The Hidden Complexity Behind a "Simple" Website

When a founder asks for "just a simple website," what they usually mean is a small brochure site with a few pages and a contact form. What they get, whether they know it or not, is a piece of software that has to survive Google's performance rules, India's patchy mobile networks, a data protection law with teeth, and an accessibility law that is now actively fining non-compliant organisations. None of that is optional anymore, and none of it is visible in a typical freelancer quote.

This post walks through where the hidden complexity actually sits.

1. "Simple" pages have gotten heavier every year

A web page is not the HTML you glance at — it's a bundle of scripts, stylesheets, fonts, images and third-party calls that all have to be downloaded and executed before anything useful appears. In 2025, the median desktop home page tracked by HTTP Archive weighed 2.9 MB, up 7.3% from the year before, and the median mobile home page weighed 2.6 MB, up 8.4% HTTP Archive, 2025. Over the ten years to 2025, median mobile page weight grew 202.8% and desktop grew 110.2% HTTP Archive, 2025.

Worth noting: the exact growth figure depends on which window you measure. HTTP Archive's 2022 edition put ten-year mobile growth at 594% HTTP Archive, 2022, while the 2025 edition says 202.8% over 2015–2025 HTTP Archive, 2025. Same trend, different start date, very different headline number. Even HTTP Archive itself warns that changes in testing methodology mean some year-over-year comparisons are "not possible" HTTP Archive, 2024. The point for a business owner isn't the exact percentage — it's that a "simple" site built without discipline will, by default, drift toward the heavier end of this curve.

2. Google's performance bar is specific, and it moves

Google doesn't leave page speed to opinion. Core Web Vitals set hard, numeric thresholds:

These thresholds are not fixed forever. INP itself only became a Core Web Vital in March 2024, replacing the older "First Input Delay" metric web.dev. Google's own documentation notes that even "stable" vitals get bug fixes and definition changes on a predictable annual cadence web.dev. Practically, this means a site that passed Google's performance bar last year can fail it this year without a single line of code being touched — the goalposts moved, not the site.

3. What's actually happening under the hood

Even loading a single, plain page involves more machinery than most site owners realise. Behind the scenes there are HTTP headers, status codes, caching directives, content-length values and ETags being exchanged before a single visible byte renders — and MDN's own documentation admits its simplified explanation of this process undersells how complex the real exchange is MDN Web Docs.

Modern frontend development adds a further layer. Most JavaScript-driven sites now require a build toolchain — bundlers like Vite or Webpack — just to convert source code into something a browser can actually run binaryigor.com. "Simple" in the finished product hides a compile step, a dependency tree, and a build pipeline behind it.

4. India's network reality changes what "fast enough" means

A site built to Western assumptions about connection speed can quietly fail Indian users. As of March 2025, India had 1.2 billion telecom subscribers, but overall teledensity had actually dipped to 85.04%, with rural teledensity at just 59.06% against 131.45% in urban areas LightReading, citing TRAI. Internet subscriber growth has also slowed, up only 1.54% year-on-year to 969.1 million, even as average mobile data usage climbed to 21.53 GB per subscriber per month LightReading, citing TRAI.

Regulators have had to adjust for this reality. TRAI raised the official minimum definition of "broadband" from 512 kbit/s (set back in 2013) to 2 Mbit/s in 2023 Wikipedia, Internet in India. That's a low bar by global standards — and a 2.9 MB home page, the current median tracked by HTTP Archive, is not a trivial load over a real rural or budget connection sitting near that floor.

5. Two legal layers most "simple" site quotes leave out

Data protection. India's Digital Personal Data Protection Act received presidential assent on 11 August 2023 Wikipedia, and the implementing DPDP Rules were notified on 13 November 2025 PrivacyWorld. It has extraterritorial reach — it applies even to processing done outside India if the goods or services are offered to people within India EY India. Compliance today is patchy at best: a PwC India review of 100 Indian enterprise websites found only 41% specified data principal rights in their privacy policies, and just 9% obtained consent that was "free, specific and informed" PwC India. A contact form or newsletter signup on a "simple" site is, legally, a data collection point subject to this law.

Accessibility. The Rights of Persons with Disabilities Act, 2016, Sections 40–46, requires barrier-free digital access ContinualEngine. India's Bureau of Indian Standards published IS 17802 in December 2021, and a 2023 amendment folded it into the RPWD Rules, aligning it with WCAG and making it legally enforceable Pivotal Accessibility. This isn't theoretical: in February 2025, 155 private and government organisations were penalised for non-compliance Pivotal Accessibility, and the Supreme Court's 2024 ruling in Rajive Raturi v. Union of India upheld accessibility as an enforceable legal right BarrierBreak.

Sources don't fully agree on how strict this is for private companies. Deque describes WCAG 2.1 AA as "strongly encouraged" rather than compulsory for private enterprises, with only government sites mandated Deque, while BOIA notes WCAG conformance itself is technically voluntary — even though IS 17802, which tracks WCAG closely, is legally enforceable and already carries penalties BOIA. In practice, "voluntary" and "carries penalties" are hard to reconcile, and a business shouldn't bet on the ambiguity.

A basic checklist before you sign off on "simple"

Questions people also ask

Does a small business website really need to worry about India's data protection law?

Yes, if it collects any personal data — a contact form, a newsletter signup, an account login. The DPDP Act applies broadly and even reaches processing done outside India when the service targets Indian users EY India. A PwC review found most Indian enterprise sites still don't get this right PwC India.

Is website accessibility actually mandatory in India, or just recommended?

It's enforced, at least in practice. IS 17802, which closely tracks WCAG, was folded into the RPWD Rules and is legally enforceable, with 155 organisations penalised in February 2025 alone Pivotal Accessibility. Some sources still describe general WCAG conformance as voluntary BOIA, but the enforceable domestic standard means treating it as optional is a risk.

Why does a website that felt fast last year suddenly score worse on Google's tests?

Because the bar itself moves. INP only became a required Core Web Vital in March 2024, replacing the older First Input Delay metric web.dev, and Google updates vitals definitions on a regular annual cadence web.dev. A site's code can stay the same while the passing criteria change underneath it.