Website Audit Checklist: 52 Checks Across 8 Categories (2026)

A website audit is a structured pass over everything that decides whether a site gets found, loads, convinces and converts. This checklist is the one Webmatik runs automatically — the same 52 checks, with the same pass thresholds — written out so you can run it by hand, hand it to a developer, or use it to judge an audit someone else sold you.

Each item gives the threshold that counts as a pass, the quickest way to test it, and where we have the data, the share of sites that fail it (from our 2026 analysis of 171 audited websites). Work through the categories in the order given: the early ones (performance, security) have the highest-payoff quick wins; the later ones (conversion, retention) are where most sites are actually weakest.

Budget two to three hours for a careful manual pass of a small site's homepage and key pages. Or run the free automated audit, which covers all 52 in about a minute and tells you which ones to fix first.

Test with PageSpeed Insights on mobile first — 61% of sites fail on mobile against 29% on desktop, so the phone score is the one that matters.

• Largest Contentful Paint (LCP) ≤ 2.5 s. The main content is visible within 2.5 seconds on mobile. 82% of sites fail this.
• First Contentful Paint (FCP) ≤ 1.8 s. Something meaningful paints within 1.8 seconds. 73% fail.
• Interaction to Next Paint (INP) ≤ 200 ms. Taps and clicks respond within 200 ms. 42% fail.
• Cumulative Layout Shift (CLS) ≤ 0.1. Nothing jumps around while loading. 13% fail — largely solved.
• Server response (TTFB) ≤ 800 ms. The first byte arrives within 800 ms; slower than that is a hosting problem no front-end fix will solve — see the TTFB guide.
• Image delivery. Images are correctly sized, compressed, in a modern format (WebP/AVIF) and lazy-loaded below the fold. 53% of sites are flagged.
• No significant unused JavaScript or CSS. Scripts and styles that never run on the page are removed or deferred. 61% flagged for unused JS, 43% for unused CSS.
• Cache lifetimes for static assets. Images, fonts, scripts and styles carry long cache headers (a year for versioned files). 44% fail.

Run these on the homepage and the three or four pages that earn the most traffic — a homepage that passes while the product pages fail is the usual pattern.

• Unique title tag, 30–60 characters, keyword first. Every key page has its own. 19% of key pages fail.
• Meta description, 70–155 characters, written for the click. 43% of key pages have none.
• Exactly one H1 that states what the page is about. 42% of key pages fail.
• Canonical tag on every page. Points to the preferred URL, prevents duplicate-content splits. 24% fail.
• Structured data for the page type. Organization on the homepage; Product, Article, FAQPage, LocalBusiness where relevant — validated with no errors. 25% have none.
• Alt text on content images. Descriptive, not keyword-stuffed; decorative images marked empty. 57% of sites have images missing it.
• robots.txt and XML sitemap present, valid and linked. Nothing important disallowed; sitemap listed in robots.txt and submitted to Search Console.
• Analytics installed and receiving data. You cannot improve what you do not measure. 38% of sites have no analytics at all.
• Social sharing preview (Open Graph and X card). Title, description and a 1200×630 image, so links look right when shared. 23% fail.

Whether AI assistants can find, read, quote and recommend you. The newest category and the one with the widest gap: most businesses are not in the answer.

• llms.txt published at the site root. A short plain-text description of the site and its key pages. 62% have none.
• AI crawler rules in robots.txt are deliberate. GPTBot, ClaudeBot, PerplexityBot and Google-Extended allowed unless you have chosen otherwise. 15% block them, often by accident.
• Content Signals declared. A machine-readable statement of what AI may do with your content (search, AI answers, training). 90% publish none.
• Answer-first content structure. Key pages open with a literal one-sentence statement of what/for whom/where; headings are questions or plain topics; facts are in lists and tables, not buried in prose. 35% fail.
• FAQ / Q&A content with FAQPage schema. Real customer questions answered in two or three plain sentences. 40% have none.
• Trust and credibility signals (E-E-A-T). Named authors, an About page with real people, contact details, credentials, dates on content. 45% weak.

The category where the median site scores 60 and the fixes are mostly copy and layout, not code.

• Value proposition above the fold. Within the first screen, a visitor can say what you offer, for whom, and why you rather than the alternative — see writing a value proposition.
• One clear primary call to action, visually dominant, repeated at natural decision points, with a verb that says what happens next.
• Trust signals on money pages. Reviews with names, client logos, guarantees, certifications, security badges — near the CTA, not on a separate page. 72% of sites have none.
• Pricing visible or findable in one click. Exact prices, or honest ranges with what drives them. 63% hide it.
• A way to ask a question — live chat, a visible phone number, or a contact form that promises a response time. 82% have no chat or visible support.
• Forms ask only for what you need. Every field beyond name and email costs conversions; labels are visible; errors are explained inline — see form design.

Test on a real phone, not a resized browser window.

• Mobile viewport set and tap targets at least 44×44 px with space between them — see tap target size.
• Every key page reachable within three clicks from the homepage; navigation labels say what is behind them; there is a search on sites with more than ~50 pages.
• Readable body text. 16 px or larger, line height around 1.5, and 50–75 characters per line — see line length and readability.
• Clear visual hierarchy. One dominant element per screen; headings, size, weight and spacing make the reading order obvious without reading.
• Consistency. Buttons, links, colours and spacing behave the same everywhere; nothing looks clickable that is not, and vice versa.

The weakest category on the web — 49% of sites score under 50 — because most sites are built for the first visit only.

• A reason to come back stated on the site — new content, new stock, an account, a community — and a way to be told about it.
• Email capture that offers something specific in exchange, placed where intent is highest (after content, at checkout, on exit) rather than as an instant pop-up — see email retention.
• Content cadence. Something new is published on a schedule you actually keep; the most recent item is dated within the last month or two.
• Engagement hooks — related content, "you might also like", saved items, progress — that give a returning visitor a next step.

Test the first three with a keyboard alone (Tab, Shift+Tab, Enter) and a screen reader (VoiceOver on Mac, NVDA on Windows). Roughly 1 in 6 visitors has a disability that affects how they use the web; most of these checks overlap with SEO.

• Skip-to-content link as the first focusable element. 69% of sites have none.
• Logical heading structure. One H1, no skipped levels, headings describe the sections. 66% fail.
• Landmarks for screen readers — header, nav, main, footer — so the page can be navigated by region. 46% fail.
• Full keyboard operability. Every control reachable and usable by keyboard, with a visible focus state, in a sensible order. 43% fail.
• Every form field has a programmatic label. Placeholder text does not count. 39% fail.
• Colour contrast of at least 4.5:1 for body text and 3:1 for large text and UI components. 33% fail.
• Pinch-to-zoom allowed. No user-scalable=no or maximum-scale=1 in the viewport tag. 16% block it.

Test with a single request: curl -I https://yoursite.com shows every header. All of these are configuration, not development — an hour at the server or CDN clears the lot. See security headers explained.

• HTTPS everywhere with no mixed content. All resources load over HTTPS; HTTP redirects to HTTPS. 11% still have mixed content.
• HSTS (Strict-Transport-Security) with a max-age of at least six months. 59% missing.
• Content-Security-Policy — at minimum a policy that restricts script sources. 72% missing.
• Clickjacking protection — X-Frame-Options or CSP frame-ancestors. 64% missing.
• X-Content-Type-Options: nosniff. 58% missing.
• Referrer-Policy set (typically strict-origin-when-cross-origin). 81% missing.
• Cookie flags. Session cookies carry Secure, HttpOnly and SameSite — see cookie security. 41% fail.

Fifty-two items is a list, not a plan. Prioritise by effort against how many visitors each failure touches:

1. Security headers — one hour, clears up to seven checks, protects every visitor.
2. Images and unused code — the two most common performance flags and the main cause of the 82% LCP failure rate. A day of work on most sites.
3. Trust signals and visible pricing — copy and layout changes with the most direct effect on revenue.
4. llms.txt, Content Signals and a real FAQ — an afternoon that opens the AI-search channel most competitors have not touched.
5. Skip link, headings, form labels — the accessibility fixes that also help search engines parse the page.

Then re-audit. A site that is checked once a quarter and after every significant change stays ahead of the regressions that every CMS update, plugin and campaign introduces. The free Webmatik audit runs all 52 checks in about a minute and puts them in this priority order for your specific site; paid plans re-run it on a schedule and alert you when something breaks.