What a Company Website Must Do: A Requirements Checklist for Owners
A company website must do five jobs. It must say clearly what you do, for whom and where, in Arabic and English. It must prove it, with real work and real contact details. It must make contacting you or buying from you easy, especially from a phone. It must load fast and be usable by everyone. And it must be owned by you, secured, and compliant with Oman’s data protection law. Design matters, but only after those five work.
The checklist in this article is the one Abdulqader Wahiba, founder and CEO of ZAWAT, recommends owners hold any website proposal against, whoever is quoting for it.
The short answer
- Clarity: the first screen says what you do, for whom, and where, in both languages.
- Proof: real projects, real people and a real address. No stock testimonials.
- Contact: WhatsApp, phone, a short form and, if relevant, booking, all reachable with a thumb.
- Speed and access: pages that meet Google’s Core Web Vitals and work for people with disabilities.
- Ownership and compliance: the domain and accounts in your company’s name, backups, security updates, and a clear notice wherever you collect personal data.
“A company website has one job before any other: making it easy for the right customer to contact you. Everything else is decoration until that works.” — Abdulqader Wahiba
1. Clarity: say what you do in the first screen
A visitor decides in seconds whether they are in the right place. The first screen should answer three questions without scrolling: what you do, who it is for, and where you operate. “Industrial cleaning for factories and warehouses in Sohar and Muscat” beats “Excellence in every service”.
Then make the Arabic and English versions genuinely equal. A site where Arabic is a thin translation of the English, or where half the pages exist in one language only, tells Arabic-speaking customers where they rank. Right-to-left layout, Arabic typography and content parity are built in from the start, as building bilingual Arabic-English software explains.
2. Proof: show real work and real people
Visitors look for evidence that you are real and competent. The strongest proof is specific:
- Projects or case studies with names, where clients have agreed, and what you actually did.
- Who is behind the company. A named founder or team, with real photographs, builds more trust than an anonymous brand.
- Contact details that work: a phone number someone answers, a physical address, opening hours.
Avoid invented testimonials and stock photos of strangers presented as staff. Visitors notice, and so do search engines and AI assistants trying to decide whether your business is real.
3. Contact: make the next step easy from a phone
Most visitors will arrive on a phone, so every way of contacting you should work with one thumb:
- WhatsApp click-to-chat, since that is how many customers in Oman prefer to start a conversation. If enquiries arrive in volume, the WhatsApp Business API lets a team share one number properly.
- A tap-to-call phone number.
- A short form asking only what you need to reply. Every extra field loses people.
- Booking, if you sell time, such as consultations, appointments or site visits. Booking and appointment systems covers the options.
Then decide who receives each enquiry and how fast they reply. A form that emails an inbox nobody checks is worse than no form.
4. Speed: meet the Core Web Vitals
Google measures real users’ experience with three Core Web Vitals. Its web.dev guidance sets the targets for a good experience:
| Metric | What it measures | Good |
|---|---|---|
| Largest Contentful Paint (LCP) | How fast the main content appears | Within 2.5 seconds |
| Interaction to Next Paint (INP) | How fast the page responds to taps and clicks | 200 milliseconds or less |
| Cumulative Layout Shift (CLS) | How much the page jumps while loading | 0.1 or less |
Google recommends judging these at the 75th percentile of page loads, separately for mobile and desktop. INP replaced the older First Input Delay metric on 12 March 2024, so a proposal that still promises “a good FID score” is out of date.
In practice, speed comes from properly sized images, sensible hosting, limited third-party scripts and restraint with heavy effects. Motion and 3D can make a brand memorable, but only if the page still loads quickly and works without them.
5. Accessibility: build for everyone
The international standard is the Web Content Accessibility Guidelines (WCAG) 2.2, a W3C Recommendation since 5 October 2023. The basics are not expensive when built in from the start:
- Text that contrasts clearly with its background.
- Every function usable with a keyboard, with a visible focus indicator.
- Descriptive alternative text on meaningful images.
- Form fields with labels, and error messages that say what went wrong.
- Pages that still work when the user enlarges the text.
Accessible sites are also easier for search engines and AI tools to read, because the same structure that helps a screen reader helps a crawler.
6. Personal data: say what happens to it
Every contact form, booking or newsletter sign-up collects personal data, so Oman’s Personal Data Protection Law applies. As amended by Royal Decree 68/2026, its Article 10 requires a request for consent to be clear and to include the controller’s details, how to contact the personal data protection officer, and the objectives and nature of the processing. Breaching Article 10 carries a fine of OMR 500 to 2,000.
In practice:
- Put a short, plain notice next to each form, linking to a full privacy notice.
- Keep marketing separate. Article 22 requires explicit consent before you send advertising or marketing material, so a contact form is not a newsletter sign-up.
- Decide where submissions go and how long you keep them. An inbox full of old enquiries is a data store too.
Oman’s PDPL amendments in Royal Decree 68/2026 sets out the wider changes.
7. Ownership and security: make sure it is yours
- The domain is registered to your company, with the login held by you, not by the agency or a former employee.
- You have administrator access to the hosting, the content management system and any analytics.
- Updates and backups have an owner. Content management systems and their plugins need regular security updates, and backups are only real once a restore has been tested.
- HTTPS everywhere, with the certificate renewed automatically.
- Your staff can edit content in both languages without calling a developer for every change.
The checklist to hold a proposal against
| Requirement | How to check it before you pay |
|---|---|
| First screen says what, for whom, where | Show it to someone outside the company for five seconds |
| Arabic and English at parity | Compare the page lists of both languages |
| Real proof | Every case study and photo can be traced to a real project or person |
| WhatsApp, call, form, booking | Test each one on a phone |
| Enquiries reach a person | Submit a test form and time the reply |
| Core Web Vitals pass | Run the pages through Google’s PageSpeed Insights |
| WCAG 2.2 basics | Use the whole site with a keyboard only |
| Privacy notice beside forms | Read it: does it name you and say what you do with the data? |
| Domain and accounts in your name | Ask for the registrar record and admin logins |
| Updates and backups | Ask who does them, how often, and when a restore was last tested |
Frequently asked questions
How long does a company website take to build? A focused company website can take a few weeks; a site with booking, a customer area or e-commerce takes longer. Most delays come from content: texts, photos and approvals in two languages. Start writing early.
Should the Arabic or the English version come first? Neither. Plan both together, with the same pages and the same depth. Writing one and translating it at the end produces a weaker version in one of your two markets.
Do we need a privacy policy for a simple company website? If the site collects any personal data, through a form, booking, newsletter or analytics that identifies people, you need to tell people what you do with it. A clear notice beside each form, linked to a full privacy notice, is the practical minimum.
Who should own the domain name? Your company, in its own account, with the login held by someone senior. Domains registered to a supplier or a former employee are a common and avoidable problem.
What makes a website easier for AI assistants to cite? The same things that help people: clear statements of what you do and where, real names and addresses, specific pages for each service, and consistent information across your site and profiles.
Sources: web.dev — Web Vitals · Google Search Central — Introducing INP to Core Web Vitals · W3C — Web Content Accessibility Guidelines (WCAG) 2.2 · Personal Data Protection Law, Royal Decree 6/2022, as amended by Royal Decree 68/2026, Articles 10, 22 and 25
This article states the position under the laws in force on 9 November 2026, the date of publication, and is not legal advice.
Planning a new website, or wondering whether yours passes? ZAWAT builds fast, bilingual company websites and web platforms that you own outright. Book a call.