On 18 October 2026 we read 22 law firm websites in Somerset West, Strand, Gordon's Bay and Stellenbosch the way a prospective client, and a search engine, would. Every site had something fixable. Hardly any of it needed a lawyer to spot, and most of it takes minutes to fix. Here are the six mistakes we saw most, what each one costs a firm, and the fix.
What are the most common law firm website mistakes?
The most common law firm website mistakes are the basics nobody checks after launch: an expired security certificate, demo pages the theme came with, email links that go to the wrong place, a misspelt firm name, links to the developer's copy of the site, and page titles that don't say where the firm is. They are rarely the things firms worry about.
1. The security certificate that quietly expired
When we checked one firm's website on 18 October, its security certificate had expired three days earlier. Every visitor got a browser warning such as "Your connection is not private" instead of the home page. Most people stop at that warning, and a referral who looks the firm up sees a security alert before a single practice area.
The fix, in about ten minutes: log in to your hosting panel (cPanel at most South African hosts), open SSL/TLS Status, run AutoSSL for both your bare and www address, and switch on automatic renewal. More in website security basics.
2. The demo page that went live
15 of the 22 sites still showed content left over from their theme or template: demo pages, sample posts or placeholder text. On at least nine, those pages were listed for Google. The most striking was an About page showing US-dollar case "results", glowing testimonials and a team of lawyers who have never worked at the firm. Theme demos are designed to look real, which is exactly why they slip through. On a law firm's site, invented results and testimonials also raise questions under the LPC's rules on how attorneys market themselves: see the LPC Code of Conduct and your website.
The five-minute check: open yoursite.co.za/sitemap.xml and look for "sample", "demo", "home-2" or "hello-world". Unpublish anything you didn't write.
3. Email links that go nowhere
Four sites show one email address but send the message to another. On one, the address had a one-letter typo in the domain, and nobody owns that domain. Mail sent there bounces, and anyone who registered the domain would receive it. A fifth site hid its address from spam robots as "nameATfirmDOTcoDOTza", and its "Email us" button opens a message to exactly that, which no inbox can receive. Every bounced enquiry is a client who thinks you never replied. We cover the other contact failures in the enquiry you never received.
The check: click every email link and phone number on your site, and send a test from your personal account.
4. Your own name, spelt wrong
Three firms misspelt their own name on their website. In one, the typo was in the site title, so every Google result for the firm carried it. The page title is the headline Google shows above your link: the first line a prospective client reads about you. Every one of the 22 sites had at least one spelling or wording slip, such as a cut-off Afrikaans word in a main heading, "secretary" or "council" missing a letter, or deceased estates spelt "diseased".
The check: Google your firm and read your own result as a stranger would.
5. The developer's copy that never left
Two sites still link to the copy the developer built them on. Both copies have since been switched off, so a click on one of those links, such as "About Us", opens a browser error instead of the page. Another site's footer still carries the template's "© 2015 Your Company" line under the firm's own. Firms rarely notice, because they seldom click through their own site the way a visitor does.
The fix: search the site for the developer's web address and replace it with your own. In WordPress, the free Better Search Replace plugin does it in one pass (take a backup first).
6. Google can't tell where you are
Half the firms (11 of 22) have a home page title that doesn't name their town. Clients search "attorney" plus where they live. If your title says only "Home" or your firm's name, Google has less to match you with. One firm's pages place its office in a different town from the one it actually works in.
The title formula: Firm name | What you do | Town. Then name the town in your main heading, and use the same address on your Google Business Profile. Our client journey study shows what this does to a firm's place in Google's map results.
Two pages most firm websites don't link
Of the 22 sites, our scan found no link to a privacy notice on 14, although any enquiry form collects personal information. It found no link to a PAIA manual on 20. POPIA section 18 asks you to tell people who you are, why you collect their information and what their rights are. Unless an exemption applies, PAIA section 51 asks private bodies to publish a manual. A missing link doesn't prove a missing document, and each fix is a single page and a footer link. Your Information Officer has the final word: see POPIA and your website for what a gap audit covers.
The ten-minute website check
Eight things to check on your firm's website before a client does:
- Open it in a private window. Check that no security warning appears.
- Type the address without https://. It should switch to the secure https address by itself.
- Click every email link and phone number. Each should open the address or dial the number the page shows.
- Google your firm. The headline should be spelt right and name your town.
- Open /sitemap.xml. Look for "sample", "demo" or "hello-world" pages, and unpublish them.
- Look at the footer. It should link your privacy notice and PAIA manual.
- Click every menu item. Each should open the page its label promises.
- Read the footer date and address. It should show this year and your current address.
Every item comes from something we found on a real firm's site this month. The full list of requirements is in our law firm website checklist.
Where we looked, and why it matters locally
The 22 firms are in the Helderberg (Somerset West, Strand and Gordon's Bay) and in Stellenbosch. The mistakes aren't local, but their cost is. In towns with a dozen or more firms close together, clients pick from a short list on Google, and small things decide who is on it: a title that names the town, a page per practice area, and an address that matches the Google listing. Firms in Cape Town suburbs and other Western Cape towns face the same list.
How we measured
On 18 October 2026 we ran our website basics scan on each site's public pages, as any visitor's browser would: certificates, redirects, links, page titles, sitemaps, and privacy and PAIA links. A second review then read each site's home, about, practice and contact pages for spelling, demo content and mislabelled buttons, and threw out any scan finding that didn't hold up. We name no firm, and nothing here is legal advice.
Frequently asked questions
What should a law firm website's page title say?
A law firm's page title should give the firm's name, what it does and where: for example "Firm Name | Divorce and Family Law | Somerset West". The title is the headline Google shows above the link, and naming the town helps Google match the firm to local searches.
How do I know if my website's security certificate has expired?
Open your website in a private browser window. If you see "Your connection is not private" or a padlock warning, the security certificate has expired or is set up wrongly. Most South African hosts can issue a free replacement in about ten minutes, with automatic renewal.
How do I find leftover demo pages on my website?
Open your website's sitemap, usually yoursite.co.za/sitemap.xml, and look for pages called sample, demo, home-2 or hello-world, or any page you didn't write. Unpublish them. In October 2026, 15 of the 22 Western Cape law firm sites we checked still showed theme or template leftovers.
Does a law firm website need a privacy notice and a PAIA manual?
POPIA section 18 asks a law firm to tell people what information it collects and why, and a website enquiry form collects personal information. Unless an exemption applies, PAIA section 51 asks private bodies to publish a manual. The firm's Information Officer should confirm what applies.
How often should a law firm check its website?
A law firm should run the quick website checks monthly: security warning, contact links, the enquiry form and the Google result. Certificates lapse, plugins update and staff change, and none of it announces itself. A full review once a year catches the rest.
Want us to check your site?
Our free website basics scan runs these checks, plus your Google listing, and gives you the exact steps to fix each finding. Start with a free website basics scan for law firms, or see a sample report. The full digital risk assessment goes further, covering the LPC Code, POPIA, security and AI search: see what we find when we audit law firm websites. When a new site is the better answer, Forge builds it.