Website audit
Free Website Audit Checklist: 47 Checks to Run on Any Site
August 4, 20267 min readUpdated August 17, 2026
A website audit sounds like a project, but it's really just a checklist — and once you've run it a couple of times it takes under an hour. These 47 checks span the five areas that decide how well a site performs: SEO, speed, accessibility, security, and content. Run them all and you'll know exactly where your site stands and what to fix first.
SEO checks (1–12)
- Title tags: every page has a unique, descriptive <title> under ~60 characters.
- Meta descriptions: unique per page, under ~160 characters, with a clear value proposition.
- Heading hierarchy: exactly one H1 per page, with H2s/H3s in a sensible order.
- Indexability: pages you want found are indexable, and thin pages are noindexed deliberately.
- Canonical tags: self-referencing canonicals, with no conflicting signals.
- URL structure: clean, readable slugs without parameters or uppercase.
- Internal links: every important page is linked from at least one other page.
- Broken links: no 404s or redirect loops inside your own site.
- Image alt text: meaningful alt attributes on images that carry meaning.
- Sitemap: an up-to-date XML sitemap submitted to search consoles.
- Structured data: relevant schema (Organization, Article, Product…) on the right pages.
- Mobile indexing: the mobile version of the page is the one being crawled.
Performance checks (13–22)
- Largest Contentful Paint: loads in under 2.5 seconds on mobile.
- Interaction to Next Paint: responds to input in under 200 ms.
- Cumulative Layout Shift: below 0.1, with no content jumping on load.
- Image weight: images are compressed and served in modern formats (WebP/AVIF).
- Lazy loading: below-the-fold images and iframes load on demand.
- JavaScript: no render-blocking scripts above the fold without need.
- Server response time: TTFB under 600 ms for a cold request.
- Caching: static assets are cached with sensible expiry headers.
- Font loading: fonts don't block rendering, and only used weights are loaded.
- Third-party scripts: trackers and widgets are audited — each one costs speed.
Accessibility checks (23–32)
- Contrast: body text meets WCAG AA (4.5:1) against its background.
- Keyboard navigation: every interactive element is reachable and operable by keyboard.
- Focus states: visible focus indicators on links, buttons, and inputs.
- Form labels: every input has a programmatic label.
- Alt text on meaningful images, empty alt on decorative ones.
- ARIA misuse: no redundant or conflicting ARIA attributes.
- Zoom: the page remains usable at 200% zoom.
- Media: video has captions, audio has a transcript.
- Motion: animations respect prefers-reduced-motion.
- Screen reader pass: the page makes sense read out loud, top to bottom.
Security checks (33–40)
- HTTPS everywhere: no mixed content, valid certificate, automatic redirect from HTTP.
- HSTS: Strict-Transport-Security header is set for HTTPS-only delivery.
- Outdated software: CMS, plugins, and libraries are on current versions.
- Exposed files: no .env, .git, backups, or debug endpoints publicly reachable.
- Headers: sensible Content-Security-Policy, X-Content-Type-Options, and Referrer-Policy.
- Forms: submissions are protected (CSRF tokens, server-side validation).
- Malware/blacklist check: the domain is clean in search console and blocklist tools.
- Excess permissions: third-party scripts only have access to what they need.
Content checks (41–47)
- Freshness: pages that should change have been updated in the last 90 days.
- Accuracy: statistics, dates, and claims are current and sourced.
- E-E-A-T signals: authors, about page, and contact details are present and trustworthy.
- Thin content: no pages with little or no unique value.
- Duplicate content: no near-identical pages competing for the same query.
- Clear calls to action: each page knows what the visitor should do next.
- Tone consistency: voice, terminology, and formatting match your brand.
How to prioritize what you find
The point of a checklist is triage, not perfection. Group everything into three buckets: things that cost you traffic or money today (broken checkout, site down, security holes), things that cost you ranking (title tags, canonical issues, thin content), and everything else. Fix the first bucket this week, the second this month, and let the rest ride.
If you don't want to run all 47 by hand, a free scored audit covers most of the automated checks in seconds — SEO, speed, accessibility, and security — and hands you a prioritized list of what to fix first.
Frequently asked questions
What is a website audit?+
A website audit is a systematic review of how well a site is set up to perform — usually covering SEO, speed, accessibility, security, and content. The 47 checks in this guide span all five areas and end with a prioritized list of what to fix first.
How long does a website audit take?+
Once you've run it a couple of times, a full manual audit takes under an hour. A free scored audit automates most of the checks and returns a prioritized fix list in about 30 seconds.
What should I fix first after an audit?+
Group findings into three buckets: things that cost you traffic or money today (site down, broken checkout, security holes), things that cost you ranking (title tags, canonicals, thin content), and everything else. Fix the first bucket this week.
What areas does a website audit cover?+
Five: SEO, performance, accessibility, security, and content. The 47 checks in this guide span all of them — title tags and indexation (SEO), load time and Core Web Vitals (performance), contrast and keyboard navigation (accessibility), SSL and malware (security), and relevance and freshness (content).