Why Your Website Is Slow, and What Else Is Broken

"Slow" is not a diagnosis. It's a symptom with about six common causes, and they range from an afternoon of image compression to a platform that cannot be made fast at any price. Before you accept a quote to rebuild anything, the only useful question is which of those six you actually have.

Start with the numbers, because "it feels slow" is not something anyone can fix. Google publishes three thresholds and they are the ones worth arguing about: Largest Contentful Paint under 2.5 seconds, Interaction to Next Paint under 200 milliseconds, Cumulative Layout Shift under 0.1. Those are measured on mobile, on a throttled connection, on a device slower than the one in your hand. That last part explains most of the confusion we get asked about. A site that scores in the nineties on a desktop test and in the thirties on mobile is not broken in two ways; it is being tested honestly for the first time.

Want a number instead of a feeling? Run a free 30-second audit → — live Core Web Vitals, the top bottlenecks, and whether the problem is your content or your platform.

Once you have real numbers, the causes sort themselves quickly. On most Australian small business sites the single biggest offender is images: a hero photo uploaded at full camera resolution, a logo saved as a half-megabyte PNG, a gallery that loads forty photographs before anyone scrolls. Second is third-party JavaScript, which is to say the chat widget, the booking iframe, the two analytics tags, the review carousel, and the pixel someone added for a campaign that ended in 2023. Third is render-blocking CSS and fonts. Fourth is the platform's own overhead: themes stacked on page builders stacked on plugins, each one loading its own assets on every page whether that page uses them or not.

The order matters because the first three are content and configuration problems. They are cheap, they are reversible, and a competent developer can usually recover most of a site's speed without touching the architecture. The fourth is structural. When the framework itself is shipping a megabyte of JavaScript before your first paragraph renders, no amount of caching plugins gets it back, and you have arrived at the honest rebuild conversation. Our own project pricing starts at $8,000, which is exactly why we would rather tell you the fix list is enough when it is.

Hosting is the answer people reach for first and it is rarely the answer. Server location matters for the first byte, not for the two seconds of your page that come after it, and a CDN in front of a bloated site just delivers the bloat faster.

Now the part that arrives in the same audit and surprises people more. When a small business site gets hacked, there is almost never a person on the other end who decided it was worth attacking. The whole thing is automated: scanning software reads a version number in your page source, matches it against a public database of known holes in out-of-date plugins, and lets itself in — with no idea, and no interest, in what the business does. Small Australian businesses are not targeted; they are swept. Which makes website security a maintenance problem rather than a product problem, and makes the defence unglamorous: keep the software updated, remove what you no longer use, put real authentication on the admin, take backups you have actually tested restoring, and force HTTPS. Nothing you can buy substitutes for the first item on that list.

The third failure mode is the one nobody quotes for. The Disability Discrimination Act applies to Australian websites, the Australian Human Rights Commission has said so in guidance, and the precedent goes back to Maguire v SOCOG in 2000. WCAG 2.2 Level AA is the standard everyone works to. The trap is the overlay industry: a script that promises compliance in one line of code, sold hard to small businesses, and comprehensively unable to deliver it. Regulators overseas have already acted on those claims. The real work is ordinary front-end discipline — colour contrast, keyboard operability, alt text, labelled form fields, headings in order — and it is much cheaper done during a build than retrofitted after a complaint.

What connects all three is ownership. Speed decays because nobody set a budget for it, so every new photo and every new tag costs a little more load and no one is watching the total. Security decays because nobody is responsible for updates after handover. Accessibility never existed because it was not in the brief. The most useful thing you can do with a quote for new work is insist on the numbers being written into it — a performance budget with a page-weight ceiling, a named maintenance arrangement, and WCAG 2.2 AA as an acceptance criterion. Agencies that will commit to those in writing are a much smaller group than the ones who will nod at them in a meeting.

The rest of this guide is the detail behind each of those, grouped by the decision you are actually trying to make.

Work out what kind of slow you have

Before you spend anything, get a number and get a cost. These three tell you whether the problem is real, how much it is taking, and where to look.

• Fast on desktop, slow on mobile: what's actually different — for anyone staring at a green desktop score and a red mobile one on the same page, and wondering which test is lying. Neither is.
• The real cost of a slow website — the revenue arithmetic for a small Australian business, so you can decide whether the fix is worth funding this quarter or next.
• GA4 for owners: the five numbers that matter — for the owner who opened Analytics once and closed it again: the handful of figures worth fifteen minutes a month, and what to ignore entirely.

The fix ladder, cheapest first

Most speed problems are solved in the order below and stop being problems well before the expensive end. Work down it and only escalate when the numbers refuse to move.

• How to fix a slow website without rebuilding — the full sequence of fixes in the order worth trying them, and the telltale signs that the platform itself is what's slow.
• Performance budget: why every quote should have one — for anyone about to sign a build contract, this is the clause that stops the new site slowly becoming the old one.
• Does your website need Australian hosting? — what server location genuinely changes, the narrow cases where keeping data onshore is a legal requirement, and how to recognise the upsell.

When the images are the product

Photography-led sites carry a genuine tension: the pictures are the reason anyone hires you, and the pictures are why the page takes six seconds. You do not have to choose.

• Tourism sites: image-heavy without killing mobile load — for operators whose customers browse on regional 4G: how to keep the photography and still get a pass out of Google's mobile metrics.
• Why architecture sites make your work look worse — the technical and editorial reasons expensive photography arrives online looking cheap, and how to stop compressing your best asset into mush.
• Slow architecture sites and the lost-brief tax — what a heavy portfolio costs a studio in enquiries that never arrive, written for practices who suspect their site is quietly filtering clients.

Both of those apply well beyond architecture; if you want the sector-specific version, our architecture firm web design and hotel web design pages cover how we build image-led sites without the weight.

When slowness costs a booking, not just a bounce

There is a category of slow that is not about milliseconds at all. It's about the moment a visitor is ready to act and the site hands them off to something that loads separately, looks different and asks them to start again.

• How a 4-second hotel site costs direct bookings — the gap between mobile traffic and mobile conversion in accommodation, why a CDN doesn't close it, and what does.
• Why embedded booking widgets kill bookings — for anyone who dropped a Calendly or Acuity iframe into their site and watched enquiries fall: what the embed costs and what a native form recovers.
• Calendly vs Acuity vs Setmore vs custom — the honest comparison for Australian service businesses deciding between free scheduling software and real booking infrastructure.
• Why AU SaaS founders get the marketing site wrong — for founders whose site converts under one percent, treating the marketing site as the account executive it actually is.

The platform decision underneath most of this

If the fix ladder ran out and the numbers still won't move, you are choosing a platform rather than debugging one. These four are the arguments worth having before you commit, plus the two structural problems that most often force a rebuild at year three.

• Next.js vs WordPress vs Webflow: the real differences — which platform suits which kind of Australian business, and the specific costs of picking the wrong one.
• Headless vs monolithic in two paragraphs — for the non-technical owner being sold "headless" by someone who hasn't explained it: what it means and the nine-in-ten case where the answer is don't.
• Headless CMS for SaaS: worth it or overengineered? — the decision tree on Sanity, Payload and Contentful, and the team size at which the complexity finally earns its keep.
• Franchise sites: many locations, one architecture — the structural choices that decide whether a multi-location site scales gracefully or needs a six-figure rebuild.
• How to build a cafe menu that updates daily — for venues whose specials change constantly and whose website hasn't moved since 2024, without handing floor staff a CMS they'll break.

Security and spam: the boring work that prevents both

Neither of these is exciting and neither is optional. They are the two maintenance jobs most likely to be skipped after handover, and the two most likely to cost you something.

• Small business website security: the real checklist — how Australian small-business sites really get broken into — no fear-selling — and the five boring maintenance habits that prevent almost every incident.
• Stop contact form spam without killing leads — how to escalate from an invisible honeypot through Turnstile to full reCAPTCHA, and which defences quietly turn away genuine customers along with the bots.

Accessibility, compliance and gates that block people

Every site has legal obligations here and most Australian businesses have never had them explained. Two of these are the standard and the law; two are the traps; the last is the specific case of deliberately putting a barrier in front of your own content.

• WCAG 2.2 AA: the plain English checklist — every criterion translated into what a competent build actually does about it, and the questions that expose a vendor who hasn't.
• DDA website compliance: what AU businesses must do — what the Act genuinely requires of a website, the AHRC guidance, and the realistic obligation for a small business rather than the maximalist reading.
• Sued for an inaccessible website in Australia — the Australian complaints that actually happened, what they cost to settle, and the awkward news about whether your existing insurance responds.
• Why accessibility overlays fail — for anyone who has been pitched one-line compliance: what the overlay vendors claimed, what regulators did about it, and what to spend the money on instead.
• Wine website age gates and the bounce trap — for producers stuck between a legal requirement and a full-screen barrier that loses visitors, and the tiered approach that satisfies both.

Where to go next

The fastest way to find out which of the three problems you actually have is to run the free audit — it returns your live Core Web Vitals and the specific bottlenecks rather than a generic score, and it takes about thirty seconds. If the results point at the platform rather than the content, that is the conversation worth having with a person: book a call and we will tell you honestly whether a fix list will get you there before anyone talks about a rebuild.

If you already know you're rebuilding, our custom web design in Melbourne and website development for small business pages set out how we work, including the performance budget and accessibility standard we write into the scope. For sector-specific detail, the industries pages go deeper on the constraints particular to your kind of business.