Website audit checklist
Last updated . Figures are approximate and change with the market, so check current prices before you decide.
Most small business sites are never audited. They are built, launched and left, and problems pile up quietly: a broken form, a slow home page, a missing privacy notice. This checklist is built to be used, not read. Work down the table, tick what passes, and write down what does not. Where a rule comes from Google or a regulator, the source is linked. Our free website check covers several of these items automatically on one page.
The checklist
| Area | Check | Pass means | Done |
|---|---|---|---|
| Technical | Site loads over HTTPS | Padlock shows, no warnings | ☐ |
| Technical | www and non-www, http and https all go to one version | One address, redirected | ☐ |
| Technical | No broken links or error pages | Menu and key links return a page | ☐ |
| Technical | Contact form sends and you receive it | Test message arrives | ☐ |
| SEO | Each page has a unique title and description | No duplicates, no "Home" | ☐ |
| SEO | One H1 per page that says what the page is | Clear to a stranger | ☐ |
| SEO | Sitemap exists and is in Search Console | Submitted without errors | ☐ |
| SEO | Google Business Profile claimed and matches site | Same name, address, phone | ☐ |
| Speed | LCP 2.5 s or less | Good at 75th percentile | ☐ |
| Speed | INP 200 ms or less | Good at 75th percentile | ☐ |
| Speed | CLS 0.1 or less | Good at 75th percentile | ☐ |
| Mobile | Same content as desktop | Nothing missing on phone | ☐ |
| Mobile | Tap targets and text readable | No pinching or zooming | ☐ |
| Trust | Real name, address, phone, email visible | Easy to find | ☐ |
| Trust | Real photos, real reviews | No stock-only site | ☐ |
| Conversion | One main action per page | Call, book or buy is obvious | ☐ |
| Conversion | Phone or WhatsApp opens in one tap | Works on a phone | ☐ |
| Conversion | Tracking counts enquiries | You can see how many came | ☐ |
| Legal | Privacy notice linked in footer | Plain language | ☐ |
| Legal | Cookie banner matches what the site sets | Choices work | ☐ |
Copy this table into a spreadsheet and add a "fix by" column.
Technical checks
HTTPS. web.dev says to protect every site with HTTPS, even sites that do not handle sensitive information, because it stops others from altering or watching traffic (web.dev). Browsers warn visitors on sites without it. Our free check tests this first.
One version of the site. Pick one address and redirect the others to it. Google recommends keeping HTTPS consistent across redirects, canonicals and sitemaps (Google).
Broken links and forms. Click every item in your menu. Send a test message through your form from a phone and check where it lands. A form that fails silently costs more than any other bug on this list.
SEO checks
Titles and descriptions. Google asks for a unique, descriptive, brief title on every page, and may rewrite titles that are vague or repeated (Google). Put your service and place in the title where it fits.
Headings. Use one H1 that says what the page is about, then H2s for sections.
Sitemap. Google says a small site of about 500 pages or fewer, with all important pages linked from the navigation, may not need one, but a new site with few links can benefit (Google). It costs nothing to submit one in Search Console.
Crawlable links. Google follows <a> elements with an href. It may not follow links built from other elements (Google).
Local listing. If you serve a local area, your site and your Google Business Profile should show the same details. Read our guide to Google Business Profile optimisation.
Speed checks
Google's Core Web Vitals targets are an LCP of 2.5 seconds or less, an INP of 200 milliseconds or less and a CLS of 0.1 or less, measured at the 75th percentile of page loads, and a page passes only when it meets all three (web.dev). Run your home page and your most important service page through PageSpeed Insights.
Slow LCP on small business sites is usually one of four things: a slow server, a big hero image, a late-loading image or scripts that block rendering. web.dev lists these causes and warns never to lazy-load your main image (web.dev). Compress images before upload, remove plugins you do not use, and re-test after each change.
Mobile checks
Google indexes the mobile version of your site, and says the mobile page should hold the same content as desktop. Hiding content in tabs or accordions is fine (Google). Open your site on a real phone. Can you read the text without zooming? Can you tap the menu, the phone number and the form with a thumb? Responsive design is the simplest setup to maintain.
Trust checks
Visitors decide quickly whether you are a real business. Show a name, an address or service area, a phone number and an email. Use your own photos of your work, your place and your team. Google's guidance on helpful content asks that readers can see who is behind the content and why it exists (Google). Add reviews only if they are real, and link to where they can be checked.
Conversion checks
For each important page, name the one action you want: call, book, request a quote or buy. Then check that the page leads with it and that it works in one tap on a phone. Look at what you can measure. If you cannot say how many enquiries the site produced last month, set up tracking before anything else. See our website design for small business page for how we set up forms, buttons and analytics.
Legal checks
This is general information, not legal advice. Rules differ by country, so check the official guidance for the places you sell in.
Privacy notice. The UK regulator says privacy information must tell people why you use their data, how long you keep it and who you share it with, in "concise, transparent, intelligible, easily accessible" and plain language (ICO). Link it from the footer and from any form that collects data.
Cookies. The ICO's guidance on storage and access technologies covers consent, the information you must give, and the exceptions such as "strictly necessary" (ICO). The UK rules and guidance have been updated recently, so read the current page. Check your banner against what your site actually sets, and make sure the choices work.
How to prioritise what you find
- Anything that stops a visitor contacting you: broken forms, dead phone links, site down.
- Anything that scares visitors off: no HTTPS, slow loading, unreadable phone layout.
- Anything that hides you from Google: noindex tags, missing titles, blocked pages.
- Legal gaps.
- Polish.
FAQ
How often should I audit my website?
Twice a year is enough for most small sites, plus after any redesign or platform change.
Do I need paid tools?
No. Google Search Console, PageSpeed Insights and our free website check cover most of this list.
What is the difference between a website audit and an SEO audit?
An SEO audit looks at how Google finds and ranks your pages. A website audit adds speed, mobile, trust, conversion and legal checks.
Can I run the audit myself?
Yes, if you are comfortable testing forms and reading reports. Ask for help when a fix touches code, such as speed work or redirects.
What should I fix first?
Whatever stops a customer reaching you. Fix form, phone and HTTPS problems before anything else.
How OnePDA helps
The free website check tells you in plain words what works and what to fix first. If you would rather have the fixes done, a one-page Website Launch is €890 and a five-page Website Business is €2,400, both built to load fast on phones, with basic SEO and analytics included. A Care plan from €39 a month covers hosting, backups and updates. Prices exclude VAT where it applies. Read more on our website design for small business page.