Website Audit Checklist for 2026: 83 Checks in Six Lists

What a website audit checklist covers

Search health comes first because it is where small business sites lose the most. In Theo's audit of 5,974 small business websites, 48 percent of the 4,027 sites with search data got an estimated zero visitors a month from Google search, and the median was 1. The report's own Limits paragraph says the sample is not random: it is the sites whose owners chose to run the audit. Both numbers are in The State of Small Business Websites 2026.

Start with the free website audit. It takes a site address, needs no login, and reports estimated search traffic, rankings and search health with specific fixes; it runs about 4,000 audits a month. Every check on the other five lists can be confirmed with a phone, a browser, Google Search Console and the site's own logins.

The six lists are in the order to work them. Search health decides whether anyone arrives, speed decides whether they wait, content decides whether they understand, conversion decides whether they act, accessibility decides whether everyone can, and technical is the plumbing underneath. An audit that skips a list usually skips the one the site is losing on.

What you need before you audit a website

Plan on an afternoon for the four or five pages that lead to money. Most of that time goes to the content and conversion lists; the search health list is partly reading what the free audit and Search Console already show.

• The four or five pages that lead to money: the homepage, the two or three service pages customers buy most, the contact page, and booking or checkout if there is one.
• Your phone on cellular data, not office Wi-Fi, because that is how most first-time visitors arrive.
• Logins for Google Search Console and Google Analytics if the site has them; if it has neither, that is the first technical finding, and setting them up is a 15-minute job.
• Someone outside the business who will try to get an estimate, book or order without help, while you watch and say nothing.
• A sheet with one row per check and three columns: pass, fix now, fix later. Date it, because the next audit compares against it.

How to audit a website in six steps

The lists below are long. This is the order to work them so the afternoon ends with a sorted to-do list instead of a pile of notes.

1. Run the free audit. Enter the site address at theo.site/audit; there is no login. The report shows the estimated visitors a month the site gets from Google search, the searches its pages appear for, its search health findings and the specific fixes. Write down the visitor number: it is the baseline every later audit is measured against.
2. Pick the money pages (10 minutes). List the homepage, the service pages that bring in the most revenue, the contact page and any booking or checkout page. Everything else waits for a later pass; auditing 40 pages at once is how audits stall.
3. Read Search Console and Analytics (15 minutes). In Search Console, open Pages and note which money pages show as "Indexed", then open Performance, set the range to three months, and note clicks, impressions and average position. In Analytics, note which pages get visits and where the visits come from. These numbers say whether the site has a traffic problem or a page problem.
4. Run the stranger test on a phone (20 minutes). Give someone outside the business one real task, such as getting an estimate for a water heater, and watch without helping. Every pause, wrong tap and scroll back up is a finding for the conversion list.
5. Work the six lists (two to three hours). Go through the money pages one at a time, marking each check pass, fix now or fix later. Do not fix anything yet; a fix in the middle of an audit is how the second half never happens.
6. Sort, fix, retest (the following weeks). Sort the fix-now items by what each one costs the business, using the table further down. Make the fixes, re-run the free audit and the stranger test, and write the date on the sheet.

Search health checklist: how Google sees the site

Search health is whether Google has the site, shows it for the searches customers type, and sends visitors. Three of the checks below, the estimated traffic, the searches the site ranks for and how many sites link to it, come straight from the free audit report; the rest take Search Console and a browser.

What improving search health looks like in Search Console: Buy My Lunch, a school lunch ordering service and a Theo customer named here with the owner's permission, moved to Theo in June 2026. In the 90 days through September 27, 2026, its site had 929 clicks from Google search, up from 131 in the 90 days before; search impressions rose from 7,500 to 61,700 over the same two periods, and average position moved from 13 to 8 as Theo's growth work published pages. Those three numbers over two 90-day windows, clicks, impressions and position, are the ones to write on the audit sheet.

1. Google lists the site. Search site:yourdomain.com and confirm the money pages appear. Zero results means Google does not have the site at all, and nothing else on this list matters until it does.
2. Search Console is verified, and its Pages report shows every money page as "Indexed". A money page marked "Discovered, currently not indexed" is a finding; the indexing guide gives six free steps to work through, in order.
3. The Performance report shows clicks from Google search over the last three months. Near zero means the site gets an estimated zero visitors a month from search, the group the report's 48 percent describes.
4. Every service has its own page rather than a paragraph on one Services page, because Google ranks pages, not paragraphs.
5. Every page has its own title tag naming the service and the place: "Drain Cleaning in Tulsa", not "Home" or the business name alone.
6. Every page has a meta description written for a person deciding whether to click, under about 160 characters, with the service and the place in it.
7. Each page has one main heading, the H1, and it matches the title tag closely enough that a searcher who clicks lands on what they expected.
8. The city or service area appears in text on the homepage, each service page and the contact page, not only in a map or a logo.
9. If the business serves more than one town, each town has its own short page saying what is offered there; the plumbing demo site further down has one per town.
10. The Google Business Profile shows the same name, address, phone and hours as the site and links to the homepage.
11. The homepage links to every service page, and service pages link to each other and to the contact page, so Google and visitors reach everything in two clicks.
12. No two pages compete for the same search: one page per service, one per town, and a blog post that covers the same ground as a service page links to it instead of repeating it.
13. You know which searches the site ranks for; the free audit lists them, and the searches customers type that are missing from that list are the pages to write next.
14. Other sites link to yours: directories, suppliers, associations, the chamber of commerce, local press. In Theo's audit of 5,974 small business websites, 65 percent of the sites with link data had a Semrush Authority Score of 5 or less, a score built largely from the sites linking to a domain.
15. Something new has been published since launch. Search Console shows when each page was last crawled; a site with nothing new for a year gives Google no reason to come back.

Speed checklist: how fast the site loads on a phone

Check speed on a phone on cellular data, on the money pages only. A page that takes more than a few seconds to show its headline loses the visitor before the content list gets a chance.

1. The headline and main button of each money page appear within a few seconds on cellular data; count it out loud, because a laptop on office Wi-Fi hides the problem.
2. Photos are exported at the size they display, not straight from the camera; a 4,000-pixel photo shown 800 pixels wide is a common speed finding on a small business site.
3. The largest image on each page, usually the top one, is compressed and loads first, before anything below it.
4. Nothing moves while the page loads; a headline that jumps when a banner or font arrives makes visitors tap the wrong thing.
5. The site uses one or two font families, and text stays visible in a fallback font while they load.
6. Every widget earns its place: chat bubbles, social feeds, review carousels and embedded maps each add load time, and a static map image with a link costs almost nothing.
7. Video is embedded from a video host rather than uploaded to the site, and it does not autoplay on phones.
8. Images below the first screen load only when the visitor scrolls to them, so the first screen is not waiting on the gallery at the bottom.
9. Pages are served as plain files rather than built from a database on every visit. Theo builds and hosts every site as static files served over HTTPS, which is why this check passes there by default.
10. Pages and images are served from servers near the visitor, so someone two states away is not waiting on one machine.
11. The slowest money page is timed again after the fixes, on the same phone and the same connection, and both times go on the sheet.

Content checklist: what every important page needs to say

Content is what each page says and whether a stranger can act on it. This list is a walk-through of the money pages; a larger site that needs a page-by-page inventory with traffic numbers should use the spreadsheet method in the website content audit instead.

1. The first screen of the homepage answers three questions without scrolling: what the business does, who it is for, and what to do next.
2. No line on the first screen could belong to a competitor; "same-week furnace repair in Dayton" beats "quality you can trust".
3. The homepage names the three or four services that make the most money, in that order, instead of every service alphabetically.
4. Every service page says who it is for, what is included, how the work goes, how long it takes and what the next step is.
5. Price context sits where the decision is made: a starting price, a range, a minimum, or a sentence on how estimates work.
6. Proof sits beside the claim it supports: a review beside the promise, a license number beside the word licensed, a photo of the crew beside the word team.
7. Business details are identical on every page and on the Google Business Profile: name, phone, email, address, hours, service area.
8. The questions customers ask before buying are answered on the page, not saved for a phone call: do you serve my town, do you take my insurance, how soon can you come.
9. Stale material is gone: services no longer offered, staff who left, expired promotions, last year's prices, holiday hours from a previous year.
10. The About page says who runs the business, how long it has run and why a customer should trust it, with a photo of a real person.
11. Photos show the actual business, its people and its work; a stock photo of a handshake tells a visitor nothing and is recognized as stock.
12. Headings say what the section answers, paragraphs carry one idea, and steps, inclusions and prices are lists rather than prose.
13. Link text names the page it goes to; "click here" and "learn more" are gone.
14. No price, instruction or offer exists only inside a graphic; anything in an image is also written out on the page.
15. Each page has one job; detail that belongs to another service has its own page and a link to it.
16. Package names, the steps of the process and trade terms are explained the first time they appear, in the words a customer would use.

Conversion checklist: the path from a visit to a call

Conversion is the path from a visit to a call, booking or order. Test it as a first-time visitor on a phone, using only the menu, and count the taps.

The plumbing demo site Theo built shows several of these checks passing at once: click-to-call in the header, a service page each for repair, drains and water heaters, service-area pages by town, and reviews and license details.

1. The site has one main action, named: call, request an estimate, book or order. Every money page points to it.
2. Each page has one primary button; competing buttons are demoted to text links.
3. The main action is visible on the first screen of a phone and again at the end of every service page.
4. The phone number is a tap-to-call link in the header and the footer; the plumbing demo site below carries a click-to-call button in its header.
5. The contact form works: a test message lands in an inbox someone reads daily, and the sender sees a thank-you that says who replies and when.
6. The form asks only what is needed to reply, usually a name, a phone number or email and a short message; a full project brief before a first conversation stops people.
7. Booking, quote and checkout links open the right tool on the right service, on a phone as well as a laptop.
8. Homepage to service to contact takes two or three taps using only the menu.
9. Nothing covers the action: no pop-up over the button, no cookie or chat bar over the phone number.
10. A visitor who is not ready today has a next step: a price guide, examples of work or an FAQ.
11. The menu opens with one hand and reaches every money page, and its label is a word, not an icon alone.
12. Text is readable without zooming, and buttons are big enough to tap without hitting the next one.
13. The contact page carries the address as a link that opens the phone's map app, the hours, the phone number as text and how fast replies come.
14. If the site has a chat widget, a person answers it during business hours; a chat nobody answers is worse than no chat.
15. Someone outside the business completes a real task with no help; every pause is a fix.

Accessibility checklist: can everyone use the site

Accessibility is whether someone using a screen reader, a keyboard, a zoomed-in phone or a bright parking lot can use the site. These 12 checks catch most failures; the ADA compliance checklist explains what WCAG 2.1 AA asks of a small business site and what to do about a demand letter.

1. Text has strong contrast: dark text on a light background or the reverse; light gray on white and white text over a photo both fail on a phone in sunlight.
2. Every image that carries meaning has a written description, and purely decorative images are marked so screen readers skip them.
3. Every form field has a visible label above or beside it, not only gray placeholder text that vanishes when typing starts.
4. The whole site can be used with the Tab key alone: every link, button and menu item can be reached, and a visible outline shows which one is selected.
5. Headings are real headings in order, one H1 then H2s and H3s, not bold text made larger.
6. Text can be enlarged to 200 percent in the browser without overlapping, cut-off words or a sideways scroll.
7. Video has captions and audio has a transcript, on the page or one click away.
8. Nothing flashes, and anything that moves on its own, such as a carousel, can be paused or stopped.
9. Color is never the only signal: a required field is marked with a word, or an asterisk explained in text, not only a red outline.
10. The message a form shows when something is wrong says what to fix, in words, next to the field where the mistake is.
11. The page language is set to English in the code so screen readers pronounce the words correctly; most platforms have one setting for it.
12. Pop-ups and cookie bars can be closed with the keyboard and do not trap the keyboard inside them.

Technical checklist: the domain, HTTPS, links and logins

Most technical checks can be confirmed in a browser. The rest need the domain and hosting logins, and knowing where those are is itself the first check.

1. The domain registrar login works, auto-renew is on, and the renewal date is written down where the business will see it.
2. The hosting and platform logins are known to the business, not only to a former developer or agency.
3. Every page loads over HTTPS with no warning, and the http address redirects to https.
4. The HTTPS certificate renews on its own; click the icon to the left of the address (a padlock in Safari and Firefox, a tune icon in Chrome), open the certificate details and confirm the expiry date is more than 30 days away.
5. The www and non-www addresses land on one site, not two copies; the www guide explains how to pick one and redirect the other.
6. No link on the money pages leads to a page-not-found; click every menu link, footer link and button once.
7. The page-not-found page is the site's own, with the menu and a link back to the homepage.
8. Search Console has received the XML sitemap and reports it as processed, with nothing flagged.
9. No robots.txt rule and no noindex tag keeps Google out of a page that should rank; both show up in Search Console's URL inspection.
10. Nothing displays sideways on a phone: no horizontal scrolling, overlapping text or cut-off tables.
11. Analytics is installed and receiving visits, and Search Console is verified on the same domain and address the visitors use.
12. On WordPress or any platform with plugins, updates and backups are current, and a backup has been restored once to prove it works.
13. Email to the business address still arrives after any domain or hosting change; send a test, because email records are easy to lose in a domain change.
14. A privacy policy page is linked in the footer, and if the business runs ads, the Meta or TikTok pixel is installed and firing.

The website audit checklist in one table

Six lists, what each needs, how long it takes, how often to repeat it and who usually does it.

What to fix first after a website audit

83 checks produce a long list. Sort it by what each finding costs the business, not by how easy it is to fix; the easy fixes are the ones that get done in the middle of an audit, and the expensive ones are the ones that get postponed.

• A worked example. Suppose a two-truck plumbing company's audit turns up 19 findings. Three are fix-now: the estimate form has been sending to a former office manager's inbox, a site:yourdomain.com search shows only the homepage, and the phone number in the header is plain text. Seven are fix-next: water heaters, drains and repiping share one Services page, every title tag says "Home", and the reviews sit at the bottom of the About page. The remaining nine, a second font, a slow Instagram feed, a missing page-not-found page, go on next quarter's list.
• The form takes ten minutes to fix and is worth more than the other 18 findings together, which is the whole argument for sorting by cost to the business rather than by effort.

Website audit mistakes that waste the afternoon

Six mistakes come up in almost every first audit. Each has a fix that costs nothing.

• Auditing on a laptop on office Wi-Fi. The fix: the phone on cellular data, because that is where the speed and conversion lists fail.
• Auditing every page. The fix: the four or five money pages this quarter, and the rest on later passes.
• Chasing a tool's score. A speed or SEO score of 100 is not the goal; a visitor who finds the page, understands it and calls is. The fix: mark checks pass or fail against the lists, and use scores only to spot a change between passes.
• Fixing as you go. The fix: finish the lists first, then sort, then fix. The dated sheet is what next quarter compares against, and a half-finished sheet compares against nothing.
• Skipping Search Console because it looks technical. The fix: the Pages and Performance reports are two screens, and they answer the question that matters first, whether Google is sending anyone at all.
• Never re-running the audit. The fix: re-run the free audit and the stranger test after the fix-now items, and put the next full pass on the calendar before closing the sheet.

How often to audit a website

The search health, speed, content and conversion lists are a quarterly job for most small businesses, and a monthly one for a site that takes bookings or orders or that runs ads; accessibility and the technical list's login and renewal checks are yearly, while its link and HTTPS checks ride with the quarterly pass. Three events call for a partial pass in between.

• A change to the business, such as a new service, new hours or a new team member: run the content and search health lists on the pages it touches.
• A campaign, busy season or new ad spend: run the conversion and speed lists on the pages the campaign lands on, before the money is spent.
• A redesign or platform move: run every list, because rankings, redirects and forms are what a move most often loses, and confirm that the old addresses that still get traffic redirect to the matching new page.

How much a website audit costs

Theo's website audit is free, needs no login and runs on any live site. An agency audit is usually a one-off fee or the first step of a monthly retainer, and the price depends on how many pages the agency reads and whether it makes the fixes; ask which lists it covers before paying, because a technical-only audit leaves four of these six lists untouched.

The audit is rarely the real cost; the fixes are. Basic, at $29.99 a month, is the site, managed hosting and 1,500 chat credits a month for changes the owner asks for; it has no ongoing SEO program. Starter, at $69.99 a month and free for the first 30 days, adds the ongoing work that the search health, speed and technical lists turn up: keyword and competitor research, new pages and posts, technical SEO fixes, page speed work and Search Console submissions, none of which uses chat credits. Pro, at $129.99 a month, adds more weekly pages and posts, 7,000 chat credits and read-only access to the site code.

Frequently asked questions