Website Audit Checklist: 30 Points to Check Before You Redesign

You want a redesign because the site “feels dated.” That feeling is usually hiding three or four real, fixable problems — and redesigning without finding them first means paying to rebuild the same mistakes in a new template.

A website audit checklist forces you to separate opinion from evidence before you spend a redesign budget. This one covers 30 points across performance, mobile UX, SEO, security, and conversion — each with the specific free tool to check it and a clear pass/fail line, not a vague “looks fine” judgment call.

Why Audit a Website Before Redesigning It?

A redesign changes what a site looks like. It rarely changes what’s actually broken underneath — a slow server, a missing sitemap, an outdated plugin, a contact form nobody tests. Skip the audit and those problems just get a fresh coat of paint.

The audit also tells you what to keep. Pages that already rank, load fast, or convert well shouldn’t be rebuilt from scratch just because they’re getting a new look — see our breakdown of when a redesign is the right call versus a narrower rebuild for how to draw that line before scoping the project.

Want this done for you instead of by hand? Our free website audit has a senior developer manually review your site and send back a video walkthrough with a prioritized fix roadmap within 48 hours — no site access required.

How Should You Use This Checklist?

Budget 2–3 hours for a full DIY pass. Every tool below is free and most need nothing more than your live URL — no login, no plugin install, no site access. Work through the five sections in order; performance and mobile issues tend to explain a chunk of what shows up later as SEO and conversion problems, so fixing upstream first saves rework downstream.

Mark each point pass, fail, or N/A. A fail doesn’t mean panic — it means you now have a specific, testable thing to fix instead of a vague “the site needs work.”

Performance: 6 Points to Check

Slow pages lose visitors before they see anything else on this list. Check these first.

1. Largest Contentful Paint (LCP). Run the URL through PageSpeed Insights. Pass: field data (real users, not the lab test) shows LCP under 2.5 seconds.
2. Interaction to Next Paint (INP). Same PageSpeed Insights report, field data section. Pass: INP under 200 milliseconds.
3. Cumulative Layout Shift (CLS). Same report. Pass: CLS under 0.1 — nothing jumps around as the page loads.
4. Server response time (TTFB). PageSpeed Insights flags this under “Diagnostics” as server response time. Pass: under roughly 600ms on a first, uncached request.
5. Image weight. Run GTmetrix and check the waterfall for oversized images. Pass: no single image over 300KB and no “improperly sized” or “next-gen format” warnings.
6. Browser caching. In GTmetrix’s waterfall, check the cache headers on static assets (CSS, JS, images). Pass: static files carry a cache lifetime of at least one month.

Every one of these ties back to the fixes in our page speed optimization guide — that’s the deeper reference if several points here fail at once.

Mobile UX: 6 Points to Check

Most visitors arrive on a phone. Test the mobile experience on the actual page, not a screenshot.

1. Mobile usability report. Open Google Search Console → Mobile Usability. Pass: zero flagged issues across indexed pages.
2. Viewport meta tag. View page source (Ctrl/Cmd+U) and search for viewport. Pass: <meta name="viewport" content="width=device-width, initial-scale=1"> is present.
3. Tap target sizing. Run Lighthouse (built into Chrome DevTools, or via PageSpeed Insights mobile report). Pass: no “tap targets are not sized appropriately” audit failure.
4. Legible font size. Same Lighthouse report. Pass: no “document doesn’t use legible font sizes” failure — body text at 16px or larger.
5. Horizontal scroll. In Chrome DevTools, toggle device mode to a 375px-wide viewport. Pass: no sideways scrollbar, no content spilling off-screen.
6. Mobile menu and form usability. Manually open the nav menu and submit a test form on a real phone. Pass: menu opens/closes cleanly, form fields are reachable and typeable one-handed.

SEO: 8 Points to Check

These determine whether Google can find, understand, and want to rank the pages you already have.

1. Indexability. Check robots.txt at yoursite.com/robots.txt and review Google Search Console → Pages report. Pass: no important pages blocked by robots.txt or an unintended noindex tag.
2. XML sitemap. Search Console → Sitemaps. Pass: sitemap submitted, zero errors, and it reflects your current live URLs.
3. HTTPS and mixed content. Load the site and check the address bar padlock; browser DevTools console will flag mixed-content warnings. Pass: HTTPS site-wide, no “not secure” warnings, no mixed-content console errors.
4. Title tags and meta descriptions. Crawl with the free tier of Screaming Frog (up to 500 URLs). Pass: every page has a unique title (50–60 characters) and meta description (150–160 characters) — no duplicates, no blanks.
5. Heading structure. View source or use Screaming Frog’s H1 report. Pass: exactly one H1 per page, with H2/H3 nesting in logical order below it.
6. Broken internal links. Screaming Frog’s response codes report. Pass: zero internal links returning a 404.
7. Canonical tags. Screaming Frog’s canonical report. Pass: every page has a self-referencing canonical, no conflicting duplicates.
8. Structured data. Run key page templates through Google’s Rich Results Test. Pass: no errors on any schema type the page is eligible for (Article, Product, FAQ, etc.).

Security and Code Health: 5 Points to Check

A site that fails here loses visitor trust and, eventually, rankings — and often has deeper problems a redesign alone won’t fix. Our guide to common website code issues goes deeper on several of these.

1. SSL certificate. Run the domain through Qualys SSL Labs’ SSL Test. Pass: grade A or higher, no expiring or misconfigured certificate warnings.
2. Security headers. Check securityheaders.com. Pass: grade B or higher, with Content-Security-Policy and X-Frame-Options present.
3. CMS and plugin versions. In WordPress, check Dashboard → Updates; externally, the free Wappalyzer browser extension identifies the CMS and visible plugin stack. Pass: core, theme, and plugins on their latest stable release, nothing flagged as abandoned or known-vulnerable.
4. Console errors. Open Chrome DevTools → Console on your five most-visited pages. Pass: zero JavaScript errors logged.
5. Malware and blacklist status. Run the domain through Sucuri SiteCheck (free). Pass: clean scan, not listed on any blacklist.

If several of these fail together, it usually points to accumulated technical debt rather than one bad plugin — our guide on diagnosing and fixing website issues covers how to triage that kind of backlog.

Conversion Path: 5 Points to Check

A fast, secure, well-optimized site that doesn’t convert is still failing at its job. This section audits the path from visitor to lead or sale.

1. Primary CTA above the fold. Resize the browser to common breakpoints (1366px, 768px, 375px). Pass: the main call-to-action is visible without scrolling on all three.
2. Form friction. Count required fields on your primary contact or lead form. Pass: five required fields or fewer, and a test submission goes through without error.
3. Click depth to conversion. Screaming Frog’s crawl depth report, or manually click from the homepage. Pass: your key conversion page (contact, quote, checkout) is reachable within three clicks of the homepage.
4. Trust signals near the CTA. Manually review the page around your primary CTA. Pass: at least one visible trust signal — reviews, client logos, a guarantee, or a security badge — sits near the button.
5. Conversion tracking. Submit a real test conversion and watch Google Analytics 4 → Realtime, or use the Tag Assistant Chrome extension. Pass: the event fires correctly and shows up in GA4 within a few minutes.

Which Points Matter Most If You Only Have an Hour?

Not all 30 points carry equal weight. If time is short, work this priority order first: LCP and mobile usability decide whether visitors stay at all; HTTPS, broken links, and conversion tracking decide whether the site is trustworthy and measurable; everything else — meta tags, structured data, tap targets — refines a site that’s already fundamentally sound.

Should You DIY This Audit or Get a Professional Review?

Running through these 30 points yourself is worth doing — it builds a real understanding of where your site stands, and every tool listed is free. Where it falls short is interpretation: a checklist tells you what failed, not always why, or which fix actually moves the needle for your specific site and traffic.

A DIY pass is the right call if you’re validating before committing budget, or if the site is small and you’re comfortable reading a Lighthouse report. A professional review is worth it once you’re actually planning to spend on a redesign — a wrong diagnosis at that stage (rebuilding a page that was already fine, or missing a server-level problem no front-end fix will solve) is a far more expensive mistake than the audit itself.

Before you commit a redesign budget, get a second opinion. Web Help Agency’s free website audit has a senior developer manually review your site — no automated scan, no site access needed — and send back a video walkthrough plus a prioritized fix roadmap within 48 hours. We’ve run this process across 500+ projects and hold a 5.0 rating on Clutch from 41 reviews; if a fix is quick, we’ll often tell you how to do it yourself.

Frequently Asked Questions

What is a website audit checklist?

A structured list of technical, SEO, and usability checks — covering performance, mobile experience, search visibility, security, and conversion — used to evaluate a site’s current state before deciding what to fix, keep, or rebuild.

How long does a DIY website audit take?

Budget 2–3 hours for a thorough pass through all 30 points using free tools like PageSpeed Insights, Search Console, and Screaming Frog. A professional audit typically takes less of your time since a developer runs the tools and interprets the results for you.

What’s the difference between an SEO audit and a full website audit?

An SEO audit focuses narrowly on search visibility — indexing, meta tags, structured data, backlinks. A full website audit is broader: it adds performance, mobile usability, security, and conversion path, since all four influence whether an SEO fix actually pays off in traffic and leads.

Do I really need to audit my site before every redesign?

Before any redesign involving real budget, yes. Skipping it means the redesign is based on opinion rather than evidence, and it’s common to rebuild pages that were already performing well while missing the actual source of a problem, like slow hosting or a broken form.

What free tools do I need for a DIY website audit?

Google PageSpeed Insights, Google Search Console, GTmetrix, the free tier of Screaming Frog (up to 500 URLs), Qualys SSL Labs’ SSL Test, securityheaders.com, Sucuri SiteCheck, and Google’s Rich Results Test. All 30 points in this checklist can be checked with that set, at no cost.

How often should I audit my website after a redesign?

At least quarterly, and after any major change — a new plugin, a hosting migration, a large content push. Performance and security especially drift over time even when nobody touches the design.

You Might Also Find Useful

• Website redesign vs. rebuild — how to decide which one you actually need once the audit is done
• Page speed optimization — the fix list for everything flagged in the performance section
• Diagnosing and fixing website issues — triage steps when multiple audit points fail at once
• Common website code issues — deeper detail on the security and code-health checks above
• Free website audit — get a senior developer’s manual review instead of running the checklist yourself

• seo checklist
• website audit
• Website Performance
• Website Redesign