Website Audit Checklist: 20 Checks Every Site Should Pass

The exact 20-point website audit checklist we run on every business site: security, mobile readiness, SEO fundamentals, performance, and trust signals, with why each check matters.

A good website audit answers one question: is this site helping the business or costing it customers? Below is the checklist we run automatically on every site, grouped the way you should work through it by hand. Want it done for you at scale? WebsiteLeadFinder runs it on every business in a city automatically.

Security and trust

1. HTTPS enabled. Browsers label plain HTTP sites as Not Secure. That warning alone loses form fills and calls.
2. Valid SSL certificate. An expired or misconfigured certificate throws a full-page browser warning that most visitors will never click past.
3. Current copyright year. A footer that says 2017 tells every visitor nobody is home. It is the fastest tell of an abandoned site.

Mobile readiness

4. Viewport configured. Without the viewport meta tag phones render a shrunken desktop page.
5. Responsive layout. Media queries or a responsive framework. Most local searches happen on a phone, so this is the single highest-impact fix.

SEO fundamentals

6. Meta title. Unique, descriptive, and under about 60 characters. This is the headline of the Google result.
7. Meta description. A compelling 120 to 160 character pitch. Google often rewrites bad ones, but a good one lifts clicks.
8. Canonical URL. Prevents duplicate-content dilution across www, non-www, and tracking-parameter variants.
9. Structured data. LocalBusiness or Organization schema helps Google show rich results, hours, and reviews.
10. robots.txt present. Missing robots.txt rarely breaks a site, but it signals nobody technical is maintaining it.
11. XML sitemap. Helps crawlers find every page, especially on sites with weak internal linking.
12. Heading hierarchy. One h1, logical h2 and h3 nesting. Screen readers and crawlers both rely on it.

Code quality and accessibility

13. Modern HTML5 doctype. Sites still using table layouts or font tags date to another era of the web and usually look like it.
14. Semantic elements. header, nav, main, and footer instead of anonymous divs.
15. Alt text on images. An accessibility requirement and an SEO win in one.

Performance

16. Server response under 600ms. Slow first bytes drag every other metric down.
17. Compression enabled. gzip or brotli should be on for every text asset.
18. Caching headers. Repeat visits should not re-download the whole site.
19. Modern image formats. WebP or AVIF instead of multi-megabyte JPEGs.
20. Lazy loading. Below-the-fold images should wait their turn.

Scoring the audit

Weight the checks, do not just count them. Security and mobile failures cost real customers today; a missing sitemap is a minor cleanup. Our scoring puts a site at 80 or above when it is healthy, 55 to 79 when it has clear gaps, and below 55 when the site is actively hurting the business.

For agencies and freelancers, every failed check is a talking point in your pitch. See how to sell website redesigns for turning audit results into signed proposals, and use the ROI calculator to price the work with confidence.