Nepali business websites in 2026 are mostly mobile-ready but often broken, slow to respond and missing SEO basics. Of 184 business web addresses listed in public directories and maps, 62 (34%) did not lead to a working site. Of the 113 that worked, 15% still opened on plain HTTP and only 24% passed five basic on-page SEO checks.
I am Ujjwal Rupakheti, a web developer and SEO specialist in Itahari. I could not find any published study of how fast, secure or search-friendly Nepali business websites are, so on 3 November 2026 I built a sample and measured it. This page gives the method, the results and a short list of fixes. I report everything in aggregate and do not name any business.
Website security is in the news. On 21 October 2026 two critical PHP flaws, known together as PHP2Shell, were made public, and Nepal took government websites offline as a precaution while they were patched. By 26 October the Kathmandu Post reported that most were back online. Private business sites run on the same kinds of software, so I wanted to see how exposed they look from the outside.
Key Findings on Nepali Business Websites in 2026
Six numbers stand out. Each one gives the sample size it is based on: 184 for every address tested, 113 for the sites that worked, and 37 for the mobile Lighthouse tests.
- One in three listed addresses is dead. 62 of 184 business web addresses (34%) did not lead to a working website, and 35 (19%) no longer resolve in DNS at all (n = 184).
- 15% of working sites still open on plain HTTP. 17 of 113 do not send visitors to HTTPS, yet 16 of those 17 already have a valid certificate (n = 113).
- 37% show their software versions to anyone. 42 of 113 sites reveal a PHP or web server version in their headers, and 11 (10%) show an end-of-life PHP version with no official PHP2Shell patch (n = 113).
- Many sites are slow to answer. The median homepage took 0.94 seconds to send its first byte to Itahari, and 51 of 113 (45%) took longer than one second (n = 113).
- Mobile speed is weak. The median mobile Lighthouse performance score was 61 out of 100, and 3 of 37 pages loaded their main content within the 2.5-second target (n = 37).
- SEO basics are patchy. Only 27 of 113 homepages (24%) had a title, a meta description, exactly one H1, a canonical tag and a mobile viewport tag together (n = 113).
How I Tested 184 Nepali Business Websites
I drew 23 website addresses for each of eight sectors from public sources, then ran the same passive checks on every homepage from Itahari on 3 November 2026. Passive means I only requested pages that any visitor can open. I did not log in, fill in forms, scan ports or probe for weaknesses.
Where the Sample Came From
The addresses come from association member lists and from OpenStreetMap, where businesses and mappers add a website to a place on the map:
- Association directories (69 addresses): the Trekking Agencies’ Association of Nepal, the Educational Consultancy Association of Nepal, the Hotel Association Nepal and Fair Trade Group Nepal.
- OpenStreetMap (115 addresses): restaurants, cafés, clinics, hospitals, private schools and colleges, shops, travel agencies and manufacturers that list a website.
Within each sector I picked sites at random with a fixed seed, and capped Kathmandu Valley at 14 of the 23 so other cities were represented. I left out government sites, banks and finance companies, insurers, internet providers, international chains and franchises, NGOs and charities, public schools and hospitals, software agencies, social media links, duplicates and obvious typos. The final sample covers more than 25 cities and towns: 106 addresses (58%) are in Kathmandu Valley, 25 in Pokhara, 10 in Bharatpur and the rest in towns from Birtamod to Dhangadhi.
| Sector | Addresses tested | Working | Not working | Could not test | Lighthouse runs |
|---|---|---|---|---|---|
| Hotels and lodges | 23 | 18 | 3 | 2 | 5 |
| Trekking and travel agencies | 23 | 18 | 5 | 0 | 4 |
| Schools and colleges | 23 | 11 | 11 | 1 | 5 |
| Clinics and hospitals | 23 | 12 | 11 | 0 | 5 |
| Restaurants and cafés | 23 | 12 | 11 | 0 | 4 |
| Shops and e-commerce | 23 | 6 | 14 | 3 | 5 |
| Education consultancies | 23 | 21 | 2 | 0 | 5 |
| Manufacturers and B2B | 23 | 15 | 5 | 3 | 4 |
| All sectors | 184 | 113 | 62 | 9 | 37 |
What I Checked on Each Homepage
- One request to the homepage starting at
http://and following redirects, onehttps://request only where the site did not redirect, and one request each for/robots.txtand/sitemap.xml. - At most four sites at a time, a 20-second timeout and a User-Agent that names this report, so any owner can see who visited and why.
- Recorded: HTTPS, redirects, certificate validity, security headers, any visible server or PHP version, time to first byte, HTML size, viewport, title, meta description, H1 count, canonical, JSON-LD, Open Graph, contact links and the platform.
- A mobile Lighthouse 12.8.2 test on 40 working sites, five per sector chosen at random, run one at a time in headless Microsoft Edge. 37 runs completed; in the others Lighthouse could not load the page.
Limitations: read these before quoting a numberThis is not a random sample of all Nepali businesses. It covers businesses that list a website in a directory or on a map, which leans towards Kathmandu Valley, tourism and established firms. Everything was measured on one day from one connection in Itahari, so response times reflect that route and that day. I checked homepages only, as the server sends them, before any JavaScript runs. A version number in a header does not prove a site is vulnerable, because some hosts patch old versions themselves. Sector groups are small, between 6 and 21 working sites, so treat sector differences as signals, not proof. Nine sites refused or challenged automated requests; they are counted as “could not test”, not as broken.
How Many Nepali Business Websites Still Work?
113 of 184 addresses (61%) loaded a real business website. 62 (34%) did not, and 9 (5%) blocked or refused my automated request, so I could not judge them. The biggest single problem is simple: the domain has gone. 35 addresses no longer resolve in DNS. For 23 of them the domain no longer exists, which usually means it expired; most of the rest have name servers that do not answer.
| What happened | Sites | Share of 184 |
|---|---|---|
| Domain no longer resolves | 35 | 19% |
| Server or hosting error (404, 500, 503, 522, 530) | 10 | 5% |
| Domain parked or for sale | 7 | 4% |
| Hosting suspended or hosting error page | 5 | 3% |
| Placeholder page or a redirect to Facebook | 3 | 2% |
| No connection at all | 2 | 1% |
Where the address came from matters. Of the 69 addresses from association member lists, 9 (13%) did not work. Of the 115 from OpenStreetMap, 53 (46%) did not, because map entries can stay online for years after a business lets its domain lapse. Customers still tap those links, though, on maps and in directories. Kathmandu Valley and the rest of Nepal were about the same: 34 of 106 valley addresses and 28 of 78 elsewhere were broken.
A lapsed domain can be bought by someone elseSeven of the dead addresses were already parked or listed for sale by domain resellers. Anyone who buys one inherits the links pointing at it from maps, directories and social media. Keep auto-renew on, and check the expiry date of your domain once a year.
How Secure are Nepali Business Websites?
Most working sites now use HTTPS, but the next layers of protection are thin. Only one in five sends an HSTS header, and more than a third tell every visitor which PHP or server version they run. The figures below are shares of the 113 working sites.
HTTPS, Certificates and Security Headers
96 of 113 working sites (85%) send visitors from http:// to https://. One of them serves a certificate for a different name, so browsers show a warning. The other 17 (15%) stay on plain HTTP by default, and 16 of those already have a valid certificate. For them, the fix is a single redirect rule.
- HSTS: 24 of 113 sites (21%) send a Strict-Transport-Security header, which tells browsers to use HTTPS every time.
- Other headers: 67 of 113 (59%) send none of HSTS, Content-Security-Policy, X-Content-Type-Options or X-Frame-Options.
- Mixed content: 5 of the 96 HTTPS homepages (5%) still load a script, style sheet or image over
http://.
Visible PHP Versions After PHP2Shell
42 of 113 working sites (37%) publish a PHP or web server version number in their response headers, usually in X-Powered-By. That tells an attacker which known flaws to try. 35 sites showed a PHP version, and the picture splits in two:
- Supported PHP was patched. All 24 sites showing PHP 8.2, 8.3, 8.4 or 8.5 were on the October releases that fix PHP2Shell (8.2.35, 8.3.36, 8.4.27 or 8.5.12), so the fix had already reached those servers.
- End-of-life PHP was not. 11 sites (10% of working sites, and 31% of those showing a PHP version) were on PHP 8.1 or older, including five on 7.4 and one on 5.6. The PHP project ended support for 8.1 on 31 December 2025, and the Kathmandu Post’s reporting on the flaw noted that no official fixes exist for 8.1 and older.
Some hosting companies patch old PHP versions themselves, so a version number alone does not prove a site can be broken into. But an owner who sees PHP 7.4 on their site should ask their host what protects it, and plan an upgrade.
WordPress Versions and Signs of Hacking
WordPress runs 55 of the 113 working sites (49%). 47 of those 55 announce their exact WordPress version in the page code. 34 were on the current 7.1 branch, but 6 were on branches first released in 2021 or earlier, from 4.9 to 5.8. Two of the 113 homepages also carried blocks of links to gambling websites, a common sign that a site has been compromised. I did not investigate further and have not named them.
Want These Checks Run on Your Website?Send me your website address on WhatsApp. I will run the same passive checks from this report on it and tell you what I find, free.
Check my siteHow Fast are Nepali Business Websites on Mobile?
Speed was measured two ways: the server’s response time to my connection in Itahari, and a full mobile page test with Lighthouse. Both point the same way. Many sites are slow before the page even starts to draw, and heavy pages make it worse on a phone.
Server Response Time from Itahari
The median homepage sent its first byte after 0.94 seconds, counting the connection set-up. web.dev treats 0.8 seconds or less as good and more than 1.8 seconds as poor. By that scale, 47 of 113 sites (42%) were good, 51 (45%) needed work and 15 (13%) were poor. Downloading the full homepage HTML, redirects included, took a median of 1.8 seconds.
The HTML itself is often heavy. The median homepage was 97 KB of HTML before any images, scripts or fonts, and 23 of 113 (20%) were over 200 KB. Large HTML often comes from page builders and inline code, and it delays the first paint on mobile data.
Lighthouse Mobile Tests
Lighthouse loads a page as a mid-range phone on a throttled mobile connection would, and scores it out of 100. These are lab tests, not real-user data, but many small Nepali sites have too few visitors for Google’s field data anyway. Across 37 working sites:
LCP · Median
7.1 s
Largest Contentful Paint. Good (2.5 s or less) on 3 of 37 pages.
CLS · Median
0.01
Cumulative Layout Shift. Good (0.1 or less) on 26 of 37 pages.
TTFB · Median
0.94 s
Time to first byte from Itahari. Good (0.8 s or less) on 47 of 113 sites.
- Performance score: median 61; 6 of 37 pages scored 90 or more, and 14 scored under 50.
- Main content: 28 of 37 pages (76%) took more than 4 seconds to show their largest element, the point Google calls poor.
- Page weight: the median page downloaded 3.6 MB, and 22 of 37 pages were over 3 MB.
- Main thread: median Total Blocking Time was 160 ms, time in which the page cannot respond to a tap.
The usual fixes are the ones in my technical SEO checklist for 2026: compress and size the main image, load it first, cut unused scripts and set image dimensions so the page does not jump.
Are Nepali Business Websites Mobile-Friendly?
On the basic test, yes. 106 of 113 working sites (94%) have a mobile viewport tag, so pages fit a phone screen. But 10 of 113 (9%) try to stop visitors zooming in, which makes small text hard to read for many people, and the median Lighthouse accessibility score was 85 out of 100 (n = 37).
The bigger gap is contact. Only 54 of 113 homepages (48%) have a tap-to-call or WhatsApp link: 49 have a phone link and 29 a WhatsApp link. Yet 80 of 113 (71%) link to Facebook. For a hotel, clinic or trekking company, one tap to call or message is often the whole point of the visit.
SEO Basics on Nepali Business Websites
Almost every site has a title, but the other basics drop away fast. Only 27 of 113 working homepages (24%) had a title, a meta description, exactly one H1, a canonical tag and a mobile viewport tag together. The median Lighthouse SEO score was 92 (n = 37), but that score does not look at H1 headings or business structured data, so a high number can hide the gaps below.
| Check | Sites | Share | What it means |
|---|---|---|---|
| Title tag present | 110 | 97% | 22 titles (19%) are over 60 characters and may be cut off in results |
| Meta description | 66 | 58% | Without one, Google writes its own snippet |
| Exactly one H1 | 46 | 41% | 38 have no H1 and 29 have more than one |
| Canonical tag | 78 | 69% | Tells search engines which URL is the real one |
| Any JSON-LD structured data | 47 | 42% | Mostly the WebSite and Organization types |
| Business-type structured data | 21 | 19% | LocalBusiness, Hotel, TravelAgency, Restaurant and similar |
| Open Graph tags | 64 | 57% | Only 47 (42%) set a share image for Facebook and WhatsApp |
| Valid robots.txt | 94 | 83% | Gives crawlers rules and a sitemap link |
| XML sitemap | 88 | 78% | At /sitemap.xml or listed in robots.txt |
| All five basics together | 27 | 24% | Title, description, one H1, canonical and viewport |
Measured in the HTML the server sends. Pages built in the browser with JavaScript may add tags later, but crawlers that do not run JavaScript, such as social media link previews and some AI crawlers, never see them.
Nepali Business Websites by Sector
The table shows the main results for each sector. “Working” counts sites out of the 23 tested, “Not working” is a share of those 23, and the other columns are shares of each sector’s working sites. Shops have only 6 working sites, too few to read much into.
| Sector | Working | Not working | HTTPS | Meta description | One H1 | Schema | Response |
|---|---|---|---|---|---|---|---|
| Hotels and lodges | 18 | 13% | 89% | 83% | 39% | 56% | 0.91 s |
| Trekking and travel | 18 | 22% | 78% | 61% | 67% | 50% | 0.79 s |
| Schools and colleges | 11 | 48% | 82% | 45% | 9% | 27% | 0.88 s |
| Clinics and hospitals | 12 | 48% | 100% | 67% | 50% | 33% | 1.35 s |
| Restaurants and cafés | 12 | 48% | 83% | 42% | 33% | 42% | 0.84 s |
| Shops and e-commerce | 6 | 61% | 83% | 67% | 50% | 17% | 1.01 s |
| Education consultancies | 21 | 9% | 81% | 52% | 38% | 38% | 0.99 s |
| Manufacturers and B2B | 15 | 22% | 87% | 47% | 33% | 47% | 1.00 s |
| All sectors | 113 of 184 | 34% | 85% | 58% | 41% | 42% | 0.94 s |
A few patterns stand out. Hotels lead on meta descriptions and structured data. Trekking companies are the most likely to get the single H1 right. Schools and colleges are weakest on headings: only 1 of 11 working school sites had exactly one H1. Every working clinic site used HTTPS, but clinics had the slowest median response. Close to half of the school, clinic and restaurant addresses, and 14 of 23 shop addresses, did not work; all four of those sectors were drawn from OpenStreetMap.
What Nepali Business Owners Should Fix First
None of these fixes needs a new website. Most are small jobs for whoever manages your hosting, and each one maps onto a problem above.
- Make sure your address works everywhere it is listed. Open the link on your Google Business Profile, Facebook page and directory listings. Turn on domain auto-renew. My website maintenance guide for Nepal lists the yearly renewals to track.
- Force HTTPS, then add HSTS. Add one 301 redirect from
http://tohttps://, fix any mixed content, then send a Strict-Transport-Security header. - Ask your host which PHP version you run. Move off PHP 8.1 or older, and hide version headers (
expose_php = Offin PHP,ServerTokens Prodin Apache). - Update WordPress, themes and plugins. Delete plugins you do not use, and check the homepage source for links you did not add.
- Fix the five on-page basics. A title under 60 characters, a meta description, one H1, a canonical tag and a viewport tag. An SEO audit finds every page that misses them.
- Add business structured data and a share image. Hotel or LocalBusiness markup with your address, phone and hours, plus an Open Graph image. See how I approach hotel website design in Nepal and trekking company websites.
- Make calling and WhatsApp one tap. Put a
tel:link and a WhatsApp link in the header and footer of every page. - Rebuild only if the site is beyond repair. If you do, keep your rankings with a redirect map. My guide to a website redesign without losing SEO covers it, and my web developer page covers new builds.
For a working example, the Hotel Aarohi website is a static site with Hotel structured data, a sitemap, robots rules and local landing pages built in from the start, so it loads fast on rural mobile connections. HeliGo Nepal, a helicopter charter marketplace, shows the same mobile-first approach on a larger tourism product. Every service I offer, with starting prices, is on my services page.
Case study: Hotel AarohiA static hotel website on GitHub Pages, built to load fast on rural mobile connections, with Hotel, FAQ and opening-hours structured data.
How to Cite This Nepal Website Report
Journalists, researchers and AI tools are welcome to quote these figures. Please give the sample size with any number you use, and link to this page.
Suggested citationRupakheti, U. (2026, November 3). State of Nepali Business Websites 2026: Speed, Security and SEO. Passive checks of 184 business websites in eight sectors, measured from Itahari, Nepal. https://www.ujjwalrupakheti.com.np/nepal-website-report-2026/
For aggregate tables by sector or city, email me at ujr.work@gmail.com. I do not share the list of sites tested or any single site’s results.
About the author
Ujjwal Rupakheti
I am a full-stack web developer and SEO specialist based in Itahari, Koshi Province, Nepal. I have worked in web development and SEO since 2022 and have published more than 200 SEO-optimised articles across five-plus domains. Since June 2026 I have been a full-stack web developer at Ektukra Digital Agency, after a year there on SEO content strategy and QA testing.