The website audit checklist for 2026: what to check, and what each finding proves

Most website audit checklists are a list of things a tool can count. Title length, image alt text, number of redirects. They are easy to run and easy to ignore, because a business owner cannot tell which of the forty items is costing them money.

A better checklist is organised by the question each check answers, and every item on it is measured against something published, so that when a client asks "says who?" you have an answer. This is the one we use. It works whether you run it by hand, with a stack of free tools, or with an audit engine.

Before you start: decide what the audit is for

An audit for a rebuild pitch, an SEO retainer and a security review should not rank findings the same way. A web studio cares most about conversion and speed; an SEO consultant about indexability and AI visibility; a security provider about exposure and email spoofing. Write down which service you are selling before you look at anything, because it decides what goes on page one of the report.

Then record three facts for every finding: what was measured, when, and against which standard. A finding without them is an opinion.

1. Speed: Core Web Vitals, lab and field

Google publishes the thresholds, which makes speed the easiest category to defend.

• Largest Contentful Paint (LCP): good at 2.5 seconds or less.

• Interaction to Next Paint (INP): good at 200 milliseconds or less. INP replaced First Input Delay in March 2024.

• Cumulative Layout Shift (CLS): good at 0.1 or less.

Measure on mobile first, because that is where local customers are. Use field data from real visitors (the Chrome UX Report) where the site has enough traffic to have any, and lab data from a headless browser where it does not. Say which one you are quoting. We cover this in depth in Core Web Vitals for small business sites.

Also check server response time, total page weight and the number of third-party scripts. They are the usual causes of a slow LCP.

2. Security you can see from outside

A passive audit reads what the site publishes to every visitor. That is enough to find a lot.

• TLS: a valid certificate, the chain served correctly, no protocols older than TLS 1.2, and how many days until expiry.

• Security headers: Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options, a framing policy (X-Frame-Options or CSP frame-ancestors), Referrer-Policy and Permissions-Policy. The free security headers checker reads them in one request.

• Exposed files: configuration files, backups and debug pages left reachable.

• Secrets in the JavaScript: API keys shipped in the bundle every visitor downloads.

• Known vulnerabilities: client-side libraries with published CVEs.

Stay read-only. Nothing in this section requires logging in, submitting a form or sending a payload, and none of it should.

3. Email authentication

This is the category most audits skip and business owners feel most directly, because it decides whether their invoices land in spam. Check:

• SPF: present, under the ten-lookup limit, and ending in ~all or -all.

• DKIM: a signing key published for the mail provider they actually use.

• DMARC: a record exists, what the policy is (none, quarantine or reject), and whether reports go anywhere.

• Blocklists: whether the sending domain or IP appears on the major mail blocklists.

Our email deliverability checker reads all three records for free.

4. Search fundamentals

• A unique, descriptive title and meta description on each important page.

• One H1 per page, and headings that describe the content under them.

• Canonical tags that point where they should, and no accidental noindex.

• A valid XML sitemap referenced from robots.txt.

• Structured data that matches the page: LocalBusiness or Organization on the home page, Product, Article or FAQPage where they apply.

• No broken internal links, and redirects that take one hop rather than four.

5. AI visibility

Answer engines such as ChatGPT, Perplexity and Google's AI features read sites differently from a search crawler. Two separate questions matter:

1. Can they get in? Check robots.txt for rules that block GPTBot, OAI-SearchBot, ClaudeBot, PerplexityBot and others. A blocked crawler cannot cite the site however good the content is.

2. Is there anything worth citing? Named authors, visible dates, a clearly defined business entity, and content structured as answers.

We wrote about the difference in auditing a site for AI visibility.

6. Accessibility

Count WCAG 2.1 AA failures on the rendered page, by severity: missing alternative text, insufficient colour contrast, form fields without labels, and controls that cannot be reached by keyboard. Automated tools catch a meaningful share of issues but not all of them, so present the count as a floor, not a verdict.

7. Conversion

The questions a business owner cares about most, and the ones most audits leave out:

• Is there a clear call to action above the fold on mobile?

• Can a phone number be tapped to call?

• Does the contact form work, and what happens after it is sent?

• How many steps stand between a visitor and an enquiry?

8. The business around the website

For local businesses the website is often not the biggest problem. Check the Google Business Profile (claimed, correct hours, categories, photos), the review profile (volume, rating, recency and what people complain about), and how visible the business is in local results across the area it serves.

9. Build quality and technology

What built the site and what hosts it, whether the CMS and plugins are current, JavaScript errors thrown at real visitors, and placeholder copy that was never replaced. These are the footprints of a site assembled in a hurry, and they are good evidence for a rebuild conversation.

10. Record what could not be measured

This is the item that separates a defensible audit from a pretty one. If a check timed out, was blocked, or needs data the site does not have (field speed data on a low-traffic site, for example), say so. A report that silently counts a missing check as a pass will eventually be contradicted in front of a client.

Turning the checklist into a report

A checklist is the input, not the deliverable. The report should open with the three findings that matter most for the service you sell, each with the measurement, the standard, what it plausibly costs the business and how to fix it. Everything else goes further down. How to present a website audit to a business owner covers that part.

SiteAssay runs this checklist automatically. Every check reports whether it ran, found nothing, failed or was unavailable, and findings are ranked by the service you sell. The free website audit runs the fast checks with no account, and the features page shows the rest.