What Does a Website Audit Include? Scope and Deliverables

A website audit can include search, technical, content, user experience, accessibility, security and performance checks. The exact scope varies, so require a written list of included domains, page samples, data sources, active tests, exclusions and final deliverables.

Use the seven areas below as a scope comparison. “Comprehensive” is meaningful only when a proposal identifies the properties, URL set, templates, devices, data period and testing limits.

SEO Analysis

The SEO analysis component examines how well your site communicates with search engines and how effectively it competes for organic visibility. This is typically the largest section of a website audit because it encompasses both on-page and off-page factors.

On-page SEO. The agreed indexable URL set or representative templates are evaluated for titles, descriptions, headings, image alternatives, internal links, URL signals and page intent. The report should say whether a finding is site-wide, sampled or limited to crawlable HTML; it should not turn a rule failure into a traffic estimate without evidence.

Keyword mapping. A thorough audit evaluates whether your existing pages target appropriate keywords and whether there are gaps in your keyword coverage. This involves comparing your current ranking keywords against search demand data to identify high-value terms where you have no content, pages cannibalising each other by targeting the same keyword, and existing content that targets keywords with negligible search volume.

Indexation status. Reconcile intended canonical URLs from the sitemap and crawl with Search Console's Page indexing report. Exclusion labels are starting points for diagnosis, not always defects: noindex, alternate canonicals and duplicates may be intentional. Inspect representative URLs before recommending a change.

Backlink profile. If included, record referring pages and domains, link context, anchor patterns, lost links and known acquisition history. A third-party “toxic” score does not prove a penalty. Google's disavow guidance reserves the tool for sites with many artificial or low-quality links plus a manual action or likely manual-action risk.

Structured data. Validate relevant markup, required properties and agreement with visible content. Eligibility does not guarantee display. Google now limits FAQ rich results mainly to authoritative government and health sites and no longer shows HowTo rich results, as its 2023 search-result update explains.

Technical Review

The technical review examines the infrastructure layer of your website — the server configuration, code quality, and architectural decisions that determine whether search engines can efficiently crawl, render, and index your content.

Crawlability. The audit examines your robots.txt configuration, XML sitemap health (validity, completeness, proper referencing), crawl depth analysis (how many clicks from the homepage to reach any page), redirect chains and loops, and orphan pages that have no internal links pointing to them. Crawlability issues prevent search engines from discovering your content, making every other optimisation pointless.

Rendering analysis. For sites that use JavaScript frameworks (React, Vue, Angular, Next.js), the audit compares the initial HTML response with the JavaScript-rendered version to identify content that is invisible to search engine crawlers. This includes checking whether Google's renderer can access and execute all necessary JavaScript files, whether critical content appears in the initial HTML, and whether dynamic content loads quickly enough to be captured during crawling.

Server response. The audit verifies HTTP response codes across the entire site, identifies slow-responding pages, tests server behaviour under concurrent request load, and checks for proper caching headers. It also evaluates your hosting infrastructure — whether you use a CDN, whether your server is geographically appropriate for your target audience, and whether your hosting plan provides adequate resources for your traffic volume.

URL architecture. Clean, logical URL structures help both users and search engines understand your site hierarchy. The audit evaluates URL length, use of descriptive path segments, consistency of conventions (trailing slashes, lowercase), handling of parameters, and the overall logical relationship between URL paths and content hierarchy.

Internationalisation. For multilingual or multi-regional sites, the audit checks hreflang implementation, language-specific URL structures, canonical configuration across language variants, and proper content targeting. Incorrect hreflang implementation is one of the most technically complex and commonly misconfigured aspects of SEO.

Content Evaluation

The content evaluation goes beyond checking whether content exists to assessing whether it is effective — whether it satisfies search intent, demonstrates expertise, and serves your business goals.

Content inventory. The audit catalogues every page on your site, classifying each by content type (product, service, blog, landing page, utility), word count, last update date, and organic traffic. This inventory reveals the overall composition of your site and identifies content that is outdated, thin, duplicate, or performing below its potential.

Search intent alignment. For your highest-traffic pages and most important target keywords, the audit evaluates whether your content matches the intent behind the search query. A page targeting "best project management software" that only describes one product is misaligned with the comparison intent behind that query. Intent misalignment is one of the most common reasons that well-optimised pages fail to rank.

Content quality signals. The audit assesses readability (sentence length, vocabulary complexity), topic comprehensiveness (does the content cover the subtopics that top-ranking pages address), E-E-A-T signals (evidence of Experience, Expertise, Authoritativeness, and Trustworthiness), and content freshness (whether information is current and accurate). These qualitative factors increasingly determine rankings in competitive markets.

Thin and duplicate content. Product pages with shared manufacturer descriptions, overlapping archives and templated location pages may offer little distinct value. Review the purpose, canonical signals, demand, links and conversions before recommending consolidation, expansion or removal; duplication does not automatically suppress an entire site.

Content gaps. By analysing your existing content against competitor coverage and search demand data, the audit identifies topics and questions that your target audience is searching for but your site does not address. These gaps represent direct opportunities for new content that can capture additional organic traffic.

UX Assessment

User-experience review tests whether people can understand, navigate and complete important tasks. Bounce rate, engagement time and pages per session are diagnostic analytics, not universal Google ranking thresholds. Google's page-experience guidance recommends considering several aspects without reducing them to one score.

Mobile usability. With Google's mobile-first indexing, your mobile experience is your primary experience. The audit tests responsive behaviour across device sizes, checks touch target spacing, verifies that text is readable without zooming, and identifies content that is hidden or inaccessible on mobile devices. It also checks for intrusive interstitials (popups, overlays, banners) that violate Google's guidelines and can result in ranking penalties.

Navigation and information architecture. Test whether representative users can find important destinations, whether labels are clear, whether breadcrumbs reflect the hierarchy and whether intended pages have crawlable internal links. Click depth is evidence to interpret with page importance and site structure, not a universal three-click pass rule.

Core Web Vitals. Review Largest Contentful Paint, Interaction to Next Paint and Cumulative Layout Shift by page group. Separate field data, which reflects eligible real-user visits, from controlled lab tests. These metrics contribute to page experience, but a failing URL does not prove why rankings or conversions changed.

Conversion path analysis. For business websites, the audit traces the path from entry page to conversion action (contact form, purchase, signup) and identifies friction points — confusing calls to action, excessive form fields, missing trust signals, or broken conversion elements. While conversion optimisation is a discipline in itself, the audit surfaces the most obvious barriers that are preventing your traffic from becoming revenue.

Security Check

Security affects both user trust and search visibility. Google uses HTTPS as a ranking signal and may display warnings for sites with security issues, directly impacting click-through rates from search results.

SSL/TLS configuration. The audit verifies your certificate's validity, chain of trust, and expiry date. It checks for the correct implementation of HTTP-to-HTTPS redirects, tests for mixed content (HTTP resources loaded on HTTPS pages), and evaluates your TLS version and cipher suite configuration. Weak TLS configurations can expose user data and trigger browser warnings.

Security headers. The audit checks for critical HTTP security headers: HTTP Strict Transport Security (HSTS) to prevent protocol downgrade attacks, Content-Security-Policy (CSP) to prevent cross-site scripting, X-Frame-Options to prevent clickjacking, X-Content-Type-Options to prevent MIME-type sniffing, and Referrer-Policy to control information leakage. Missing security headers expose your site and your users to preventable attacks.

Vulnerability review. Passive checks can inspect public responses for exposed files, directory listings, visible version information and known vulnerable components. Any active vulnerability scan or exploit test needs written authorisation, defined targets, timing, request limits and an escalation contact before testing begins.

Third-party script review. Inventory analytics, advertising, chat, embed and tracking scripts by owner, purpose, data sent, consent state and page scope. Flag unknown domains, obsolete tags and unexpected behaviour for investigation; deciding whether processing is lawful requires the applicable privacy rules and legal review.

Performance Analysis

Performance review identifies slow templates, bottlenecks and unstable interactions. It can measure timings and payloads directly; ranking, conversion and infrastructure effects need separate evidence.

Server performance. Time to First Byte measures how long the request waits for the first response byte. Test representative routes from relevant locations and separate DNS, connection, cache and origin behaviour. Interpret the result with the application and delivery architecture rather than imposing a universal 200 ms target.

Resource optimisation. The audit analyses every resource loaded by your pages: CSS files, JavaScript bundles, images, fonts, and third-party scripts. For each resource category, it identifies opportunities for reduction: unused CSS that should be purged, JavaScript that should be deferred or lazy-loaded, images that should be compressed or converted to modern formats, and font files that should be subsetted or preloaded.

Caching strategy. Check Cache-Control and validators by resource type, plus CDN behaviour where used. Fingerprinted assets can normally use long immutable caching; HTML and APIs need lifetimes that match freshness, privacy and invalidation requirements.

Rendering performance. Beyond server response time, the audit examines client-side rendering performance: how quickly the browser can parse and execute your CSS and JavaScript, whether critical rendering path resources are optimised, whether images above the fold are preloaded, and whether layout shifts occur during page load. This analysis requires browser-based testing (Lighthouse or WebPageTest) and reveals issues that server-side analysis alone cannot detect.

Mobile performance. Mobile devices have less processing power and often slower network connections than desktops. The audit tests performance on simulated mobile hardware and network conditions to identify resources and code patterns that are acceptable on desktop but problematic on mobile. This includes large JavaScript bundles that take seconds to parse on mid-range phones and high-resolution images served to small screens.

Deliverables

A professional website audit produces several deliverables. Understanding what you should receive helps you evaluate audit proposals and hold providers accountable.

Executive summary. A concise overview should state the scope, material findings, uncertainty and recommended priorities in business language. A provider may use a score, but the score is optional and must expose its inputs and weighting. The evidence matters more than a fixed page count or top-five list.

Detailed findings report. The comprehensive technical document that lists every issue found, organised by category and severity. Each finding includes the affected URLs, a clear explanation of the issue, why it matters (impact on traffic, rankings, or user experience), and specific steps to fix it. The best reports include screenshots, code examples, and configuration snippets that developers can implement directly.

Prioritised action plan. A ranked list of recommended actions ordered by expected impact and implementation effort. Quick wins (high impact, low effort) are listed first. This document serves as a project plan that development and marketing teams can work through systematically.

Benchmark data. Record dated baselines for relevant metrics such as search clicks, intended indexed URLs, Core Web Vitals, security-header coverage and crawl outcomes. Use the same definitions and comparison periods after implementation, and distinguish correlation from measured incremental return.

Competitor comparison. Where relevant, the audit includes a comparison of your technical and content metrics against your top organic competitors. This context helps you understand not just where you are falling short of best practice, but where you are falling short of your specific competitive set.

If a provider cannot describe the scope and deliverables before engagement, ask for clarification. For DIY page-markup triage, AuditWeb's free checker analyses pasted HTML locally; it does not fetch or crawl the site, test SSL, accessibility or speed, or prove indexation.