Everything below is written for decision-makers who need website security checklist to produce commercial results, not for people collecting best practices.
Most website problems presented as design problems are actually structure, speed or trust problems. Getting those three right does more for enquiry volume than any amount of visual refinement applied afterwards.
Setting the scope
The honest starting point for website security checklist is an audit rather than a plan. Half of what most Saudi businesses need is already present and broken — a profile nobody maintains, pages nobody links to, data nobody reconciles. Fixing existing assets typically returns faster than building new ones, and it is considerably cheaper. Build only after you have exhausted the repairs.
Arabic fonts are a performance decision
A full Arabic typeface can weigh several hundred kilobytes because of the glyph count and contextual forms. Subsetting to the ranges you actually render, using font-display: swap, self-hosting rather than calling a third-party origin, and preloading only the weights above the fold together take a second or more off first paint on a mid-range Android device — which is what most of the Kingdom is browsing on.
Duplicate content in a bilingual, multi-branch site
Faceted navigation, session parameters, printer views, and city pages that differ by two words all create near-duplicates. Set self-referencing canonicals, block parameter crawling deliberately, and give each city page genuinely distinct content — local pricing, local case work, local landmarks and directions. If two pages can be swapped without a reader noticing, Google will pick one and it may not be the one you want.
The cheapest growth available to most Saudi businesses is the customers they already have and have not contacted in a year.
Redirects, migrations and the cost of getting it wrong
Map every old URL to its closest new equivalent one-to-one; never bulk-redirect to the homepage. Use 301s, not 302s. Keep the old sitemap live for a few weeks so the redirects are discovered. Preserve internal links, then update them. Watch Search Console coverage daily for the first fortnight. Migrations that lose traffic almost never lose it to bad content — they lose it to missing redirect mappings nobody checked.
Monitoring so problems surface in days, not quarters
Set up uptime checks, a weekly crawl with change alerts, Search Console coverage alerts, and a Core Web Vitals field report reviewed monthly. Most catastrophic SEO losses in this market trace back to a deployment that added a noindex, a robots rule or a broken canonical, and sat unnoticed for a full quarter because nobody was watching the right dashboard.
Hreflang without the usual mistakes
Use ar-SA and en plus an x-default. Every annotation must be reciprocal — if the Arabic page points to the English one, the English page must point back, or the whole set is discarded. Point at canonical URLs only. Do not mix hreflang with a canonical that points to the other language. And remember hreflang selects between versions; it does not create authority. A thin Arabic page still ranks like a thin page.
Core Web Vitals, honestly
Interaction to Next Paint is the metric that catches most Saudi sites out, because it punishes heavy third-party scripts — chat widgets, tag managers, multiple pixels, review carousels — that accumulate over years. Largest Contentful Paint is usually an image or web-font problem: serve modern formats, set explicit dimensions, preload the hero, and subset Arabic fonts rather than shipping the full glyph set. Cumulative Layout Shift is almost always ads or late-loading banners. Fix in that order and the field data follows within a month.
Typical project shape
| Stage | Typical window | What you should see |
|---|---|---|
| Discovery and content | 2–3 weeks | Usually the critical path, not development |
| Design system and key templates | 3–4 weeks | Bilingual from the first artboard |
| Build and integrations | 4–8 weeks | Varies most with third-party systems |
| QA, RTL testing and launch | 1–2 weeks | Real devices, throttled connections |
Windows assume consistent execution and a market of ordinary competitiveness. Treat them as planning ranges, not commitments.
Accessibility is legibility for everyone
Contrast ratios that survive sunlight on a phone screen, focus states that are visible, semantic headings, labelled form fields, alt text in the page language, and no information conveyed by colour alone. In Arabic, ensure screen readers receive correct language attributes so pronunciation is right. Accessible pages are also cleaner for crawlers and AI extraction — the same structural discipline serves both.
Start with the query, not the keyword
A keyword is a string; a query is a person with a problem. Before touching {kw}, write down what the searcher is trying to finish: compare vendors, check a price, solve an error, book something today. In Saudi Arabia the same intent often arrives twice — once in English from a procurement manager, once in Arabic from an owner — and the page that satisfies both wins twice. Map every target term to a single job-to-be-done, then decide whether that job needs a guide, a comparison, a calculator or a booking page. Pages built this way stop competing with each other and start compounding.
Search intent decides the format
Look at what currently ranks before deciding what to build. If the first page is dominated by listicles, a sales page will not break in. If it is dominated by tools, publish a tool. If Google shows a map pack, the winning asset is a location page plus a well-tended profile, not a blog post. Matching format is a larger lever than word count, and it costs nothing but the discipline to check first.
Citations and NAP consistency across Arabic and English
Name, address and phone must match everywhere — and in a bilingual market that means two versions of the truth staying in sync. Decide the canonical Arabic company name and the canonical transliteration, then enforce both across the profile, the website footer, Maroof, chamber directories, sector portals and social bios. Inconsistent addresses are one of the most common reasons a technically sound Saudi site under-performs locally, and it is one of the cheapest problems on this list to fix.
Generative engine optimisation, defined without hype
GEO is the practice of making your content the material a generative system reaches for when composing an answer. It shares its foundations with SEO — crawlability, authority, clarity — but shifts the objective from position to inclusion. Success looks like being named in a synthesised paragraph rather than sitting at position three. The tactics are less exotic than the label suggests: be retrievable, be quotable, be corroborated.
Practical checks before you sign anything off
- Test the full journey on a throttled mid-range Android before sign-off
- Test the Arabic layout for correctly mirrored navigation, breadcrumbs and progress steps
- Check contrast ratios survive direct sunlight on a phone screen
- Add a WhatsApp route to a human on every page
- Confirm numerals, phone numbers and Latin brand names stay left-to-right inside Arabic text
- Reduce the primary enquiry form to three fields
- Set correct language attributes so screen readers pronounce Arabic properly
Google Business Profile is a ranking asset, not a listing
Treat the profile as a page you optimise weekly. Primary category drives the majority of map-pack relevance, so choose it precisely rather than broadly. Fill every service with an Arabic and English description. Post updates at least fortnightly. Upload geotagged photographs of the actual premises, not stock imagery — Saudi buyers check photos for legitimacy before they call. Answer questions in the Q&A section yourself, using the phrasing customers use. Profiles maintained this way routinely out-rank larger competitors who set theirs up once and forgot it.
The three-layer local ranking model
Local rankings in the Kingdom resolve across three layers. Proximity you cannot change. Prominence you build through reviews, citations, press and links. Relevance you control almost entirely through on-page content, categories and structured data. Most businesses obsess over the layer they cannot move and neglect the one they can. Audit relevance first: does the page name the service, the city, the neighbourhood and the language the customer uses? Then work prominence steadily over quarters. Proximity only decides ties.
Where to start this week
Test your site on a throttled mid-range Android. Time it. Then check the Arabic version for mirrored layouts, correct typography and a language switch that preserves the page. Add the trust elements Saudi buyers look for — registration number, national address, real photographs, a WhatsApp route. Most sites gain more from that afternoon than from a full redesign.
Pick the two changes above with the clearest link to revenue and ship them this month. Momentum matters more than completeness at the start, and a finished small change beats a planned large one.
