How to audit your website: the checklist I actually use

Before redesigning a website, spending on ads or arguing about the colour of a button, I always do the same thing: an audit. Not out of academic rigour, but because half the time the problem isn't the one the client thinks it is. They want a new design and it turns out the site takes eight seconds to load. They want to spend on Google Ads and it turns out analytics hasn't recorded anything for a year.

This is the list I work through, in the order I work through it, with the tools I use. You can do it yourself in an afternoon.

1. Performance

First, because it's the fastest thing to notice and the most expensive thing to ignore. A slow site loses visitors before anyone reads a word, and Google factors it into ranking.

What to measure with

• PageSpeed Insights: gives you field data (real users) and lab data. The field data is what matters.
• Lighthouse, built into Chrome: performance, accessibility, best practices and SEO in one pass.
• GTmetrix: useful for the loading waterfall, which shows exactly what's blocking the page.

What to look at

• LCP under 2.5 s. That's the time until the main element appears. It's almost always ruined by an unoptimised image or a font that arrives late.
• Page weight. Over 2 MB means uncompressed images. Use modern formats (WebP, AVIF) and put width and height on every image so the layout doesn't jump.
• Third-party resources. Every external script is a request to a server you don't control. Fonts and libraries can be hosted on your own domain: they load sooner and you stop sending your visitors' IP addresses to someone else.
• Caching. Files that don't change (CSS, JS, images) should have a long cache and a version in the URL. Otherwise you either serve them stale or serve them from scratch every time.

2. Technical SEO

Not keywords yet. Whether Google can understand the site at all.

• Search Console. It's free and it's the only source that tells you what Google actually sees: what it indexes, what it drops and why.
• Sitemap and robots.txt. That they exist, are current and don't contradict each other.
• One version of each page. With canonical and no duplicates via www, http, trailing slash or parameters.
• Broken links and redirects. Every 404 arriving from outside is authority thrown away. If you've migrated, check that old URLs redirect to the matching new page, not to the homepage.
• Structured data. Schema.org for article, person or organisation as appropriate. It's what makes you show up properly in results.
• If you have more than one language, reciprocal hreflang between versions. It's the most common mistake on multilingual sites: each version points to the others, but the others don't point back.

3. Content

This is where it's decided whether the site is any use. Page by page:

• Can someone tell in five seconds what you do and who for? If not, no technical trick will fix it.
• Titles and descriptions that are unique and written for people, not robots.
• One h1 per page and a heading hierarchy you can actually follow.
• Stale content. Old dates, prices that aren't real any more, projects that no longer exist. It looks worse than having nothing.
• Clear calls to action. One per page, visible without hunting.

4. Experience and accessibility

• Mobile first, for real. Open the site on an actual phone, not the browser simulator. Check nothing overflows or gets hidden behind the browser bar.
• Contrast and text size. Nothing under 16 px for body copy.
• Keyboard navigation. Tab through the site: if you can't see where you are at any moment, you're missing focus styles. It's one of the most common faults and one of the easiest to fix.
• Alt text on images that carry information.
• Forms. Errors that explain themselves, fields with labels, and everything fillable on a phone without zooming.

5. Security

• HTTPS everywhere, with redirection from http and no mixed content.
• A valid certificate. Obvious, but I've seen sites down for months because nobody noticed automatic renewal had stopped working.
• Security headers: Strict-Transport-Security, X-Content-Type-Options, Referrer-Policy and a sensible Content-Security-Policy. They're free and almost nobody sets them.
• Updates and backups. If it's WordPress: core, plugins and themes current, and automatic backups that someone has actually restored at least once.
• What's exposed. Old installs, test folders, admin panels nobody uses any more. All of it is attack surface in exchange for nothing.

6. Analytics and cookies

The item I've most often found broken, and the quietest one: nobody notices until someone asks for a report.

• Does it measure what you think it measures? Check that the measurement ID belongs to your property. A site rebuild with the code copied wrong leaves months of data in limbo.
• Does it load before consent? If the cookie banner appears but analytics has already loaded, the banner is decorative.
• Events. Page views alone tell you nothing. Measure what matters: email clicks, form submissions, downloads, clicks out to other domains.
• Cross-check two sources. Browser analytics always sees less than what happens. Comparing it with server or CDN data tells you by how much, and therefore how much each number you quote is worth.

What to do with the result

An audit that ends in a forty-page document is useless. I always close mine the same way: three lists.

1. Fix today, because it takes minutes and stops the bleeding: broken redirects, misconfigured analytics, expired certificates, 4 MB images.
2. Next cycle: performance, content, structure.
3. Decide before touching: whether it needs a redesign, a change of platform, or a rethink of the whole digital business.

Most websites don't need a redesign. They need someone to look at the data and fix the five things breaking the funnel.