Vodafone ran two versions of one landing page and changed a single variable: how fast it loaded. The 31% faster version sold 8% more. Same copy, same offer, same design.
What this means for you
- Core Web Vitals are scored on real visits; a URL passes only when 75% hit good on all three.
- A 31% faster LCP lifted Vodafone’s sales 8% with no change to the content.
- 91% of 2025’s 11,334 WordPress vulnerabilities sat in plugins; only six were in core.
- Serve 5xx or 429 for over two days and Google drops those URLs from the index.
- Certificate lifetimes are capped at 200 days today and 47 days from 2029.
Trust gets judged before the copy
Google’s Search Quality Rater Guidelines, last revised in September 2025, put Trust at the center of E-E-A-T and call it the most important member of the family. Raters do not set rankings; their scores test whether the ranking systems are working.
Trust is also the one component you cannot write your way into. A visitor decides whether a site is safe and functional in the seconds before the first paragraph renders, which makes the hosting under a small-business site a conversion question rather than an IT chore.
Content is reviewed when you publish it. Infrastructure is scored on every visit.
That scoring is literal. Core Web Vitals are collected from real Chrome sessions in the Chrome User Experience Report, and a URL passes only when 75% of those sessions hit the good threshold on all three metrics.
Read your own numbers at the 75th percentile rather than the average, because averages hide the slow visits that cause bounces.
| Metric | Good | What it captures |
|---|---|---|
| Largest Contentful Paint | 2.5 seconds or less | How fast the main content appears |
| Interaction to Next Paint | 200 milliseconds or less | How fast taps and clicks respond |
| Cumulative Layout Shift | 0.1 or less | How much the page jumps while loading |
What a slow page costs in sales
Google’s mobile benchmark research found that 53% of mobile site visits are abandoned once loading passes three seconds. The figure rests on 2016 data, so read it as a decade-old benchmark rather than a current measurement.
Portent’s analysis of ecommerce data found conversion averaged 3.05% at a one-second load and roughly 1% at five seconds. The widely repeated three-times-better line comes from the same study’s B2B lead generation pages, not its ecommerce set.
The Vodafone case study is the cleanest evidence because it isolates the variable: two otherwise identical pages, one with a 31% better LCP, and measured lifts of 8% in sales, 15% in lead-to-visit rate and 11% in cart-to-visit rate.
Two of the three Core Web Vitals depend on how quickly the server answers at all. Compressing images does not rescue a slow time to first byte, and no plugin fixes a request that spent half a second queued.
On cheap shared hosting the mechanism is ordinary. Your site shares CPU and disk with dozens or hundreds of neighbors, so response times swing at the hours those neighbors are busy, which for local businesses is usually lunchtime and early evening.
Add an unoptimized hero image, a page builder loading four stylesheets and no server-level cache, and three seconds is gone before the fonts arrive.
“Speed is not a vanity metric for a plumber or a pizzeria. It is the difference between a phone call and a back button.”
Downtime reads as a verdict
Google’s documentation on HTTP and network errors is explicit. Persistent 5xx responses slow crawling and can eventually remove URLs from the index, and serving 503 or 429 for more than two days causes Google to drop those URLs.
Network timeouts and DNS failures are treated like 5xx errors, and Google says indexed URLs it cannot reach are removed within days.
Recovery is not symmetric. Googlebot backs off quickly and returns gradually, so the dip usually outlasts the outage that caused it. Google publishes no recovery curve, so treat that shape as directional rather than a figure.
Uptime percentages also hide shape. A 99.9% year is roughly nine hours down, and it matters enormously whether those hours land at 4am or during Friday dinner service.
AI assistants behave differently again. Several fetch pages live at answer time instead of serving a cached copy, so a timeout can mean no citation at all, and that behavior varies by product and is not consistently documented.
The visitor cost is the one you never see. Analytics only fires if the page loads, so a Friday-evening outage on a restaurant site produces no data, just a quiet week you blame on the weather.
This is why a short monitoring interval matters more than an uptime percentage on a sales sheet. A check every few minutes, alerting on consecutive failures, tells you before a customer does.
Security warnings are the fastest exit
An outage lets a visitor come back later. A browser warning that the connection is not private ends the visit, and most people cannot tell an expired certificate from a real compromise.
An expired certificate is rarely a hack. It is usually a calendar failure at a business that renews by hand, and the visitor has no way to tell the difference.
Certificates now expire on a tightening schedule. Under CA/Browser Forum ballot SC-081v3, the maximum lifetime has been 200 days since 15 March 2026, falls to 100 days in March 2027 and to 47 days in March 2029.
Let’s Encrypt still issues 90-day certificates by default, has made optional six-day certificates generally available, and plans to move its default to 45 days by February 2028.
Manual renewal does not survive those intervals. Automated issuance and renewal, with an alert on the expiry date, is the only arrangement that keeps working.
Mixed content is the quieter failure. Chrome auto-upgrades HTTP images, audio and video to HTTPS with no fallback, so anything missing over HTTPS does not load, while mixed scripts and iframes are blocked outright.
The patch window is five hours
Patchstack’s State of WordPress Security in 2026 counted 11,334 new vulnerabilities in the WordPress ecosystem during 2025, up 42% year over year, with 91% in plugins and six in core. Patchstack sells vulnerability protection, and these are its own figures.
The timing is what should change a maintenance plan. Patchstack puts the weighted median gap between disclosure and first exploitation at five hours, and reports that 46% were disclosed before a patch existed.
Monthly updates are housekeeping, not a control against that window. What closes it is a managed firewall, automatic security releases, a small plugin footprint and daily off-server backups you have restored at least once.
What to check on your own site
All of this is measurable in an afternoon, without buying anything. Work through it in this order.
- Run your homepage and top service page through PageSpeed Insights and read the field data section, not the lab score.
- Check Search Console under Settings, then Crawl stats, for host status problems and 5xx responses in the last 90 days.
- Confirm the certificate expiry date and whether renewal is automated or sitting in somebody’s calendar reminder.
- Load the site over HTTPS and check the browser console for blocked or upgraded mixed-content requests.
- Restore your most recent backup to a staging copy. A backup you have never restored is only a hypothesis.
- Count active plugins and remove anything not updated in the last twelve months or not doing real work.
If three or more come back badly, the problem sits in the hosting stack rather than the copywriting. Fixing the foundation first makes every content improvement afterwards worth more.
ProXSites builds and hosts sites for local businesses, with managed SSL, monitoring and backups included rather than sold separately. If your site failed the checks above, start there before you touch the content.
Sources
- Search Quality Rater Guidelines (Google, 2025)
- Web Vitals thresholds (Google web.dev, 2026)
- Mobile page speed benchmarks (Think with Google, 2017)
- Site speed and conversion research (Portent, 2022)
- Vodafone Core Web Vitals case study (Google web.dev, 2021)
- HTTP status codes and network errors (Google Search Central, 2026)
- State of WordPress Security in 2026 (Patchstack, 2026)
- Ballot SC-081v3 on certificate lifetimes (CA/Browser Forum, 2025)
- Certificate lifetime plans (Let’s Encrypt, 2026)
ProXSites builds and hosts websites for small and local businesses, so this post has a commercial interest in the conclusion that hosting matters. It was developed from a Kinsta blog post, and Kinsta is also a hosting company; every figure here was re-checked against the primary source cited above, and no compensation was received from any company mentioned.
