The Law Firm Website Checklist

EXHIBIT A

Accessibility

The reading your site gets from a screen reader — and a plaintiff’s scanner.

Text contrast ≥ 4.5:1 (3:1 large text) — including the muted grays on cream ✦ often missedWCAG 1.4.3Every interactive element reachable and operable by keyboard; no trapsWCAG 2.1.1Visible focus indicators on links, buttons, and fields ✦ often missedWCAG 2.4.7Skip link to main content ✦ often missedWCAG 2.4.1All form fields labeled — placeholder text is not a label ✦ often missedWCAG 3.3.2Errors described in text, never color aloneWCAG 3.3.1Meaningful alt text; decorative images marked decorativeWCAG 1.1.1Logical heading outline (h1→h2→h3, no skips)WCAG 1.3.1lang attribute set on every pageWCAG 3.1.1Published PDFs tagged and readable — scans are images of text ✦ often missedWCAG 1.1.1CAPTCHA replaced with an accessible bot defense (honeypot, Turnstile) ✦ often missedINTAKEVideo captioned; audio transcribedWCAG 1.2No accessibility overlay widget standing in for real remediation ✦ often missedFTC C-4817

EXHIBIT B

Regulatory compliance

Your site read as a communication, a solicitation, and an advertisement.

No unsubstantiated superlatives — “best,” “top,” “#1,” “leading” ✦ often missedR. 7.1“Specialist/specializes” only where certification (or your state) allows ✦ often missedR. 7.2(c)Case results carry circumstances + a legible, adjacent disclaimer ✦ often missedR. 7.1 cmt. [3]Substantiation on file for every factual claim ✦ often missedR. 7.1Prospective-client disclaimer on every form, before the button, acknowledged ✦ often missedR. 1.18Forms invite contact details and matter type — not the narrative ✦ often missedR. 1.18Chat widget reactive (or deliberately configured); scripts audited ✦ often missedR. 7.3Testimonials reviewed for unjustified expectations; review-response policy in force ✦ often missedR. 7.1 / 1.6Badges dated and attributed; no purchased accolades displayed as earnedR. 7.1Fee claims carry the costs-vs-fees distinction ✦ often missedR. 1.5(c)“Areas we serve” reconciled against actual bar admissions ✦ often missedR. 5.5 / 8.5Firm name checked under your state’s current rule (7.5 or 7.1 cmts.)CH. 2Lawyer admissions stated on bios and footerR. 5.5AI-drafted copy gated by a human claims check ✦ often missedOP. 512

EXHIBIT C

Security & email

What an attacker sees — the whole Cybersecurity guide, as line items.

Core, theme, and plugin updates on a schedule — 96% of WordPress vulnerabilities are pluginsCYBERSECURITY CH. 1No version strings or generator tags disclosed ✦ often missedCYBERSECURITY CH. 1MFA on admin, hosting, registrar, and DNS accountsCYBERSECURITY CH. 2Domain monitored for breach and stealer-log exposure ✦ often missedCYBERSECURITY CH. 5Forms bot-protected and rate-limitedCYBERSECURITY CH. 3SPF, DKIM, and DMARC enforced — not just present ✦ often missedCYBERSECURITY CH. 8Published documents scrubbed of metadata (authors, paths, tracked changes) ✦ often missedCYBERSECURITY CH. 4Obvious lookalike domains defensively registered; monitoring on ✦ often missedCYBERSECURITY CH. 8Offsite, tested backups; restoration actually rehearsedCYBERSECURITY CH. 13No database or admin panel reachable from the open internetCYBERSECURITY CH. 6TLS everywhere; no mixed content; HSTS onBASELINEVendor list written down — who can touch the site and its data ✦ often missedCYBERSECURITY CH. 9

EXHIBIT D

SEO

Found for the cases you want — without a compliance problem in the copy.

One clear topic per page; practice-area pages that say somethingCONTENTTitle tags and meta descriptions written, unique, front-loadedON-PAGEAttorney bios with real E-E-A-T signals — credentials, admissions, authorship ✦ often missedE-E-A-TArticle/FAQ/LocalBusiness structured data, valid and honest ✦ often missedSCHEMACanonicals, sitemap.xml, robots.txt — boring and correctTECHNICALNo doorway pages — location pages reconciled with admissions (see B) ✦ often missedQUALITYInternal links between practice pages, bios, and resourcesARCHITECTURERedirects preserved from every old URL — migrations bleed rankings silently ✦ often missedMIGRATIONGoogle Business Profile claimed, categories right, reviews flowingLOCALContent answers client questions — not keyword soup a regulator would read badlyCONTENT

EXHIBIT E

Design

The first impression — and whether it survives a partner’s squint.

Typography system: two families, consistent scale, real hierarchyTYPEThe palette passes contrast without losing the register (see A) ✦ often missedBRANDConsistent spacing rhythm — no orphan sections or filler stock photosLAYOUTReal photography of real people where it matters; rights clearedIMAGERYResponsive at every width — including the awkward tablet onesRESPONSIVEPrint stylesheet for pages lawyers actually print ✦ often missedDETAILFavicon, OG images, and social cards — the link preview is a first impression too ✦ often missedDETAILEmpty states, 404s, and form confirmations designed, not defaulted ✦ often missedDETAIL

EXHIBIT F

Conversion & intake

From visitor to consultation — with the guardrails from section B intact.

Primary action obvious on every page — one decision, not fiveCROPhone number clickable, visible, and answeredCROIntake form short: contact details + matter type; the story comes later ✦ often missedCRO / 1.18Form submissions land somewhere staffed — tested end to end ✦ often missedOPERATIONSResponse-time expectation stated (“we reply within one business day”) ✦ often missedTRUSTProof near the ask: reviews, results (compliant ones), credentialsTRUSTFree consultation scoped honestly — length and what it coversR. 7.1Thank-you page confirms what happens next — and repeats the 1.18 line ✦ often missedDETAIL

EXHIBIT G

Page speed

Core Web Vitals — the details Google measures whether you do or not.

LCP under 2.5s on a mid-range phone, not your office fiberCWVCLS ~0 — nothing jumps while a client is reading ✦ often missedCWVINP under 200ms — taps respondCWVImages sized, compressed, lazy-loaded, modern formatsMEDIAFonts subset and swap-loaded — no invisible-text flash ✦ often missedFONTSThird-party scripts inventoried — every chat/analytics/tag has a cost (and see B/C) ✦ often missedSCRIPTSCaching and CDN configured on the hostHOSTINGTested from where your clients are, not where your developer is ✦ often missedMETHOD

EXHIBIT H

Privacy & analytics

The site’s own conduct with visitor data — practice what your privacy policy preaches.

Privacy policy real, current, and linked — not a template with the wrong firm name ✦ often missedPOLICYAnalytics configured without recording form contents or chat transcripts ✦ often missedDATAConsent handling appropriate to your jurisdictions (PIPEDA / state laws) ✦ often missedCONSENTNo marketing pixels on intake or client-portal pages ✦ often missedDATAForm data transmitted and stored encrypted; retention decided, not accidentalDATACookie policy matches the cookies actually set ✦ often missedPOLICY

EXHIBIT I

Maintenance & continuity

The checklist that keeps the other eight true next year.

Someone owns the site — named, reachable, accountableOWNERSHIPUpdates, scans, and backups on a written schedule with logsCADENCEDomain and hosting renewals diarized — expired domains end practices ✦ often missedCONTINUITYRegistrar and DNS access documented; not held hostage by a past vendor ✦ often missedCONTINUITYUptime monitoring with a human on the other endMONITORINGThe claims inventory and this checklist re-run after every redesign ✦ often missedDISCIPLINE