If you pay a monthly fee for your restaurant or small-business website, it is fair to assume someone is handling the technical part. You are busy running the place. You bought the subscription so you would not have to think about HTML.
Here is the uncomfortable truth. A monthly website subscription buys you a baseline. It does not guarantee that your site does the modern things that now decide whether people find you: clean structured data, basic security headers, real accessibility, and the plain-text facts that AI answer engines read before they recommend anyone. None of that is automatic. A lot of it depends on whether the platform built it in, and whether you, the paying customer, ever asked.
This post is the anchor for a small series. The other posts look at specific platforms. This one is the part that is true no matter which platform you are on. I want you to walk away able to check your own site in about twenty minutes, and to know what each result means.
Why a subscription is not the same as "done right"
Website platforms are businesses. They ship a product that works for the most people at the lowest support cost. That is a baseline. It covers the obvious stuff: your site loads, it works on a phone, you can edit your hours.
The baseline is not the frontier. Three things keep moving past it.
First, platforms improve mostly when paying customers ask. A feature that no customer requests is a feature that sits at the bottom of the roadmap. If structured data or accessibility never comes up in support tickets, it stays a quiet default that may or may not be correct.
Second, the standards keep changing. Schema.org adds and revises types. Google changes which rich results it shows. AI answer engines like Google's AI Overviews, Gemini, and ChatGPT search arrived and now read your site in a new way. Privacy law shifts state by state. The email rules that protect your domain from being spoofed got stricter in 2024. A site that was "modern" three years ago can be behind today without a single thing changing on your end.
Third, the defaults are generic. A platform template has to work for a florist, a law office, and a taco shop. So the structured data, if there is any, is usually the lowest common type. For a restaurant, the difference between a generic "this is a business" tag and a proper Restaurant tag with cuisine, price range, hours, and a menu link is the difference between a machine guessing about you and a machine knowing about you.
None of this means your platform is bad or that you got ripped off. It means the subscription is the floor, not the ceiling, and nobody is going to raise the ceiling for you unless you check what is up there.
What "modern programmatics" actually means, in plain English
That phrase sounds technical. Here is what it covers, in owner language.
Structured data. Hidden labels in your page's code that tell Google and AI tools the facts: your name, address, phone, hours, cuisine, price level, and a link to your menu. For restaurants this is the Restaurant type in a format called JSON-LD. Required at minimum: name and address. Worth adding: cuisine, price range, hours with real open and close times per day, whether you take reservations, your phone, and a full menu link. When this is clean, AI tools state your facts with confidence. When it is missing, they guess or pick a competitor they understand better.
Security headers. Small instructions your site sends to every visitor's browser that make it harder to attack or impersonate. You will not see them. A scanner does. Missing ones are common and quietly weaken trust signals.
Accessibility. Whether a person using a screen reader or just a keyboard can actually use your site, read your menu, and place an order. This is also a legal exposure, which I will get to.
AEO readiness. AEO means answer engine optimization, which is just making sure AI answer tools can read and trust you. The two big pieces: put your real facts in plain text on the page, not trapped inside an image or a PDF, and keep those facts identical everywhere they appear.
That last point deserves its own line. The single most common, most damaging mistake I see on restaurant sites is a menu that is only a photo or a PDF.
The menu trap
A beautiful PDF menu feels finished. It is also close to invisible to the systems that now decide who gets recommended.
Google, AI answer engines, and screen readers all struggle to read text locked inside an image or a flattened PDF. So your dishes, your prices, the fact that you have vegan options or a gluten-free crust, all of it becomes data the recommendation systems cannot see. When someone asks an AI tool for "a good vegetarian-friendly Italian place near downtown with a patio," the tool matches plain words on pages it can read. If your patio and your vegetarian menu live inside a JPEG, you are not in the running, no matter how good the food is.
The fix is the same one that helps your customers and keeps you out of accessibility trouble: publish the menu as real text on the page. Keep the pretty PDF as an optional download if you like. Just do not let it be the only version.
How to check in ten seconds: open your menu page and try to highlight the text with your cursor, the way you would to copy and paste it. If you cannot select the words, it is an image, and you have the menu trap.
The 20-minute self-audit
You do not need to be technical to do this. You need a browser, your phone, and twenty minutes. Run through these in order. I will tell you what a bad result looks like and what to do about it.
1. Try to select your menu text (2 minutes). Open your menu page. Try to highlight the words. If you cannot, your menu is an image or a PDF. Action: ask your platform or web person to publish the menu as on-page text. This one fix helps Google, AI tools, screen readers, and customers at once.
2. View the page source for structured data (3 minutes). On a desktop browser, right-click your homepage and choose "View page source," then press Ctrl+F (Cmd+F on Mac) and search the page for the word Restaurant. You are looking for a block that mentions your name, address, and ideally cuisine, price range, hours, and a menu link. If you find nothing, or only a generic mention with no real details, your structured data is thin. Action: ask for a proper Restaurant JSON-LD block with name, address, phone, cuisine, price range, hours, reservations, and a menu URL.
3. Check your title and meta description (3 minutes). Look at the browser tab when your homepage is open. That short text is your title tag. Then view source again and search for description. The title should say what you are and where ("Wood-Fired Pizza in [Neighborhood]"), not just your business name. The description should be one honest sentence a human would want to click. If the title is just your name, or the description is missing or generic, fix it. These are usually editable in your platform settings.
4. Run a free structured-data test (4 minutes). Paste your homepage URL into Google's Rich Results Test (search for "Google Rich Results Test"). It will tell you what structured data Google can read and whether anything is broken. A single broken block can be silently ignored, so this is worth doing even if you think you have markup. Action: note any errors and hand them to whoever maintains your site.
5. Check your email protection, DMARC (3 minutes). This is the one that stops scammers from sending fake emails that look like they come from your restaurant, the gift-card and fake-invoice scams that hit hospitality constantly. Use any free DMARC checker (search "DMARC checker") and enter your domain. If it says no DMARC record found, your domain is unprotected. Action: ask your email or DNS provider to set up SPF, DKIM, and a DMARC record. This is usually free. The DNS / Email Auth Audit on this site pulls these records live and gives you the exact fix snippets.
6. Look for a privacy page and an accessibility statement (2 minutes). Check your site footer. Is there a privacy notice that actually describes what you collect through reservations, wifi sign-in, online ordering, and loyalty signups? Is there a short accessibility statement with a phone number so someone who hits a barrier can still order? Most single-location restaurants are not legally required to post a full privacy policy under state law, but a plain, honest notice is cheap goodwill and protects you if your data practices grow. An accessibility statement is smart given how often restaurant sites draw accessibility complaints.
7. Scan your security headers and accessibility (3 minutes). Run your homepage through a free accessibility checker like WAVE or your browser's built-in Lighthouse audit. Then try to navigate your site using only the Tab and Enter keys, no mouse. If you cannot reach the menu or complete an order with the keyboard, neither can a customer who relies on one. The Mega Analyzer on this site checks security headers, structured data, and more in one pass, and the Restaurant Website Audit tool is built specifically for the checks in this list.
That is the whole audit. Seven checks, twenty minutes, no code.
A few facts worth knowing before you call anyone
These come up constantly, so here is the straight version.
You cannot buy a better local ranking on Google. Google ranks local results on relevance, distance, and prominence. Relevance is how complete and accurate your profile and site are. Prominence includes your review count and score. There is no pay-to-win. The wins are free and within your control: a fully filled out Google Business Profile, consistent facts, and honest reviews.
Reviews have new legal guardrails. Since October 21, 2024, the FTC's rule on consumer reviews bans fake or AI-generated reviews, bans offering a discount or free item in exchange for a positive review, requires staff and insiders to disclose the connection if they post a review, and bans threatening customers over negative ones. You can and should ask every happy guest for an honest review. You just cannot pay for sentiment or scrub the bad ones. Reply to negatives calmly and in public instead.
Accessibility is a real, quiet legal exposure. The Department of Justice treats public-facing business websites as covered by the Americans with Disabilities Act and points to the WCAG guidelines as the practical benchmark. There is no fixed federal deadline for private businesses, and the headlines you may have seen about an "April 2026 deadline" apply to state and local governments, not to your restaurant. But food service is a frequently targeted industry for accessibility demand letters, and an image-only menu is a common trigger. Treat WCAG 2.1 AA as today's target, not a future one.
The fancy Google "restaurant menu" widget is not something you can switch on. Google does not offer a standalone menu rich result for ordinary site owners. The carousel you sometimes see is limited to a small set of approved providers, and the menu inside the Google panel flows through Google's partners, not your page's code. So you add Restaurant structured data not to unlock a special widget, but because it powers your basic knowledge panel and gives AI engines clean, confident facts. That is reason enough.
What to hand to your platform or web person
If the audit turns up problems, you do not have to fix them yourself. You have to know enough to ask. Here is the short list to send:
- Publish the menu as real on-page text, not only an image or PDF.
- Add a proper Restaurant JSON-LD block with name, address, phone, cuisine, price range, hours, reservations, and a menu URL.
- Fix any errors the Rich Results Test flags.
- Set the homepage title and meta description to say what we are and where.
- Set up SPF, DKIM, and DMARC for our domain.
- Add a plain privacy notice and a short accessibility statement.
- Get the site to WCAG 2.1 AA: real text menu, alt text on images, good contrast, keyboard navigation, labeled form fields.
A good platform or web person will recognize every item on that list. If yours pushes back or says it is not possible on your plan, that is useful information about whether your subscription is serving you.
The point
Paying a monthly fee is reasonable. Assuming the fee covers everything is the mistake. The platform gives you a floor. The standards that decide whether customers and AI tools find you keep climbing past that floor, and they will keep climbing. Twenty minutes a quarter with the checklist above keeps you honest about the gap, and it turns a vague worry ("is my website actually any good?") into a specific to-do list you can hand to someone.
If this kind of plain-language, do-it-yourself approach is how you like to learn, my book The $97 Launch walks through building and checking a small-business web presence on a tiny budget, in the same hand-it-to-a-real-person voice as this post.
Fact-check notes and sources
Every specific claim above is verifiable against a primary source. Where a reader could reasonably ask "where did you get that," here it is:
- Google ranks local results on relevance, distance, and prominence, and you cannot pay for better ranking, Google Business Profile Help: Tips to improve your local ranking.
- Restaurant structured data: required name and address, recommended cuisine, price range, hours, reservations, menu URL, Google Search Central: Local Business structured data and the schema.org Restaurant type.
- JSON-LD is Google's recommended structured-data format, Google Search Central: Intro to structured data.
- Google does not offer a standalone restaurant-menu rich result; the carousel is limited to approved providers, Google Search Central: structured data feature gallery.
- FTC rule on consumer reviews, effective October 21, 2024, bans fake reviews, incentivized sentiment, undisclosed insider reviews, and review suppression, FTC: Final Rule Banning Fake Reviews and Testimonials and the FTC Reviews and Testimonials Rule Q&A.
- DOJ treats public business websites as covered by the ADA and points to WCAG as the benchmark; no fixed standard for private businesses, ADA.gov: Guidance on Web Accessibility and the ADA.
- The April 2026 web-accessibility deadline applies to state and local governments (Title II), not private businesses, DOJ Fact Sheet on the 2024 Title II web rule.
- WCAG as the practical standard, W3C: Web Content Accessibility Guidelines overview.
- DMARC, SPF, and DKIM as baseline email defenses against domain spoofing, CISA: Enhance Email and Web Security insights.
A couple of honest caveats. Whether your specific data practices put you under a state privacy law is fact-specific and worth a lawyer's read if your marketing vendor runs heavy ad retargeting. And reported AI star-rating thresholds (claims like "ChatGPT recommends 4.3 and up") circulate in vendor blogs but are not confirmed by any primary source, so I have left them out.
This post is informational, not legal or SEO-consulting advice. Web accessibility, consumer-review, privacy, and email rules are regulated at the federal level and in many US states. Consult counsel for your specific situation. Mentions of Google, the FTC, the DOJ, schema.org, W3C, CISA, and any website platform are nominative fair use. No affiliation or sponsorship is implied.
