Direct answer
A complete website audit reviews whether a public page can be discovered, trusted, understood, and used.
A complete website audit reviews whether a public page can be discovered, trusted, understood, and used. Start with availability and crawl access, then examine SEO, public security, accessibility, and design evidence. Prioritize severe failures and blocked user paths before cosmetic cleanup, make one controlled change at a time, and rescan the live result.
The checklist combines FreeScan's public audit model with primary search, accessibility, and web-platform references. It is not a certification or penetration test.
Audit checklist
Inspect each layer and record the evidence behind the result.
| Area | What to verify | Why it matters |
|---|---|---|
| Availability | Page loads at the intended public URL without redirect loops, certificate errors, or runtime failures. | A broken foundation makes every downstream check irrelevant. |
| Discovery | Robots rules, canonical URL, sitemap routing, titles, descriptions, headings, and structured data agree. | Conflicting discovery signals can hide or misrepresent the page. |
| Public security | HTTPS, headers, mixed content, form transport, and recognizable exposed-file signatures are reviewed. | Trust and data-handling failures can interrupt high-value actions. |
| Accessibility | Semantics, labels, keyboard use, alternatives, contrast, reflow, and errors receive automated and manual review. | A technically live page can still block people from using it. |
| Design and runtime | Hierarchy, primary action, responsive layout, stability, performance signals, and console health are checked. | Friction can waste traffic that discovery work successfully earned. |
Start with the outcome
Define what must keep working before you inspect what could improve.
Write down the page's intended audience, primary action, canonical URL, and critical dependencies. This turns the audit into a review of a real user outcome instead of an abstract pursuit of a perfect score.
Capture a baseline before changing anything. The public URL, screenshots, category scores, failed checks, console state, and conversion path give you a comparison point and a rollback signal.
- Record the public URL and completed scan time.
- Test the primary action without submitting sensitive or destructive data.
- Name the routes and services that cannot regress.
Evidence before totals
A category score directs attention; the check evidence explains the work.
Two pages with the same total can have completely different risks. One may have a critical public exposure while another has several lower-impact metadata issues. Open the evidence, confirm it against the live page, and understand the consequence before creating a task.
Treat unknown results honestly. They mean the signal could not be verified safely, not that the site passed or failed. Manual review or a later scan may be the correct response.
Safe remediation
Turn each verified finding into a small change with a measurable public result.
A good task names the observed evidence, likely implementation surface, acceptance criteria, tests, deployment plan, and rollback condition. Keep unrelated refactors out of the fix so reviewers can understand its blast radius.
After deployment, verify the original user path first. Then confirm the intended audit signal and watch adjacent routes, logs, and performance before declaring the work complete.
Common mistakes
Avoid conclusions that the available evidence cannot support.
01
Chasing 100 before fixing the critical path
A polished total cannot compensate for a blocked form, exposed secret, broken canonical, or unusable control.
02
Treating automated output as final truth
Public scanners have bounded access. Reproduce findings and add qualified manual testing where the tool cannot observe context.
03
Bundling unrelated fixes
Large mixed changes increase regression risk and make it difficult to connect a result to its cause.
Audit workflow
How to complete a website audit safely
Step 1
Confirm the page and critical paths are available
Load the public page on desktop and mobile, confirm its intended canonical URL, and identify the conversion paths that must remain operational.
Step 2
Collect evidence across all four categories
Review crawl and metadata signals, public security configuration, accessible structure and controls, and rendered design behavior.
Step 3
Prioritize by consequence
Address critical exposure, blocked discovery, unusable controls, and broken conversion paths before low-impact cleanup.
Step 4
Change, verify, and rescan
Use a narrowly scoped implementation, run regression checks, observe the deployment, and rescan the public URL.
Collect current evidence for the public page before creating remediation work.
FAQ
The complete website audit checklist FAQ
What should a complete website audit include?
It should include crawl and indexing signals, metadata and structure, public security configuration, accessibility evidence, responsive and runtime behavior, and the page's primary user journey.
How often should a website be audited?
Audit after meaningful releases, platform or template changes, incidents, and major content migrations. A recurring scan can also catch public regressions between releases.
Should I fix every audit warning?
No. Verify the evidence and prioritize by severity, points lost, user impact, and business context. Some unknown results need manual review rather than a code change.
Can an automated audit prove a site is accessible or secure?
No. Automated public checks identify useful evidence, but accessibility requires knowledgeable human evaluation and security can require authenticated review and penetration testing.
Primary references
Standards and platform documentation used for this guide.
Technical summary
The complete website audit checklist in five statements
- A complete website audit covers discovery, security, accessibility, and design rather than treating SEO as the entire website.
- Availability, crawl access, and critical user paths should be checked before lower-impact refinements.
- Audit totals are summaries; individual evidence, severity, category impact, and user consequences determine priority.
- Automated evidence should be combined with manual review, especially for accessibility and complete user journeys.
- Safe implementation uses small changes, explicit acceptance criteria, regression testing, deployment monitoring, and a live rescan.
