Which trust signal has the highest ROI to fix first?

Email Authentication (SPF/DKIM/DMARC) if you send sales or transactional emails — because a misconfigured domain gets your emails marked as spam, killing your funnel before visitors even reach your site. For pure conversion rate, fixing Core Web Vitals (especially LCP) typically delivers the fastest measurable lift.

Do these signals apply to B2B sites as well?

Yes, arguably more so. B2B buyers do more pre-purchase diligence than consumers. Security headers, DMARC, schema accuracy, and third-party reviews on G2 or Capterra are particularly important in enterprise and mid-market B2B sales where trust determines whether you even get a meeting.

Is a 90% trust score enough, or should I aim for 100?

90+ puts you in the Elite tier — top 5% of scanned sites. Chasing 100 involves diminishing returns on signals like minor schema warnings or thin content flags on pages that are intentionally short. Focus on eliminating P1 and P2 issues; the remaining gap is usually cosmetic.

The 9 Trust Signals Buyers Check Before Purchasing (Whether They Know It or Not)

When someone lands on your website for the first time, their brain runs a rapid trust assessment before they consciously even think about your product. Research on web credibility consistently shows that judgment happens in milliseconds — and it happens on signals most business owners never think to check.

The result: sites with genuinely great products fail to convert because they're failing an invisible checklist buyers run on autopilot.

Here are the 9 signals that actually move the needle.

1. SSL + HTTPS Redirect

The padlock is the minimum viable trust signal. But SSL alone is not enough — you also need a clean redirect from http:// to https://. Sites that serve both HTTP and HTTPS create mixed-content warnings that browsers now flag prominently. Start with the basics working correctly.

2. Email Authentication (SPF, DKIM, DMARC)

This one surprises most site owners. Your email domain's authentication records — SPF, DKIM, and DMARC — are publicly checkable, and a failing DMARC policy (or none at all) tells a sophisticated buyer that your domain can be spoofed by phishers sending emails that look like they come from you. B2B buyers increasingly check this before engaging with a vendor. A p=reject DMARC policy takes 30 minutes to configure and is free.

3. Page Speed (Core Web Vitals)

Google measures LCP (Largest Contentful Paint), CLS (Cumulative Layout Shift), and INP (Interaction to Next Paint). Sites that fail all three aren't just slower — they feel untrustworthy. The cognitive shortcut is: "If they can't build a website that works properly, can I trust them with my money?" Speed is a proxy for professionalism.

4. Real Legal Pages

Privacy policy and Terms of Service are trust signals, not just legal obligations. A thin, one-page placeholder or a policy that still says "Company Name" in the template fields reads immediately as a site built to flip or to avoid responsibility. Your privacy policy should mention what data you collect, why, and who to contact for erasure requests. For EU visitors, this is GDPR — ignore it and you're leaving trust (and revenue) on the table.

5. Cookie Consent Done Right

A cookie popover that asks for consent before loading tracking scripts is GDPR-compliant. One that fires tracking pixels first and shows the banner as decoration is not. Buyers in France, Germany, and the Netherlands — among the most skeptical online shoppers in the world — have been trained to notice the difference. An IAB TCF-compliant consent management platform (Cookiebot, Iubenda, OneTrust) takes an afternoon to set up.

6. Schema.org Structured Data

This is invisible to most visitors but highly visible to AI assistants, search engines, and tech-savvy buyers who check source code. Missing or malformed schema (e.g. a Product schema without a price, an Organization schema without a URL) tells both algorithms and people that the site was not built with care. Complete, accurate structured data also improves how your products appear in Google Shopping and in AI-generated answers.

7. Independent Reviews (Not Just Testimonials)

Testimonials on your own site are categorically different from reviews on Trustpilot, G2, or Capterra. The former are curated; the latter are moderated by a third party and searchable by anyone. A bimodal review distribution — lots of 5-star and many 1-star — is itself a trust signal to investigate. A site with zero third-party reviews and 47 homepage testimonials is suspicious to an informed buyer.

8. Content Readability and Quality

Text that is dense, jargon-heavy, or written for SEO rather than for humans correlates with lower trust. The Flesch Reading Ease score — used by RoastReady and originally developed for assessing reading difficulty — quantifies this. A score below 40 often indicates either a very technical audience (fine for B2B SaaS) or content that was generated without editing (a trust negative for consumer products).

9. No Dark Patterns

Live visitor counters showing "14 people viewing this" on a page with 3 daily sessions, countdown timers that reset on reload, and 90%-off pricing from an inexplicably high "original price" — these are detectable dark patterns that destroy trust the moment a buyer notices them. Sophisticated shoppers notice. And one dark pattern noticed means the entire site is suspect.

How Most Sites Actually Score

In RoastReady's database of hundreds of scans, the average site fails on 4 of these 9 signals — usually Email Authentication, Cookie Consent, Schema accuracy, and either Speed or Reviews.

The good news: 6 of the 9 are entirely free to fix. The two that cost money (a proper CMP and Trustpilot verification) are both under £50/month.

Run a free trust audit at RoastReady to see exactly which signals you're failing, ranked by priority and with a step-by-step fix for each.