Website Audit: How to Find, Prioritize, Fix, and Verify Problems

How do you know your website is actually working? Not just loading, but getting crawled, indexed, found, used, and measured the way you expect. For most teams, the honest answer is that they don't know until something breaks badly enough to show up in traffic or revenue numbers.

A website audit gives you that answer before the damage shows up. But most audits fail after the report is delivered. The findings are real, the list is long, and three months later half the issues are back because a plugin updated or a deployment overwrote a fix.

The answer is to treat a website audit as a repeatable cycle: establish a baseline, find issues, trace them to their root cause, fix them, and prove each fix worked by comparing a new crawl against the old one.

What is a website audit?

A website audit is a structured evaluation of a website's technical health, SEO, content, performance, usability, accessibility, and security, used to find and fix problems that limit visibility, user experience, and conversions.

A complete audit answers four questions:

1. What is broken? Errors, blocked pages, broken links, failing forms.
2. Why is it broken? The root cause, often a page template, CMS setting, or deployment.
3. What matters most? Severity based on impact, scope, and page value.
4. Did the fix work? Verified by retesting and comparing against a baseline.

Most audits stop at the first question. The value comes from answering all four.

Why a website audit is important

Websites change constantly. Content is published, templates are edited, plugins update, and developers deploy new code. Each change can introduce problems that nobody notices right away.

• Catch indexing problems early. A single noindex tag on a template can remove hundreds of pages from search results.
• Detect regressions after deployments. Fixes that worked last quarter can quietly break after a release.
• Recover lost traffic. Many traffic drops trace back to technical causes like redirects, canonicals, or blocked resources.
• Protect conversions. Broken forms, slow checkout pages, and dead-end landing pages lose revenue every day they go unnoticed.
• Stay visible in AI search. If AI crawlers can't access or extract your content, you can be mentioned without ever being cited or linked.
• Make better decisions. An audit replaces guesses with evidence about what to fix, update, consolidate, or remove.

Website audit vs. SEO audit vs. technical SEO audit

A technical SEO audit is part of a website SEO audit, which is part of a full website audit. The distinction matters because a site can have clean technical SEO and still lose customers to confusing navigation, slow pages, or broken tracking.

Types of website audits

You don't need every audit type every time. Choose based on what triggered the audit.

How to do a website audit: step by step

Every step matches a numbered section in the downloadable checklist, so the explanation and the checkboxes stay in sync.

01Define the scope, goals, and sampling plan

Start by naming the reason for the audit:

• Organic traffic or conversions dropped
• A redesign, migration, or CMS change is planned or just launched
• Pages aren't getting indexed
• The site is slow on mobile
• Content has accumulated without review
• Analytics numbers don't match sales or lead data

Write it as one sentence: what changed, and what decision the audit needs to support. Then list your priority pages: homepage, category pages, product or service pages, top landing pages, and conversion pages. Pull the top landing and converting pages from GA4 for the last three to six months so the list reflects real traffic, not assumptions.

How to audit a large website without checking every URL. On large sites, most issues come from a small number of page templates. A bug in the product template affects every product page. Audit by template:

1. Group URLs by template or directory, such as /products/, /blog/, /category/, and /locations/.
2. Crawl the full site for technical signals, since crawlers handle volume easily.
3. For manual checks like UX, accessibility, and content quality, review 3 to 5 representative URLs per template, including your highest traffic and highest revenue examples.
4. When you find an issue on a sample page, check how many URLs in the same template share it.

800 pages missing an H1 is one template fix, not 800.

02Crawl the website and save a baseline

A crawl gives you an inventory of every URL a website crawler can discover, including status codes, titles, meta descriptions, headings, canonical URLs, indexability directives, internal links, redirects, image alt text, and crawl depth.

• Include or exclude subdomains intentionally
• Decide how to handle URL parameters and faceted navigation
• Enable JavaScript rendering if menus or content load client side
• Set crawl speed limits so you don't overload the server

Save the crawl and name it clearly, for example "2026-11-baseline-redesign." Without a baseline, you can't tell whether a future issue is new, recurring, or was always there. Every later audit compares against this record.

03Check crawlability and indexability

Crawlability is whether a crawler can reach a page; indexability is whether it's allowed into the index. See crawlability vs. indexability and the crawling and indexing glossary for definitions.

Filter your crawl by status code and cross-check against your priority page list. Weight errors by page value: a 404 on a product page with backlinks matters far more than one on an expired event page. If a URL returns 5xx, recrawl it once. Errors that persist usually point to a template or server problem.

Indexability signals. Review meta robots tags, X-Robots-Tag headers, and robots.txt rules together. Filter the crawl by non-indexable URLs and check the reason for each, using how to find and fix noindex issues as a reference. Some exclusions are intentional, such as internal search results, filtered URLs, and private areas. Cross-check with the Page indexing report in Google Search Console, and use the URL Inspection tool on priority pages to see how Google actually sees them.

Canonical tags. Confirm each canonical points to the intended preferred URL (common canonical tag issues). Flag canonicals that point to redirected or noindexed URLs, pages that all canonicalize to the homepage, and conflicts between HTML and HTTP header canonicals.

XML sitemaps. Your sitemap should contain only canonical, indexable URLs that return 200. Remove redirects, errors, noindexed pages, and non-canonical variants. More in XML sitemap errors and fixes.

Redirect chains and loops. Every extra hop adds latency. Find chains of two or more hops and update internal links to point directly to the final destination. See how to find and fix redirect problems.

JavaScript rendering: compare raw HTML to the rendered DOM. Search engines can render JavaScript, but rendering can be delayed or fail, and many AI crawlers don't render JavaScript at all. For each key template, compare View Source (raw HTML) with the Elements panel in browser DevTools (rendered DOM). If the main content, navigation links, canonical tag, or structured data exist only after rendering, move them into server-rendered HTML. The rendering lesson and JavaScript SEO guide go deeper.

Crawl budget and log files. On sites with many thousands of URLs, search engines may waste crawl activity on parameter combinations and filter pages. Server log analysis shows which URLs Googlebot actually requests. Look for heavy crawling of faceted URLs, important pages crawled rarely, and crawl activity on redirecting or erroring URLs. Small sites rarely need this step. Related: crawl rate explained.

International sites. If you use hreflang, confirm annotations are reciprocal, use valid language and region codes, point to canonical 200 URLs, and include a self-reference. Use the free hreflang validator or read how to fix hreflang errors.

04Check AI crawler access and content extractability

AI answer engines now cite sources and send referral traffic. But being named by AI and being linked by AI are not the same thing. A brand can appear frequently in AI answers while its own pages are rarely the cited source. Part of closing that gap is technical: AI systems can only cite pages they can reach and read.

• Review robots.txt for AI user agents such as GPTBot, OAI-SearchBot, ClaudeBot, PerplexityBot, and Google-Extended. Also check broad wildcard rules that may block them unintentionally. Test your file with the free robots.txt checker. Allowing or blocking them is a business decision, but it should be deliberate.
• Check firewall and CDN rules. Bot protection can return 403 errors to legitimate crawlers. Review CDN or WAF logs for blocked requests from known crawler user agents, then follow how to fix 403 errors blocking AI crawlers.
• Confirm key content exists in raw HTML, since many AI crawlers don't execute JavaScript.
• Review content structure. Clear headings, direct answers near the top of sections, defined terms, and tables make content easier to extract and cite.

For more on why mentions and citations diverge, listen to the SiteAuditLint podcast episode AI Search: Cited vs. Mentioned.

05Review site architecture and internal links

A page that returns 200 can still be effectively invisible if nothing links to it.

• Orphan pages: pages with no internal links pointing to them
• Crawl depth: important pages more than three or four clicks from the homepage
• Broken internal links and links pointing to redirects
• Internal link distribution: whether high-value pages receive enough internal links
• Anchor text: descriptive anchors instead of "click here"
• Navigation and breadcrumbs: consistent and matched to how visitors think

To find orphan pages, compare your crawl's URL list against your XML sitemap and the URLs receiving traffic in GA4 or Search Console. URLs that appear in those sources but not in the crawl have no discoverable internal links. For broken internal links, filter by 4xx destination and fix them at the source page or template.

Faceted navigation. On ecommerce and directory sites, filters can generate thousands of near-duplicate URLs. Decide which filter combinations deserve indexable pages, and control the rest with canonicals, noindex, or crawl rules.

Related reading: Internal Linking: How to Audit and Improve Internal Links and How to Find and Fix Broken Internal Links.

06Audit on-page SEO elements

• Page titles: present, descriptive, unique across important pages, and matched to the page's main topic.
• Meta descriptions: accurate summaries that earn the click. They aren't a direct ranking factor, but they influence how the page appears in results when Google uses them.
• Headings: a clear H1 and a logical subheading hierarchy. Multiple H1s aren't automatically an error. A confusing structure is.
• Image alt text: descriptive for meaningful images, empty for decorative ones. No keyword stuffing.
• Structured data: valid, matched to visible content, and eligible for the relevant search feature. Test with the Rich Results Test or the free schema markup validator.

07Evaluate content quality

• Thin pages with little useful information
• Duplicate or overlapping content
• Keyword cannibalization, where multiple pages target the same search intent
• Outdated statistics, prices, screenshots, or product details (how to spot content that needs an update)
• Pages with high impressions but low click-through rate (try the free GSC analyzer)
• Pages with traffic but no path to the next step
• Topic gaps where competitors cover questions you don't

For each underperforming page, choose one action: keep, update, consolidate, redirect, or remove. Don't delete pages just because traffic is low. Check backlinks, internal links, conversions, and purpose first.

08Review backlinks

• Broken backlinks: external links pointing to URLs that now return 404. Export them and 301 redirect each to the closest live match to recover authority you already earned.
• Lost links: referring domains that removed links. Consider updating the resource and reaching out.
• Anchor text patterns: heavy exact-match anchors can signal manipulation.
• Unnatural links: links from obvious link schemes. Disavow only in clear cases, since Google ignores most low-quality links on its own.

Use the Links report in Google Search Console alongside a backlink tool such as Ahrefs or Semrush. For authority metrics, see DA vs. DR.

09Check website performance and Core Web Vitals

Thresholds are assessed at the 75th percentile of page visits, separately for mobile and desktop, per Google's Core Web Vitals documentation.

Field data vs. lab data. Field data from the Chrome UX Report (CrUX) reflects real visitors and is what Google uses. Lab data from Lighthouse helps diagnose causes under controlled conditions. Start with the field data section in PageSpeed Insights or the Core Web Vitals report in Search Console, which groups failing URLs by template, then use Lighthouse to find the cause.

• Large or unoptimized images
• Excessive JavaScript and unused code
• Render-blocking CSS and scripts
• Slow server response time (TTFB)
• Third-party scripts such as chat widgets, ads, and tag piles
• Missing caching or CDN configuration
• Layout shifts from images without dimensions or injected elements

Test one URL per template on a real phone over mobile data, not just the homepage on office Wi-Fi.

10Review user experience and conversion paths

A crawler can't click your checkout. You have to.

• Is navigation clear and consistent?
• Can visitors find key information within a few seconds?
• Do layouts work on mobile, with tappable buttons and readable text?
• Do forms work, with clear labels and error messages?
• Do intrusive pop-ups interrupt important tasks?
• Can visitors complete the main conversion path?

Walk through real journeys. For ecommerce, go from product page to completed checkout. For service sites, go from landing page to a submitted inquiry and confirmation. Submit forms with empty and invalid inputs to confirm errors are clear. Use GA4 path exploration to find where users drop off, and heatmaps or session recordings to see why.

11Check accessibility

Accessibility is part of website quality and, in many regions, a legal requirement. Review against WCAG 2.2:

• Alt text for meaningful images
• Sufficient color contrast
• Full keyboard navigation with visible focus indicators
• Labels and error messages on form fields
• Descriptive link and button names
• Logical heading structure and HTML landmarks
• Captions or transcripts for video and audio

The fastest manual test: tab through the page without a mouse. Every link, button, and form field should be reachable, and you should always see where focus is. Automated tools catch only part of common issues, so combine them with keyboard testing and, where possible, screen reader testing.

12Review security and data privacy

Security basics:

• HTTPS is enforced across the site. Request the http:// version and confirm a single 301 to https://.
• No mixed-content warnings
• SSL certificate is valid and not close to expiring
• CMS, themes, and plugins are up to date
• Admin accounts use strong authentication, and unused accounts are removed
• Backups exist, and you've restored one to staging at least once to prove it works

Data privacy basics:

• A current privacy policy is linked in the footer
• Cookie consent lets visitors accept, reject, or customize
• Tags respect consent choices. Reject all cookies, then confirm analytics and ad tags don't fire.
• Every form and data collection point is disclosed

A general crawler is not a security assessment. Sensitive sites need vulnerability scanning or a professional penetration test.

13Validate analytics and tracking

• GA4 installation on every template
• Google Tag Manager configuration and duplicate tags
• Conversion events, form submissions, and ecommerce events
• Search Console property verification and data
• Consent mode behavior
• Referral exclusions, such as payment gateways appearing as referrers

Test events by performing them. Use Tag Assistant on one URL per template to spot duplicate hits, then trigger each conversion event and confirm it appears in GA4 DebugView. Full walkthrough: tracking and analytics audit for GA4, GTM, and pixels.

14Prioritize findings with a severity score

An audit can surface hundreds of issues. Score each one so priorities are consistent and defensible:

Severity = Impact × Scope × Page value ÷ Effort

The same four levels appear as CRIT, HIGH, MED, and LOW badges on every item in the downloadable checklist.

Look for patterns before fixing. If hundreds of URLs share an issue, the root cause is usually a template, CMS setting, or deployment. Fix it once at the source (SEO debugging: find the root cause). For a deeper method, see SEO Audit Prioritization and the prioritization lesson.

15Fix, retest, and compare crawls

A closed ticket is not proof. A passing recrawl is.

An audit isn't finished when the report is delivered. It's finished when fixes are verified. Document each issue with acceptance criteria:

Acceptance criteria turn a vague task like "fix canonicals" into a testable result.

Recrawl with the same settings as the baseline, then compare. A crawl comparison shows:

• Resolved issues: present in the baseline, gone now
• Persisting issues: still present after the fix was "deployed"
• New issues: absent from the baseline, present now. These are regressions, often introduced by the fix itself or a parallel release. Investigate them first.
• Changed URLs: new pages, removed pages, and changed status codes, titles, or canonicals

Comparison catches the most expensive kind of problem: the one introduced while fixing something else. Run one after every migration, redesign, CMS update, or large deployment, and keep the SEO regression checklist handy. More in SEO issues after a deployment.

Website audit checklist

A condensed version of all 10 sections. The PDF includes the full 60+ checks with priority badges, tool tags, "how to check" hints, and an audit record page for logging baseline and comparison dates.

Website audit report template

1. Executive summary: the three to five findings that matter most, written for decision makers.
2. Scope and method: what was audited, which tools were used, crawl date, and sampling approach.
3. Findings by category: each issue with affected URLs, root cause, severity score, and recommendation.
4. Action plan: prioritized fixes with owners, deadlines, and acceptance criteria.
5. Baseline and verification plan: the saved crawl, key metrics, and when the comparison crawl will run.

Lead with decisions, not data dumps. See writing audit reports and how to report technical SEO issues. A 200-row spreadsheet is an appendix, not a report.

Website audit tools

A quick SEO analyzer or online SEO test gives a fast snapshot of one page. A full website audit needs a crawler that inspects every URL, plus tools for data a crawler can't see.

Where SiteAuditLint fits

SiteAuditLint is a Windows desktop SEO crawler built for the crawling and technical SEO parts of a website audit. It helps you:

• Crawl website URLs and inspect page-level elements
• Identify technical SEO and indexability issues
• Review titles, meta descriptions, headings, canonicals, and links
• Inspect internal linking, crawl depth, and site structure
• Compare crawls to see which issues were resolved, which persist, and which are new
• Track recurring issues across audits

Crawl comparison turns an audit from a snapshot into a process. Instead of treating each crawl as a separate report, you use the last one as a baseline and investigate exactly what changed.

SiteAuditLint does not replace analytics, field performance data, accessibility testing, or security assessments. It handles the crawling and technical layer so you can spend your manual time on the parts tools can't judge. Download SiteAuditLint or compare it with other crawlers.

How often should you do a website audit?

Scheduled audits are useful, but changes should trigger reviews too. See SEO Monitoring and the SEO Migration Plan for ongoing checks, and SEO Incident Investigation when something drops without warning.

How long does a website audit take, and what does it cost?

Time depends more on the number of templates and integrations than on raw page count. Agency costs vary widely by region and scope, so treat these as rough ranges.

Common website audit mistakes

1. Treating every warning as equal. Score issues before assigning work.
2. Auditing only the homepage. Problems often live in product, category, or blog templates.
3. Fixing symptoms instead of root causes. Fix the template, not 500 URLs.
4. Skipping the baseline. Without one, you can't prove improvement or detect regressions.
5. Ignoring raw HTML. Content that only exists after JavaScript rendering may be invisible to some crawlers.
6. Deleting low-traffic pages blindly. Check backlinks, conversions, and purpose first.
7. Relying on one tool. Crawlers can't measure user experience, field performance, or security.
8. Closing tickets without verification. A deployed fix is not a verified fix.
9. Delivering a report without an action plan. Every significant finding needs an owner and acceptance criteria.

Frequently asked questions

Related reading