Logistics Website Checklist for UK Haulage and Courier Firms

A good logistics website does four jobs: it lets customers track consignments, request a quote quickly, trust the emails and texts you send, and find the right depot. For a haulage or courier firm, that means a secure tracking page, a short quote form, authenticated notification email, accurate depot listings and a site that stays online when customers need it. This checklist uses UK rules and services; outside the UK, the website advice is the same, but check your own country's data protection and marketing rules.

Most haulage company websites are built as a brochure: a fleet photo, a list of services and a phone number. That's fine until customers start using it as a tool, checking where a pallet is at 7am or requesting a quote for a regular run. This checklist covers the parts that matter for transport, courier and logistics businesses, in the order customers hit them.

The logistics website checklist

Tracking pages

Keep them simple and fast

A tracking page needs a reference field, a clear status, an estimated time, and a way to contact you or rearrange delivery. Most visits will be on mobile, often outdoors. Keep the page light, put the status at the top in plain words ("Out for delivery, expected 10:00-12:00") and avoid loading a full marketing site around it.

Protect what the page shows

Tracking references are often shared widely: in emails, on labels, on the side of a box. Treat anything someone can see with just a reference number as public.

• Show the minimum. Status, town or postcode district and time window are usually enough. Full names, phone numbers and complete addresses shouldn't appear from a reference alone.
• Use references that can't be guessed. Sequential numbers let anyone step through other customers' consignments. Use longer random references, or ask for a postcode as a second factor before showing detail.
• Keep tracking results out of search. Add noindex to result pages and keep them out of your sitemap. Our guide to noindex vs robots.txt disallow explains the right approach.

Under UK GDPR, a delivery address linked to a named person is personal data. If a tracking page shows more than it needs to, that's a data protection problem as well as a security one.

Check it after every system update

Tracking pages often break when the transport management system (TMS) or tracking platform updates. Use the HTTP status checker to confirm tracking and booking URLs return 200 rather than an error or an unexpected redirect.

Quote and booking forms

Every extra field on a quote form costs you enquiries, but too few fields means a phone call to price the job. Ask for what you need to quote and nothing else:

• Collection and delivery postcodes
• Goods type, quantity and dimensions or pallet count
• Weight, and whether the load is hazardous or needs a tail lift
• Collection date or regularity
• Contact name, email and phone

Add a free-text box for anything else. Send an immediate acknowledgement with a reference and a realistic response time, and route the enquiry to the right depot or team.

Two data protection points. First, contact details from a business enquiry are still personal data under UK GDPR, so explain in your privacy notice how you use them. Second, if you want to send marketing emails afterwards, the ICO's guidance on business-to-business marketing explains that PECR treats companies and sole traders differently. Many hauliers' customers are sole traders, who count as individuals and need consent or the soft opt-in.

Protect the form against spam with a honeypot field or a privacy-friendly challenge, so your team isn't sorting junk every morning.

Notification email that reaches the inbox

Tracking updates, proof of delivery, booking confirmations and invoices often come from several systems: the TMS, a tracking platform, accounting software and your office email. Each one needs to be authorised for your domain.

Google's email sender guidelines require every sender to Gmail to set up SPF or DKIM and use TLS. Senders of more than 5,000 messages a day must use SPF, DKIM and DMARC, and align the From domain with one of them. A courier sending tracking updates to consumers can pass that threshold quickly.

Work through it in this order:

1. List every system that sends as your domain. Ask the TMS and tracking platform suppliers what they send and from which servers.
2. Check SPF with the SPF checker. Each sending service needs to be included, and the record must stay within ten DNS lookups.
3. Turn on DKIM for each service, so mail is signed with your domain. Confirm it with the DKIM checker.
4. Publish DMARC and read the reports. Use the DMARC checker to confirm the policy, then move from p=none towards p=reject once all your systems pass.
5. Consider a subdomain such as updates.yourfirm.com for automated mail, so a problem with one system doesn't affect office email. It still needs its own SPF, DKIM and DMARC.

When a customer says they didn't receive an update, ask them to forward a message that did arrive, or one from spam, and paste the headers into the email header analyser. It shows which check failed. Our guide to why emails go to spam covers the other common causes.

Text messages and scam protection

Fake "missed delivery" texts and emails are a long-running scam. The NCSC's guidance on missed parcel SMS messages warns that some link to fake tracking apps that are really malware. You can't stop criminals using your brand name, but you can make your genuine messages easy to recognise.

The NCSC's best practice for business SMS and telephone communications recommends:

• Avoid links in texts where you can. If you need one, use a simple, memorable address on your own domain, and never a URL shortener.
• Use a brand-specific sender ID, not something generic like "Alert", and keep the number of sender IDs to a minimum.
• Register your sender ID with the MEF SMS SenderID Protection Registry and ask your SMS suppliers to take part.
• Never ask for personal details in a message, and tell customers clearly what you will never ask for.
• Give customers a way to check a message independently and to report scams.

Put this into a short "How to spot a fake delivery message" page on your website. Explain what your texts and emails look like, which domain your links use, that you never ask for payment by text, and how to report suspicious messages: forward texts to 7726 and emails to report@phishing.gov.uk, as GOV.UK advises. An enforced DMARC policy stops criminals sending email from your exact domain. It doesn't stop lookalike domains, which is why the page matters. Our guide to stopping email spoofing covers the technical side.

Local SEO for depots

Customers search for "pallet delivery Leicester" or "haulage company near me", and Google shows local results. Each depot that customers deal with in person can help you appear.

Google's Business Profile guidelines allow one profile per location. A business needs a location customers can visit, or it must travel to customers. Some practical rules for transport firms:

• Staffed depots with a trade counter or reception can usually have their own profile, with that depot's phone number and hours.
• Yards and cross-dock sites with no customer contact generally don't qualify on their own.
• If you serve customers at their premises and don't receive visitors, set up a service-area business and hide the address. Google says a service area shouldn't usually extend beyond about two hours' driving time from your base.
• Use the right hours. For storage facilities, Google says to use office hours, or front gate hours otherwise.

On the website, give each depot its own page with the address, phone number, opening hours, a map, the services run from that site, and directions for drivers, such as gate entrance and booking-in rules. Add LocalBusiness structured data to each depot page. Our guides to UK local SEO and local business schema explain both.

Uptime, certificates and security

Booking portals and tracking pages are used around the clock. When one is down, the phones ring.

• Monitor uptime with a dedicated service that checks every few minutes and alerts you. For a quick "is it just us?" check when a customer reports a problem, use the website down checker.
• Renew certificates automatically. An expired certificate on a portal or driver app subdomain blocks logins. Check every hostname with the SSL checker, and confirm auto-renewal is working, as public certificate lifetimes are getting shorter.
• Turn on MFA for the website admin, hosting, domain registrar and TMS accounts.
• Keep the CMS and plugins patched. Our website monitoring guide explains what to watch and how often.

Useful extras

• QR codes on delivery cards, vans or invoices that link to your tracking page or booking form. The QR code generator makes static codes that don't expire.
• Proof of delivery paperwork. Drivers' phone photos can be turned into one PDF with the image to PDF tool, which runs in the browser, so delivery details aren't uploaded anywhere.

Our free tools for logistics and transport page brings these checks together. Many of the jobs above, such as routing quote requests to the right depot or chasing missing PODs, are also good candidates for automation, with your team still deciding prices and priorities. If you'd like to map that out, talk to Make It Flow.

FAQ

What should a logistics website include?

At minimum: clear services and coverage, a mobile-friendly tracking page, a short quote form, depot pages with addresses and hours, a page explaining how to spot fake delivery messages, contact details, and a privacy notice. Behind the scenes, notification email must be authenticated and the site should be monitored for uptime.

Should tracking pages be indexed by Google?

No. Tracking result pages are specific to one consignment and may show customer information. Add a noindex tag, keep them out of your sitemap and make sure references can't be guessed. Index your main tracking entry page, where customers enter a reference, so people searching for it can find it.

Why are customers not receiving our tracking emails?

The usual cause is a TMS or tracking platform that isn't authorised in your SPF record or isn't signing with DKIM for your domain, so the email fails DMARC. Check each sender, add the supplier's DNS records, and test with a real message's headers to confirm.

Can each depot have its own Google Business Profile?

Yes, if it's a real location that customers can contact or visit during stated hours, with its own staff. Google allows one profile per location. Sites with no customer contact, such as yards, usually don't qualify. Service-area businesses that visit customers should hide their address.

How can a courier protect customers from fake delivery texts?

Use a consistent brand sender ID, avoid links in texts where possible, never use URL shorteners, never ask for personal or payment details by text, and publish a page explaining what genuine messages look like. Enforce DMARC on your domain, and tell people to report scam texts to 7726.

Do haulage companies need DMARC?

Yes. Hauliers and freight firms are targeted by invoice and payment diversion fraud, where criminals send emails that appear to come from a trusted supplier. A DMARC policy at quarantine or reject stops email that falsely uses your exact domain, protecting both your customers and your reputation.

Related reading

• Restaurant Website Checklist: 12 Things Every UK Restaurant Site Needs: A practical restaurant website checklist for UK venues: HTML menus, allergen info, prices, booking, Google Business Profile, Restaurant schema and QR menus.