Website Audit Checklist

How to use this checklist

Work through it in the order given. Crawlability comes first because an indexing problem makes every other improvement invisible, and security comes last only because it is usually pass or fail rather than a matter of degree. Sample by template rather than by page: audit one URL of each distinct template thoroughly instead of skimming a hundred near-identical pages.

For each item, record the pass condition, the URLs that fail it, and a severity using the severity rules. A list of failures without severity is a backlog nobody will order correctly later.

Technical & crawlability

• robots.txt is valid and permissive where it matters — Fetch it directly. It returns 200, parses cleanly, and blocks nothing you need indexed. Check for a stale Disallow: / left over from a staging deploy.
• Every important page is indexable — No unintended noindex in meta tags or X-Robots-Tag headers. Verify on the rendered page, since directives are sometimes written by script.
• A sitemap exists and is accurate — It lists canonical, indexable URLs only — no redirects, no 404s, no noindex pages — and is referenced from robots.txt.
• Canonical tags are correct — One self-referencing canonical per URL, absolute, on HTTPS, on the preferred hostname. See missing canonical.
• URL structure is shallow and consistent — Important pages within three clicks of the home page; consistent casing and trailing slashes; no duplicate URLs reachable by more than one path.
• No broken links or redirect chains — Internal links resolve in one hop with a 200. See broken links.
• Error handling is honest — Missing URLs return 404 or 410, not 200 with an apologetic page. Error pages are useful and are not themselves indexable.

Performance

• LCP under 2.5s on mobile — Measure on a throttled mobile profile, several runs, median result. Identify the LCP element on each page.
• INP under 200ms — Test real interactions — menu open, filter change, add to cart — not just page load.
• CLS under 0.1 — Images and embeds have width and height, fonts load without reflow, and nothing injects above existing content.
• Images are sized and optimised — File size proportional to rendered dimensions, modern formats where supported, lazy loading below the fold. See large images.
• Third-party scripts justify their cost — Inventory every third-party request with its size and main-thread time. Remove anything nobody can name an owner for.
• A viewport meta tag is present and sane — width=device-width, initial-scale=1, with no maximum-scale blocking zoom. See missing viewport meta.

SEO & content

• Every page has a unique title — Present, distinct, front-loaded, roughly 50–60 characters. See missing title tag.
• Every page has a unique meta description — Written for the click, not stuffed. See missing meta description.
• One H1, then a descending heading order — No skipped levels, no headings chosen for their font size. See heading structure.
• Structured data is valid and honest — JSON-LD parses, uses appropriate types, and describes content that is actually on the page.
• Open Graph and Twitter card tags are set — Title, description, image and URL, so shared links render rather than degrade.
• No thin or duplicate content competing with itself — Near-identical templates, parameterised variants and paginated series each have one canonical destination.
• Internal links reach everything and describe it — No orphaned pages; anchor text says where the link goes, not “learn more”.

Accessibility & UX

• Text contrast meets WCAG AA — 4.5:1 for body text, 3:1 for large text and interface elements — in every state, including hover and focus. See low colour contrast.
• Every image has an appropriate alt attribute — Meaningful images described, decorative images given alt="". See missing alt text.
• Every form field has a real label — Programmatically associated and visible. Placeholders are not labels. See missing form labels.
• The whole site is keyboard operable — Logical tab order, visible focus, no traps, a working skip link, and every control reachable without a mouse.
• Key journeys work with a screen reader — Names, roles and states announced; dynamic updates announced; reading order matches visual order.
• Layout holds at 320px and at 400% zoom — No horizontal scrolling, no clipped content, touch targets at least 44 by 44 pixels.

Conversion & analytics

• Analytics is installed once and firing — One GA4 property, no duplicate tags, and events verified in real time rather than assumed.
• Conversions are actually tracked — Every meaningful action — form submit, checkout step, call click — maps to a defined event with a value.

Security

• HTTPS is enforced everywhere, in one hop — Every HTTP URL, www and non-www, redirects to the canonical HTTPS host. See no HTTPS / mixed content.
• The certificate is valid, complete and current — Correct hostnames including subdomains, a complete chain, and comfortably inside its expiry window.
• No mixed content — No HTTP scripts, styles, images or iframes on HTTPS pages.
• Nothing is exposed that should not be — Directory listings off; no reachable backup, config or source-control files; admin endpoints not answering anonymously.

What a professional audit adds

Most of the list above can be checked with browser dev tools, a crawler and patience. What is hard to do for yourself is the part after detection: deciding which forty of two hundred findings matter, agreeing what they cost, and sequencing the work so the first week of effort recovers most of the loss. That judgement — plus the browser-based interaction testing and the live one-hour readout — is what a W3Audit engagement is for. The rules it applies are published in the methodology; the categories are broken down on the comprehensive audit page.