A good website audit takes 4-8 hours of senior engineer time and produces a prioritised remediation list, not a 50-page PDF that no one reads. This page is the complete 47-point checklist we run on every audit engagement, organised by category, with the threshold each check passes or fails against. Use it as a self-audit checklist or as the spec for an external audit engagement.
Performance (8 checks)
Field data is the only data Google ranks on. (1) LCP under 2.5s at 75th percentile mobile — check via Search Console or CrUX. (2) INP under 200ms at 75th percentile mobile. (3) CLS under 0.1 at 75th percentile mobile. (4) TTFB under 600ms from a UK IP. (5) Total page weight under 1.5MB uncompressed. (6) JavaScript bundle for initial paint under 100KB. (7) Image bytes above the fold under 200KB total. (8) No render-blocking third-party scripts in the critical path.
SEO — on-page (12 checks per critical page)
(9) Unique meta title under 60 characters with primary keyword. (10) Meta description under 160 characters with primary keyword + CTA. (11) Canonical tag pointing to the correct URL. (12) Robots meta indexable (unless deliberately not). (13) One H1 per page containing the primary keyword. (14) Logical H2 → H3 nesting. (15) Primary keyword in first 100 words. (16) Internal links with descriptive anchor text (not "click here"). (17) Outbound links to authority sources where claims are made. (18) Image alt text descriptive and keyword-relevant where natural. (19) URL slug lowercase with hyphens, keyword-rich, ≤5 words. (20) Open Graph and Twitter Card metadata present and accurate.
SEO — schema (8 checks)
(21) Organization or LocalBusiness schema present sitewide. (22) WebSite schema with publisher reference. (23) BreadcrumbList schema on every non-homepage page. (24) Page-type-appropriate schema (Article on blog posts, Service on service pages, Product on product pages, FAQPage where applicable). (25) All schema validates on Google's Rich Results Test. (26) All schema validates on schema.org's validator. (27) @id values stable across the site so entities reference consistently. (28) AggregateRating present and tied to a Reviewable entity where genuine reviews exist.
Accessibility (7 checks against WCAG 2.2 AA)
(29) Colour contrast ratio meeting 4.5:1 for normal text, 3:1 for large text. (30) All interactive elements keyboard-navigable. (31) ARIA labels on all icon-only buttons and non-text controls. (32) Focus indicators visible on every interactive element. (33) Forms have associated labels (not placeholder-only). (34) Images have alt text (decorative images have alt=""). (35) Accessibility statement published with feedback channel.
Compliance — UK GDPR + PECR (6 checks)
(36) Cookie banner with a real "reject all" button of equal visual prominence to "accept all". (37) Privacy notice naming every third-party processor with purpose, lawful basis and retention period. (38) ICO Data Protection Fee paid (£52 for tier-1 small business as of February 2025). (39) DSAR (Data Subject Access Request) endpoint linked from privacy notice. (40) Consent log capturing timestamp, user, choice and notice version. (41) Analytics and marketing cookies fired only after consent (not before).
Conversion-rate (6 checks)
(42) Primary CTA visible above the fold on mobile (without scrolling). (43) Phone number is a tel: link, not a graphic. (44) Forms have ≤5 fields where the conversion path is high-intent (≤3 for emergency-service trades). (45) No interstitial pop-ups before the user has seen the page content. (46) Mobile-first design tested at 375px and 414px viewports. (47) Trust signals (reviews, badges, testimonials) visible without scrolling past the first viewport.
How to score the audit
Each check passes or fails; some checks have a "needs improvement" middle band (Core Web Vitals specifically). A site passing 40+ of 47 checks is in good shape; 30-39 is the typical baseline for UK SMB sites; under 30 needs material remediation. The remediation priority order: performance first (because it affects ranking and paid-media Quality Score), then schema (because it lifts ranking on commercial queries), then on-page SEO, then accessibility, then conversion-rate, then compliance. Compliance last only because it does not affect ranking — but it does affect your legal exposure, so do not skip it.
How long the audit itself takes
A proper audit takes 4-8 hours of senior engineer time depending on site complexity. Less than that and important checks are being skipped; more than that and the auditor is padding the deliverable with low-signal items. The output should be a prioritised remediation list with effort estimates, not a 50-page PDF. The auditor should be willing to fix the issues themselves — auditors who can only diagnose without fixing tend to identify problems that are not actually problems.
What to expect on remediation
Performance fixes typically deliver field-data improvements within 28 days of going live. Schema fixes typically deliver rich-results eligibility within 7-14 days. On-page SEO fixes deliver ranking changes over 4-12 weeks. Accessibility fixes deliver immediate user-experience improvements and longer-term legal/procurement benefits. Compliance fixes deliver legal-exposure reduction immediately and (where ICO contacted) a defensible audit trail. Most full-remediation engagements take 2-4 weeks of engineering time depending on scope.
Self-audit vs paid audit
For owners comfortable with developer tools and the time investment, self-audit against this checklist is genuinely useful — the checklist itself is the most important asset. For owners without that comfort or that time, a paid audit at £400-£800 from a competent freelancer or boutique agency delivers the same checklist applied by a senior engineer with the prioritised remediation list. Either way, the audit is the diagnosis; the remediation is the treatment.