Website trends for 2027: what's already scheduled and what to watch

How to read this page

Most lists of web design trends 2027 are about looks. This page covers changes that reach your site even if you never redesign.

Scheduled changes have a date and an official source, such as a rule, a standards ballot or a company filing. Trends are announced or underway, with no single deadline. Where nobody has said what happens next, we say we don’t know yet.

Already on the calendar

Some apply only above a size threshold or to one service.

Further out: Vermont’s privacy law starts January 1, 2028, smaller governments face the Title II deadline on April 26, 2028, and the maximum certificate lifetime reaches 47 days on March 15, 2029.

AI builders and agents

The main website builder trends are AI agents inside the editor and AI apps that work on your site from outside.

What is confirmed

• Wix launched Wix Harmony on January 21, 2026. It mixes building from a prompt with drag-and-drop editing, around an AI agent called Aria.
• Shopify introduced Canvas on October 1, 2026, a design surface where merchants build their store with Sidekick, its AI agent. On October 6 it said its Agentic Storefronts put products in AI channels like ChatGPT and Google.
• WordPress 7.0 (May 20, 2026) added an AI Client in core and a separate AI plugin for images, titles, excerpts and alt text. No 2027 release dates are published yet.
• Webflow announced AI content agents and a limited research preview called Source in September 2026, and said site branching would enter beta later in 2026.
• Squarespace runs an official MCP server for domain name search, but we found no dated 2026 AI announcement on its own pages.

The connector side: MCP

MCP (Model Context Protocol) is the open standard that lets AI apps like Claude, ChatGPT and Gemini connect to outside services. Wix, Webflow, Framer, WordPress.com and Hostinger run official MCP servers that let an AI app work on your site or account, and Shopify offers official AI connectors for store owners. Webflow’s MCP 2.0 came to all site plans at no extra cost in July 2026, and Framer launched its server on October 22, 2026. For self-hosted WordPress, the MCP Adapter plugin joined the WordPress.org directory on October 7, 2026.

What it means for a small business site

Routine edits, like updating hours or adding a blog post, can now be done by chatting with an AI app. That saves time, but a connector with publish rights can also change your live site by mistake. A site built by an AI agent still lives on that platform, so ask how hard it is to leave. Our exit scores answer that for each builder.

What to do

• Connect only the company’s own server. Our MCP directory lists the official ones.
• Keep tool approval on, and use drafts, branches or a staging site when offered.
• Try new AI editors on a copy of your site first. See our AI builders hub for how they compare.

Search and AI answers

What is confirmed

Google said on May 19, 2026 that AI Overviews has over 2.5 billion monthly active users and AI Mode has passed 1 billion.

Google’s Search Central guide on generative AI search, last updated July 10, 2026, says optimizing for AI search is “still SEO.” You don’t need AI text files or special markup, and mass-producing pages for every query variation breaks its spam policy.

Google says Search ignores llms.txt. The llms.txt site itself calls it a proposal, not a standard.

A Search Console setting lets you remove your site from AI Overviews, AI Mode and Discover AI features (available to all sites from August 31, 2026), and new Generative AI reports show your impressions in those features. Google says the opt-out is not a ranking signal for the rest of Search.

What it means for a small business site

More questions get answered on the results page, so some searches that used to bring a click may not. We don’t know yet how this will change traffic for any one site. Google says a page must be indexed and eligible for a snippet to appear.

What to do

• Open the Generative AI report in Search Console and see which pages already show up.
• Skip paid “AI SEO” files and tricks. Spend the time on pages that answer real customer questions.
• Read our guides to AI search and SEO controls by builder.

Accessibility

What is confirmed

The Department of Justice’s ADA Title II rule requires state and local government websites and apps to meet WCAG 2.1 Level AA. An Interim Final Rule on April 20, 2026 pushed the deadlines back one year: April 26, 2027 for governments serving 50,000 or more people, and April 26, 2028 for smaller ones and special districts. DOJ says it will consider proposing changes; if it doesn’t, it “fully anticipates implementing the regulation at the new deadline.” We don’t know yet whether it will.

A similar HHS rule covers groups that receive HHS funding, including some health care providers. Its deadlines are May 11, 2027 (15 or more employees) and May 10, 2028 (fewer than 15).

Private businesses fall under ADA Title III, which has no federal web regulation and no deadline. DOJ’s 2022 guidance says the ADA applies to what businesses open to the public offer on the web, gives them flexibility in how they comply, and points to WCAG as helpful guidance. Lawsuits continue: a third-party count by the law firm Seyfarth Shaw found 3,117 federal website accessibility suits in 2025, up 27% from 2024.

If you sell to consumers in the European Union, the European Accessibility Act has applied to e-commerce services since June 28, 2025. Microenterprises that provide services are exempt.

What it means and what to do

For a typical business site, nothing new arrives on a set date in 2027. The lawsuit risk stays, so fix the common problems: missing alt text, low contrast, unlabeled form fields and menus that don’t work with a keyboard. Start with our web accessibility explainer.

Privacy

What is confirmed

Indiana, Kentucky and Rhode Island privacy laws took effect January 1, 2026. Next come Oklahoma and Louisiana on January 1, 2027, Alabama on May 1, 2027 and Vermont on January 1, 2028. Each has its own thresholds. Alabama’s is low: businesses that handle data on more than 25,000 consumers, not counting data used only to complete a payment.

California added a different kind of rule. From January 1, 2027, its Opt Me Out Act requires web browsers to include a setting that sends an opt-out preference signal, such as Global Privacy Control (GPC), to the sites a person visits. California’s privacy agency names 12 states where businesses already had to honor these signals in 2026.

What it means for a small business site

Each state law applies only above its thresholds, so check them. As more browsers offer opt-out signals, more visitors may ask not to be tracked by your ad and analytics tags.

What to do

• Make sure your privacy notice lists what you collect and who you share it with.
• If you use a cookie or consent tool, confirm it honors GPC signals.
• See our US website laws guide for the basics by topic.

Security and certificates

What is confirmed

An SSL certificate is what puts the padlock and https on your site. In April 2025 the CA/Browser Forum, where certificate sellers and browser makers set the rules, voted to shorten how long certificates last. The maximum was cut to 200 days on March 15, 2026, drops to 100 days on March 15, 2027 and to 47 days on March 15, 2029.

Let’s Encrypt, a free certificate authority behind many hosts’ free SSL, will issue 64-day certificates by default from February 10, 2027 and plans 45-day defaults in 2028. Since Chrome 154 (September 2026), Chrome asks people by default before opening a site over plain http.

On the server side, PHP 8.2 stops getting security fixes on December 31, 2026, and PHP 8.3 on December 31, 2027.

What it means and what to do

If you use a hosted builder, or free SSL from your host, renewal is usually automatic already. If you paste in a certificate by hand, you will repeat that about every three months after March 2027, so switch to automatic renewal now. If you run WordPress yourself, check the PHP version in your hosting panel. Our SSL certificates hub covers the details.

Domains

What is confirmed

Verisign, which runs .com, raises its wholesale fee from $10.26 to $10.97 on November 1, 2026. Its agreement allows up to 7% a year in the last four years of each six-year period. The .net fee goes from $10.91 to $12.00 on March 1, 2027. No 2027 .com increase has been announced, so any number you see would be a guess.

ICANN took applications for new domain endings from April 30 to August 12, 2026 and revealed 1,615 applications on October 7. Objections run until March 16, 2027. ICANN has not said when the first new endings could go on sale.

What it means and what to do

Registrars set their own markups, so your renewal may rise by more or less than the wholesale change. Check the renewal price, not the first-year price, and compare on our domain registrars page. New endings are not something to plan around in 2027. See our domain extensions guide for what exists today.

Email

What is confirmed

Gmail and Yahoo have required basic email authentication since February 2024, with extra rules for bulk senders, including DMARC and one-click unsubscribe. Outlook.com added rules for senders of more than 5,000 emails a day on May 5, 2025. Starting November 2025, Gmail stepped up enforcement, with non-compliant mail facing temporary and permanent rejections. Google’s FAQ lists no new step for 2026 or 2027. It says DMARC alignment with both SPF and DKIM will eventually be required, with no date.

What it means and what to do

The rules are in place, and Gmail tightened enforcement in November 2025. If form emails or newsletters go missing, check your domain’s SPF, DKIM and DMARC records first. Our email deliverability hub walks through the fixes.

Prices and checkout rules

What is confirmed

• Webflow merged its CMS and Business site plans into Premium at $25 a month billed yearly, with Basic at $15 billed yearly. New purchases changed May 13, 2026, existing sites June 29, and Freelancer, Agency and legacy sites move on November 16, 2026.
• BigCommerce renamed its plans on June 1, 2026 (Standard became Core, Plus became Growth, Pro became Scale). Core is $29 a month billed yearly ($39 billed monthly).
• Squarespace lists Core at $29 a month billed yearly ($39 billed monthly) on its pricing page. A July 2026 PetaPixel report said Squarespace raised yearly prices by up to 26%; we found no official Squarespace notice.

Two federal commerce rules matter for some sites. The FTC’s fees rule has required the total price up front for live-event tickets and short-term lodging since May 12, 2025. The FTC’s 2024 “click-to-cancel” rule was struck down by a federal appeals court in July 2025, and in March 2026 the FTC asked for comments on a possible new version. As of October 2026 there is no new proposed rule or date.

What to do

Before you renew, check the renewal price in your billing settings and run a 3-year cost, not just year one. If you sell event tickets or vacation stays, show the all-in price wherever a price first appears.

What is not changing

• The Core Web Vitals are still LCP, INP and CLS, with the same “good” thresholds.
• Chrome is not cutting off third-party cookies. Google said in April 2025 it would keep user choice, and it is retiring most Privacy Sandbox tools.
• Google still says normal SEO is how you appear in its AI Overviews and AI Mode.
• There is still no federal web accessibility rule for private businesses.

Your 2027 checklist

1. Confirm your SSL certificate renews automatically.
2. If you run WordPress yourself, check your PHP version and plan for WordPress 7.2.
3. Look up your domain renewal prices for .com and .net.
4. Review your privacy notice, and confirm your consent tool honors GPC signals.
5. Fix the common accessibility problems against WCAG 2.1 AA.
6. Check that SPF, DKIM and DMARC records exist for your domain.
7. Open the Generative AI report in Search Console.
8. If you connect an AI app to your site, use the official server and keep approvals on.
9. Check your builder’s renewal price before the renewal date.

Where to go next

Start with whatever would break first, such as email delivery or certificate renewal. Before you let an AI app work on your site, read our MCP connectors guide, and see our AI search guide for how pages show up in AI answers.