What is a website audit: the five kinds of checks and what a useful report contains

A website audit is a checklist that ends in a report

The short answer to what is a website audit: a check of a site against a list of known problems, ending in a written report. The report says what is broken, where, why it matters and in which order to fix it. Without that last part it is only an inspection. Owners order one when traffic drops, before a redesign, after a platform move or when the site stops bringing requests.

The word covers several different jobs. A technical audit asks whether search engines can reach and read the pages, and an SEO audit looks at what each page says. A usability review watches a person try to buy or book, a security audit looks for holes, and an accessibility audit asks whether people with disabilities can use the site. One order can include all five or just one, so first decide which you need.

The technical audit: can search engines find and read the site

Google's SEO starter guide explains the mechanics. Crawlers move across the web, and Google primarily finds new pages through links from pages it has already crawled. A page that no link points to, or one closed to the crawler by mistake, may never reach the index. The quickest check the guide suggests is a search with the site: operator and your domain: if your pages appear, the site is in the index.

Google Search Console goes deeper. Its help page calls it a free service that helps owners monitor and troubleshoot how their sites appear in Google Search: it shows indexing problems, lets you request re-indexing and sends alerts about indexing, spam or other issues. Signing up is not required to appear in results, so it is a diagnostic tool rather than an entry ticket. Its URL Inspection tool, recommended in the starter guide, shows how Google sees a single page.

For Russian-language search, Yandex Webmaster plays the same role. Its help describes it as a service that shows how easily users find your site. It lists errors that prevent indexing, shows how often the robot visits and checks robots.txt, the Sitemap file and mobile adaptation. A technical audit reads both services side by side, because two search engines can see one site differently.

Page speed in an audit: lab tests and field data

Speed is the part owners can test in a minute and the part most often misread. The PageSpeed Insights documentation separates field data, taken from the Chrome User Experience Report over the previous 28-day collection period, from lab data produced by Lighthouse in a simulated environment. Google calls lab data useful for debugging but warns that it may not capture real-world bottlenecks. Only the field data describes real visits.

Google's web.dev guide names three Core Web Vitals: Largest Contentful Paint for loading, Interaction to Next Paint for responsiveness and Cumulative Layout Shift for visual stability. It recommends an LCP within 2.5 seconds, an INP of 200 milliseconds or less and a CLS of 0.1 or less, measured at the 75th percentile of page loads for mobile and desktop separately. The 0 to 100 lab score is a different thing: PageSpeed Insights counts 90 and above as good and below 50 as poor. These targets are Google's and may change, and a lab score alone measures a test, not the visitors.

The SEO audit: titles, descriptions, addresses and duplicates

An SEO audit moves from whether pages are found to what they say. Google's starter guide is specific: a good title is unique to the page, clear and concise, and accurately describes it. A good meta description is short, belongs to one page and carries its most relevant points. The guide also asks for long texts split by headings and for addresses with words useful to a person rather than random identifiers.

Duplicates are a classic finding. The guide says duplicate content does not violate Google's spam policies but can be a poor experience for users and waste crawling resources; where possible it recommends a redirect or rel="canonical". An auditor also checks that every service people search for has a page of its own. The guide is honest about timing: some changes take effect in hours, others in several months.

Usability and accessibility: whether people can actually use it

A site can be indexed and fast and still lose customers at the form. A UX audit follows tasks, such as finding the price, booking a time or paying, on a phone and on a computer. The auditor records each place where a person hesitates, misreads or gives up. Typical findings are buttons that do not look like buttons, forms that ask for too much and contacts hidden three clicks deep.

Accessibility asks the same question for people with disabilities, including those who use a screen reader or a keyboard instead of a mouse. The yardstick is WCAG, developed by the Accessibility Guidelines Working Group of the W3C Web Accessibility Initiative. It rests on four principles, perceivable, operable, understandable and robust, and sorts its success criteria into three levels, A, AA and AAA. WCAG 2.2 was published on 5 October 2023, and W3C notes that content meeting it also meets versions 2.1 and 2.0.

The W3C page says plainly that WCAG is a technical standard, not an introduction, so an audit translates it into tasks such as labelling form fields and making every action possible from the keyboard. Lighthouse has an accessibility category that catches part of this automatically. A machine, however, cannot judge whether an alt text really describes the picture. That still needs a person, ideally one working with a screen reader.

The security audit and the OWASP Top 10 list of risks

A security audit looks at the site as an attacker would: what is exposed, what is outdated, who can reach which data. Most checklists start from the OWASP Top 10, which OWASP describes as the reference standard for the most critical web application security risks. The current release is the 2025 edition. Broken access control is first, security misconfiguration second and injection fifth.

On a small business site the checks are modest: an updated content management system and plugins, a protected admin panel, forms that filter input, backups that restore. Yandex Webmaster adds an outside view, since its help says the service lets you check whether the site is safe for visitors. A security finding should not wait for the next sprint. If the site stores personal data, the legal side is a question for a lawyer, not for the auditor.

A basic website audit you can run yourself in one evening

A first pass does not need a specialist. Run a site: search in Google and in Yandex and compare the pages shown with the pages you know exist. Then connect Google Search Console and Yandex Webmaster if needed and read their sections on indexing and errors. Write down every warning as it stands, without fixing anything yet.

Next, run PageSpeed Insights on the home page and on the pages that bring requests, starting with the mobile tab, and note field data apart from the lab report. Lighthouse also runs from its tab in Chrome DevTools, which Google's Lighthouse documentation recommends for pages behind a login. Each Lighthouse audit comes with a reference explaining why it matters and how to fix it. That keeps the list readable for a non-specialist.

Finally, act as a customer. Open the site on your phone, fill in the form and check that the request arrives in the inbox, CRM or messenger it should. Make sure no two key pages share the same title in the search results. By the end of the evening you have a list of facts with no priorities or reasons, which is not yet an audit, but it is an honest starting point and a good test of any audit you order later.

Ordering a website audit: the report, the decision and the access

A good report is easy to tell from an export. An export is a long list of warnings of equal weight, many of them irrelevant to your business. A report written by a person groups the findings, shows each on a specific page and explains what it costs in requests. It puts the fixes in order, this week, this month, later, and says openly what was not checked.

A self-check is enough when the site is small, the findings are obvious and someone on the team can fix them. Ordering makes sense when traffic has fallen without a visible cause, before a redesign or a platform move, when the site takes payments or personal data, or when your list is longer than you can handle. Technical SEO and UX audits can be ordered separately, for example at VITON13 Studio, so you pay only for the part you need. Either way, ask for a sample report first.

Prepare access in advance: user rights in Search Console and Yandex Webmaster, analytics, the site admin or hosting, and a list of the pages that bring money. Add what changed recently and what the goal is, because the same site is checked differently for more requests than for a redesign. Then the auditor spends the hours on the site rather than on emails. The question of what is a website audit becomes a practical one: which finding to fix first.