How to do a website audit (checklist and template)

What a website audit is for

A website audit is a structured check of your site against the things that decide whether it earns enquiries: can search engines reach it, do its pages say the right things, is it fast and secure, does it meet its legal obligations, and does it make contacting you easy.

The point isn't a score. Most audit tools will hand you hundreds of warnings, and very few of them matter. A good audit ends with a short, ordered list: what's broken, why it matters, who fixes it and when. This guide shows you how to do a website audit that gets you there.

Two principles shape everything below:

• Order matters. If Google can't index a page, its title tag is irrelevant. If the site is hacked, its conversion rate is the least of your worries. Work from the foundations up.
• Start with the pages that matter. Your homepage, service pages, contact page and best-performing content carry most of your enquiries. Audit those properly before you look at anything else.

Before you start: gather what you'll need

An hour of preparation saves a day of guesswork.

If you don't have Search Console set up, do that first. Our guide to getting your website on Google walks through it.

Step 1: Access and indexing

This is the foundation. If search engines can't crawl and index your pages, nothing else in the audit will move enquiries.

1. Check what Google has indexed. In Search Console, open the Pages report (under Indexing). Look at the number of indexed pages, then at the reasons pages aren't indexed. Our guide to the page indexing report explains each status.
2. Inspect your key pages one by one. Paste each URL into the URL Inspection bar. You want "URL is on Google" for every page that matters.
3. Check robots.txt. Open yourdomain.com/robots.txt. A Disallow: / line blocks the whole site. Remember that robots.txt controls crawling, not indexing: to keep a page out of Google, use a noindex tag instead.
4. Look for stray noindex tags. Many CMSs have a "discourage search engines" setting used during development. It's often left on after launch.
5. Check your sitemap. It should list only the pages you want indexed, all returning a 200 status. See how to submit a sitemap to Google.
6. Check for one version of the site. http and https, www and non-www should all redirect to one preferred version.

Our technical SEO audit checklist goes deeper on each of these, plus redirects, canonicals, broken links and structured data.

Step 2: Page basics

Next, check that each key page clearly says what it's about, in the words your customers use.

For each page on your list, record:

• Title tag: unique, describes the page, includes the main service or topic. See our guide to title tags and meta descriptions.
• Meta description: a clear reason to click. Google may rewrite it, but a good one is still worth writing.
• One H1 that matches the page's purpose.
• Content depth: does the page answer what a buyer needs to know (what's included, who it's for, how it works, what it costs, what to do next)?
• Internal links: can people and search engines reach the page from relevant pages, and does it link on?
• Images: descriptive alt text, sensibly sized files.

The most common finding here isn't technical. It's that several services share one page, so none of them ranks for anything specific. If that's you, it goes near the top of the fix list.

Look at Search Console's Performance report at the same time. Filter by page and check which searches each page appears for. If a service page shows impressions for the wrong searches, or none at all, its wording needs work.

Step 3: Speed and mobile

Google indexes the mobile version of your pages, and most visitors arrive on a phone. A slow or awkward mobile site loses rankings and enquiries.

• Check Core Web Vitals in Search Console (under Experience). It groups your URLs as Good, Needs improvement or Poor, based on real visitors' data. Our guide to Core Web Vitals explains each metric and its fixes.
• Test your key pages in PageSpeed Insights. Focus on the field data (what real users experienced) over the lab score.
• Use the site on your own phone. Can you read the text without zooming, tap buttons easily and submit the contact form? Our mobile-friendly website check lists what to test.
• Check other browsers. A form that works in Chrome can fail in Safari. See cross-browser testing.

If you're on WordPress, slow sites usually come down to heavy themes, too many plugins, unoptimised images and no caching. Our guide to speeding up WordPress covers each.

Step 4: Security

Security problems are rare but costly: a hacked site can be flagged by Google, lose its rankings and damage trust overnight.

• HTTPS everywhere: every page loads over https with a valid certificate, with no "Not secure" warnings or mixed content. See site not secure if you have one.
• Search Console Security issues report: should say no issues detected.
• Software up to date: CMS core, theme and plugins. Remove anything you don't use.
• Admin accounts: remove old users, use strong passwords and turn on two-factor authentication.
• Backups: confirm they run, are stored off the server, and that you know how to restore one.

Our website security checklist covers the full list.

Step 5: Legal and accessibility

These are the checks people skip until someone complains. They matter more in some sectors (education, care and the public sector are often held to accessibility standards), but every business collecting personal data has obligations.

• Privacy policy: present, linked from every page and from forms, and accurate about what you collect. See does my website need a privacy policy.
• Cookie consent: if you use non-essential cookies such as analytics or advertising tags, many jurisdictions require consent before they load. Check that the banner actually blocks those tags until people agree. See our guide to the cookie consent banner.
• Accessibility: check colour contrast, alt text, keyboard navigation, form labels and heading order against WCAG. Our website accessibility checklist walks through the main checks.

Step 6: Conversion

Finally, check that the site turns visits into enquiries. A technically perfect site that doesn't ask for the enquiry is still underperforming.

• Every key page has a clear next step, such as a call, a form or a booking, visible without hunting for it.
• The contact page works: submit a test enquiry and confirm it arrives. Our guide to the contact us page covers what to include.
• Proof is visible: reviews, case studies and accreditations near the call to action.
• Enquiries are tracked: form submissions and calls are recorded as key events in GA4, so you can see which pages and channels produce them. See UTM tracking.

Our guide to website conversion rate goes further on why traffic isn't turning into enquiries.

Turn findings into a fix list

This is where most audits fail. A list of 300 warnings doesn't get fixed. A list of 12 prioritised actions does.

Score each finding on two things:

"Impact" means effect on being found, trusted or contacted. A noindex tag on your main service page is high impact and low effort. A missing alt attribute on a decorative image is low impact.

Then give every action an owner and a date. If you rely on a developer or agency for some fixes, group those into one clear request rather than a drip of emails.

Website audit template

Copy this structure into a spreadsheet. One row per finding.

How often to audit your website

• Monthly: a light check of Search Console (indexing, Core Web Vitals, security issues), your enquiry numbers and a test form submission.
• Quarterly: re-check your key pages for content, links and conversion.
• After any big change: a redesign, a migration, a new CMS, a domain change or a large content update. Changes like these are where rankings are most often lost, usually through missing redirects.
• Yearly: a full audit using every step in this guide.