix.
3 of the 5 run PHP versions that no longer get any updates.
8 of 66 sites hand their WordPress login names to anyone who asks.
Browser protections are a handful of one-line settings that stop a site being framed by a scam page or served over a downgraded connection. Email protection (SPF and DMARC) decides whether Gmail and Outlook throw away a fake invoice that claims to be from you. Both are free to fix. Our guide on why business email lands in spam covers the email side, and you can look up your own plugins with the plugin check.
Speed and phones
48 of 63 sites scored under 70 on Google’s mobile speed test.
The middle score was 58 out of 100.
15 of 63 sites scored under 50.
27 of 62 sites had no phone number a customer could tap to call.
4 of 62 sites weren’t set up for phones at all.
Most local customers find a business on a phone, often on a weak signal. A slow first screen and a phone number you can’t tap are the two things that lose the call.
Showing up on Google
25 of 62 sites don’t tell Google their business name, address and hours in the format it reads directly.
14 of 62 sites have no search description, so Google writes its own.
What the sites are built on
- WordPress30
- Custom or unidentified21
- Wix5
- Duda3
- GoDaddy Website Builder2
- Weebly2
- Hostinger AI builder2
- Shopify1
Nearly half are WordPress, which is why WordPress plugin and PHP flaws hit this area hard. That isn’t a knock on WordPress; it’s that a WordPress site needs someone keeping it updated, and most of these don’t have one.
What to do about your own site
- Run the free checkThe website check covers the security, email and phone items in this report for your site in about a minute.
- Check your pluginsIf you’re on WordPress, look up each plugin and version in the plugin check, or ask whoever manages the site to.
- Ask your host one question“What PHP version is my site on, and when was it last updated?” If the answer is 8.1 or older, read our PHP2Shell advisory.
- Turn on email protectionSPF, DKIM and a DMARC policy set to quarantine. It costs nothing and stops the fake-invoice scam.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Written by Nikita Huttenlocher, founder of Huttenlocher Technologies, a cybersecurity and software firm in Myrtle Beach, South Carolina. Journalists and the Chamber are welcome to quote these figures with a link to this page.
Tell us what you're building.
A website, a booking system, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.