DIY website audit checklist: a scored health check for your site

You can find the obvious problems on your own website in about 30 minutes. Follow one real customer task through a few pages, score 15 checks and write down what you saw.

That's a health check, not a certification or proof of legal compliance. But it's still the fastest way to discover your contact form hasn't delivered an enquiry since March.

How do you run a useful website audit in 30 minutes?

Pick one task a real customer completes. Follow it on a phone and a desktop, then score what you can verify. The honest result of a first pass is often a list of things to test properly.

Set the sample before you start the clock. Choose the task, such as requesting a quote or booking an appointment. Record three URLs: the homepage, the service or campaign landing page and the contact or booking destination. The task runs from the landing page to the destination. Add an article only if it sits on that route.

Account setup and permissions don't count toward the 30 minutes. So have Search Console, your analytics and the receiving inbox or CRM open. Start the speed tests first and let them run while you walk the journey.

Use a fresh visitor session. Note the device, browser, date and consent state. Don't bypass privacy choices to make analytics appear.

Stop at the limit and mark unfinished checks U. Rushing an accessibility or tracking test to claim all 15 are done is the audit's first mistake. It produces a score you can't act on.

Which 15 website checks should you score?

Score these 15, in this order. Copy the scorecard before you start and record each result and its evidence as you go.

Each check below has a practical test, a rubric and a next action. Score 0, 1 or 2 only against the rubric. Mark anything you couldn't test as U. Use N/A only with a reason.

Where a check covers several sampled pages, record the lowest score and the URL it came from. That's because a broken route doesn't average away.

Is the offer clear and specific?

Test Ask someone unfamiliar with the business to read the sampled page. Have them explain what it offers, who it's for, where it operates and what to do next. Read the headline and the first lines aloud. Give them about ten seconds, as a practical prompt rather than a scientific abandonment threshold.

Score 0: the offer or audience cannot be understood. 1: partly clear, with key details vague. 2: a stranger can explain the offer and the next step from the page.

Next action The example is made up. Rewrite the headline around the service, the customer and the location where it matters. Include a verb the customer would use. For the deeper work, how to write a homepage that converts covers structure and copy.

Is the main action clear and usable?

Test Identify the action the page is meant to produce and click it on desktop and on mobile. Check the label, the destination and whether a sticky button covers content or controls.

Score 0: no usable route to the intended action. 1: the route works but is hard to find or unclear. 2: the action is clear, reachable and lands on the expected next step.

Next action Don't bolt a button onto every section. "Learn more" is fine for exploration. Use specific action wording where the reader is ready to enquire. Make sure the mobile button leaves the content readable.

Is the proof genuine, relevant and current?

Test Check the business identity, contact details, applicable credentials and project or customer evidence on the sampled pages. Confirm that claims, logos and testimonials are authorised and accurately presented. Look for stale content: last year's prices, a closed location, an expired offer, a "2024" that nobody updated.

Score 0: misleading claims, or no usable evidence of who provides the service. 1: identity is clear but proof is weak, stale or detached from the claim. 2: relevant, verifiable, current proof supports the decision.

Next action A new business can show truthful qualifications, a process and work samples. It doesn't need testimonials or team photography to do that. Fake reviews or results are a consumer law problem. So present reviews the way the ACCC's guidance on online reviews describes: genuine, not misleading and transparently shown. Our guide to E-E-A-T for small business covers showing that proof on the pages customers use.

Does the journey work on mobile?

Test Use a real phone. Check each of these in portrait and in any other viewport where you suspect a problem:

• readable text

• the menu

• tap targets

• overlays

• horizontal overflow

• the chosen customer task

Score 0: a layout or interaction prevents the task. 1: the task works with noticeable friction. 2: the sampled journey is readable and usable without obstructed controls.

Next action Record the device and browser you tested. One phone isn't compatibility coverage. Use your own analytics to judge how much mobile matters to your site. Don't assume a universal share.

What do the speed results actually show?

Test Run the homepage and the landing page through PageSpeed Insights. Separate the Lighthouse lab score from the real user Core Web Vitals. Google's own PageSpeed documentation explains the difference. Note whether field data is page level, origin level or unavailable. Record the date and device setting.

Score 0: a serious observed delay or a poor relevant field result. 1: lesser issues or conflicting evidence that needs follow up. 2: repeated sampled use and lab checks look good, with no contradictory page level field evidence. U: the test did not complete.

Next action Read the lab score against Google's own bands. Scores of 0 to 49 are poor, 50 to 89 need improvement and 90 to 100 are good.

The field data is the part that reflects real visitors. It's judged against three thresholds, covered in Core Web Vitals explained. Never translate 2 points or a 90 lab score into a Core Web Vitals pass. For an observed delay, why your website is slow covers the usual causes.

Does the enquiry reach the right person?

Test Submit the primary form or booking through a validation error and a successful submission. Check the on screen confirmation and the receipt in the intended inbox or CRM. Use an agreed test entry and label it as test data.

Check the spam folder and the notification recipients too. We tested enquiry delivery in our 100 website audits from May 2023 to September 2026. A labelled test enquiry had to reach the person who answers it within one business hour. It failed on about 1 in 5 sites with an enquiry form. The usual suspects are:

• a spam filter

• an old notification address

• a stopped integration

• an unassigned CRM queue

Score 0: the primary action fails or the record is lost. 1: it reaches the business with material friction or unclear feedback. 2: submission, confirmation and receipt are verified, including a recoverable validation error.

Next action A customer email receipt is only required if that is the intended workflow. Check third party booking handoffs the same way. For a shop, use an approved test method and the ecommerce website checklist, not an accidental paid order. Where the form itself is the friction, website enquiry form design covers fields, labels and errors.

Does the chosen contact channel work?

Test Where phone is a real contact route, check the visible number and the tel: link destination. Confirm the routing with an agreed test call. Then check the published availability. If another channel is primary, such as a booking platform or messaging, verify that route instead.

Score 0: the advertised route is wrong or unusable. 1: it works but is hard to find or its expectations are unclear. 2: a working route whose label, destination and response expectations agree.

Next action A tapped number is not a connected call and not a qualified lead. Don't force a sticky call button onto a business that doesn't answer the phone. If calls do matter, how to get more phone calls from your website covers the page side.

Does the service page support a decision?

Test Review the key service page for:

• scope

• inclusions

• suitability

• process

• genuine coverage

• relevant proof

• common objections

• a next action

Add pricing or price factors where they're useful and supportable. For an ad landing page, compare the ad promise with the page and the form.

Score 0: the essential service page is missing or misleading. 1: the service is identifiable but important buying questions remain. 2: the page gives sufficient accurate information for its intended decision.

Next action No word count fixes a page that skips the buying questions. The structure that answers them is in our guide to service page structure.

Can visitors find the next relevant page?

Test Follow the main journey through the desktop and mobile menus and the relevant in page links. Check the labels and whether the menu opens and closes. Then check how to reach contact and whether you can get back without being trapped.

Score 0: navigation prevents finding or reaching a required destination. 1: destinations are reachable but confusing. 2: the sampled path is clear and works.

Next action There's no universal two click rule. Deleting useful pages to shorten a menu is a mistake. Group and label the menu around real tasks.

Is a successful action measured correctly?

Test Repeat the enquiry test with your tag manager's preview or GA4 DebugView open. Confirm a completion event fires on success. Check that no success event fires on a validation failure and that nothing fires twice. Match the event to the received test record. Google's documentation on enhanced measurement events, recommended events and DebugView sets out what each does.

Expect to find problems here. Key events are the actions GA4 counts as important, such as an enquiry. In the same audits, they were missing or broken on about 3 in 4 sites. The problem took one of these forms:

• no GA4 collecting at all

• no key event for the enquiry

• a key event that fired on page load

• a key event that fired twice

Score 0: a verified success event is missing, or the measurement is demonstrably false. 1: an interaction is measured but completion or duplication is unresolved. 2: the completed action is measured as designed and matched to receipt. U: no access or no test evidence.

Next action Use generate_lead where it fits. The automatic form_submit event, a page view and a button click aren't interchangeable with a received lead.

Check intended consent behaviour. Keep personal data out of event parameters. Keep test entries out of business reporting. Remember DebugView is not an attribution report.

The configuration side is in GA4 for small business. Paid campaigns need their own Google Ads conversion tracking on top.

Can the intended search page be indexed?

Test Inspect the canonical homepage and the selected service page in Search Console. Record the indexed status, crawl and index permissions and the Google selected canonical. The URL Inspection documentation describes each one. Use the live test after a fix, keeping the indexed and live results distinct.

Then search site:yourdomain.com.au and skim the results. Look for pages that shouldn't be there: a staging copy, tag archives, test pages or injected spam.

Score 0: an intended search page has a confirmed accidental indexing block or a wrong canonical. 1: no obvious block, but an unexpected exclusion needs investigation. 2: the intended canonical is indexed without an unexpected block. U: no Search Console access or not checked.

Next action Deliberately excluded private pages, thank you pages and duplicates are not failures. Requesting indexing and passing the live test guarantee nothing. Removing noindex sitewide fixes nothing.

If your site isn't verified in Search Console yet, start with our Google Search Console setup guide. An indexed, snippet eligible page is also the entry ticket to Google's AI features. Our guide on getting cited in Google AI Overviews and AI Mode explains those features.

Do titles and descriptions describe the page?

Test Read the actual title element and meta description on the sampled pages. Use a crawler, the page source or our meta title and description checker with the text supplied. Check for unique, accurate wording, a meaningful service or topic detail and a truthful reason to visit.

Score 0: key titles are missing, misleading or indistinguishable. 1: wording exists but lacks useful differentiation or supporting descriptions. 2: the sampled metadata is specific, relevant and consistent with the page.

Next action Search Console isn't a metadata crawler. Google can generate different title links and snippets from the page. So a width guide is a preview, not a ranking limit.

Do important links reach the right destination?

Test In the sample, click the menu, the key action buttons and the important in text links. Do the same for any campaign landing URL. Record broken assets, unexpected redirects and links to retired pages.

Type a wrong URL on the domain and look at the 404 page. It should say what happened and offer the menu or a search, not bounce to the homepage.

Score 0: a broken link blocks a primary task. 1: lesser broken or indirect links remain. 2: sampled links reach the intended current destinations.

Next action Update internal links to final URLs. Redirect a retired page to a relevant replacement where one exists. Let a deleted page return a 404 or 410. Don't redirect every error to the homepage. Google's site move documentation says such a redirect may be treated as a soft 404.

Is data collection secure and explained?

Test Confirm HTTPS on the sampled pages and on any external form or booking destination. Check the http version redirects to https. Look for browser warnings, as Chrome's connection check help describes.

Review what personal information the form asks for and the stated purpose. Check whether accessible privacy information describes the actual process. Remember the notification email itself carries the submitted data.

Score 0: a confirmed insecure collection path or a clearly misleading collection statement. 1: the connection works but the information requested is excessive or unclear. 2: these limited checks reveal no obvious gap. U: the relevant behaviour wasn't tested.

Next action This is a spot check, not a security or legal audit. HTTPS does not prove a trustworthy business or a secure backend.

Most small businesses aren't covered by the Privacy Act. But some are, as the OAIC's small business guidance explains. What Australia's new privacy laws mean for your website covers the turnover threshold, tracking pixels and coming changes. Whatever your coverage, don't paste a generic notice. Our guide to website privacy policy and terms covers what yours should say.

Can people complete the task accessibly?

Test Put the mouse away. Use the keyboard alone through the menu and the main action. Then check:

• visible focus

• no trap

• readable zoom at 200%

• meaningful labels

• errors shown as text

• colour contrast

• image alternatives

Run WAVE on the sampled pages. Read its findings beside your manual results, in the spirit of the W3C's easy checks.

Score 0: an observed barrier prevents the task. 1: lesser barriers or incomplete follow up remain after the basic test. 2: no obvious barrier in the specified basic tests. U: those tests were not done.

Next action The quick check is a guided self review, not a scanner or a certificate. Its result is separate from this score. Informative images need useful alternatives. But decorative images may need empty alt text.

Add assistive technology and representative user testing to the deeper review. The Australian Human Rights Commission has guidelines on equal access to digital goods and services (April 2025). They name WCAG as the applicable standard and advise meeting its latest published version.

Never label 2 points or an automated green score WCAG compliant. The scope and the next tests are in our guide to website accessibility basics.

What does your website audit score mean?

It means what the rubric says and nothing more. The points are equal weight editorial triage. They're not a validated health index, a predicted conversion rate or anything Google uses.

When all 15 checks apply and are complete, report points out of 30 and use the bands below. Otherwise report points out of twice the number scored, beside the coverage.

An example incomplete result: one N/A, three U and eleven scored checks gives "16/22 points across 11 of 14 applicable checks, with 3 marked U". It is not 22/30. It is not a healthy site verdict either.

Don't scale an incomplete result to 30 or apply the full score bands to it.

Here is how the sites in our website audits spread across those bands on these 15 checks. The chart shows the number of sites in each band.

A middle band score is the normal result of a first pass, not a failing grade. The checks at 0 matter more than the total.

That example is arithmetic, not a client result. Fourteen checks at 2 and the main form at 0 is 28 out of 30. But the business is still losing every enquiry.

Fix measurement gaps before claiming any later change improved results. Treat accessibility as a blocker, not a final cosmetic step.

What should you fix first?

The blocker, then the search fault, then the measurement gap, then everything else by evidence. The tree below is editorial triage. Urgent items can run in parallel.

For each finding, record:

• the URL

• the evidence

• the affected task

• the severity

• the proposed fix

• the owner

• any dependency

• the retest result

Judge impact and effort qualitatively.

A spreadsheet that forecasts revenue from a broken form is guesswork. A note that says "primary form fails on mobile, every enquiry lost, developer, this week" is enough to act on.

After the fixes, repeat the same journey under the same conditions. Record qualified enquiries separately from raw event counts.

The common mistake at this stage is fixing the easy cosmetic items first because they're visible. Meanwhile the form stays broken because it's someone else's job.

Then fill the scorecard summary from your 15 scores. Name the critical finding even when the total is high. Copy the summary into a document or an email and it becomes the audit record.

Which free website audit tools do you need?

You need five. None of them replaces the customer task test.

An online website checker reads code. It can time a page and list missing tags. It can't submit your form and confirm the enquiry arrived. Nor can it tell you whether a stranger understands your offer. Use the tools for what they measure and the 15 checks for the rest.

Google's own Rich Results Test checks eligibility for supported types, not every Schema.org type. It doesn't check whether your claims are true. Google's structured data guidelines make clear that valid markup doesn't guarantee a result.

Two markup facts to carry into any optional deeper check. Google's Search documentation updates record that FAQ rich results stopped appearing in Google Search from 7 May 2026. So helpful FAQ copy stays and the display promise goes. Under Google's review snippet guidelines, self serving reviews on a LocalBusiness or Organization aren't eligible for review stars. That includes reviews embedded through a widget.

What markup still does is covered in schema markup explained. A site crawler finds broken links and metadata problems at scale. It still isn't a complete audit.

A local business can add one more free check. This audit leaves out your Google Business Profile and whether your business details are consistent. The local SEO readiness checker covers both.

When do you need a deeper audit or redesign?

When the 30 minutes finds something it can't resolve. Escalate any of these:

• an unresolved task failure

• a significant unexplained fall in enquiries

• migration faults

• a complex checkout or booking system

• anything beyond your access or skills

The deeper scope can include a full crawl, analytics reconciliation, assistive technology testing and a specialist security review.

Platform maintenance sits outside this health check. It's still on the same owner's list: software and plugin updates, backups, certificate renewal and domain expiry.

Decide between targeted fixes and a redesign from the findings, never from the total score. A low score with three fixable blockers is a fix list. A site whose structure can't support the service pages it needs is a bigger conversation. Our guide to the signs your website needs a redesign helps you tell which one you have.

For the search side, our SEO audit checklist covers the crawl and visibility investigations this checklist only samples. Then there's the site that passes the basics and still fails to convert. For that site, the investigation and testing that follows is conversion rate work. Our guide to why your website isn't converting covers the diagnosis that comes first.

Where the evidence justifies structural work, web design and development is the route. A recent move or missing pages call for the checks in migrating a website without losing SEO rankings. Before any relaunch, the website launch checklist is the release gate.

What we recommend at Elev8d

FAQ

Next steps

Written by Ajay K.Co-founder, Elev8d

Ajay is the co-founder of Elev8d and writes most of what you will read here. Psychology grad turned marketer, which is a fancy way of saying he cares about why people click, not just where things rank. Every guide is written in plain English for Australian businesses, tested on real campaigns before it earns a spot on this site.