Website Audit Checklist: 40 Points for Small Business
By Nemanja Vukmirović, Lizzard Solutions. Updated November 8, 2026.
You know the site looks dated, the contact form feels slow on a phone, and you are not sure what to fix first. A website audit checklist turns that into a scored list you can finish in one sitting.
This template has 40 checks in eight areas, from access and speed to SEO, security, conversions and measurement. It covers the same ground as a free website audit, so you can score the site yourself.
TL;DR
- A website audit checklist is a structured list of what to inspect on a live site, from HTTPS and titles to forms and analytics.
- Score each of the 40 points as yes (1), partial (0.5) or no (0). The total shows where to start.
- Fix failures that block visitors or search first: HTTPS, mobile layout, contact paths, titles and backups.
What Is a Website Audit Checklist?
A website audit checklist is a repeatable list of checks that tells you whether a site is findable, fast, secure and able to turn visitors into enquiries. You open the live pages, mark each item as yes, partial or no, and use the score to decide what to fix this week instead of redesigning everything at once.
It is broader than an SEO review, which looks at how search engines read the site. A full audit also covers security, speed, trust and whether someone can contact you. For that slice, see our SEO audit guide for small business.
Key takeaway
The checklist is a decision tool. Its job is to rank problems, not to produce a report nobody acts on.
Action for today: open your homepage on a phone and a desktop before you start scoring.
How to Score This Website Audit Checklist
- Use the live site, not a staging copy or a screenshot of an old design.
- Mark yes (1 point) when the item clearly passes, partial (0.5) when it works only on some pages, and no (0) when it fails or you cannot tell.
- If you cannot verify an item in five minutes, mark it no. Guessing hides the gaps.
- Add the points (maximum 40), then look at the weakest section, not only the total.
| Total score | What it usually means | What to do first |
|---|---|---|
| 32–40 | A solid base with a few leftover gaps | Fix the remaining nos, then re-check quarterly |
| 24–31 | Usable site with clear leaks | Prioritize HTTPS, speed, titles, forms and backups |
| 0–23 | Visitors or search are hitting friction | Restore access, contact paths and basic security |
These ranges are a rule of thumb from the audits we run, not a published standard.
Action for today: copy the 40 items into a sheet with yes / partial / no and a notes column.
Checks 1–10: Access, Speed and First Impressions
If people cannot load the site or read it on a phone, nothing else on this website audit checklist matters yet. Google describes Core Web Vitals (LCP, INP and CLS) as signals for loading, interactivity and stability. Measure a public URL with PageSpeed Insights.
| Check | What “yes” looks like |
|---|---|
| 1. HTTPS everywhere | The padlock is present and HTTP redirects to HTTPS. |
| 2. Mobile layout | Text is readable; nothing forces sideways scrolling. |
| 3. Contact details visible | Phone, email or a contact path is easy to find. |
| 4. Helpful 404 page | Unknown URLs offer links back to home or contact. |
| 5. Key pages respond | Home, services and contact load without errors or loops. |
| 6. Main content loads promptly | The homepage hero or headline is not a long blank wait. |
| 7. Taps feel responsive | Buttons and menus react; the page does not freeze. |
| 8. Layout stays stable | Content does not jump as images or banners load. |
| 9. Images are reasonably sized | Hero photos are compressed, not multi‑megabyte files. |
| 10. Hosting is not the bottleneck | Repeat visits do not re-download the same heavy files. |
Items 6–8 map to LCP, INP and CLS. Our explainer of Core Web Vitals for owners translates those names into what a visitor feels.
Key takeaway
A slow or broken mobile homepage loses people before they read your offer.
Action for today: run your homepage through PageSpeed Insights and note the LCP, INP and CLS labels.
Checks 11–20: On-page and Technical SEO
These items follow Google's SEO starter guide: unique titles, clear headings, a sitemap and pages that are allowed to be indexed. They are the cheapest wins on most small-business sites.
| Check | What “yes” looks like |
|---|---|
| 11. Unique title tag | Each key page names the business and the page topic. |
| 12. Unique meta description | The search snippet states a benefit and is not copied. |
| 13. One clear H1 | The main heading matches what the page is about. |
| 14. Descriptive image alt text | Photos describe the image, not “IMG_4021”. |
| 15. Internal links with real anchors | Important pages link to each other in plain language. |
| 16. XML sitemap | A sitemap lists the pages you want found. |
| 17. robots.txt is not blocking you | It does not disallow /blog, /services or similar sections. |
| 18. Preferred URLs | www/non-www and HTTP/HTTPS resolve to one address. |
| 19. Pages are indexable | Key pages are not marked noindex by accident. |
| 20. Useful structured data | Organization or LocalBusiness markup matches real details. |
If titles, indexability or the sitemap fail, deeper content work will not show up in search. That is why a structured SEO audit starts here.
Action for today: search Google for site:yourdomain.com and compare the results with the pages you want found.
Checks 21–30: Security and Trust
Visitors decide quickly whether they will send a message or a card number. A current certificate, basic headers and an honest about page matter more than a new color palette. MDN's HTTP headers reference explains what each response header does.
| Check | What “yes” looks like |
|---|---|
| 21. Valid certificate | The certificate is current and there is no mixed content. |
| 22. Basic security headers | Responses set frame control, referrer policy and nosniff. |
| 23. Forms resist junk mail | Contact forms have some form of spam protection. |
| 24. Software is updated | CMS, plugins or dependencies are on supported versions. |
| 25. Backups you have tested | You have a recent backup and have restored it once. |
| 26. A clear About page | Visitors can see who you are and how to reach a person. |
| 27. Services in plain language | Each offer states what you do and who it is for. |
| 28. Privacy policy | A policy explains form and analytics data you collect. |
| 29. Consistent name and phone | Location details match what you show on maps. |
| 30. Some proof | Reviews or permissioned examples exist, not only adjectives. |
Watch out
A missing backup is not a documentation issue. It is the item that turns a hacked plugin into a week of downtime.
Action for today: confirm today's backup, then write the date you last tested a restore.
Checks 31–40: Conversions and Measurement
A site can look polished and still fail at the only job that pays: turning a visitor into a call, a form or a booking. Measurement tells you whether a later change helped.
| Check | What “yes” looks like |
|---|---|
| 31. A primary call to action | The homepage states one next step above the fold. |
| 32. The form works on phone and desktop | You submitted it on both and received the message. |
| 33. A confirmation after submit | The visitor sees a thank-you page or success message. |
| 34. Tappable phone number | The number uses a click-to-call link on mobile. |
| 35. One obvious next step | Contact or booking is easy to find from every key page. |
| 36. Analytics you can log into | A working property is installed and someone can open it. |
| 37. Search Console connected | You can see indexing issues and queries that already work. |
| 38. One conversion tracked | Form submits, bookings or call clicks are recorded. |
| 39. A decision on AI crawlers | robots.txt reflects what you want AI search to read. |
| 40. Plain facts AI can quote | Who you are, where you work and what you do are written out. |
When you later receive a longer report, our guide on how to read a website audit report shows which sections to act on first.
Key takeaway
If you cannot submit your own contact form on a phone, treat that as a priority bug.
Action for today: send a test enquiry from your phone and confirm it arrives.
A Worked Example: Scoring a Local Business Site
Imagine a neighborhood bakery site, Pekara Sunce in Bor. The owner refreshed the homepage last year and now wonders why calls do not match foot traffic.
| Item | Score | What we found |
|---|---|---|
| 1. HTTPS | Yes | Valid certificate; HTTP redirects. |
| 9. Image weight | No | Uncompressed multi‑megabyte hero JPEG. |
| 11. Title tags | No | Every page is titled “Home | Pekara Sunce”. |
| 16. Sitemap | No | No XML sitemap; seasonal pages orphaned. |
| 32. Form on mobile | Yes | A test message from a phone arrived. |
| 34. Tappable phone | No | Number is plain text, so visitors must type it. |
| 37. Search Console | No | The property was never verified. |
A site like this often lands in the mid‑20s. First work is compressing the hero image, writing unique titles, making the phone tappable and connecting Search Console, not a new look.
Action for today: pick one page on your site and score the first ten items before you look at design ideas.
What Your Score Means and What to Fix First
After you total the points, resist fixing everything at once. Work in this order:
- Access and contact. HTTPS, mobile layout, working forms and a tappable phone number.
- Security basics. Certificate, updates and a backup you have restored once.
- Keeping it that way. After the fixes, follow our website maintenance checklist so the score does not slip back.
- Findability. Titles, indexability, sitemap and consistent contact details.
- Proof and measurement. Examples or reviews, analytics and one tracked conversion.
If you would rather not inspect forty items by hand, run our free website audit on your URL. It checks many of the same technical points automatically. Use this list for judgment calls a tool cannot make, such as whether the offer is clear. For help reading the results, see our website and IT services.
Action for today: circle the three nos that block visitors today and give each an owner and a date.
Website Audit Checklist: FAQ
What is a website audit checklist?
A website audit checklist is a scored list covering access, speed, SEO, security, content, conversions and analytics. You mark each item yes, partial or no on the live site. The total shows what to fix first, before anyone starts a redesign.
How often should I audit my website?
Do a full pass after a redesign, platform move or major content change, and a lighter pass every quarter. Titles, plugins, certificates and forms can fail quietly, so treat the checklist as a habit rather than a one-off project.
What is the difference between a website audit and an SEO audit?
An SEO audit focuses on how search engines crawl, index and rank the site. A website audit also checks speed, security, trust content and whether visitors can contact you. SEO issues appear inside a wider audit, but they are not the whole picture.
Can I audit my website myself for free?
Yes. This 40-point list is meant for an owner or marketer without developer access, paired with free tools such as PageSpeed Insights and Search Console. Automated checks save time; they do not replace reading your pages as a customer would.
How long does a website audit take?
A first pass through these 40 items usually takes one focused session if you can log into analytics and hosting. Fixing titles, images or a form takes longer than finding the problems.
A website audit checklist will not redesign your brand, but it will stop you guessing. Score the 40 points, fix what blocks visitors and search, then re-check. For a faster technical pass, start with the free website check.
Want a second look at your score?
Send us your URL and the three items you are least sure about. We will say what we would fix first, at no obligation.
Book a free consultation