Website Speed and Security: What Your Lighthouse Score Means for Business
An agency tells you "our websites score 95 on Lighthouse", and you are not sure whether to be pleased or indifferent. This article translates website speed optimisation and security from technical language into business language: how many customers you lose for every 1 second of delay, what customers see when you have no SSL, and what you have to do after being hacked. Then we show you how to test it yourself in 3 steps, so you do not have to take anyone's word for it.
Website speed directly affects your business: Google research shows 53% of mobile visitors leave when a page takes more than 3 seconds to load, and every 0.1 second of speed improvement lifts retail conversion by around 8%. Test it yourself in 3 steps: open your site in Chrome → F12 → Lighthouse tab, select "Mobile" and click Analyse. A mobile performance score of 90 or above is good; SME websites commonly score 40 to 70. The 3 security essentials: a valid SSL, daily backups, and no outdated plugins on the platform. WKH's Keep You Standing delivery standard is Lighthouse 95+.
Speed = Business: 3 Data Points
Website speed is not a KPI for technical staff; it is 3 numbers that directly affect your revenue: bounce rate, conversion rate and search ranking.
53% leave. Google research shows 53% of mobile visitors leave when a page takes more than 3 seconds to load. That means half the people your ad spend brings in have left before they even see your WhatsApp button.
Every 0.1 second faster, conversion up 8%. The 2020 "Milliseconds Make Millions" study by Google and Deloitte analysed data from 37 brand websites and found that for every 0.1 second improvement in mobile site speed, retail conversion rose 8.4% and travel conversion 10.1%. That is retail data; there is no equivalent statistic for service SMEs, but the direction is the same: when a site is fast, customers are willing to take 1 more step.
Search ranking. Since 2021, Google has included Core Web Vitals (load speed, interaction responsiveness, layout stability) as a ranking factor. Given the same content, the faster site ranks higher. AI crawlers are the same: they give up on slow-loading pages.
Add the 3 numbers together and a slow website means paying for traffic and then turning half of it away at the door.
Test Your Lighthouse Score Yourself in 3 Steps
Testing your website speed yourself needs only the Chrome browser, 3 steps and 2 minutes.
- Open your website in Chrome, preferably in an incognito window (so your own cache does not flatter the result).
- Press F12 (Cmd + Option + I on Mac) to open Developer Tools, and find the "Lighthouse" tab.
- Select "Mobile", tick "Performance", and click "Analyse page load". Wait 30 seconds.
You will see 4 circular scores. The most important is the first, "Performance": 90 and above is green, 50 to 89 orange, below 50 red. Underneath is a list of "Opportunities", each stating how many seconds it could save.
Another method is PageSpeed Insights (pagespeed.web.dev): paste in the URL. The result is the same but adds real-user data.
When testing, bear in mind that the mobile score is always lower than the desktop score, and most of your customers are on mobile. So look at the mobile score.
What Are the 5 Most Common Reasons for a Slow Site and a Low Score?
A low Lighthouse score on an SME website comes down to the following 5 causes nine times out of ten, and you can fix the first 3 yourself.
1. Images are too large. 1 photo uploaded straight from a phone can be 5MB, when the web page only needs 200KB. 10 photos across the site is 50MB, which takes over ten seconds on a mobile network. The fix: compress before uploading, use WebP format, and enable lazy loading.
2. Too much embedded content. An IG feed, YouTube, Google Maps, a chat widget and 3 analytics tools each have to load their own code. 1 homepage embedding 5 things is like opening 5 websites at once.
3. Too many plugins or apps. Every plugin adds a block of code. Anything installed but unused, or duplicating another's function, should go.
4. Shared platform resources. The servers behind drag-and-drop site builders are shared by thousands of websites, and you have no control over that. This is why so many platform sites have mobile scores stuck between 60 and 75.
5. No CDN. Hosted on a single server in the United States, every load for a Hong Kong customer crosses the Pacific. A CDN copies the site to nodes around the world, and customers fetch it from the nearest one.
To understand how different platform architectures affect speed, How to Choose a Site Builder in 2026 compares them across 6 dimensions.
Beyond Speed Optimisation, What 3 Things Does Security Require?
For an SME, website security comes down to getting 3 things right: a valid SSL, backups, and no outdated software. Get these 3 right and you have avoided nine-tenths of disasters.
SSL. This is the padlock in front of the web address. Without SSL, or with an expired one, the browser shows "Not secure", and on pages with forms Chrome throws up a full-page red warning. Customers leave the moment they see it. Most hosts now provide free, auto-renewing SSL; the problem is usually a misconfiguration or an expiry nobody noticed. To check: open your site and look for the padlock to the left of the address.
Backups. If you are hacked, make a bad edit, or your host has an outage, a backup means a few hours to restore; no backup means starting from zero. Requirements: automatic, daily or weekly, and stored somewhere separate from the website.
Updates. If you use a WordPress-type platform, outdated plugins are the main way sites get hacked. Hackers use automated scripts to scan the whole world for sites that have not updated; it is not personal, they simply get in wherever they find a gap. A static website has no plugins, so this attack surface does not exist at all.
The real consequences of being hacked: your site stuffed with gambling or fake pharmaceutical links, a "This site may have been hacked" warning when people Google your company name, and in serious cases customer data leaks. The cost of cleaning up and restoring your reputation far exceeds the cost of prevention.
To see which items in a maintenance fee correspond to these 3 things, What Are You Paying For in Website Maintenance Fees breaks them down item by item.
WKH's Keep You Standing Delivery Standard
Keep You Standing is 1 of the 3 Web Employees in WKH's HKD 6,000 plan, and it comes with 1 explicit number at delivery: a Lighthouse mobile performance score of 95 or above.
How that is achievable: WKH's 3-page website uses a static build + CDN architecture. Pages are pre-generated, images automatically compressed to WebP, no plugins, no database. The speed comes from the architecture itself, not from after-the-fact speed optimisation.
During launch onboarding, Keep You Standing is responsible for:
- Lighthouse 95+ delivered, and showing you how to run the test yourself
- Auto-renewing SSL, with the domain in your name
- CDN distribution, fast for customers in Hong Kong and overseas alike
- Automatic backups set up, and showing you how to restore
- Back-end access + a training handbook, so you can change text and photos yourself
If you would like Keep You Standing to stay on long term, a maintenance plan can be arranged separately. To learn how the whole architecture lets the 3 employees work together, see What Is a WKH Next-Generation Website; to get started straight away, the WKH Web Design Plans and Pricing page has the complete list. If you would like WKH to run a free speed score on your site, WhatsApp us and just send the URL.
Frequently Asked Questions
Website speed optimisation: what counts as a good Lighthouse score?
Lighthouse is Google's free website assessment tool built into Chrome. It scores 4 categories, Performance, Accessibility, Best Practices and SEO, each from 0 to 100. A Performance score of 90 or above is green (good), 50 to 89 orange (needs improvement), below 50 red. SME websites commonly score between 40 and 70 on mobile performance.
Does a site that is 1 second slower really lose customers?
Yes. Google research shows 53% of mobile visitors leave when a page takes more than 3 seconds to load; the Google and Deloitte "Milliseconds Make Millions" study found every 0.1 second of mobile speed improvement lifts retail conversion by around 8%. For 1 SME that lives on enquiries, slow means people leaving every day before they ever see your WhatsApp button.
What happens without SSL?
The browser displays "Not secure" next to the address, and on pages with forms Chrome shows a red warning. The proportion of customers who close the page immediately is very high. Most hosts now provide SSL free with auto-renewal, so there is no reason not to have it; problems usually come from misconfiguration or an expiry nobody noticed.
I use a site builder. Is speed simply out of my hands?
You can improve it to a degree: compress images, reduce animations and embedded content, remove surplus plugins or apps. But the platform's shared resources and code are beyond your control, and a mobile performance score of 70 to 80 is about the ceiling. To get above 90 usually means changing architecture, for example a static website plus CDN.
What is WKH's Keep You Standing delivery standard?
At delivery, a Lighthouse mobile performance score of 95 or above, with auto-renewing SSL, CDN distribution and automatic backups set up, and the domain in your name. During launch onboarding, Keep You Standing configures all of this and shows you how to run the score yourself; if you want someone keeping watch long term, a maintenance plan is arranged separately.