Website Audit Checklist for 2026: What to Check and Fix

Most “website audit” posts give you a 200-item list that nobody finishes. This one is the checklist I actually run on client sites, in order, with the specific things that break and how to fix them. If you only do the first four sections, you’ll catch the majority of real problems.

Start With Real Data, Not Opinions

Before touching anything, get numbers. Guessing wastes time and you’ll “fix” things that were never broken.

PageSpeed Insights and Lighthouse for lab data on your top 5 pages. Not all 400 pages. The ones that get traffic or make money.
Chrome UX Report (CrUX) for field data. This is what Google actually uses for Core Web Vitals ranking signals, so it matters more than your lab score.
Search Console for queries, impressions, CTR, and indexing problems. The Pages report will tell you what’s excluded and why.
Server logs or analytics to confirm what’s actually getting hit. Your homepage might be 4% of traffic while a product page does 40%.

Write the numbers down before and after. If you can’t measure the improvement, you can’t tell whether the work was worth it.

Performance and Core Web Vitals in 2026

The three metrics still stand: LCP (loading), INP (interactivity), CLS (visual stability). Google retired the FID metric back in 2024 and INP replaced it, so if a tool still shows FID, that tool is stale.

Targets worth aiming for

LCP under 2.5s on mobile, at the 75th percentile. Field data, not lab.
INP under 200ms. This is the one most sites fail in 2026 because of heavy third-party scripts.
CLS under 0.1. Usually caused by images without dimensions, injected banners, or late-loading fonts.

The usual culprits

Unoptimized hero images are still the number one LCP killer. Serve modern formats and set explicit dimensions so the browser reserves space:

<img
 src="/hero-1200.avif"
 srcset="/hero-800.avif 800w, /hero-1200.avif 1200w, /hero-1800.avif 1800w"
 sizes="(max-width: 800px) 100vw, 1200px"
 width="1200" height="630"
 loading="eager"
 fetchpriority="high"
 decoding="async"
 alt="Storefront on Main Street">

Note loading="eager" and fetchpriority="high" on the LCP image only. Everything below the fold should be loading="lazy". Lazy-loading your hero is a common self-inflicted wound.

Third-party scripts are the INP problem. Every chat widget, heatmap, and ad tag competes for the main thread. Audit them quarterly and delete anything nobody has looked at in six months. If a tag must stay, load it after interaction or on idle:

// Defer a non-critical third-party script until the browser is idle
function loadChat() {
 const s = document.createElement('script');
 s.src = 'https://example.com/chat-widget.js';
 s.async = true;
 document.head.appendChild(s);
}

if ('requestIdleCallback' in window) {
 requestIdleCallback(loadChat, { timeout: 3000 });
} else {
 window.addEventListener('load', loadChat);
}

Accessibility Checks That Catch Real Problems

Automated tools catch roughly a third of accessibility issues. They’re still worth running because that third is embarrassing when it’s on your site.

Run axe DevTools or Lighthouse’s a11y audit on your top pages.
Tab through your site with a keyboard only. Can you reach and use every control? Can you see where focus is?
Check color contrast on text, buttons, and form placeholder text (placeholders fail constantly).
Confirm every form field has a real <label>, not just a placeholder.
Make sure your language attribute is set: <html lang="en">.

Accessibility overlaps heavily with SEO. Alt text, heading structure, and semantic HTML help both. Fixing one usually helps the other.

Technical SEO Pass

This is where a lot of sites quietly bleed traffic.

Indexing: In Search Console, review “Crawled – currently not indexed” and “Discovered – currently not indexed.” Large counts usually mean thin or duplicate content.
Titles and meta descriptions: Unique per page. No templated duplicates. Keep titles under about 60 characters so they don’t get truncated.
Canonicals: One correct canonical per page. Watch for CMSs that point everything at the homepage by accident.
Structured data: Validate with the Rich Results Test. Local businesses should have LocalBusiness or Organization markup. If you’re in Commack or anywhere else on the Island, your NAP (name, address, phone) needs to match your Google Business Profile exactly.
Sitemaps and robots.txt: Confirm the sitemap is current, submitted, and doesn’t include noindexed or redirecting URLs.
Redirect chains: Multiple hops waste crawl budget. Collapse them to a single 301.

Security and Headers

This section gets skipped constantly and it’s the one that bites hardest.

HTTPS everywhere. No mixed content. Browsers will flag it and users will bounce.
Security headers. Add HSTS, X-Content-Type-Options, and a Content-Security-Policy. CSP is the hard one but it’s the one that stops injected scripts.
Dependencies. Run npm audit or your platform’s equivalent. Old plugins are the top entry point for WordPress compromises.
Backups. Confirm they run and, more importantly, that you can actually restore one. An untested backup is a guess.

# Basic security headers in nginx
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Content-Security-Policy "default-src 'self'; img-src 'self' data: https:;" always;

Test headers at securityheaders.com or with curl -I https://yoursite.com and read the output. Don’t assume they’re set because a plugin claims to set them.

Content and Conversion

Technical fixes get you found. Content and UX get you paid.

Check for decay. Pages that ranked two years ago and dropped may just need a refresh, not a rewrite.
Kill or consolidate thin pages. Ten weak pages competing for the same keyword lose to one strong one.
Above the fold: Can a first-time visitor tell what you do and what to do next within five seconds?
Forms: Fewer fields convert better. Test your own contact form on a phone. Half of them are broken on mobile.
Dead links and outdated info: Old pricing, wrong phone numbers, expired offers. These cost trust fast.

How Often to Run This

Quarterly for most sites. Monthly if you’re actively publishing, running ads, or shipping code. The full technical pass (performance, headers, indexing) can be annual if nothing major changed, but the content and conversion review should be ongoing.

If the audit turns up structural problems (bloated themes, a CMS fighting you on every change, pages that can’t be fixed without a rebuild), that’s usually the point where custom web development beats patching something that was never built right. Not every site needs that, but pretending a bad foundation is fine gets expensive.

FAQ

How long does a website audit take?

A focused audit of a 20 to 50 page site takes roughly 4 to 8 hours if you’re pulling field data and testing on real devices. Larger sites with e-commerce or heavy third-party scripts take longer, mostly because there’s more to measure and more to break.

Do I need to fix everything at once?

No. Fix in order of impact: LCP and INP problems, indexing issues, then security headers, then content. Performance and indexing move the needle fastest. Cosmetic issues can wait.

Can I just use an automated audit tool?

Use it as a starting point, not the answer. Automated tools miss INP causes, content quality, and most conversion problems. They also flag things that don’t matter for your specific site. Combine tool output with field data and an actual look at your top pages.