The website audit checklist
Every issue our free website audit looks for: 44 checks across security, performance, SEO, accessibility, WordPress and copy. Each guide explains why it matters and exactly how to fix it.
Scan my siteSecurity (12)
- Content-Security-Policy is too permissiveA CSP that allows 'unsafe-inline' scripts or any origin blocks almost nothing an attacker would try.
- Forms submitted over plain HTTPAnything typed into these forms, such as emails, messages or passwords, travels across the internet readable by anyone on the path.
- HTTP does not redirect to HTTPSVisitors who type your domain or follow old links land on the insecure version, which can be intercepted before they ever reach HTTPS.
- Missing or leaky Referrer-PolicyFull URLs, including paths and query strings that may contain identifiers, are sent to every third party your pages link to or load.
- Missing or weak Strict-Transport-SecurityHSTS tells browsers to always use HTTPS for your domain, closing the window where a first plain-HTTP request can be hijacked.
- Missing X-Content-Type-OptionsWithout `nosniff`, browsers may guess a file's type and execute an uploaded file as script.
- Mixed content on an HTTPS pageAssets loaded over plain HTTP can be tampered with in transit, and browsers block or warn about them, breaking parts of the page.
- No clickjacking protectionAny site can embed yours in an invisible frame and trick visitors into clicking buttons they can't see.
- No Content-Security-PolicyA CSP limits where scripts can load from, so a single cross-site scripting bug can't easily run attacker code or steal sessions.
- No HTTPSWithout HTTPS, anyone on the network path can read or modify what visitors see and submit.
- No Permissions-PolicyEmbedded third-party content can ask for sensitive browser features (camera, microphone, location) on your pages.
- Server software versions exposedExact version numbers in response headers let attackers match your stack to known vulnerabilities without any probing.
Performance (10)
- High Total Blocking TimeJavaScript keeps the main thread busy, so the page looks ready but ignores taps and clicks.
- Homepage returns an error statusSearch engines drop pages that answer with 4xx/5xx, and visitors see an error instead of your site.
- Layout shifts while loadingContent jumping around makes people mis-click and is a Core Web Vitals ranking signal.
- Many inline scriptsEach inline script blocks parsing and makes a strict Content-Security-Policy harder.
- Poor Lighthouse performance scoreGoogle's lab test shows the page loads slowly on a mid-range phone, which costs visitors and search ranking.
- Site did not respondIf our scanner can't load your homepage, some visitors and search engines can't either.
- Slow interaction response (INP)Real visitors wait too long after a click or tap before the page responds.
- Slow Largest Contentful PaintLCP measures when the main content appears.
- Too many external scriptsEvery script is a request and often blocks rendering; dozens of them slow every visit.
- Very heavy HTMLLarge HTML documents delay first render, especially on mobile connections, before any images or scripts even start.
SEO (11)
- Broken internal linksDead links frustrate visitors, waste crawl budget and leak ranking signals.
- Homepage tells search engines not to index itA noindex directive removes the page from search results entirely.
- Meta description length offToo short and it undersells; too long and search engines truncate it.
- No canonical URLWithout a canonical tag, variants of the same page (with/without www, tracking parameters) compete with each other in search.
- No main heading (H1)The H1 tells visitors, screen readers and search engines what the page is about at a glance.
- No meta descriptionThe meta description is your pitch in search results.
- No mobile viewportWithout a viewport tag, phones render the desktop layout zoomed out.
- No page titleThe title is the headline of your search result and the label on the browser tab.
- Poor Lighthouse SEO scoreBasic technical SEO checks are failing, making it harder for search engines to crawl and present the page.
- Several H1 headingsMultiple H1s dilute the page's main topic and confuse screen-reader navigation.
- Title too short or too longVery short titles waste the most prominent spot in search results; very long ones get cut off mid-word.
Accessibility (3)
- Images without alt textScreen-reader users hear nothing (or a file name) for these images, and search engines can't understand them.
- Page language not declaredScreen readers use the lang attribute to pick pronunciation; without it, content may be read in the wrong language.
- Poor Lighthouse accessibility scoreAutomated checks found barriers such as contrast, labels and names, which likely means more issues a manual audit would find.
WordPress (7)
- Default login page reachableEvery bot knows /wp-login.php, so it gets constant credential-stuffing traffic.
- Directory listing on uploadsAnyone can browse every file you've ever uploaded, including drafts, exports and private documents.
- Plugin versions visibleVersion numbers in asset URLs let attackers find vulnerable plugins instantly.
- readme.html is publicThe default readme advertises that this is WordPress and can reveal version details.
- Usernames can be enumeratedThe public REST API users route hands attackers valid usernames, which is half of every login attack.
- WordPress version exposedAdvertising the exact core version tells attackers which known vulnerabilities to try.
- XML-RPC enabledxmlrpc.php lets bots try hundreds of passwords in one request and can be abused for pingback DDoS.