Website Audit Checklist: 30 Checks in 10 Groups to Copy

A website audit checklist is a fixed list of checks you run on every site in the same order, so that two audits can be compared. This one has 30 checks in 10 groups, and each check has a pass mark. You can run all 30 from the outside, with a phone, a browser and two public tools.

It is written for agencies and freelancers who review a local business's site before a sales call or at the start of a project. Below the list you will find how to audit a website in six steps, a filled-in example and the parts to adapt.

The website audit checklist, 30 checks in 10 groups

The 10 groups are the 10 domains that Twip, the AI inside Leadodo, scores on every website. The 30 checks are a manual version written for this post. They do not describe how Twip scores a site.

Mark each check pass, fail or not applicable, and write down what you saw.

Design

1. One clear focus. The first screen has one headline, one supporting line and one button that stands out.
2. A consistent look. Fonts, colors and buttons match on every page you check.
3. Clean images and layout. Photos are sharp and unstretched, and nothing overlaps or is cut off on a laptop screen.

Speed

Run the homepage through PageSpeed Insights and read the mobile results. The three pass marks are Google's own, measured at the 75th percentile of page loads (web.dev).

4. Largest Contentful Paint. The main content shows within 2.5 seconds.
5. Interaction to Next Paint. The page responds to a tap within 200 milliseconds.
6. Cumulative Layout Shift. The score is 0.1 or less, so the page does not jump while it loads.

Mobile

Use a real phone. Google indexes and ranks the mobile version of a site (Google Search Central).

7. No zooming, no sideways scroll. Text reads without pinching and the page fits the width of the screen.
8. Tap targets. Buttons and links measure at least 24 by 24 CSS pixels, the level AA minimum in WCAG 2.2 (W3C). The rule lists five exceptions, links inside a sentence among them.
9. The menu. It opens, it closes and it never covers the phone number or the main button.

Security

10. HTTPS on every page. The address bar shows a secure connection, and the HTTP address redirects to HTTPS.
11. No browser warnings. No page shows "Not secure" or a certificate warning. Check the contact form first.
12. No pages that do not belong. Search site: plus the domain and scan the results for spam pages, which point to a hacked site.

SEO

13. Indexed. A search for site: plus the domain returns the homepage and the main service pages.
14. Titles that say something. Each page title names the service and the place. None reads "Home".
15. Matching details. The business name, address and phone number match the Google Business Profile exactly.

Accessibility

Run an axe-core or Lighthouse scan, then test by hand.

16. Contrast. Body text has a contrast ratio of at least 4.5 to 1 against its background, the level AA mark in WCAG 2.1 (W3C). Large text needs 3 to 1.
17. Alt text. Every photo that carries meaning has a text description.
18. Keyboard and labels. The Tab key reaches every link and form field, you can see where you are, and each field has a visible label.

Content

19. A clear offer. The first screen says what the business does, for whom and where.
20. Service detail. Each main service has its own page, and that page answers a buyer's first questions.
21. Up to date. The site shows no expired offers or past events, and the opening hours match the Google listing.

Conversion

22. A next step on the first screen. A visitor on a phone can call, book or ask for a quote without scrolling.
23. A phone number you can tap. It appears on every page and starts a call.
24. A form that works. Send it with your own details. It submits, confirms and asks only for what the business needs.

Trust

25. Reviews. Named, dated reviews appear on the site or sit one tap away.
26. Real photos. The site shows the actual people, premises or finished work.
27. Proof of standing. Licenses, insurance, memberships and a street address appear where the trade expects them.

Technology

28. No dead links. Every link in the menu and the footer leads to a working page.
29. Embeds that load. Maps, booking widgets and videos appear and work on a phone.
30. Readable by machines. The site has a sitemap, and its robots.txt file does not block search engines.

How do you audit a website with this checklist?

Work from the outside in, and from machine checks to judgment. Allow about 60 minutes for one site, which is 30 checks at 2 minutes each. That is our estimate, and your first audit will take longer.

1. Set the scope. Pick four pages, which are the homepage, the main service page, the contact page and one more.
2. Run the scans. Use PageSpeed Insights for speed, and axe-core or Lighthouse for accessibility. Save the results.
3. Walk the site as a customer. On your phone, try to do the one thing a customer comes to do.
4. Go down the list. Mark each check and note the evidence, such as a screenshot or a measured figure.
5. Rank the fails. Put first whatever stops a customer from calling, booking or paying.
6. Write it up. Our website audit template turns the marks into a two-page report.

Which checks can a tool run for you?

By our count a tool can measure 7 of the 30 checks, about a quarter of the list. Those are the three speed checks, tap targets, contrast, alt text and dead links. A person has to judge the rest.

The scoring model in our October 2026 study divided the work the same way. It used Google Lighthouse and axe-core for the technical and accessibility checks, and an AI model for the visual and content analysis. It applied 206 indicators to 20,000 Dutch company websites, and the write-up explains the method.

By hand, this list suits a handful of sites. Our write-up of an earlier campaign puts a quicker review of 1,382 websites at about 8 minutes a site, and that still comes to about 184 hours. For a whole list of prospects, software has to do the scoring.

Leadodo is in that category. Twip scores every website in a search out of 100 across the same 10 domains, and sites that score below 40 form the shortlist. See how the score works.

What does a finished checklist look like?

A finished checklist is a tally per group, with a note for every fail.

Filled in. Larkfield Roofing at larkfieldroofing.example is a made-up business, and every result below is invented to show the format.

A count of passed checks is a working tally. A Twip score is a different thing, out of 100 across 10 domains.

How should you adapt the checklist before you use it?

Adapt it to the trade, to your access and to the depth you need.

• The trade. Add the two or three checks that only this kind of business needs. A restaurant needs a menu that opens on a phone. A dentist needs online booking. A shop needs a checkout you can finish.
• Your access. From the outside you cannot see visitor numbers, search queries or the editing system. Once a client gives you access, add checks for analytics and Google Search Console.
• The depth. For prospecting, 30 checks a site is too many. Use the 9 signs that a business needs a new website, which take a few minutes, and keep this list for the businesses that reply.

What do you do with the results?

Pick one finding for the first message and keep the rest for the call. A list of 14 fails from a stranger reads as criticism. One finding the owner can check on their own phone reads as help.

For Larkfield Roofing, that finding is the quote form. A roofer whose quote form returns an error is losing jobs the business had already earned.

After the call, the full tally becomes a report or a scope of work. If the fails add up to a rebuild, our website redesign checklist covers the next stage. Our bad website examples show what each kind of failure costs an owner.

Questions

How long does a website audit take?

About 60 minutes by hand for the 30 checks in this list, by our estimate of 2 minutes a check. Our write-up of the October 2026 study puts a quicker review at about 8 minutes a site. An audit with access to analytics takes longer, because there is more to read.

Can you audit a website you do not own?

Yes. All 30 checks here run from the outside. You cannot see traffic, search queries or the editing system, so say that in your notes.

What is the difference between a website audit and an SEO audit?

An SEO audit goes deep on one of the ten groups. A website audit covers all ten, including whether a visitor can find the phone number and send the form. Our glossary post explains what a website audit is and the main types.

How often should a website be audited?

After every redesign or change of platform, and once a year otherwise. That is our advice, and no rule sets it. Speed and dead links are worth a monthly look, since a tool does the work.

---

Next step. Let Twip score every website in a search across the same 10 domains. See AI analysis.