'Website audit' is used to mean anything from a two-minute automated scan to a fortnight of consultancy, which makes it hard to know what you are being offered or whether the price is fair.
This is a plain description of what the term covers, written by people who sell one — so read the last section first if you would rather start with the part where we say what we cannot do.
What an audit usually covers
A reasonably complete audit looks at six areas. Most tools cover two or three and call it an audit, which is worth knowing before comparing prices.
- Search
- Whether search engines can find, read and index your pages, and whether anything is actively stopping them. The largest group on most sites, because it is where most sites lose the most and almost none of it is visible by looking at your own home page.
- Speed
- How long the page takes to become useful, measured on a mid-range phone rather than an office desktop. The desktop number flatters almost every site.
- Security
- Whether the site is configured the way a secure site should be — HTTPS enforced, a valid certificate, the response headers browsers look for. Not a penetration test.
- Accessibility
- Whether people using screen readers, keyboards or magnification can use the site. Automated testing covers roughly a third of this; the rest needs a person.
- Email trust
- Whether somebody can send email pretending to be your domain. Invisible from the website, genuinely damaging when wrong, and almost never checked.
- AI crawlers
- Whether AI tools may read your site, and whether you point them at your best content. New, and worth deciding deliberately rather than by accident.
Automated scan or manual review?
They answer different questions and the distinction is worth holding on to.
An automated scan is good at everything countable and comparable: which pages are missing titles, how long the server took, which images have no alt text, whether a header is present. It is fast, it is cheap, it is consistent, and it can be repeated to show whether a fix worked. It cannot tell you whether your pricing page is confusing, whether your booking form asks for too much, or whether your content answers the question people actually have.
A manual review is the opposite. It is slow and expensive and it is the only thing that answers those questions.
The sensible order is a scan first. It costs little, and it removes the mechanical problems so that any manual review you pay for is spent on judgement rather than on a person reading out a list a machine could have produced.
How to tell a useful report from a sales document
There are a few reliable signals, and they are easy to check before you pay anything.
- It shows its evidence
- A finding should name the pages affected and show what was actually observed. 'Your site has performance issues' is a sales line. 'This image is 2400px wide and displayed at 400px, on this page' is a finding.
- It says what it did not check
- Any honest report has gaps — a collector that could not run, a section that needs a person. A report with no gaps is a report that is not telling you about its gaps.
- It distinguishes urgent from tidy
- A list of ninety issues sorted by nothing in particular is easy to generate and impossible to act on. What you need is which three things to do first and why.
- It tells you what a fix is worth
- Not a made-up revenue figure, but an honest account of what the problem costs — visitors leaving, pages not indexed, a form nobody can complete.
- You can act on it without the person who wrote it
- A report whose recommendations all require hiring its author is a proposal wearing a report's clothes.
When you probably do not need one
If your website is a single page with your phone number on it and it loads quickly, an audit will tell you very little. Spend the time on getting reviews instead.
If you already know what is wrong and have not fixed it, another report will not help. This is more common than it sounds — most businesses that commission an audit already suspect the answer.
And if the site is about to be replaced, audit the new one rather than the old one.
The times it is genuinely worth it: traffic has dropped and you do not know why; the site was built by somebody you no longer work with; you are about to spend money on advertising and want to know the destination works; or nobody has looked at it properly in two years and you would rather find the problems than be told about them by a customer.
Find out where your site stands
Everything described above is something the scanner looks for, with the evidence for each result on your own pages. Free, no account, first findings in about twenty-five seconds.
Scan my siteThe checks behind this guide
- No page is accidentally hidden from searchA noindex instruction tells Google to keep a page out of search results entirely. That is exactly right for a thank-you page or a checkout step, and catastrophic on a page you want found — it is invisible, and no amount of other work will change that until the instruction is removed. It is worth checking because it is usually left behind by accident after a redesign.
- Main content appears quickly on a phoneThe largest thing on the page — usually the main image or headline — is what a visitor is waiting for. Until it finishes loading they are looking at a blank or half-built page. This is measured on a mid-range phone on mobile data rather than on a fast desktop connection, because that is the harder case and the one most visitors are actually in.
- Secure connection is enforcedVisitors who type your address without 'https' stay on an unencrypted connection. Browsers mark those pages 'Not secure' in the address bar, and anything typed into a form on them can be read in transit.
- Text is readable against its backgroundText has to stand out enough from what is behind it to be readable. Pale grey on white looks refined on a designer's monitor and disappears for anyone with reduced vision, or simply reading on a phone in daylight. It is one of the most common reasons people give up on a page, and one of the easiest to fix.
- Email cannot be forged from your domain (SPF)There is no record saying which servers are allowed to send email as you. That means someone can email your customers from your address, and it also means your own legitimate email is more likely to land in spam.
- You have decided what AI crawlers may doCompanies training AI models and answering questions with your content read your site using crawlers with names like GPTBot and ClaudeBot. Your robots.txt says nothing about them, so by default they are all allowed. That may be exactly what you want — being quoted in an AI answer is visibility — but it is worth being a decision rather than an accident.