Website Audit: Scope, Checks, Evidence and Prioritised Fixes

A website audit examines a site's technical setup, content and user experience. It records observed problems and turns them into prioritised actions.

This guide starts with a real finding, then explains the audit types, checks, tools and review process. AuditWeb's methods page explains how our guides, free checker and owned-site evidence differ.

What an Audit Finding Looks Like

An audit finding connects an observed problem to a correction and a verification step. This example records a missing-page response on our own website. It demonstrates the method without claiming a client result or traffic uplift.

Read the documented AuditWeb self-audit for the original evidence and reproduction steps.

To see how findings can be organised for a handoff, review the website audit report example.

What Is a Website Audit

A website audit reviews the technical setup, content and user experience factors that affect how a site attracts visitors, supports tasks and earns enquiries or sales.

A thorough site audit examines your website across multiple dimensions:

• Technical health — Can search engines crawl and index your pages? Are there server errors, redirect chains, or broken resources?
• Search engine optimisation — Are your pages properly optimised for the keywords your audience actually searches for?
• Content quality — Is your content useful, accurate, up-to-date, and better than what competitors offer?
• User experience — Can visitors easily find what they need, on any device, without frustration?
• Performance — Do pages load fast enough to keep users engaged? Are Core Web Vitals passing?
• Security — Is your site protected against common attacks, data breaches, and compliance violations?
• Accessibility — Can people with disabilities use your site? Do you meet WCAG 2.2 requirements?

The output of a website audit is usually a prioritised report that records observed issues, explains their relevance and recommends a specific fix. Where the inputs support an estimate, the report can state the assumptions behind business impact.

A site audit is not a one-time event. Websites are dynamic — content changes, plugins update, Google adjusts its algorithms, and competitors improve their own sites. Regular audits ensure you catch problems early and maintain the gains you have worked hard to achieve.

Why Website Audits Matter

An audit is useful when it answers a decision: why visits declined, whether a migration preserved important pages or which task prevents enquiries. Choose the evidence needed for that decision before expanding the checklist.

Protect and Grow Organic Traffic

Search engines use technical signals alongside content and external evidence. A misconfigured robots.txt file can block crawling, a slow server response can affect page experience and duplicate content can make preferred URLs harder to interpret. An audit helps identify these conditions for review.

The number and severity of findings vary by site. Record the evidence for each issue and prioritise fixes by affected scope, confidence, impact and effort.

Improve Conversion Rates

Traffic does not guarantee conversions. Audits can reveal conversion barriers that analytics alone may not explain, such as confusing navigation, slow-loading product pages, broken forms, missing trust signals and checkout friction.

Reduce Wasted Ad Spend

Check paid landing pages for broken forms, inaccurate offers and task barriers before increasing spend. Use campaign and outcome data to assess the effect; a bounce alone does not prove a wasted visit.

Stay Ahead of Competitors

A competitor audit compares the pages serving the same search or customer task. Use dated observations to identify useful missing answers and differences in the offer; a competitor's ranking alone does not explain why it performs differently.

Mitigate Risk

Security vulnerabilities, accessibility obligations and search-engine actions can create legal, operational and financial risk. Audits can identify conditions such as SSL misconfiguration, exposed admin paths and accessibility barriers so the appropriate specialists can investigate them.

Types of Website Audits

Not all audits are the same. Depending on your goals and the maturity of your site, you may need a focused audit in one area or a comprehensive review across all of them.

SEO Audit

An SEO website audit reviews the on-page, technical and off-page signals relevant to search visibility. It covers elements like title tags, headings and internal links; crawlability, site speed and structured data; and backlink context. This is a focused choice for sites that depend on organic traffic.

Technical Audit

A technical website audit goes deep into the infrastructure of your site. It checks server response codes, redirect chains, XML sitemaps, robots.txt configuration, canonical tags, hreflang implementation, Core Web Vitals, and JavaScript rendering issues. Technical audits are essential for large sites, sites that have recently migrated, or sites built on complex CMS platforms.

Content Audit

A content audit evaluates an agreed inventory or sample of pages for purpose, quality, relevance, accuracy and available performance evidence. Record each recommendation and its reasons in a report or spreadsheet. Keep, improve, merge or remove decisions require manual review of user value, obligations, links and conversions; missing traffic alone is not a reason to delete a page.

Security Audit

A security audit identifies vulnerabilities that could be exploited by attackers. It checks for outdated software, SQL injection points, cross-site scripting vulnerabilities, insecure file permissions, missing security headers, and SSL/TLS configuration issues. Agree authorisation and testing boundaries before active security checks. Applicable obligations depend on the service, jurisdiction and data involved.

Accessibility Audit

An accessibility audit tests your site against the Web Content Accessibility Guidelines (WCAG) 2.2. It checks colour contrast, keyboard navigation, screen reader compatibility, form labels, image alt text, focus management, and ARIA implementation. Automated checks cover only part of the evaluation. Include manual keyboard, assistive-technology and task testing, and assess legal obligations separately.

UX Audit

A UX audit evaluates the overall user experience — navigation structure, information architecture, visual hierarchy, call-to-action placement, form design, and mobile responsiveness. UX audits rely on heuristic evaluation, user testing data, heatmaps, and session recordings to identify friction points.

Performance Audit

A performance audit analyses server response, resource waterfalls, rendering, images, caching and third-party scripts. Use representative devices and connections for repeatable tests, then compare available field data with Core Web Vitals thresholds. A passing lab run cannot establish performance for every visitor.

What a Website Audit Covers

A comprehensive website audit examines a defined set of checkpoints across technical, search, content, experience, security and performance areas. The agreed scope determines the categories and depth.

Source: Google’s explanation of crawling, indexing and serving results.

Technical Infrastructure (12 Checkpoints)

• Server response codes and error pages
• Robots.txt configuration and crawl directives
• XML sitemap completeness and accuracy
• Redirect chains and loops
• Canonical tag implementation
• Hreflang tags for multilingual sites
• JavaScript rendering and crawlability
• Orphaned pages with no internal links
• URL structure and parameterisation
• Log file analysis for crawl behaviour
• Index bloat and thin page ratio
• Pagination and faceted navigation handling

On-Page SEO (10 Checkpoints)

• Title tag optimisation and uniqueness
• Meta description quality and click-through rate
• Heading hierarchy and keyword alignment
• Internal linking structure and anchor text
• Image alt text and file naming
• Structured data markup (schema.org)
• Content depth and topical coverage
• Keyword cannibalisation detection
• Duplicate content identification
• Thin content and doorway page flagging

Page Speed and Performance (10 Checkpoints)

• Largest Contentful Paint (LCP)
• Interaction to Next Paint (INP)
• Cumulative Layout Shift (CLS)
• Time to First Byte (TTFB)
• First Contentful Paint (FCP)
• Total Blocking Time (TBT)
• Image optimisation and modern formats
• Render-blocking resources
• Third-party script impact
• Caching and CDN configuration

Content Quality (10 Checkpoints)

• E-E-A-T signals (Experience, Expertise, Authoritativeness, Trustworthiness)
• Content freshness and accuracy
• Completeness of the answer for the intended task
• Readability and audience alignment
• Content gaps compared to competitors
• Author attribution and credentials
• Multimedia usage (images, video, infographics)
• Outbound link quality
• Content update frequency
• Source verification, original evidence and editorial accountability

User Experience (10 Checkpoints)

• Mobile responsiveness and touch target sizing
• Navigation clarity and depth
• Above-the-fold content and calls to action
• Form usability and error handling
• Visual hierarchy and readability
• Interstitial and popup behaviour
• Breadcrumb implementation
• Search functionality
• 404 page design and recovery paths
• Cross-browser compatibility

Security (10 Checkpoints)

• SSL/TLS certificate validity and configuration
• HTTP security headers (CSP, HSTS, X-Frame-Options)
• Mixed content detection
• Outdated CMS, plugins, and dependencies
• Admin panel exposure
• File permission vulnerabilities
• SQL injection and XSS vectors
• Backup and recovery procedures
• Cookie consent and privacy compliance
• GDPR and data protection measures

Accessibility (10 Checkpoints)

• Colour contrast ratios (WCAG AA minimum)
• Keyboard navigation completeness
• Screen reader compatibility
• Form label associations
• Image alt text presence and quality
• Focus indicator visibility
• ARIA landmark and role usage
• Skip navigation links
• Video captions and audio descriptions
• Responsive text sizing without horizontal scroll

AI search visibility within the audit scope

Review whether important answers are accessible as text, clearly attributed, supported by evidence and connected to useful related pages. Check crawler and snippet controls, then record actual cited answers with their query, platform and date. Inclusion is not guaranteed. Google's AI-search guidance does not require special AI markup or fixed paragraph lengths. For a practical distinction between AI-assisted auditing and AI visibility checks, read the AI website audit guide.

How to Do a Website Audit

Running a website audit yourself is entirely possible, especially if your site is relatively small. Here is a step-by-step process you can follow.

Step 1: Define Your Goals

Before you open any tool, clarify what you want to achieve. Are you trying to recover lost traffic? Improve conversions? Prepare for a site migration? Your goals determine which areas to prioritise and how deep to go. A site recovering from a Google penalty needs a different audit than one preparing to scale paid campaigns.

Step 2: Crawl Your Site

Use a crawler like Screaming Frog, Sitebulb or the site audit tool in Ahrefs or Semrush to crawl the agreed scope. This gives you an inventory of URLs with technical data such as status codes, page titles, meta descriptions, word counts and internal link counts. Crawl time depends on site size, configuration and response speed.

Step 3: Check Google Search Console

Google Search Console provides useful evidence for an SEO audit. Check the Page indexing report for indexation issues, the Core Web Vitals report for performance problems, URL Inspection for page-level signals and the Manual actions and Security issues reports where relevant. Cross-reference Search Console data with crawl data to build a complete picture.

Step 4: Run a Speed Test

Test important page types in PageSpeed Insights. Separate available real-user data from Lighthouse laboratory results; a lab performance score is not a field Core Web Vitals pass. Record device and network conditions, repeat diagnostic runs and use the waterfall to locate expensive resources. See the Core Web Vitals audit for metric definitions and evidence limits.

Step 5: Audit On-Page SEO

Review the title, description, headings and content against each page's intended task. Use query-to-page Search Console data alongside the actual pages to investigate overlap. Two URLs appearing for a related query does not by itself establish harmful cannibalisation. Merge only when the pages substantially duplicate the same need, and use descriptive links between distinct tasks.

Step 6: Review Content Quality

Inventory all in-scope pages and prioritise important landing pages, declining query groups and neglected content. Check whether each page answers its task accurately, supports consequential claims and gives the reader a usable next step. Word count alone does not determine quality. Include low-traffic pages when they serve a necessary task rather than pruning them automatically.

Step 7: Check Security and Accessibility

Use an HTTP-header checker, a TLS test and an accessibility checker for initial signals, then manually verify findings. Public scanners do not establish application security or WCAG conformance. Review permissions before testing and involve specialists where the agreed scope requires them.

Step 8: Prioritise and Plan

Compile all issues into a single spreadsheet. Score each issue by impact (how much it affects traffic, conversions, or risk) and effort (how long it takes to fix). Start with high-impact, low-effort fixes — these are your quick wins. Then work through the medium and long-term items in order of ROI.

If you want a reusable way to capture evidence, priorities and owners, use the agency audit toolkit.

Website Audit Tools

Select tools for the evidence you need. A crawler, a performance test and an analytics report answer different questions; one score cannot replace the whole audit.

All-in-One SEO Platforms

SEO platforms can combine crawling with search and backlink research. Compare the scope, ownership requirements, crawl limits and exports in the tool directory before choosing a subscription. Provider severity labels still need review against your site's priorities.

Desktop Crawlers

Desktop crawlers support configurable URL inventories and exports. Use the Screaming Frog guide to decide which settings and licence features your task requires. A crawler discovers linked pages within its configuration; compare it with sitemaps and other inventories to find omissions.

Speed Testing

Google PageSpeed Insights provides Core Web Vitals data from real users (Chrome User Experience Report) alongside lab data from Lighthouse. WebPageTest.org offers more detailed waterfall analysis and filmstrip views. GTmetrix combines Lighthouse scores with its own performance metrics.

Security Testing

Remote malware, HTTP-header and TLS checks examine different public signals. They cannot see every server-side issue or authenticated workflow. Review the security-tool scope guide before treating a clean result as reassurance about the entire application.

Accessibility Testing

WAVE, axe-based tools and command-line automation can identify testable accessibility issues. Combine them with keyboard and assistive-technology checks. The accessibility tools guide explains coverage and the manual work that remains.

For a detailed comparison of all major audit tools, see our website audit tools guide.

How Often to Audit

The right audit frequency depends on your site's size, how often it changes, and the competitiveness of your market.

Monthly: Quick Health Checks

Run a quick crawl and check Google Search Console for new issues every month. This catches broken links, indexation problems, and speed regressions before they compound. Automated monitoring can flag changes, but allow time to validate new findings. The required time depends on the site and changes detected.

Quarterly: Focused Audits

Every three months, do a deeper dive into one specific area. Rotate through SEO, content, technical, and UX so that each area gets a thorough review once a year. Treat this as an example schedule; scope and change frequency determine the time required.

Annually: Comprehensive Audit

Once a year, conduct a comprehensive audit that covers the agreed dimensions of your site. This is the time to benchmark against competitors, reassess your content strategy and plan improvements for the year ahead. The time required depends on site size and scope.

Event-Triggered Audits

Certain events should trigger an immediate audit regardless of your regular schedule:

• Traffic drops — Compare demand, tracking, query mix and indexing evidence before assigning a cause
• Site migration — Before and after any domain change, CMS migration, or redesign
• Google algorithm updates — Core updates can shift rankings significantly
• Security incidents — After any suspected breach or malware infection
• New market entry — Before launching into a new geography or product category

Getting Professional Help

While DIY audits are valuable, there are situations where professional help delivers significantly better results.

When to Hire a Professional

Consider a professional website audit service when:

• Your templates, integrations or page inventory exceed the team's capacity to review reliably
• You have experienced a significant traffic drop and cannot identify the cause
• You are planning a site migration or redesign and need to protect your existing rankings
• You lack in-house SEO expertise and need actionable recommendations, not just raw data
• You need a benchmark audit to present to stakeholders or investors
• Your site handles sensitive data and needs a separately scoped specialist security assessment. AuditWeb's public configuration checks do not include penetration testing or certification.

What to Expect from a Professional Audit

A good professional audit delivers more than a list of issues. Agree which of these deliverables are included in the quote:

• A prioritised action plan with effort and impact scores for each recommendation
• Business relevance notes or clearly labelled estimates where the inputs support them
• Competitor benchmarking to show where you stand relative to your market
• A strategy call to walk through the findings and answer questions
• Follow-up support to help with implementation

How to Choose an Audit Provider

Look for providers who show you a sample report before you buy, explain their methodology and state the scope and limitations clearly. Check the evidence behind any case study. Avoid specific ranking promises or pressure to buy.

Our audit services start at $297 for a basic audit and $997 for a comprehensive review. Confirm the scope, deliverables, call duration and terms before commissioning work.