What Does a Website Audit Include? A Breakdown of Every Component

Originally posted on April 23, 2024 @ 12:03 pm

A complete website audit covers ten core component areas: technical SEO, technical performance, content quality, user experience and accessibility, security, backlinks, analytics, conversion rate optimization, competitor benchmarking, and the prioritized roadmap that translates findings into decisions. A free website audit tool is a useful first pass — it surfaces obvious symptoms quickly. But surfacing symptoms is not the same as producing a roadmap.

The diagnostic test for whether an audit is defensible is straightforward. It examines whether search engines can find your site, whether visitors can use it, whether content earns trust, whether security and analytics infrastructure are sound, and whether the path from first visit to revenue is free of friction. Done properly, this work is a full-spectrum business diagnostic. 

Key Takeaways

• A free audit tool tells you something is wrong; a professional audit tells you what to do, in what order, and who owns it.
• Every flagged issue should arrive with three things attached: A business impact estimate (expressed in revenue, risk, or rank), an effort estimate (in engineering hours or sprints), and a stakeholder owner (named, and accountable for the fix).
• Credible website audits capture baselines first: organic sessions and conversions over the trailing ninety days, current Core Web Vitals field data, indexed page counts, and conversion rates on high-traffic landing pages. Without baselines, every “improvement” claim made afterward is unprovable.

Technical SEO Audit: The Foundation Every Other Component Depends On

A technical SEO audit comes first because nothing else matters without it. If search engines can’t crawl your site or won’t index your pages, content is invisible, performance optimizations have no audience, and analytics are tracking a phantom. Comprehensive SEO audit services start here for that reason.

Crawlability and Indexing

This layer asks one question: can search engines find and read your pages? The review covers robots.txt, noindex tags, canonical implementation, redirect chains, and XML sitemap accuracy. It also surfaces crawl budget waste — and crawl budget, in plain language, is the number of pages a search engine is willing to crawl on your site within a given window. For most small sites it’s effectively unlimited; for large e-commerce and publisher sites, it’s a real constraint — and any page a search engine wastes its budget on is a page that never makes it into the index.

A robust crawlability check triangulates three sources, not one: a fresh crawl from a tool like Screaming Frog or Sitebulb, the Pages report inside Google Search Console, and on larger sites, server log file analysis. Reports built from a single crawl tool routinely miss indexing issues that only surface in the Search Console discrepancy.

Site Architecture and Internal Linking

Site structure is the blueprint of how authority flows through a site. A useful heuristic most teams underuse: every conversion-critical page should be reachable within three clicks from the homepage and should receive internal links from at least three high-authority pages. When the review reveals a money page sitting four or five clicks deep with one inbound internal link, that single fix often produces a measurable ranking lift inside a quarter. No new content. No new backlinks. Just authority routed correctly.

On-Page Elements

Title tags, meta descriptions, header structure, schema markup (code that helps search engines understand what your content represents), and canonical tags (the tag that tells Google which version of a page is the original) — these are the on-page elements every review examines for uniqueness, accuracy, and rich-result eligibility.

Schema is where the easy wins hide. A credible check runs Google’s Rich Results Test on a representative sample of templates, because plugin-generated schema frequently passes a syntax check while failing eligibility for rich results. The fix is usually trivial. The traffic missed from invalid markup is not.

Duplicate Content and Keyword Cannibalization

Keyword cannibalization — when two pages on your site target the same query and split traffic instead of consolidating it — is the version of duplicate-content problem most teams don’t realize they have. The review maps which pages are competing against each other, which should be merged, and which should be redirected.

Technical Performance Audit: Speed, Core Web Vitals, and Mobile Usability

Once a site is discoverable, the next question is whether it performs well enough to keep the visitors search engines send. Performance issues compound: slower pages rank worse, slower pages convert worse, and slower pages bounce more — meaning the same broken millisecond costs you at three points in the funnel.

Core Web Vitals

Three metrics make up Core Web Vitals, and Google evaluates them at the 75th percentile of real-user field data. At least 75% of page visits must hit the “good” threshold for a URL to pass.

Metric	What It Measures	Google’s “Good” Threshold
LCP	Loading speed of the largest visible element	≤ 2.5 seconds
INP	Responsiveness to user interactions	≤ 200 milliseconds
CLS	Visual stability during page load	≤ 0.1

 

INP — Interaction to Next Paint — replaced First Input Delay as the responsiveness metric on March 12, 2024, and it remains the metric most sites currently fail. The 2025 Web Almanac, drawing on July 2025 CrUX data, reports that roughly 23% of mobile sites still miss the 200ms threshold. Unlike LCP and CLS, which usually respond to image and layout fixes, INP failures almost always trace back to JavaScript: heavy third-party scripts, bloated page builders, and long main-thread tasks during user interactions.

The other distinction worth understanding is field versus lab data. Lab data — Lighthouse, PageSpeed Insights synthetic scores — is what auditors run on a single test machine in controlled conditions. Field data is what Google actually uses, aggregated from real Chrome users on real networks. A page can pass the lab tests and still fail in the field. A credible audit always pulls the field data, not just the synthetic score from a single run.

Page Speed and Time to First Byte

Time to First Byte — TTFB — is the time between a visitor clicking your link and the first byte of your page arriving in their browser. Google’s general guidance puts TTFB at 800ms or less, with anything over 1.8 seconds classified as poor.

A high TTFB usually points to one of three causes: slow hosting, an unoptimized database query, or a missing CDN. Of the three, adding a CDN is typically the lowest-effort, highest-impact fix — and almost always cheaper than an LCP-targeted image optimization sprint.

Mobile Usability

Google completed its full transition to mobile-first indexing in October 2023. The implication still surprises stakeholders: if your mobile version has less content, weaker schema, or different internal linking than the desktop version, the mobile version is the one Google ranks against. Auditors regularly find sites that hide important content behind “Read more” toggles on mobile, then wonder why traffic dropped — Google rendered the page, indexed only what was visible, and the rest never got crawled.

If you suspect Core Web Vitals are silently suppressing your traffic, Web Upon’s site speed optimization audits diagnose every millisecond of friction and translate findings into a prioritized fix list.

Content Audit: Quality, Relevance, and Strategic Alignment

A site can be technically flawless and still fail. The next layer asks what’s on the pages — whether the content earns the trust required to rank, convert, and retain attention. Content audit services operate at this layer.

Content Quality and E-E-A-T

E-E-A-T — Experience, Expertise, Authoritativeness, Trustworthiness — is the framework Google’s quality raters use to evaluate content. The leading “E” was added in December 2022, and the practical implication is that pages on sensitive topics (finance, health, legal) need to demonstrate first-hand experience, named authorship, and credentials. Auditors increasingly flag missing author bios, missing publish or update dates, and missing credential signals as content-quality issues, not just SEO ones.

The review identifies pages that are outdated, thin, or duplicative; pages competing for the same intent; and topical gaps where competitors are capturing demand the site should be earning.

Page Performance	Topic Still Relevant?	Recommended Action
High traffic, outdated info	Yes	Update
Low traffic, overlapping topic	Yes	Consolidate with a stronger page
Low traffic, irrelevant topic	No	Redirect to closest match or remove
No traffic, no link equity	No	Delete

Site Structure as a Content Lever

Navigation menus, internal search, breadcrumb implementation, and the logical hierarchy of categories all determine whether content gets discovered. Poor structure creates content silos — clusters of pages that should reinforce each other but instead sit isolated, splitting authority that should be consolidating.

User Experience and Accessibility Audit: Removing Every Barrier to Engagement

If the layers above determine whether users can find you, UX and accessibility determine whether they can actually use the site once they arrive.

UX: Mapping Behavior Against Design

The UX review pulls behavioral data — heatmaps, session recordings, scroll depth — alongside the layout, hierarchy, and CTA placement decisions baked into the design. The goal is to identify where intended behavior diverges from actual behavior, and where that gap is costing conversion.

Form friction is where UX work pays off fastest. Baymard Institute’s research has consistently shown that a meaningful share of cart abandonment traces back to extra fields, unclear error messages, and required-account-creation gates — 19% of users abandon when forced to create an account, and the average U.S. checkout flow contains 23.48 form elements when the ideal is 12–14. Removing two or three non-essential fields on a primary lead form often produces a larger conversion lift than a full visual redesign — and costs almost nothing to implement. Our web design audit guide covers the methodology in detail.

Accessibility Compliance

Accessibility testing runs against WCAG 2.1 Level AA — color contrast, keyboard navigation, alt text, ARIA labels, semantic structure. WCAG 2.1 AA is the technical standard specified in the U.S. Department of Justice’s April 2024 Title II final rule, and is widely cited as the working benchmark in Title III private-business litigation. WCAG 2.2 was formally approved as ISO/IEC 40500:2025 on October 21, 2025 and is increasingly referenced in procurement requirements.

A defensible accessibility check uses both automated tools and manual testing. Automated tools — axe, WAVE, Lighthouse accessibility scoring — catch roughly 30% of WCAG issues, per Deque Systems’ coverage analysis of the 50 Level AA success criteria. The rest require human evaluation: keyboard-only navigation, screen-reader walkthroughs, color-contrast spot-checks. Reports built on automation alone are how organizations end up “passing” and still receiving demand letters. Proactive remediation is meaningfully cheaper than reactive remediation under legal pressure, and accessibility improvements double as SEO wins and audience expansion.

Security Audit: Protecting Site Integrity and User Trust Signals

Security is invisible when present and catastrophic when broken. It belongs in every review (not just IT ones) because the consequences of a security failure are revenue, ranking, and trust losses that show up on the marketing scorecard.

SSL and HTTPS Implementation

HTTPS has been a Google ranking factor since August 2014, and modern browsers actively flag non-HTTPS pages as “Not Secure.” The reality, though, is that the most common SSL findings aren’t missing certificates — they’re mixed content errors, where a page served over HTTPS still loads images, scripts, or fonts over HTTP. Browsers either block these resources or downgrade trust signals. Both outcomes hurt conversion.

Vulnerabilities and Security Headers

The vulnerability scan looks for malware, unauthorized code injections, and CMS plugin or theme exposure — the most common attack surface on plugin-heavy platforms. Unresolved vulnerabilities can trigger Google Safe Browsing penalties, and a Safe Browsing flag can collapse traffic overnight.

Three security headers do most of the easy-to-explain work, and the review verifies all three exist and are configured correctly:

• HSTS (HTTP Strict Transport Security) tells browsers: always connect to this site over HTTPS, even if a user types the http:// version.
• Content Security Policy tells browsers exactly which scripts, stylesheets, and resources are allowed to run on a page — blocking injected malicious scripts even if an attacker manages to inject them.
• X-Frame-Options prevents the site from being embedded in an iframe on another domain, mitigating clickjacking attacks.

These three are universally cheap to implement and routinely missing , especially after CDN configuration changes or plugin updates that silently disable them.

Backlink and Link Audit: Evaluating the External Authority Landscape

Internal site health is half the picture. The other half is what the rest of the internet is saying about you, and how that off-site reputation shapes the way search engines weigh everything inside the site.

Backlink Profile Analysis

The backlink check examines link quality, relevance, anchor text distribution, and domain diversity. It separates authority assets from toxic liabilities and identifies competitor link gaps.

Google has stated repeatedly that its algorithms ignore most spammy links automatically; its own Search Console guidance notes that most sites do not need to use the disavow tool at all. That position has shifted disavow practice. Use the disavow tool conservatively — only when there’s evidence of an active manual penalty or a clear pattern of negative SEO. An aggressive disavow strategy can damage a site by removing legitimate authority signals; a sober assessment explains the trade-off rather than dumping every low-DA link into a disavow file.

Broken Link Audit

Inbound broken backlinks are the highest-ROI fix this layer surfaces. A page that used to exist, accumulated authoritative inbound links, and now returns a 404 is leaking ranking power into the void. The fix is a single 301 redirect to the closest relevant live page — an hour of work that often reclaims authority equivalent to weeks of new outreach.

Analytics and Conversion Tracking Audit: Ensuring Data You Can Trust

Every finding above this section is only as valuable as the analytics infrastructure used to measure it. Without trustworthy data, the priorities can’t be defended, the improvements can’t be proven, and next quarter’s budget request loses its anchor.

GA4 Configuration

Universal Analytics stopped processing new data on July 1, 2023; analytics work today examines GA4 implementations only. GA4’s event-based data model is fundamentally different from the session-based model that came before, and the most common finding is a property that was migrated rather than rebuilt. Symptoms: duplicate event firing, conversions counted twice, incomplete enhanced measurement, missing custom dimensions for the actual KPIs the business tracks.

A clean check verifies the data layer, the gtag implementation, conversion event definitions, and — most importantly — the alignment between what’s tracked and what stakeholders are actually trying to measure. GA4 analytics expertise at this layer is what separates engagements that produce defensible numbers from those that produce false confidence.

Conversion Rate Optimization

The CRO review maps the full path from first touch to revenue, identifies drop-off points, and audits the alignment between ad messaging, landing page content, and on-page conversion elements.

The trap most CRO work falls into is page-level optimization without funnel-level diagnosis. A page can have a low conversion rate that is appropriate for its funnel position, or a high conversion rate that masks poor upstream traffic quality. Start with the funnel, identify the single largest drop-off point, and prioritize that. Fixing the biggest leak first is almost always more valuable than running A/B tests on the smallest one.

Trustworthy analytics and a CRO-tuned conversion path are where audit insights become measurable revenue. See how CRO audits identify exactly where revenue is leaking.

Competitor Analysis Within the Audit Framework

Reviewing your site in isolation is incomplete. Competitive context is what transforms findings from abstract observations into urgently actionable priorities, because a site can be objectively healthy and still losing to better-optimized rivals on the queries that drive the business.

The most useful competitive benchmark is rarely the brand-level competitor a stakeholder names. It’s the SERP-level competitor — whoever is currently ranking in positions one through five for the queries that matter. Those URLs may be from a smaller publisher, an industry resource page, or a competitor the marketing team hasn’t been thinking about. A credible benchmark pulls Core Web Vitals field data, content length and structure, and backlink authority for those specific top-ranking URLs. Beating them is the actual job; comparing yourself to a brand peer who isn’t ranking is a comfort exercise, not a strategy.

Turning Audit Findings Into a Prioritized Action Plan

A roadmap requires ordering, scoring, and ownership; this is where the work earns its budget.

From Findings to Decisions

The output a stakeholder needs is a tiered priority matrix:

The most defensible prioritization frameworks score each finding on three axes: estimated business impact, implementation effort, and confidence in the impact estimate. The output is an Impact-Effort-Confidence score per finding, which sorts the entire audit into an executable roadmap. Findings that can’t be scored on all three axes are either communicated as research items or held until they can be. That discipline is what separates a roadmap from a wish list.

The Tools Behind the Work

A comprehensive website audit uses many instruments. Crawlers like Screaming Frog and Sitebulb. Google’s own Search Console, PageSpeed Insights, and Lighthouse. Backlink platforms like Ahrefs, Semrush, and Moz Link Explorer. Accessibility scanners, security vulnerability tools, and the CrUX field data Google publishes for every site.

No single tool produces a credible roadmap. Every tool has blind spots: Screaming Frog cannot see Search Console data, PageSpeed Insights’ lab tests don’t match field data, and even the best backlink platforms disagree on what counts as toxic. The diagnostic value lives in the triangulation: pulling the same question through three or four different instruments and reconciling where they agree and disagree. The expertise applying the tools is what produces the roadmap.

From Audit Components to a Defensible Roadmap

A website audit is a business diagnostic. The ten components — technical SEO, performance, content, UX and accessibility, security, backlinks, analytics, CRO, competitor benchmarking, and the prioritized roadmap that ties them together — are the lenses through which we triangulate where revenue is leaking, where risk is accumulating, and where competitive ground is being lost.

What separates audits that move quarterly numbers from PDFs that only gather dust is the discipline of converting findings into decisions and the willingness of a strategic partner to defend the prioritization across the table from a skeptical CFO. A credible audit ends with a single sentence the marketing director can carry into Monday’s standup: here is what we are fixing first, here is what it will cost, and here is what we expect to recover. Everything before that is just preparation.

If you’re ready to commission a website audit that produces a defensible, ROI-linked roadmap, schedule a consultation with Web Upon.