The complete website audit checklist

1. Technical health

Core Web Vitals exist because Google needed a proxy for whether a real visitor experiences a page as fast and stable, not just fast on a lab test. Largest Contentful Paint under 2.5 seconds means the biggest visible element, usually a hero image or headline, has rendered before someone on a patchy connection gives up and hits back. Cumulative Layout Shift under 0.1 stops buttons jumping around as fonts and images load in, which is how people tap the wrong thing and blame themselves. Interaction to Next Paint under 200 milliseconds is about whether the site responds to a tap without a visible lag. Beyond the Vitals, mobile responsiveness matters because most traffic now arrives on a phone, broken links and redirect chains waste crawl budget and quietly erode trust, and a valid sitemap plus a robots.txt that isn't blocking your own content are what let Google find what you've built. HTTPS everywhere, with no mixed content warnings, is table stakes now, not a differentiator.

2. Marketing and conversion

A website audit that skips marketing and conversion checks the plumbing but never asks whether anyone who arrives actually does anything. A headline that says what you do in plain words matters because visitors decide whether to keep reading within seconds, and clever or vague copy costs you that window. One clear primary call to action per page matters for the same reason a shop with five doors confuses more customers than it welcomes: when everything competes for attention, nothing wins, and conversion drops even though the page "has" all the right elements. Visible contact details and trust signals, genuine reviews, credentials, guarantees, do the work a salesperson would do in person, reassuring a stranger before they commit money or personal information. Analytics actually installed and firing sounds basic, but plenty of small business sites lost it somewhere in a redesign, which means every decision after that point is a guess. And no dead ends: every page should lead somewhere, because a page that goes nowhere is a wasted visit.

3. AI visibility

AI visibility is the newest area on this checklist, and the one most sites fail simply because the item didn't exist when they were built. The mechanism differs from traditional SEO: tools like ChatGPT, Perplexity and Google's AI Overviews retrieve and synthesise content rather than crawl and rank pages, so they need clean, unambiguous signals about who you are. Structured data, Organization, FAQ and Product schema, gives them a machine-readable summary instead of forcing them to infer meaning from marketing prose. An llms.txt file is an emerging convention telling AI crawlers what your site is about and where the important content lives, similar in spirit to how robots.txt once did for search engines. Whether AI crawlers are permitted in robots.txt matters because some sites unknowingly block the bots they'd want citing them. Content needs to sit in the raw HTML rather than render only via JavaScript, since many AI crawlers don't execute scripts, so a site that looks fine to a human can read as blank to a bot. Clear entity signals, consistent naming across your site and public profiles, help these systems connect your business to what's said about it elsewhere.

4. Security signals

Security signals matter for two audiences at once: the visitor who quietly checks for the padlock before entering payment details, and the browser or email provider deciding whether to warn people away from you. Valid SSL/TLS with no mixed content means every resource on the page, not just the page itself, loads over an encrypted connection, because one insecure image or script can trigger a warning that undoes the trust the rest of the site built. Security headers, HSTS, CSP, X-Frame-Options, are the difference between a site that looks secure and one actually hardened against common attacks like clickjacking, and their absence is one of the most common findings on sites never technically audited. SPF, DKIM and DMARC aren't about the website at all, they govern whether email claiming to be from you gets delivered or silently binned, and whether someone else can spoof your domain to send phishing mail in your name. No exposed software versions matters because a visible version number hands an attacker a shortlist of known vulnerabilities to try, and a clean Google Safe Browsing status determines whether Chrome shows visitors a full-page red warning before they can even reach you.

5. Privacy compliance

Privacy compliance is the layer most businesses treat as a legal formality rather than something that actually gets read, and that assumption is increasingly wrong on both counts. A findable, current privacy policy needs to reflect what the site actually does, not a template downloaded years ago and never revisited, because regulators and enterprise procurement teams will check it against your real tracking behaviour. Cookie consent that genuinely blocks trackers until accepted, rather than firing them the moment the page loads and displaying a banner as decoration, is the difference between compliant and merely appearing compliant. A working way for users to exercise their data rights, request deletion, ask what's held, matters because the absence of a process is itself a gap even if no one has asked yet. And being able to name and justify every third-party tracker on your site, rather than discovering an old analytics snippet nobody remembers adding, separates a business that controls its data footprint from one that's accumulated it by accident.

6-7. Reputation and social footprint

Reputation and social footprint are where a stranger's five minutes of homework either confirms or undermines everything the rest of the site claims. Reputation covers review presence and ratings across the platforms people actually check, but the number matters less than whether the business responds: a pattern of unanswered negative reviews reads as a business that doesn't care once the sale is made, while thoughtful responses, even to fair criticism, read as one that does. Social footprint is a similar trust check. Profiles that exist but haven't posted in two years, or that use a different logo and tone to the website, create a small but real doubt about whether the business is still active and coherent. Consistency across platforms, same name, same visual identity, same core message, is what makes a business look like one organised entity rather than a loose collection of accounts, and inconsistency is exactly the kind of detail a sceptical visitor notices without being able to say why something feels off.

8-9. Employer brand and AI readiness

Employer brand and AI readiness sit further from the sale than the other seven areas, but they shape how the business reads to anyone doing deeper due diligence, a candidate, a partner, or a larger client vetting a supplier. Employer brand covers whether the careers page exists, whether roles listed are current, and whether team pages present a business that looks like somewhere a good candidate would want to work rather than abandoned or overly corporate for its size. A stale careers page with a role posted many months ago actively costs the business candidates who reasonably assume nobody's hiring. AI readiness is a softer signal, looking at how automated and data-mature the business behind the site appears, drawing on cues like whether processes seem manual and ad hoc or whether there's visible evidence of real systems at work. It matters increasingly because buyers, especially in B2B, read operational maturity as a proxy for reliability: a business that looks like it has its own back end in order is more credible when it promises to handle yours.

Frequently asked questions