Guide

What does a website audit include?

If you have never ordered a website audit, the hardest part is knowing what you are paying for. One provider hands you a two-page PDF with a traffic-light grade. Another sends a 60-page report you will never finish. Both call themselves an audit.

A real audit has a defined scope. It crawls your site the way a visitor and a search engine would, checks the mechanics that decide whether people can find you, trust you, and contact you, and ranks what it finds by what it is costing you. This article covers the five areas a proper audit should include — and what it should not. It is part of our complete guide to website audits.

1. Broken pages, broken links, and dead ends

This is the foundation. The audit crawls every reachable page on your site — in our case, up to 50 pages — and follows every internal link. It should list:

• Dead pages (404 errors): pages that return "not found" when a visitor or Google tries to open them
• Broken internal links: links on your own pages that point to pages that no longer exist
• Broken images and assets: images, files, or scripts that fail to load
• Orphaned pages: pages that exist but no other page links to, so visitors can only find them by guessing the URL

Every dead end is a visitor who hit a wall, and Google treats a site full of broken links as unmaintained. A good report gives you the exact source page and target URL, so you can fix it without hunting.

2. HTTPS and security basics

Open your own site on your phone. Does the address start with https://, and does the browser show it as secure? A proper audit checks:

• Whether your site serves over HTTPS at all
• Whether the insecure http:// version automatically redirects to HTTPS
• Whether your certificate is valid
• Whether security headers such as HSTS (Strict-Transport-Security) are set, which tells browsers to only ever load your site securely

Browsers warn visitors away from insecure sites, especially on form and checkout pages. If a stranger sees "Not secure" before your headline, most will leave. That makes this a trust blocker, not just a technical item.

3. Page speed and page weight

Speed is not about shaving milliseconds for bragging rights. It is about how much data you force a phone on a mediocre connection to download before your page becomes usable. An audit should measure:

• Total page weight: how many bytes your homepage and key pages transfer on load
• Heaviest assets: the specific images, videos, or scripts doing the damage — usually one or two oversized images account for most of it
• Mobile performance score where available: a PageSpeed-style check that reflects what a phone user actually experiences

A common finding: a homepage that weighs 8–12 MB because photos were uploaded at full camera resolution. The fix is often ten minutes of compression — but you cannot fix what nobody measured.

4. SEO fundamentals

This is not keyword strategy or backlink analysis. An audit covers the on-page fundamentals that decide whether search engines can read your site correctly in the first place:

• Page titles: missing, duplicated, too short to be useful, or too long to display in search results
• Meta descriptions: missing or duplicated — the short text under your title in Google results that decides whether someone clicks
• Heading structure: whether each page has one clear main heading (H1) and a logical order below it
• Canonical URLs: tags that tell Google which version of a page is the real one, so duplicates do not compete with each other
• Open Graph data: the title, description, and image shown when someone shares your page
• robots.txt and sitemap: whether you have a sitemap listing your important pages, and whether robots.txt is accidentally blocking pages you want indexed

Image checks sit here too: alt text, dimensions, and broken sources. None of this is glamorous. It is also where most small sites lose free traffic — not because their content is bad, but because the basics were never checked after launch.

5. Conversion blockers

This is the section most automated tools skip, and it is often the most valuable. Once a visitor can find your site and load it quickly, can they actually become a customer? An audit should look for:

• Whether the page makes clear what you offer and what to do next in the first few seconds
• Whether contact information and calls to action are reachable from every key page — especially on mobile
• Whether key pages look current and maintained, or abandoned
• Whether anything in the path from landing page to enquiry or purchase is broken, hidden, or confusing

An audit should not pretend to test every form end-to-end unless it says so plainly. What it can do is flag obvious blockers: a "Contact" link that 404s, a phone number that disappears on mobile, a buy button buried below three screens of text.

What a good audit report looks like

Coverage is only half the job. Presentation decides whether you act. A useful report gives you:

1. A single score — 0 to 100. To force an honest judgment and let you measure improvement next time.
2. Every finding with its exact location. Page URL, element, and what was found.
3. A priority order. Revenue blockers first, trust blockers second, traffic blockers third. Everything marked "medium priority" is a report designed to be ignored.
4. Plain language. If you need a developer to translate it, the audit failed.

What an audit does not usually include

Be clear on the boundaries, so you do not pay for one thing and expect another:

• Fixes. A diagnostic audit finds and ranks problems; it does not repair your site. That separation matters — an auditor who also sells fixes has an incentive to find expensive problems.
• Content strategy or copywriting. It flags missing titles, it does not write your marketing.
• Backlink or competitor analysis. Useful, but a different product.
• Ongoing monitoring. An audit is a snapshot, not an alert service.

If a provider bundles all that into a monthly retainer starting with a "free audit," you are entering a sales funnel, not buying an audit.

The bottom line

A website audit should include a full crawl for broken pages and links, an HTTPS and security check, a speed and page-weight measurement, a review of SEO fundamentals — titles, descriptions, headings, canonicals, robots and sitemap, images — and a check for conversion blockers. Everything should come back scored, located, and ranked by impact.

This article is part of our slow-drip series on website audits. Start with the full website audit guide for the complete picture.