A website rarely breaks all at once. It drifts. A plugin update slows the homepage down, a certificate quietly expires, a contact form stops sending, and the hours on your contact page are still the ones you set two summers ago. Nobody tells you, because the people who hit those problems just leave.
This website audit checklist gives you 10 checks across six areas, and each one comes with what “good” looks like so you know when to stop. You won’t need a developer for most of it. A browser, your phone, and access to your hosting control panel will get you through the list in an afternoon. Here’s the short version first, then the detail behind each check.
The 10-Point Website Audit Checklist
- Measure Core Web Vitals on your busiest pages
- Cut image weight and turn on caching
- Walk your top three pages on a real phone
- Confirm your backups actually ran
- Restore a backup to a test copy
- Check your SSL certificate and its renewal date
- Update your CMS core, themes, and plugins
- Place a real test order or booking
- Confirm the confirmation emails arrive
- Audit hours, pricing, contact details, and old campaign pages
Speed & Core Web Vitals
Google looks at three numbers to judge how a page feels to a real visitor, and they’re grouped together as Core Web Vitals. Largest Contentful Paint (LCP) measures how long the main content takes to appear, and you want it under 2.5 seconds. Interaction to Next Paint (INP) measures how quickly the page responds when someone taps or clicks, and the target is under 200 milliseconds. Cumulative Layout Shift (CLS) measures how much the page jumps around while it loads, and you want a score of 0.1 or lower.
Check one: measure the pages that matter. Run your homepage, your top product or service page, and your checkout through Google PageSpeed Insights. Then open the Core Web Vitals report in Google Search Console, which shows what real visitors experienced over the past 28 days rather than a single lab test. If the two disagree, trust Search Console. Good looks like: all three metrics in the green band on the pages that earn you money.
Check two: fix the two most common causes. Oversized images and no caching account for most slow pages. Compress every image with TinyPNG and save it as WEBP, then turn on page caching. Re-measure afterward rather than assuming it worked. If your scores are still poor once images and caching are sorted, the bottleneck is usually your theme, a heavy page builder, or a server that’s out of headroom, in that order. Good looks like: a measurable drop in load time between your before and after test, rather than a higher score.
The Mobile Experience
Most of your traffic arrives on a phone, and a desktop preview won’t show you what those visitors are dealing with.
Check three: walk your top three pages on a real phone. Not the responsive preview in your browser, but an actual device on mobile data. Load your homepage, one product or service page, and your contact or checkout page, and pay attention to a few things. Are the buttons big enough to tap without zooming? Does the menu open and close properly? Do pop-ups, cookie notices, or banners cover the content, and can you close them with one thumb? Is any text so small you’re squinting?
Fix what you find in that order: anything blocking a purchase first, anything blocking navigation second, cosmetic issues last. Good looks like: you can get from your homepage to a completed enquiry or purchase on a phone without pinching, zooming, or losing your place.
Backups & Restore Testing
A backup you’ve never restored isn’t a backup, it’s a hope. This is the check almost everyone skips, and it’s the one that decides how bad your worst day gets.
Check four: confirm your backups actually ran. Open your backup tool and look at the date on the most recent file. Daily is the right cadence for a site that changes often, and the copies need to live somewhere other than your web server, so one server problem doesn’t take your backups with it. Check that the backup covers your database as well as your files, since a files-only backup won’t bring your orders, posts, or settings back. Good looks like: a dated backup from the last 24 hours, stored off-server, covering files and database.
Check five: restore one. Pull your latest backup into a staging copy or a test subdomain and click through the result. Are the products there? Do the images load? Is the database intact? A restore that takes 20 minutes on a quiet Tuesday is a different experience from one you’re attempting for the first time during an outage. Good looks like: a working copy of your site, restored by you, start to finish, with a time you’ve written down.
Security & SSL
Check six: your SSL certificate and its renewal date. SSL, short for Secure Sockets Layer, is what puts the padlock in the address bar and encrypts what passes between your site and your visitors. Load your site and confirm the padlock appears with no warnings. Check the certificate’s expiry date and make sure auto-renewal is switched on, because a certificate that lapses shows every visitor a browser warning until someone notices. Confirm that visitors typing the http version get redirected to https, and look for mixed content warnings, which happen when a secure page loads an image or script over an insecure connection. Good looks like: a valid certificate, auto-renewal on, no mixed content, and http redirecting to https across the whole site.
Check seven: update your CMS core, themes, and plugins. Take a backup first, then update everything and click through your key pages afterward. Delete plugins and themes you’re no longer using, since inactive code still carries vulnerabilities. Confirm your malware scanning is active, and turn on two-factor authentication for every admin account. While you’re in there, remove admin accounts belonging to people who’ve moved on. Good looks like: nothing pending in your updates screen, no unused extensions installed, and an admin user list you recognize.
Forms & Checkout
Plenty of sites look fine and quietly lose sales at the last step. The only way to know is to go through it yourself, all the way to the end.
Check eight: place a real test order or booking. Use a real card, buy something cheap, and complete the purchase. Confirm your payment gateway is in live mode rather than test mode, and check that taxes, shipping rates, and any discount codes calculate the way you expect. Then refund yourself. Do the same for a booking form or a quote request, and repeat the whole thing on your phone, because mobile checkout often breaks in ways desktop doesn’t. Good looks like: one completed transaction and one completed form submission, both done on a phone, both correct to the penny.
Check nine: confirm the emails arrive. The order confirmation, the receipt, the shipping notice, and the notification that lands in your own inbox all need to work. Check your spam folder as well as your inbox, then send a test form submission to a Gmail address and a Microsoft 365 address to see how both handle it. A contact form that fails silently for two months is a stack of leads you never knew about. Good looks like: every automated message arriving in the inbox, not the spam folder, on two different email providers.
Content Accuracy
Check ten: audit the details people came to your site to find. Your hours, including seasonal changes and the dates you’re closed. Your phone number, email address, and physical address, on your site and on your Google Business Profile, matching each other exactly. Your prices, which may have moved since you last touched those pages. Your shipping or turnaround times and your return policy, stated plainly, so nobody has to email you to ask.
Then look at your old campaign and seasonal pages. If a landing page still lists last year’s dates or a product you’ve discontinued, either update it or take it down, because customers land on those pages from old links and search results. Run a link checker across the site while you’re there, and set up redirects for anything you’ve removed, so a visitor following an old link ends up somewhere useful instead of on a 404. Good looks like: no broken links, no page contradicting another page, and nothing on the site you’d be embarrassed for a customer to read.
How Often to Run This Audit
Running the full list every quarter keeps most sites out of trouble. A few checks deserve a tighter cycle, and a few moments deserve an audit, whatever the calendar says.
- Weekly: Apply CMS, theme, and plugin updates as they’re released
- Monthly: Submit a test form and confirm the notification arrives
- Quarterly: The full 10-point list, including a restore test
- Twice a year: A full content pass across hours, pricing, and policies
Run the whole list again, off-schedule, after a redesign, after a migration to a new host, after a theme or page builder change, and roughly a month before any period you expect to be busy. Those four moments cause most of the breakage anyone finds in a routine audit, and catching it a month early costs you an afternoon instead of a weekend.
What to Do With What You Find
Work the list top to bottom and write down what fails, even the small things you don’t fix that day. An audit is only useful if the second one can be compared to the first, and a short list of dated notes turns this from a chore into a record of your site getting steadier.
Some of what surfaces isn’t yours to fix. Slow server response times, backups that don’t cover the database, and certificates nobody renews are usually signs your hosting is doing less than it should. If that’s where your audit lands, our PapaSquad experts are on the phone, chat, and email 24/7 and will happily walk through your results with you.
Dedicated resources that scale with your growth.
Root access, NVMe storage up to 3x faster than standard SSDs, DDoS protection and firewall, and your choice of managed or unmanaged from as low as $2.95 per month with 99.9% uptime and a 30-day money-back guarantee.
