Tech Jargon, Translated

Skip to the answer

What these actually are (forget the jargon)

It's a lot like property. Your domain name is your street address — it's how people find you. Your web hosting is the actual building sitting at that address — it's where all your stuff (website pages, images, content) physically lives.

When someone types yourbusiness.com.au into their browser, the domain name tells the internet where to go, and the hosting server delivers the actual website. Two different jobs, often sold by two different companies — though many providers bundle them together, which is where the confusion starts.

Why this matters for your business

If you don't understand this distinction, you can accidentally lose control of your online identity. The most common problem I see? A business owner pays their web designer to "set everything up," the designer registers the domain under their own account, and when the relationship ends, the business owner has to negotiate to get their own web address back. Your domain is your brand. You should own it directly.

Signs you need to understand this

• You're setting up a website for the first time
• Someone's told you to "point your domain" somewhere and you have no idea what that means
• You're switching web designers or platforms and things are getting confusing
• You're not sure who actually owns your domain right now

Signs you can relax about this (for now)

• You're on an all-in-one platform (Squarespace, Wix) and happy with it
• You know where your domain is registered and have your own login

Mistakes I see all the time

• Letting someone else register your domain under their account. This is the big one. Always register your domain yourself or make sure it's under your name and your login.
• Confusing domain renewal with hosting renewal. They're separate bills. Missing a domain renewal can mean losing your web address entirely.
• Assuming your web designer handles everything. They might host your site, but that doesn't mean they own your domain — or it shouldn't.

What I'd recommend

I've written a full guide breaking this down in more detail — have a read here.

Skip to the answer

What the options actually mean

.com.au has been the go-to for Australian businesses for decades. Customers recognise it, trust it, and Google gives it a slight preference in Australian search results. To register one, you need a valid ABN (Australian Business Number), ACN, or other qualifying registration — which is actually a good thing, because it means not just anyone can grab one. The eligibility requirements are managed by auDA (the .au Domain Administration).

.au is the newer, shorter option introduced in 2022. Same eligibility rules as .com.au (you still need an ABN), but fewer characters. It's gaining traction but hasn't overtaken .com.au in familiarity yet. If your ideal .com.au is taken, the .au version might be available.

.com is the global default. No ABN required, no Australian connection needed. It's a good choice if you do business internationally or your brand is global. But for a local plumber in Perth or a consultant in Melbourne, .com.au carries more weight with Australian customers.

And these days, plenty of businesses are going with alternatives like .studio, .ai, or .co — especially if their ideal name is taken in the traditional extensions. It's more common than you'd think, and it works fine.

A real example (my own business)

When I started Plain Speak Online Services, I originally registered plainspeakonlineservices.com.au. Technically correct — but ironically, a business called "Plain Speak" had the least plain-speak domain going. It was too long to type, too long for a business card, and too easy to get wrong.

The .com.au version of psos was already taken. The .com was available — for thousands of dollars. So I went with psos.net.au. Short, affordable, and it's worked perfectly. Nobody's ever had trouble finding me because of it.

The point? Don't spend thousands chasing the "perfect" domain. Get something that works, that people can remember, and move on to actually building your business.

Why this matters (but not as much as you think)

Your domain extension does affect trust — an Australian customer seeing .com.au feels a bit more confident than seeing .com. It's a subtle signal that says "we're a real Australian business." It also has a small impact on local SEO — Google recognises .com.au as geographically relevant to Australian searches.

But let's be real: nobody's choosing a plumber based on whether they have .com.au or .net.au. Your work, your reviews, and your reputation matter infinitely more than your domain extension.

Signs you should aim for a .com.au

• Your customers are primarily in Australia
• You have an ABN and want to look established
• Your ideal name is actually available (check before you get attached)

Signs another extension is fine

• Your ideal .com.au is taken or too expensive
• You're targeting customers in multiple countries
• You're an online business without a strong geographic tie
• A shorter or more creative domain just fits your brand better

Where people trip up

• Spending thousands on the "perfect" domain. Unless you're building a national brand, the money is almost always better spent on your website, your marketing, or your tools.
• Not knowing the ABN requirement. You can't just buy a .com.au on a whim — you need an active ABN. Plan for this if you're still setting up your business.
• Letting registrations lapse. If your domain expires, someone else can register it. Set up auto-renewal.

If you do want to register extra variants (.com.au, .au, .com) to protect your name, you can — just keep in mind you'll pay the yearly registration fee for each one. For most small businesses, one good domain is enough.

My recommendation

The 30-second version

Why this actually matters for your business

Your website, your email, your booking system, your CRM — they all rely on DNS records to function. When DNS is set up correctly, you never notice it. When it's wrong, things break in confusing ways: your website disappears, emails stop arriving, or your booking links stop working.

The good news is that most of the time, DNS is configured once and left alone. The bad news is that when you do need to change it — and eventually you will — it can feel intimidating if you've never seen it before.

Where to actually find your DNS records

This is the bit most guides skip. Your DNS records live with whoever manages your domain — which is usually your domain registrar. That's the company you (or someone) bought your domain through. Common ones in Australia include:

• Crazy Domains — popular in Australia, DNS is under "DNS Settings" in their dashboard
• VentraIP — Australian-owned, look for "DNS Management"
• GoDaddy — one of the biggest globally, DNS is under "Domain Settings"
• Namecheap — popular for .com domains, look for "Advanced DNS"
• Cloudflare — if someone's set up Cloudflare for your site, your DNS records might be managed there instead of at your registrar

If you use an all-in-one platform like Squarespace or Wix and registered your domain through them, your DNS is managed inside that platform.

What the different records do

A Record

The most basic record. It says: "When someone types in my domain name, send them to this server." It's how your domain name connects to your web hosting.

MX Record

This tells the internet where to deliver emails sent to your domain. If you use Google Workspace or Microsoft 365, your MX records point to their mail servers. Get this wrong, and your business email stops working.

CNAME Record

This says: "This name is actually an alias for that other name." Useful when you want www.yourbusiness.com.au to go to the same place as yourbusiness.com.au.

TXT Record

This is where you stick verification codes and security settings. Your SPF, DKIM, and DMARC records (more on those in the email section) all live here. So do verification records for Google, Facebook, and other services.

When you need to worry about this

• You're switching web hosting providers
• You're setting up business email (Google Workspace, Microsoft 365)
• You're connecting a CRM or marketing platform that sends emails on your behalf
• Your website or email has suddenly stopped working
• Someone's asked you to "update your DNS records" and you're staring blankly at a screen

When you can safely ignore it (for now)

• Your website and email are both working fine
• You haven't changed any providers recently
• You're on an all-in-one platform that manages this for you

Common slip-ups

• Editing DNS without noting what was there before. Always screenshot or copy your existing records before changing anything.
• Not understanding propagation time. DNS changes can take up to 48 hours to spread across the internet. Don't panic when things don't work instantly.
• Deleting records they don't recognise. If you're not sure what a record does, leave it alone or ask before removing it.
• Not knowing where to look. Half the battle is finding the right login. If you've never touched your DNS before, use the WHOIS tip above to figure out where your domain lives.

Here's what I'd do

Want to dig deeper into the "do I even need a website?" question? I wrote a blog post on exactly that.

Skip to the answer

What's the actual difference?

A website builder (Wix, Squarespace, WordPress.com) is an all-in-one platform. You pick a template, drag and drop your content in, and they handle hosting, security, and updates. You pay monthly.

A custom-built site is designed and coded specifically for your business — either from scratch or using a framework like WordPress. You (or your developer) control everything: how it looks, how it works, where it's hosted, and how fast it loads. You pay upfront for the build, then ongoing for hosting and maintenance.

Think of it this way — a website builder is like renting a furnished apartment. A custom site is like building your own house. The apartment is quicker and cheaper to move into. The house is exactly what you want, but takes more time and money.

The thing most people underestimate with builders is your time. The platform might cost $20 a month, but you'll spend evenings and weekends learning how it works, choosing templates, fighting with layouts, and Googling "why won't my image resize." That time has a dollar value — and it adds up fast.

Maybe I'm biased — but hear me out. Dragging and dropping a site together in a builder is one thing (and it'll still take you longer than you think). It's everything else that catches people off guard. SEO, mobile responsiveness, setting up forms, booking systems, payment gateways, Google Analytics, page speed, accessibility — each one of those is its own rabbit hole. Before you know it, you're watching YouTube tutorials about Google Analytics properties at 8pm on a Tuesday night instead of doing the thing you actually started your business to do.

Hiring a developer means all of that gets considered from the start. You end up with a complete, working product — in less time, with far less stress. You absolutely can do it all yourself. But your time is better spent making money, talking to customers, and growing your business.

The platforms worth knowing about

Here's an honest rundown of the main options Australian small businesses actually use. Prices are in AUD and based on annual billing where available — monthly billing is usually 20–30% more.

Prices are approximate and based on annual billing as of early 2026. Monthly billing is typically 20–30% more.

A few things the table doesn't show

You're not locked in forever. Starting on Wix or Squarespace doesn't mean you're stuck there. Plenty of businesses start with a builder and move to a custom site once they outgrow it. That's a normal, healthy progression — not a mistake.

WordPress.com and WordPress.org are different things. WordPress.com is the hosted builder (like Wix or Squarespace). WordPress.org is the free software you install on your own hosting — more powerful, but you manage everything yourself. When people say "WordPress" they usually mean the self-hosted version, which is what most developers build on.

The learning curve is the real hidden cost. A platform might be $20 a month, but if it takes you three weekends to build a site you're happy with — and you earn $50 an hour — that "cheap" website just cost you $2,400 in your time. Factor that in when you're comparing options.

Custom-built doesn't always mean expensive. My website packages start from $500 for a clean, fast, professional site. Not every custom build is a $15,000 project — it depends on what you need.

Where people get tripped up

• Choosing a platform based on price alone. The cheapest plan often strips out the features you actually need — like removing the platform's branding, connecting your own domain, or accepting payments.
• Not realising you can't take your site with you. Most builders don't let you export your design. If you leave Wix or Squarespace, you're starting from scratch on the new platform.
• Spending months building a DIY site when they should've hired someone. Your time has a dollar value. If you've been "working on the website" for six months, it probably would've been cheaper to pay a professional.
• Paying for a custom build when a builder would've been fine. If your site is five pages and a contact form, you probably don't need a developer. Be honest about what you actually need.

What I'd suggest

Skip to the answer

The three paths (and what they really cost)

There are basically three ways to get a website for your small business. Here's an honest look at what each one actually costs — not just the number on the price tag, but the full picture including ongoing fees and your time.

PSOS includes 12 months of hosting in every build. After that, hosting continues at $29/month or Hosting + Support at $59/month — both month-to-month, no lock-in. You own your site outright and can host it yourself or go elsewhere anytime.

The costs nobody mentions upfront

Whichever path you take, the build cost is only part of the story. These are the things that catch people off guard:

• Domain renewal: $15–$50/year depending on the extension (.com.au, .com, etc.)
• Email hosting: $7–$15/month per user (Google Workspace or Microsoft 365)
• Hosting: Included with builders, but $100–$600/year with a custom site depending on quality
• SSL certificate: Usually included now — but check. You need this for the padlock in the browser.
• Maintenance and updates: $50–$200/month if outsourced. WordPress sites in particular need regular plugin updates and security patches.
• Premium add-ons: Booking systems, payment gateways, form tools, SEO plugins — these can add $10–$50/month each on builder platforms.

The cost of your time

This is the one that gets people. As I mentioned in the question above — building a website on a platform like Wix or Squarespace isn't just dragging and dropping. It's learning the platform, writing the copy, choosing fonts and colours, making it look good on mobile, setting up forms, configuring SEO, connecting Google Analytics, and a dozen other things you didn't know existed until you started.

If your time is worth $50 an hour and you spend 40 hours building a DIY site, that's $2,000 worth of your time — on top of the platform fees. For a lot of business owners, hiring someone actually works out cheaper when you factor in what your time is worth. And you end up with a better result, faster.

Where PSOS fits in

I'm not the cheapest option — a DIY builder will always win on sticker price. And I'm not an agency with a team of fifteen and a boardroom. I'm somewhere in the middle, and that's deliberate.

For $500–$1,000, you get a custom-designed website (as many pages as you need), all the copywriting, mobile-responsive design, SEO built in, Google Analytics, contact forms, a training video, a live walkthrough, a 90-day settle-in period, and 12 months hosting included. You own the site — no lock-in, no leasing, no "you lose everything if you leave."

After the settle-in period, your hosting continues (it's included for 12 months). If you want ongoing edits and SEO attention, you can add Hosting + Support for $59/month. After 12 months, hosting continues at $29/month. Both plans are month-to-month, cancel anytime.

It's not the right fit for everyone. If you need a 50-page e-commerce site with a custom checkout flow, you'll need an agency (or my online store packages, which start from $1,000). But for most small businesses that need a professional, fast, well-built site without spending five figures — that's exactly what I do.

Traps to watch for

• Going with the cheapest quote without understanding what's included. A $500 "website" from a marketplace freelancer often means a template with your logo slapped on it, no SEO, no copywriting, and no support after handover.
• Paying agency prices for a five-page site. Not every business needs a $10,000 bespoke build. Be honest about what you actually need — a good developer can deliver a lot for a fraction of that.
• Budgeting for the build and forgetting everything else. If you plan for the build and forget about hosting, email, domain renewal, and maintenance, you'll get hit with surprise costs every year.
• Choosing DIY to "save money" and still not having a live site six months later. The cheapest option upfront is rarely the cheapest over three years — especially when you factor in your time and the business you're not winning while your site sits half-finished.

My honest take

I wrote a full breakdown of website costs for Australian small businesses on the blog — read the full post here.

Skip to the answer

What the padlock actually means

When you see a padlock icon in your browser's address bar, it means the data travelling between the visitor's browser and your website is encrypted. That includes anything they type into contact forms, login pages, and payment screens — it's scrambled so nobody can intercept it in transit.

The padlock does not mean the website itself is trustworthy or legitimate. Scam websites can have padlocks too — all it proves is the connection is encrypted. But if your site doesn't have one, browsers like Chrome display "Not Secure" in big letters next to your URL. For a potential customer landing on your site for the first time, that's a trust killer.

HTTP vs HTTPS — one letter makes a real difference

HTTP is the original way websites talked to browsers — everything sent in plain text, readable by anyone listening. HTTPS is the secure version — same thing, but encrypted. That extra "S" stands for "Secure," and it's powered by an SSL certificate installed on your hosting.

Since 2018, Google Chrome has flagged every HTTP site as "Not Secure." Other browsers followed. If your website URL starts with http:// instead of https://, your visitors are seeing that warning right now.

Why it matters beyond security

• Google ranking signal. Google has used HTTPS as a ranking factor since 2014. It's a small signal, but when you're competing with similar local businesses, every bit counts. (More on ranking factors in the SEO entry.)
• Browser warnings kill trust. "Not Secure" next to your business name is the online equivalent of a shop with a broken front window. People walk past.
• Payment processing requires it. If you take payments online, your payment provider requires HTTPS. No exceptions.
• Form submissions. Some browsers block or warn about submitting forms on HTTP pages. If your contact form stops working, this might be why.

Free vs paid SSL — what you actually need

Here's the good news: you almost certainly don't need to pay for SSL.

Let's Encrypt is a free, open certificate authority that provides SSL certificates to over 300 million websites. It's free, it auto-renews every 90 days, and it's included by default with most modern hosting platforms — Vercel, Netlify, Cloudflare, SiteGround, and every major website builder (Wix, Squarespace, Shopify) all include it automatically.

Paid SSL certificates (called EV or Extended Validation certificates) are for banks, large e-commerce platforms, and enterprise businesses that need the extra verification layer. They cost $100–$500+ per year. If you're a plumber in Perth or a cafe in Cairns, you do not need one. The free certificate does exactly the same job of encrypting the connection.

Signs you need to fix this now

• "Not Secure" appears in the browser bar when you visit your own site
• Your URL starts with http:// instead of https://
• Customers have mentioned the site "doesn't look safe" or they "didn't want to fill in the form"
• Google Search Console is flagging HTTP pages or mixed content warnings

Signs you can hold off

• You don't have a website yet (SSL gets set up as part of the build)
• Your site already shows the padlock — you're sorted

The common mistakes

• Mixed content. Your site has HTTPS, but some images, scripts, or fonts are still loading over HTTP. The browser may show a warning or break the padlock. Fix: update all internal links to use https:// or relative paths.
• Not redirecting HTTP to HTTPS. You've got SSL installed, but people who type your URL without the "s" (or click old links) still land on the HTTP version. Your hosting should automatically redirect — if it doesn't, that's a config fix.
• Letting the certificate expire. If you're on older hosting that doesn't auto-renew, your SSL can expire without warning. Suddenly your whole site shows "Not Secure" and you scramble to fix it. Modern hosts with Let's Encrypt handle this automatically.
• Paying for something you can get free. Some hosting providers or "SEO consultants" charge $50–$200/year for SSL. Unless they're providing an EV certificate for a large e-commerce site, you're paying for something that should be included.

What I'd suggest

The 30-second version

This is probably costing you money

This isn't a minor IT annoyance — it directly hits your revenue. Here's what I see with clients regularly:

• Invoices sitting in spam. You think a client is being slow to pay. They think they never received the invoice. Meanwhile, your cash flow suffers for weeks.
• Quotes disappearing. You send a quote on Monday, the client never sees it, and by Wednesday they've gone with the competitor who actually got through to their inbox.
• Booking confirmations vanishing. A customer books through your website, the confirmation goes to spam, and they call wondering if it went through — or worse, they just don't show up.
• "I never got that email." If you're hearing this more than once, it's not the recipient — it's your setup.

I've worked with businesses that had no idea their emails were going to spam for months — until a client casually mentioned it. By then, they'd lost quotes, confused customers, and damaged their professional reputation without even knowing.

What's actually going on

Email providers are drowning in spam — billions of junk emails every single day. To sort the real from the fake, Gmail, Outlook, and Yahoo check three things about every email that arrives:

1. Is the sender authorised? Does your domain have a record saying "yes, this server is allowed to send on my behalf"? (This is called SPF.)
2. Has the email been tampered with? Is there a digital signature proving the email wasn't changed in transit? (This is DKIM.)
3. What should we do with fakes? Does your domain have instructions for what to do with emails that fail those checks? (This is DMARC.)

If your domain doesn't have these records, email providers can't verify you're legitimate — so they play it safe and put your emails in spam. I go into each of these in more detail in the next question.

But authentication isn't the only thing that'll land you in spam:

• Brand-new domain with no reputation. If you registered your domain last week, email providers don't trust you yet. Send emails gradually to build trust — don't blast your entire contact list on day one.
• Using a CRM or booking system that sends email "from" your domain without adding it to your SPF record. Mailchimp, Calendly, Xero — any tool that sends on your behalf needs to be authorised in your DNS.
• Spammy subject lines. "FREE!!!", "Act now!!!", excessive caps and exclamation marks — these trigger filters regardless of authentication.
• Sudden volume spikes. Sending 500 emails from a domain that normally sends 5 a day looks suspicious to every major email provider.

Check it yourself (for free)

You don't need to call anyone to find out if you have a problem. These tools are free and take a couple of minutes:

What Australian businesses specifically need to know

• The Spam Act 2003 is real, and ACMA enforces it. Every commercial email you send must identify your business, include a working unsubscribe link (honoured within 5 business days), and only go to people who've consented to receive it. Penalties are up to $220,000 per breach — and there's no volume threshold. Even one unsolicited commercial email can be a breach. Check ACMA's guidelines if you're unsure.
• Watch for duplicate SPF records. If you're on a cPanel host (common with Australian budget hosting), the host sometimes adds their own SPF record automatically. If you then add one for Google Workspace or Microsoft 365, you end up with two SPF records — and that breaks both of them. You can only have one per domain.
• Google and Microsoft both tightened their rules in 2024–2025. Even if your emails were landing fine a year ago, the bar has gone up. Both now expect SPF, DKIM, and DMARC on every domain sending commercial email — regardless of volume. If you haven't checked your setup recently, it's worth running through those free tools above.

When you need to worry about this

• A client has told you they didn't get your email (even once is a red flag)
• Invoices or quotes are going unanswered and you're not sure why
• You've recently set up a new domain or switched email providers
• You've started using a CRM, booking system, or marketing tool that sends on your behalf
• You've never heard of SPF, DKIM, or DMARC (which means they probably aren't set up)

Where things usually go wrong

• Blaming the email content when it's actually authentication. Rewriting your emails won't help if the problem is missing DNS records. Always check the technical setup first.
• Adding a CRM or booking system without updating DNS. Mailchimp, Xero, Calendly — if it sends email "from" your domain, it needs to be in your SPF record. This is the single most common issue I fix.
• Assuming the email provider set everything up. Google Workspace and Microsoft 365 walk you through the basics during setup, but they don't log into your registrar and add the records for you. Someone still needs to do that.
• Ignoring the problem because "most emails get through." Maybe 90% of your emails land fine — until you realise that the 10% that didn't included three invoices, a quote, and a client's reply to your proposal.

What I'd do first

The 30-second version

Why this actually matters

Without these records, two things happen. First, your legitimate emails are more likely to end up in spam — because email providers can't verify you're real. Second, scammers can send emails that look like they come from your domain, and there's nothing stopping them. I cover the spam side in the previous question and the spoofing side in the scam emails question below.

These three records are the fix for both problems. Think of them as: who's allowed to send, proof it hasn't been tampered with, and what to do with fakes.

What each one does

SPF — who's allowed to send

SPF (Sender Policy Framework) is a DNS record that lists every server authorised to send email from your domain. When Gmail receives an email "from" you, it checks your SPF record to see if the sending server is on the list. If it's not — it's treated as suspicious.

Real-world example: You use Google Workspace for email and Mailchimp for your newsletters. Your SPF record needs to list both Google's servers and Mailchimp's servers. If you only list Google, every email Mailchimp sends on your behalf fails the SPF check — and goes straight to spam.

DKIM — proof it's not been tampered with

DKIM (DomainKeys Identified Mail) adds a digital signature to every email you send. The receiving server checks this signature to confirm the email wasn't altered between your outbox and their inbox. Think of it as a wax seal on a letter — if the seal's intact, you know nobody's changed the contents.

DMARC — what to do with fakes

DMARC (Domain-based Message Authentication, Reporting and Conformance) ties SPF and DKIM together with a policy. It tells receiving email servers: "If an email claiming to be from my domain fails SPF or DKIM, here's what to do — let it through, quarantine it, or reject it." DMARC also sends you reports showing who's attempting to send email as you — legitimate services you might've forgotten, or scammers trying to impersonate your business.

Check yours right now (for free)

You can see exactly what records you have (or don't have) in about 30 seconds:

If either tool shows missing records or errors, that's your answer — your emails are at risk of going to spam, and your domain is open to spoofing.

When you need these

• You send emails from your own domain (you@yourbusiness.com.au)
• You use a CRM, booking system, or marketing tool that sends email on your behalf
• You've had emails land in spam or clients say they never got your email
• You own a domain — even if you're not actively using it for email (it can still be spoofed)

When you can skip this

• You're pre-launch with no domain yet
• You're using a personal Gmail or Hotmail address with no custom domain

Mistakes I fix regularly

• Setting up SPF but forgetting the CRM. If Mailchimp, Xero, Calendly, or any other platform sends email "from" your domain, it needs to be in your SPF record. I see this one constantly — someone sets up Google Workspace correctly, then adds Mailchimp six months later and wonders why those emails go to spam.
• Having two SPF records. You can only have one SPF TXT record per domain. If your hosting provider added one automatically and you add another for Google Workspace, both break. Merge them into one record.
• Jumping straight to strict DMARC. If you set your DMARC policy to "reject" before checking that all your legitimate senders pass authentication, you'll block your own emails. Start with p=none (monitoring only), check the reports for a few weeks, then move to quarantine, then reject.
• Assuming someone else set this up. Google Workspace and Microsoft 365 walk you through the basics, but they don't log into your registrar and add the records for you. Someone still has to do that — and often, nobody did.

The practical next step

Skip to the answer

What this actually means

A "professional email" is an email address that uses your own domain name: sarah@sarahsplumbing.com.au instead of sarahsplumbing@gmail.com. It still works through Gmail or Outlook — you just pay for a service (Google Workspace or Microsoft 365) that connects your domain to their email platform.

The difference is perception. When a potential client gets a quote from sarah@sarahsplumbing.com.au, it signals "established business." When they get it from sarahsplumbing2019@gmail.com, it signals "might be working out of the back of a ute." Fair or not, first impressions matter — especially when someone's deciding whether to hand you money.

Why this matters more than you think

Trust. Credibility. Professionalism. Clients notice. Accountants notice. Suppliers notice. And if you ever bring on staff, you can create accounts@yourbusiness.com.au and bookings@yourbusiness.com.au without everything funnelling into one person's Gmail inbox.

There's a practical benefit too: emails from custom domains with proper authentication (SPF, DKIM, DMARC) are significantly less likely to end up in spam than emails from free accounts. So you're not just looking more professional — your emails are actually more likely to arrive.

The other thing nobody tells you: every account, subscription, and online service you sign up for using that Gmail address becomes a problem later. The longer you wait to switch, the more painful the migration. I've helped businesses untangle this after three years of using a personal Gmail for everything — it's doable, but it's not fun.

Signs you need a professional email

• You're sending quotes, invoices, or proposals to clients
• You have employees, contractors, or a VA who need their own email
• You've felt awkward giving out your email address (or a client's commented on it)
• You already have a domain name and a website

Signs Gmail is fine (for now)

• You're testing a business idea and not sure if it'll stick
• You're a sole trader just starting out and budget is genuinely tight
• You don't have a domain name yet

Pitfalls I see often

• Waiting too long to switch. The longer you use a free address, the more tangled it gets — subscriptions, client contacts, online accounts all tied to it. Every month you wait makes the migration harder.
• Setting up professional email but skipping authentication. A nice email address means nothing if your emails go to spam. Set up SPF, DKIM, and DMARC from day one — not "when you get around to it."
• Paying for features you'll never use. Google Workspace's Starter plan ($10/month) does everything most small businesses need. You don't need the $27/month Business Plus tier unless you have very specific requirements.
• Using a free email with a CRM. If you're sending automated emails through Mailchimp or any CRM from a Gmail address, you can't set up proper authentication — because you don't own the gmail.com domain. This means your CRM emails are far more likely to hit spam.

What I tell clients

Skip to the answer

What you're actually choosing between

Both give you the same core stuff: professional email on your domain, cloud storage, calendar, video calls, and document editing. The difference is in how they feel day to day.

Google Workspace (Gmail, Google Drive, Google Docs, Google Meet) lives in your browser. Everything's online, collaboration happens in real-time, and the interface is clean and familiar if you've ever used personal Gmail. There's nothing to install — you just log in and go.

Microsoft 365 (Outlook, OneDrive, Word, Excel, Teams) gives you full desktop applications alongside web versions. If you do serious spreadsheet work in Excel, need advanced formatting in Word, or have clients who send .docx and .xlsx files constantly, Microsoft will feel more natural. Outlook is also more powerful than Gmail for managing complex inboxes — rules, folders, categories, focused inbox.

Quick comparison

Why this decision actually matters

You'll use this every single working day — it's your email, calendar, files, and documents. Getting it right means less daily friction. Both integrate with Xero, both work with the major CRMs, and both handle email authentication properly when set up correctly.

The good news is there's no wrong answer here. The bad news is that switching from one to the other later is a pain — not impossible, but enough of a hassle that it's worth picking the right one now.

Where people trip up

• Paying for the enterprise tier. Google Workspace Starter and Microsoft 365 Business Basic do everything most small businesses need. You don't need the $27+/month plans unless you have very specific requirements.
• Not migrating emails properly. Switching from free Gmail (or from one platform to the other) without a proper migration can mean lost emails and calendar entries. Don't wing it — plan the switch or get someone to help.
• Forgetting about authentication. Whichever platform you choose, you still need to set up SPF, DKIM, and DMARC in your DNS. The platform gives you the records — but you (or someone you trust) needs to add them.
• Overthinking it. Honestly, for a small business sending emails and managing a calendar, both platforms do the job well. Pick the one that feels more natural and move on.

My take

The 30-second version

This happens more than you think

Here's a scenario I've dealt with more than once: you get a call from a confused client asking why you sent them a weird invoice. You didn't send it. A scammer did — using your domain name. The email looked like it came from you, it had your business name on it, and your client almost paid it.

This is called "email spoofing," and it's disturbingly easy to do. The "From" field in an email is about as trustworthy as the return address on a letter — anyone can write anything there. Email was built in an era when everyone on the internet trusted each other. Authentication protocols like SPF, DKIM, and DMARC were invented later to fix that — but they only work if you set them up.

The damage from spoofing goes beyond one fake email. Clients lose trust in your business. Your domain can end up on email blacklists, which means your real emails start going to spam. And in serious cases, your domain's reputation can be permanently damaged. The Australian Cyber Security Centre (ACSC) has flagged this as a growing threat to Australian businesses and recommends DMARC as a key defence.

Check if your domain is exposed (for free)

You can find out in about 30 seconds whether your domain is currently vulnerable to spoofing:

When you need to act on this

• A client has told you they received a suspicious email "from" you
• You've received bounce-back notifications for emails you never sent
• You haven't set up SPF, DKIM, or DMARC records (or you're not sure)
• You own a domain but aren't currently using it for email — these get spoofed too
• You own multiple domains (e.g., .com.au and .com) and haven't protected all of them

When you're already covered

• You've set up SPF, DKIM, and DMARC and your DMARC policy is set to "quarantine" or "reject"
• You're monitoring DMARC reports and reviewing them periodically

Common missteps

• "It won't happen to me." Spoofing is automated and random — bots scan domains in bulk. It targets domains, not people. If your domain exists and doesn't have DMARC, it's a target. Full stop.
• Only protecting your main domain. If you own yourbusiness.com.au and yourbusiness.com and yourbusiness.net.au, you need DMARC on all of them — including the ones you don't actively use for email. Scammers specifically look for unprotected secondary domains.
• Jumping straight to "reject" without monitoring. DMARC has three levels: p=none (monitor only), p=quarantine (send fakes to spam), and p=reject (block fakes entirely). Start at "none" for a few weeks to make sure all your legitimate services are passing authentication — then tighten gradually. I covered this in more detail in the SPF/DKIM/DMARC question above.
• Not knowing it's happening. Without DMARC monitoring, you have no visibility. Someone could be sending scam emails "from" your domain right now, and you'd never know until a client mentions it — or until your real emails start bouncing because your domain reputation tanked.

If it's already happened

If you've confirmed that someone is spoofing your domain, here's what to do:

1. Set up DMARC immediately — even at p=none, it starts generating reports so you can see the scope of the problem.
2. Warn your clients. A quick email or social media post letting people know to ignore suspicious emails from your domain goes a long way.
3. Report it. In Australia, you can report cybercrime to the ACSC via ReportCyber. If it involves financial fraud, also report to Scamwatch.
4. Tighten DMARC to "reject" as soon as you've confirmed all your legitimate senders pass authentication.

What I'd recommend

Skip to the answer

What a CRM actually does (forget the jargon)

A CRM keeps all your customer information in one spot. Contact details, what you've talked about, what you've quoted them, when you need to follow up, and where each person is in the process of becoming (or staying) a customer.

Think of it as a super-powered address book that also remembers every conversation, never forgets a follow-up, and can remind you when it's been three months since you last spoke to a good client.

What it actually replaces

Here's a quick reality check. If any of this sounds familiar, a CRM replaces all of it:

• Sticky notes on your monitor with "call back Tuesday"
• Customer details buried somewhere in your phone contacts
• A notebook with scribbled names and numbers you can't quite read
• That spreadsheet with six tabs and no structure
• Your memory (which, let's be honest, isn't as good as you think it is)

I've talked to business owners who lost a $3,000 job because they forgot to follow up on a quote. Not because they didn't want the work — because it slipped through the cracks. That's the problem a CRM solves. It doesn't make you a better salesperson. It stops you from losing the easy wins.

You don't have to pay for one

This is the bit most CRM articles skip. You don't need to spend money to start using a CRM. There are genuinely good free options:

• HubSpot Free CRM — unlimited users, up to 1,000 contacts, surprisingly feature-rich for $0. It's the best free CRM I've seen. The catch? Once you need marketing automation, their paid tiers add up fast.
• A well-structured Google Sheet — seriously. If you've got under 50 clients, a simple spreadsheet with columns for name, phone, email, last contact date, and next follow-up date works. It's not glamorous, but it works.

Some CRMs go much further and handle email marketing, SMS, booking, invoicing, and automation all in one place — that's the "all-in-one platform" category you'll hear about. But don't jump to that until you've outgrown the basics.

Signs you might need a CRM

• You've forgotten to follow up on a quote and lost a job because of it
• You can't remember what you discussed with a client last time
• You've got customer info scattered across your phone, email, a notebook, and a spreadsheet
• You've sent the same quote twice to different people and didn't realise
• You spend more time managing your contacts than actually talking to them

Signs you can hold off (for now)

• You have fewer than 20 regular clients and you genuinely know them all
• Your business model is simple with repeat customers you see regularly
• Your current system actually works — not "sort of works," actually works
• Honestly though — if you had to think about it for more than a few seconds, you probably do need one

What tends to go sideways

• Buying a CRM before knowing what problem it solves. "I should probably have a CRM" isn't a strategy. Write down what you need to track and why — then pick a tool.
• Starting with Salesforce or HubSpot's enterprise tier. That's like hiring a full-time receptionist when you get three calls a day. Start free or cheap. Upgrade when it hurts.
• Not actually using it after setup. A CRM only works if you put information into it. Consistently. Every single time. If you're going to enter half your contacts and ignore it for two weeks, save your money.
• Trying to track everything instead of what matters. Start with contacts, conversations, and follow-up dates. Add complexity later.

Where I'd start

If you want the full picture on CRMs and whether one makes sense for your business, I go deeper in this blog post.

Skip to the answer

The spreadsheet tipping point

Here's the scenario. You've got a Google Sheet that started as a simple contact list. Now it's got six tabs — "Leads," "Quotes Sent," "Active Clients," "Old Clients," a mysterious tab called "Sheet2" that you're afraid to delete, and one called "Danny's copy DO NOT EDIT" that someone made nine months ago. You can't find anything. You're not sure if the phone number in row 47 is current. And you just realised you sent the same follow-up email to someone twice.

Spreadsheets are great — until they're not. They don't send reminders. They don't track conversations. They don't log phone calls. And they definitely don't follow up with clients automatically. The tipping point usually hits when you spend more time maintaining the spreadsheet than doing the work it's supposed to support.

The hidden cost of manual tracking

Every time you copy-paste a contact's details between apps, every time you forget to update the sheet after a phone call, every time you lose track of where a deal is up to — that's time and money leaking out of your business. A CRM doesn't create more work. It replaces the work you're already doing badly.

Signs it's time to switch

• Your spreadsheet has multiple tabs and you've lost track of which one is current
• You've lost a job because you forgot to follow up
• You can't see the full history of a conversation with a client in one place
• You're manually copy-pasting information between your spreadsheet, email, and phone
• You've got duplicate entries and aren't sure which one is right
• More than one person needs access and you're emailing spreadsheets back and forth

Signs your spreadsheet still works

• You have fewer than 50 active contacts and a simple sales process
• You're disciplined about updating it and it actually reflects reality
• You work alone and don't need to share access
• You're not losing leads or forgetting follow-ups

The middle ground — free CRMs

You don't have to jump straight from a spreadsheet to a paid platform. HubSpot Free CRM gives you unlimited users, up to 1,000 contacts, deal tracking, and basic reporting — for $0. It's a genuine stepping stone that lets you experience what a CRM feels like without committing to a monthly bill. If you outgrow it and need automation, SMS, or deeper marketing tools, that's when a paid platform — or a system built around your business — makes sense.

Before you switch: clean your data first

Don't just dump your spreadsheet into a CRM and call it done. Spend an hour cleaning it up first:

• Delete anyone you haven't spoken to in two years — they're not a lead anymore
• Merge duplicate entries (pick the one with the most recent info)
• Update phone numbers and email addresses you know have changed
• Add a "last contacted" date to every entry — if you can't remember, that tells you something

A CRM full of rubbish data is no better than a spreadsheet full of rubbish data. Thirty minutes of cleanup now saves you hours of confusion later.

Traps to avoid

• Trying to replicate your exact spreadsheet inside a CRM. A CRM works differently. Adapt to its strengths instead of fighting its structure.
• Running both at the same time. The worst outcome is maintaining a spreadsheet AND a CRM. Pick one, commit, and stick with it. Cold turkey.
• Choosing something too complex. If you're coming from a spreadsheet, you don't need Salesforce. Start with HubSpot Free or a simple setup, and upgrade when it hurts.
• Not actually using it. A CRM only works if you put information into it. Consistently. Every single time. The tool isn't magic — the habit is.

My suggestion

Skip to the answer

What it actually is (forget the jargon)

GoHighLevel is one platform where a business's CRM, email marketing, SMS, booking system, form builder, and marketing automation all live in one place and share the same data. When someone fills out a form, the platform can add them to the CRM, send a confirmation email, trigger a follow-up SMS, and book them into a calendar — without connecting separate tools together.

That "everything in one subscription" model is the whole pitch: instead of paying for an email tool, a booking tool, a CRM, and an SMS service separately, you pay for one platform that covers all of them.

What's typically included

• CRM and sales pipelines
• Email marketing and campaign sequences
• SMS messaging (charged as usage on top of the subscription)
• Booking calendars and appointment reminders
• Forms, surveys, landing pages, and a basic website builder
• Workflow automation connecting all of the above
• Review and reputation management tools

What it costs

GoHighLevel's published pricing starts at around US$97/month (roughly $150 AUD) for the Starter plan, with higher tiers adding features like white-labelling and API access. Email and SMS sending is billed as usage on top.

Why people keep talking about it

Two reasons. First, the platform is aimed heavily at marketing agencies, who can white-label it and offer it to their clients under their own brand — so a lot of businesses encounter it through an agency without ever hearing the name GoHighLevel. Second, it rides the broader "tool consolidation" trend: plenty of small businesses are looking to reduce the number of separate subscriptions they juggle, and all-in-one platforms are one way to do that.

Where PSOS stands

PSOS doesn't sell or set up GoHighLevel — my automation work is built on custom systems designed around each business. This entry is here because it's a name Australian small business owners hear constantly, and it deserves a plain-English explanation like everything else in this dictionary. If you're weighing up how to handle your CRM, follow-ups, or automation, the CRM and marketing automation entries are a good place to start.

Skip to the answer

What it actually looks like (no buzzwords)

Forget "drip campaigns" and "nurture sequences" and "lead funnels." Here's what marketing automation looks like for a real Australian small business:

• Someone enquires on your website at 9pm. They immediately get a friendly email confirming you've received their enquiry and telling them when you'll be in touch. You didn't have to do anything — it just happened.
• You complete a job for a client. Two days later, they automatically get a message asking them to leave a Google review. You didn't have to remember.
• Someone got a quote but hasn't responded. After three days, they get a polite check-in. After a week, one more. Then it stops. No nagging — just a nudge.
• It's been six months since a client's last service. They get a friendly reminder that it might be time for their next one.

That's it. Not spam. Not robot emails. Just the stuff you'd do yourself if you had a perfect memory and unlimited hours in the day.

Why this matters for your business

Consistency. Your follow-up doesn't depend on whether you remembered, whether you had a busy week, or whether you were on holiday. The system handles the routine so you can handle the relationships.

The cost reality check

Automation isn't free — you'll need something to run it on, whether that's an email marketing tool, an all-in-one platform, or a custom-built system. But here's how I think about it: if one automated follow-up wins back a $2,000 job you would've forgotten about, that's your whole year of platform costs paid for in a single email. Most of my clients see the value within the first month.

If you're sending SMS — know the rules

SMS automation is powerful, but Australian law is strict about it. The Spam Act 2003 applies to every commercial SMS your business sends:

• Express consent required. You can't cold-text someone who didn't ask to hear from you. They need to have opted in.
• Every SMS must identify your business and include a working way to unsubscribe.
• Opt-outs must be honoured within 5 business days.
• Penalties are serious: up to $220,000 per breach, and $2.1 million for repeat offenders. ACMA doesn't mess around.

Coming July 2026: the new SMS Sender ID Register means businesses using custom sender names (like "PSOS" instead of a phone number) will need to register them. Unregistered sender names will show as "Unverified" on recipients' phones. If you're using SMS automation, make sure you're registered before July.

Signs you could benefit from automation

• You regularly forget to follow up with enquiries or quotes
• You send the same type of email over and over (confirmations, reminders, follow-ups)
• You wish you had a personal assistant handling routine communication
• You know you should be asking for reviews but never get around to it
• You've got a growing number of leads and can't keep up manually

Signs you can hold off for now

• You have very few clients and can personally manage each relationship
• Your business is entirely relationship-driven and every interaction is unique
• You're not yet at the stage where you're getting regular enquiries

Where businesses stumble

• Automating too much too fast. Start with one or two automations that solve a real problem. Don't try to automate your entire business on day one.
• Not personalising the messages. Automation should feel personal. Use the person's name, reference their situation, and write the way you actually talk. More on this in the next entry.
• Setting and forgetting. Automation still needs reviewing. Check your messages quarterly — prices change, offers expire, and what sounded good six months ago might sound stale now.
• Ignoring compliance. Especially with SMS. "I didn't know" is not a defence with ACMA. Make sure your automations include unsubscribe options and only contact people who've opted in.

Where to start

I've gone deeper into what automation actually looks like for small businesses on the blog — check it out here. And if you want to see what this looks like for your specific industry, the automation guide for 8 Australian business types walks through trades, beauty, allied health, coaching, hospitality, and more in detail.

Skip to the answer

The real problem (it's not automation — it's silence)

Most people get this wrong: they worry about sounding too automated when the real problem is that they're not following up at all. Research consistently shows that most sales happen between the second and fifth contact — but most businesses only follow up once (if they remember at all). A slightly imperfect automated follow-up is infinitely better than the perfect follow-up you never sent.

Why speed matters

The business that responds to an enquiry within five minutes is dramatically more likely to win the work than the one that responds the next day. An automated instant response buys you time while sounding professional and attentive. Then, well-timed follow-ups keep you top-of-mind without you having to remember each one.

How to sound human (with a before and after)

Here's the difference between a robotic follow-up and one that actually sounds like a person:

Robotic: "Dear valued customer, thank you for your recent enquiry. We appreciate your interest in our services and will endeavour to respond within 24-48 business hours. Kind regards, The Team."

Human: "Hi Sarah, thanks for getting in touch — I've got your enquiry about the kitchen renovation and I'll get back to you with some options by tomorrow morning. If anything's urgent in the meantime, just reply to this email. Cheers, Danny"

Both are automated. Only one sounds like a real person wrote it. Here's how to get there:

• Use their name. "Hi {first_name}" is the minimum. If your system captures what they enquired about, reference that too.
• Write like you talk. Read the message out loud. If it sounds like a corporate press release, rewrite it. If it sounds like something you'd text a colleague, you're closer.
• Vary the tone across messages. First follow-up: helpful ("Just making sure you got my reply"). Second: casual ("Hey, circling back — happy to answer any questions"). Third: a gentle close ("No worries if the timing's not right — I'm here when you're ready").
• Don't overdo the frequency. Immediate auto-reply, then 24 hours, then 3 days, then a week. After that, stop. Nobody wants daily emails from a business they enquired with once.
• Give them an easy out. Every message should make it easy to opt out — it's also a legal requirement under the Spam Act 2003.

When to automate vs. stay personal

Automate: Initial enquiry response, first follow-up, booking confirmations, review requests, routine check-ins.

Keep personal: High-value proposals, complex projects, sensitive conversations, anything where the client needs to feel individually heard.

The legal bit — Spam Act and SMS

If your follow-up includes SMS (and it should — open rates for SMS are dramatically higher than email), the Spam Act 2003 applies. Every commercial SMS must identify your business, include a working unsubscribe option, and only go to people who've given express consent. Penalties are up to $220,000 per breach — ACMA enforces this actively.

New from July 2026: the SMS Sender ID Register requires businesses to register custom sender names. If you send SMS as "YourBusiness" instead of a phone number, you'll need to register or your messages will display as "Unverified." I set this up for my automation clients as part of onboarding.

What usually goes wrong

• Too many messages, too fast. Three emails in 24 hours is a great way to get marked as spam and annoy potential clients.
• Generic messages that could be from anyone. "Dear valued customer" is an instant delete. Use their name and be specific.
• Following up after they've already said no. Your automation needs to stop when someone converts, declines, or opts out. Check your triggers.
• No opt-out mechanism. Not just bad practice — it's illegal under Australian law. And it's one of the first things ACMA checks.

What I'd recommend

This is something I get asked about a lot — so I wrote a full guide on automating follow-ups without losing the personal touch. Read it on the blog.

Skip to the answer

What it's not (because this confuses people)

A landing page is not your website homepage. Your homepage is like the front of your shop — it welcomes everyone and points them in different directions (services, about, contact, blog). A landing page is like a market stall at a trade show — it's promoting one thing, and the only option is to take it or walk away.

Landing pages typically have no navigation menu, no links to other pages, and no distractions. Everything on the page pushes the visitor toward that one action. That's what makes them effective.

A real example

Say you're a plumber in Perth running Google Ads for "emergency plumber Perth." If you send that ad traffic to your homepage — which has links to your gas fitting services, your about page, your blog, and a photo gallery — you've just given an urgent customer fifteen reasons to click somewhere else instead of calling you.

A landing page for that same ad would say: "Emergency Plumber in Perth — Call Now or Book Online" with one phone number, one booking button, a few reviews, and nothing else. That's it. One page, one job, one action. The difference in enquiries can be two to five times higher from the same ad spend.

Why Google actually rewards good landing pages

Here's something most people don't know: if you're running Google Ads, your landing page directly affects how much you pay per click. Google gives you a "Quality Score" based partly on how relevant your landing page is to your ad. A landing page that matches your ad copy — same keywords, same offer, fast loading — gets a higher Quality Score, which means cheaper clicks. Sending ads to a generic homepage usually means a lower score and higher costs.

Signs you need a landing page

• You're running paid ads and sending traffic to your homepage (stop doing that)
• You have a specific offer, promotion, or event you want to push
• You want to capture leads (email addresses, phone numbers) in exchange for something valuable
• You're running a seasonal campaign or limited-time offer
• You want to test a new service idea before building a full page on your main site

Signs you can skip this for now

• You're not running paid advertising or specific campaigns
• Your website already handles enquiries well and you're happy with the conversion rate
• You don't have a specific offer — a landing page needs a clear call to action to work

What makes a good landing page

• Clear, benefit-focused headline. Not "Welcome to our page" but "Get a free quote for your kitchen renovation in 30 seconds."
• One call to action. One button. One form. One thing to do. Not three different options competing for attention.
• No navigation menu. Don't give them an escape route. The only links should be your CTA and your privacy policy.
• Social proof. Reviews, testimonials, client logos. People trust other people more than they trust your marketing copy.
• Fast and mobile-friendly. Most traffic is on phones. If your landing page takes more than three seconds to load, you're losing visitors before they even see your offer.

The big mistakes

• Sending ad traffic to the homepage. The most common and most expensive mistake. Your homepage isn't built to convert ad traffic — a landing page is.
• Too many options. If there are three buttons pointing to three different things, it's not a landing page — it's a confused webpage.
• No tracking. If you can't measure how many people visited and how many took action, you can't improve anything. Set up conversion tracking before you launch.
• Mismatched messaging. If your ad says "Free quote in 24 hours" but your landing page says "Contact us for more information," you've broken the promise. Match the ad copy to the landing page — exactly.

Connect it to your follow-up

The real advantage isn't the page itself — it's what happens after someone fills in the form. When your landing page is connected to your CRM and follow-up sequence, a new lead is automatically captured, sent a confirmation email or SMS, and queued up for follow-up. No copy-pasting, no manual steps. The lead goes from ad click to follow-up sequence in seconds.

What I'd suggest

Skip to the answer

The shop analogy

Think of Google Analytics like a security camera inside your shop — it tells you how many people walked in, which aisles they browsed, how long they stayed, and whether they bought anything or left empty-handed.

Google Search Console is like standing outside your shop watching the street — it tells you how many people saw your sign, what they were looking for when they noticed it, and how many actually walked through the door.

Same shop. Two very different perspectives. You want both.

Five things to actually check (and where to find them)

You don't need to become a data analyst. Just check these five things once a month:

1. How many visitors you're getting (trending up or down?). In GA4, go to Reports > Reports snapshot. Look at the "Users" number over the last 28 days. The trend matters more than the actual number.
2. Where visitors come from. In GA4, go to Reports > Acquisition > Traffic acquisition. This tells you if people are finding you through Google (organic), typing your URL directly, clicking from social media, or coming from other websites.
3. Which pages get the most attention. In GA4, go to Reports > Engagement > Pages and screens. If your services page gets ten times the traffic of your about page, that tells you something about what visitors actually care about.
4. What search terms people used to find you. This is the gold. In Search Console, go to Performance > Search results. You'll see the exact words people typed into Google before clicking through to your site. This should directly inform your content and SEO strategy.
5. Whether Google has problems with your site. In Search Console, check the Pages report (under Indexing). If Google can't crawl or index certain pages, they won't show up in search results at all. This report tells you what's broken.

What you do NOT need to worry about

• Bounce rate obsession. A high "bounce rate" often just means someone found what they needed on the first page and left. For a service business, that's usually fine — they read your page, grabbed your phone number, and called.
• Real-time dashboards. Watching visitors in real-time is addictive and completely useless for decision-making. Check monthly, not hourly.
• "Industry benchmarks" from random blogs. Every business is different. Compare your numbers to your own numbers from last month, not to some blog's idea of an "average."
• Building custom reports. The default reports in GA4 and GSC are more than enough for most small businesses. Don't waste time on custom dashboards you'll never look at.

Setting them up

Both tools are free. GA4 requires adding a small tracking code to your website (one line of JavaScript on every page). GSC requires verifying that you own the domain — usually by adding a DNS record or uploading a small file.

If you're using a website builder like Wix or Squarespace, they have built-in analytics too. But GA4 and GSC give you more detail and — importantly — the data belongs to you, not the platform. If you ever move your website, your GA4 history comes with you.

Bonus tool: Google's PageSpeed Insights tests how fast your site loads and flags performance issues. Free, takes 30 seconds, and it'll tell you exactly what's slowing things down.

The common mistakes

• Tracking code on some pages but not others. If GA4 is only installed on your homepage, you're missing data from every other page. Make sure it's on every page of your site.
• Vanity metrics. "We had 5,000 visitors this month!" means nothing if none of them called, emailed, or bought anything. Focus on the numbers that connect to actual business outcomes.
• Setting it up and never logging in. The most common mistake by far. Data is only useful if you actually look at it.
• Confusing the two tools. GA and GSC overlap slightly, but they do different jobs. If you want to know what search terms bring people to your site, that's GSC. If you want to know what they do after they arrive, that's GA.

What I'd suggest

Skip to the answer

What it actually is

Google Business Profile is Google's local business directory. When someone searches "electrician near me" or "best coffee shop Scarborough," the map results that appear at the top of the page — that's called the Local Pack. Those results are pulled directly from Google Business Profiles.

You don't need a physical shopfront to have one. If you're a service-area business (you travel to customers), you can set up a GBP without displaying your home address. Plumbers, cleaners, mobile mechanics, consultants, photographers — all eligible.

Why it matters so much

The Local Pack appears above regular search results. That means a well-optimised GBP can outperform even a beautifully built website in terms of visibility. Here's what the data consistently shows:

• Most people looking for a local service never scroll past the map results
• Businesses with complete profiles get significantly more calls, direction requests, and website clicks than incomplete ones
• Reviews on your GBP are one of the strongest local ranking factors (more on that in the reviews entry)

The "please the Google gods" checklist

Google rewards profiles that are complete, current, and active. Here's what to do:

1. Complete every single field. Business name (your real one — not stuffed with keywords), categories (pick the most specific primary category), address or service areas, phone number, website, hours, business description, and attributes (women-owned, wheelchair accessible, etc.).
2. Keep your info up to date. Changed your hours? Update immediately. Going on holiday? Set special hours. Got a new phone number? Change it the same day. Stale information tells Google (and customers) you're not paying attention.
3. Add real photos regularly. Not stock photos — Google can tell. Photos of your actual work, your team, your premises. Aim for at least one new photo per month. Businesses with photos get significantly more clicks than those without.
4. Post updates. GBP has a "Posts" feature — it's basically a mini social media feed built into Google. Share updates, offers, events, or tips. Google notices active profiles and rewards them with better visibility.
5. Get reviews and respond to every single one. This is the big one. More on this in the online reviews entry, but the short version: ask every customer, respond to every review (good and bad), and never buy fake ones.
6. Use the Q&A section. Anyone can ask questions on your GBP — and anyone can answer them (including random strangers giving wrong information). Pre-populate it with your own frequently asked questions and correct answers.
7. Add your services with descriptions and prices. GBP lets you list your services, add descriptions, and show pricing. Most competitors don't bother. Doing this makes your profile stand out and gives Google more information to match you with relevant searches.

Verification — what to expect

Before your profile goes live, Google needs to verify you're a real business. As of 2026, video verification is the most common method — Google asks you to record a short video showing your business location, signage, and proof of operations. Some businesses may be offered phone, email, or postcard verification instead. The process typically takes a few days.

What you must NOT do

• Keyword-stuff your business name. If your business is "Smith Plumbing," don't list it as "Smith Plumbing | Best Emergency Plumber Perth | 24/7 Plumber." Google will suspend your profile. It happens regularly.
• Create fake or duplicate listings. One business, one profile. Creating multiple profiles for the same location will get all of them suspended.
• Use a PO Box as your address. Google requires a physical location or a service-area designation. PO Boxes aren't allowed.
• Incentivise reviews. "Leave us a review and get 10% off" violates both Google's policies and Australian Consumer Law. Don't do it. (More details in the reviews entry.)

Signs you need to sort this out

• You've never searched your own business name on Google (do it now — you might be surprised)
• Your GBP exists but the hours are wrong, photos are from three years ago, or the phone number is outdated
• You have fewer than 10 Google reviews and your competitors have 50+
• Customers say they "couldn't find you on Google" or "found the wrong phone number"

Signs you can skip this

• You don't serve local customers at all (purely online, national/international with no local focus)

That's a pretty short list. For almost every Australian small business, GBP is non-negotiable.

What I'd suggest

I've also written about local SEO specifically — what it is and why it matters for businesses that serve a local area. Read the full post here.

Skip to the answer

The three types (simplified)

SEO gets complicated fast, but at the core there are only three types. You don't need to master all of them — just knowing what they are puts you ahead of most business owners.

• On-page SEO. The stuff on your actual website — page titles, headings, the words on the page, image descriptions. This is about making sure your content clearly tells Google what each page is about. It's the most accessible type for DIY.
• Technical SEO. The behind-the-scenes stuff — site speed, mobile-friendliness, SSL/HTTPS, schema markup (structured data that helps Google understand your content), sitemap, and crawlability. You can't see most of this by looking at the website, but Google can.
• Off-page SEO. What other websites and platforms say about you — backlinks (other sites linking to yours), reviews, directory listings, social mentions. This is the hardest to control directly because it depends on other people.

What you can do yourself — for free

Seriously, you can make a meaningful difference without spending a cent:

• Claim and optimise your Google Business Profile. For local businesses, this often matters more than your website. (Full guide in the GBP entry.)
• Write clear, helpful content. Google's entire job is to show people the most helpful result. Write pages that actually answer the questions your customers ask. Don't write for Google — write for humans, and Google will follow.
• Keep your NAP consistent everywhere. NAP = Name, Address, Phone. Make sure your business details are identical across your website, GBP, social media, and every directory listing. Mismatches confuse Google and cost you rankings.
• Ask for Google reviews. Genuine, recent reviews are one of the strongest local ranking signals. (More on how to do this in the reviews entry.)
• Keep your website updated and mobile-friendly. A website that hasn't been touched in two years with outdated information tells Google you're not active. And if it doesn't work properly on a phone, Google deprioritises it — over 60% of Australian web traffic is mobile.

What typically needs a professional

• Technical SEO. Schema markup, site structure, Core Web Vitals optimisation, fixing crawl errors — this is specialist work. Getting it wrong can actually hurt your rankings.
• Competitor analysis and keyword research. Understanding what your competitors rank for, what gaps exist, and which keywords are worth targeting requires tools and experience.
• Building quality backlinks. Getting reputable websites to link to yours is one of the most impactful — and most difficult — parts of SEO. Anyone selling "100 backlinks for $50" is selling you a penalty.
• Fixing indexing and crawl issues. If Google Search Console is showing errors, interpreting and fixing them usually needs someone who knows what they're looking at.

The reality of SEO timelines

SEO is a slow burn. Expect 3–6 months before you see meaningful results from any changes. For competitive keywords, it can take longer. This isn't because anyone's doing it wrong — it's because Google needs time to recrawl, re-evaluate, and re-rank your site against every other site targeting the same terms.

Be wary of anyone who promises specific rankings by a specific date. Google's algorithm changes constantly, and nobody — nobody — can guarantee a #1 position. What a good SEO professional can do is put you in the strongest possible position to rank well and improve steadily over time.

What I include in every website build

Every PSOS website comes with the SEO foundations already done — because retrofitting SEO after the fact costs more and takes longer:

• Optimised page titles and meta descriptions for every page
• Schema markup (LocalBusiness, FAQPage, BreadcrumbList as relevant)
• Mobile-responsive design (every page, every screen size)
• Site speed optimisation (compressed images, efficient code, fast hosting)
• Google Analytics setup
• XML sitemap and robots.txt
• SSL/HTTPS as standard

The common mistakes

• Paying for "guaranteed rankings." Nobody can guarantee Google rankings. If they promise it, they're either lying or using techniques that will eventually get your site penalised.
• Ignoring GBP and focusing only on website SEO. For local businesses, your Google Business Profile is often the faster, higher-impact win. Do both, but don't neglect the free tool that might be driving more calls than your website.
• Keyword stuffing. Writing "best plumber Perth best plumber Perth best plumber Perth" on your homepage doesn't work. Google's been wise to this for years. Write naturally.
• Not doing anything because it feels overwhelming. You don't need to do everything at once. Claiming your GBP, getting a few reviews, and making sure your website content is clear and current — that alone puts you ahead of most competitors who are doing nothing.

What I'd suggest

Want the plain English version without all the jargon? I wrote a full guide to SEO in plain English on the blog.

Skip to the answer

Why reviews matter more than you think

Think about the last time you needed a tradie, a restaurant, or any local service. What did you do? You Googled it, looked at the star ratings, skimmed a few reviews, and picked someone. Your customers do exactly the same thing.

• Social proof. People trust strangers' experiences more than your marketing copy. A five-star Google review from a real customer carries more weight than anything you could write on your own website.
• Google ranking factor. Review quantity, quality, recency, and your response rate all influence where you appear in the Local Pack. More genuine reviews = better visibility.
• Decision-making shortcut. When two businesses offer the same service at a similar price, the one with 47 recent reviews beats the one with 3 reviews from 2021. Every time.

Where to focus (don't spread thin)

Google first. For Australian businesses, Google reviews are by far the most important. They show up directly in search results, they influence your Local Pack ranking, and they're the first thing most people see.

After Google, consider industry-specific platforms only if they're relevant to you:

• Hospitality: TripAdvisor
• Products: ProductReview.com.au
• Health and medical: HealthEngine
• General local: True Local, Yellow Pages (less impactful but still worth having)

Don't try to build a presence on every platform. Focus on Google, get that running well, and then expand if it makes sense for your industry.

How to actually get reviews

Reviews don't happen by accident. The businesses with the most reviews aren't luckier — they have a process. Here's what works:

1. Ask every customer. Not just the happy ones — Google's policies require you to send review requests to all customers equally (more on that below). Most satisfied customers are happy to leave a review. They just need to be asked.
2. Time it right. Ask immediately after a positive interaction — when the experience is fresh. For a tradie, that's the day the job is done. For a consultant, that's right after delivering results. Don't wait a week.
3. Make it stupidly easy. Your Google Business Profile has a built-in review link generator. Use it. Send a direct link that opens the review form in one click. Put it in follow-up emails, on invoices, on printed cards. The fewer steps, the more reviews you get.
4. Automate it if you can. With the right setup, automated review requests can go out after every completed job. No manual effort, consistent results.

How to respond (yes, you need to respond)

Your response rate matters — both to Google's algorithm and to potential customers reading your reviews. Here's how to handle them:

Positive reviews: Thank them by name, mention something specific about the work. "Thanks Sarah — glad the new website is already bringing in enquiries!" beats a generic "Thanks for the review!" every time.

Negative reviews: Take a breath. Respond professionally, acknowledge the concern, and offer to resolve it offline. "Hi Mark, sorry to hear this wasn't the experience we wanted for you. I'd like to make this right — could you call me on [number] so we can sort it out?" Never argue publicly. Potential customers read your response to bad reviews just as carefully as the review itself.

The legal bits (Australia-specific)

This is where a lot of businesses accidentally cross the line. Australian Consumer Law is strict about reviews, and the ACCC actively enforces it:

• Fake reviews are illegal. Writing your own reviews, paying someone to write them, or getting friends and family to post fake ones — all breaches of Australian Consumer Law.
• Incentivised reviews are prohibited. "Leave us a review and get 10% off your next visit" violates both Google's policies and the ACCC's guidelines. You can ask for a review. You cannot reward one.
• Review gating is against Google's rules. That means you can't send a survey first, then only send a review link to people who gave positive feedback. You must give all customers the same opportunity to review.
• Penalties are serious. Since November 2024, the ACCC can pursue fines of up to $50 million for corporations and $2.5 million for individuals for fake or misleading review conduct. This isn't theoretical — Australian businesses have been fined.

Signs you need a review strategy

• You have fewer than 10 Google reviews and your competitors have 30+
• Your most recent review is more than six months old
• You've never responded to a review (Google notices, and so do potential customers)
• You're relying on word-of-mouth alone and wondering why the phone isn't ringing
• You don't have a consistent process — reviews happen by accident, not by design

Signs you can deprioritise this

• You have a steady flow of recent reviews with good ratings
• You're already responding to every review
• You have a process in place and it's working

The common mistakes

• Only asking happy customers. Apart from being against Google's rules, it also means you miss the chance to fix problems before they become public complaints. Send the request to everyone equally.
• Ignoring negative reviews. An unanswered negative review tells every potential customer "this business doesn't care." A thoughtful response tells them you do.
• Buying fake reviews. It's illegal in Australia, it's detectable by Google (they regularly purge fake reviews), and the risk-to-reward ratio is absurd. Don't.
• Not having a process. If getting reviews depends on you remembering to ask, it won't happen consistently. Build it into your workflow — a template message, an automated email, a step in your job-completion checklist.

What I'd suggest

If you're wondering whether reviews actually help your Google rankings, I answered that one on the blog too — give it a read.