Website Audit Checklist for Small Business

Why audit a website that seems fine

Websites rarely break in a way you notice. Nobody calls to say the contact form stopped sending in March, or that the phone number on the services page is the old one. The site still loads, it still looks the way it did at launch, and so it gets left alone while the business around it changes.

Meanwhile the parts underneath keep moving. Plugins and themes release updates, browsers change, search engines adjust how they read pages, and staff come and go with their logins still active. Prices, hours, services and team members change in real life faster than anyone remembers to change them online. None of this is dramatic. All of it costs enquiries.

An audit is the deliberate version of noticing. You walk through the site with a checklist, the way a customer and a search engine would, and write down what is broken, what is weak and what is fine. Done once a year, it catches the slow drift. Done after a big change, such as a redesign or a hosting move, it catches the fast damage before your customers do.

“A website rarely breaks loudly. It drifts, one stale price and one failed form at a time, until it quietly stops earning.”

This website audit checklist is written for owners and small teams, not developers. Most of it needs nothing more than a phone, a laptop and the logins you should already have. Where a step needs a tool, the tool is free. Where a problem needs a professional, the checklist says so, rather than pretending every fix takes five minutes.

It is also deliberately different from a website launch checklist. A launch checklist asks whether a new site is ready. An audit asks what has gone wrong, gone stale or fallen behind on a site that has been live for a while, which is a harder question, because the problems have had time to hide.

Before you start: access, tools and a plan

An audit can stall on access long before it gets difficult. Halfway through, someone needs the domain registrar login, or Search Console turns out to belong to a former agency, and the afternoon is gone. Gather the keys first.

If you cannot get into one of these, that is your first finding. A business should never depend on a single person, or a past supplier, to reach its own website, domain or analytics. Write it down under broken and keep going.

Keep the sheet simple. For each problem, note the page, what you saw and what it probably costs: a lost enquiry, a worse first impression, or nothing much yet. That last column is what turns a pile of observations into a plan, and it is the part most audit reports leave out.

Finally, before you change anything, confirm a recent backup exists. An audit has a habit of turning into fixing, and fixing is where things go wrong.

Step 1: test the money path

Start with the one thing your website exists to do. For most small businesses that is an enquiry: a contact form, a quote request, a booking or a phone call. For a shop it is a purchase. Whatever it is, do it yourself, end to end, before you look at a single score.

Fill in the contact form with a real email address you can check. Confirm the message arrives in the inbox someone actually reads, not a forgotten address set up at launch, and look in the spam folder too. Read the confirmation message the visitor sees and the auto-reply they receive, if there is one. Then do the same on a phone, because a form that works on a laptop can fail on a small screen when a field is hidden or a button sits under a cookie banner.

Tap every phone number. On a phone it should open the call screen with the right number already in place. Tap the email address and the map link. If you take bookings or payments online, make a real booking at a quiet time and cancel it, or buy something small and refund it. Booking and payment tools change their settings and screens over time, and a real transaction is the only test that proves the whole chain still works.

While you are here, look at the route to the money path. From the homepage, how many taps does it take to reach the form or the booking page? Is the main button visible without scrolling on a phone? If you sell several services, can a visitor reach the right one without guessing? Our guide to conversion rate optimization basics covers how to tighten this once you know where people drop off.

If anything here is broken, stop the audit and fix it. Every other step on this list is about doing better. This one is about whether the website is doing its job at all.

Step 2: check that Google can find and index you

A site that Google cannot index is invisible in search, no matter how good it looks. A quick search for site:yourdomain.com shows roughly what Google has, but it is a quick look, not a record. The real answer lives in Google Search Console.

Open the Page indexing report in Search Console. It shows which pages Google can find and index on your site, and the indexing problems it ran into with the rest. A page listed as not indexed is not always a fault, since some pages, such as thank-you pages, should stay out of search. The ones to worry about are pages you want customers to find: your services, your locations and your best articles.

For any important page that is missing, use the URL Inspection tool. It shows Google’s indexed version of a specific page and lets you test whether a URL might be indexable. A noindex tag left over from development, a page blocked by robots.txt or a redirect pointing somewhere unexpected will usually show up here.

Then open your robots.txt file, at yourdomain.com/robots.txt. A robots.txt file tells search engine crawlers which URLs they can access, and Google is clear that it is not a mechanism for keeping a page out of Google; for that you need a noindex tag or a password. What you are looking for is an overly broad rule, such as a single Disallow: / under User-agent: *, which asks every crawler to stay away from everything.

Finally, confirm your sitemap is submitted in Search Console and that it lists the pages you care about. If your site is genuinely not appearing at all, our step-by-step guide to why a website is not showing on Google walks through every cause in order.

Step 3: measure speed and Core Web Vitals

Run your homepage and your most important service page through PageSpeed Insights, with the mobile setting selected. Mobile is the slower, harder test, and it is how many customers will first meet your business, often on a patchy connection.

Google groups its main measures of loading, interactivity and visual stability as Core Web Vitals. For a good experience, the largest content on the page should appear within 2.5 seconds, the page should respond to taps and clicks within 200 milliseconds, and the layout should hold still, with a layout shift score of 0.1 or less. Google suggests measuring these at the 75th percentile of page loads, so that most of your visitors get that experience, not just the lucky ones.

Do not chase a perfect score. The number at the top of the report summarizes a lab test, and it moves from run to run. What matters is the list of opportunities underneath, and whether real pages feel quick on a real phone. On small business sites the usual suspects are oversized images, too many plugins or third-party scripts, and slow or overcrowded hosting.

Images are the cheapest fix. Photos uploaded straight from a camera or phone are often far larger than the space they fill on screen. Resizing them and saving them in a modern format such as WebP can transform a slow page without touching anything else. Our guides to website speed optimization and getting website images right cover the fixes in order of effect.

Write down the mobile scores for both pages and the three biggest opportunities for each. Next time you audit, you will see whether things are improving or slipping, which tells you more than any single number.

Step 4: do the phone test properly

Automated tools can tell you a page fits a small screen. They cannot tell you whether it is pleasant to use with one thumb on a bus. For that you need a phone and a few honest minutes.

Open the site on your own phone, then borrow a different one, ideally an older model or a different brand. Open the menu, find a service, read a full page and reach the contact form. Notice everything that makes you pinch, zoom, hunt or wait. Text that needs zooming is too small. Buttons squeezed close together get mis-tapped. Pop-ups that cover the whole screen, especially ones that are hard to close, send people straight back to search.

Pay attention to the top of each page. That first screen does much of the work of deciding whether someone stays, and it is easy to fill it with a large logo, a slider or a stock photo while the actual offer and the call button get pushed out of view. On a phone, a visitor should know what you do and how to contact you before they scroll.

Rotate the phone and try the site in landscape. Fill in a form with the on-screen keyboard open and make sure the submit button is still reachable. If you sell online, add something to the cart and reach checkout. Our guide on how to check if your website is mobile friendly has a fuller walkthrough.

Step 5: read every page for stale details

This is the least technical step and the one most likely to turn up something embarrassing. Read every page as if you were a customer seeing it for the first time, with one question in mind: is this still true?

Check opening hours, including holiday hours. Check prices, packages and anything described as new. Check staff names and photos, service areas, addresses and phone numbers, which should match everywhere, from the header and footer to the contact page and your listings. Look for dates: a copyright year that has not moved, an event that already happened, a promotion that ended months ago, a blog that went quiet. Each one tells a visitor the business may not be paying attention.

Then read for clarity rather than accuracy. Does the homepage headline say what you do and who it is for, in plain words, or could any business in any industry have written it? Is there an obvious next step on every page? Are your testimonials real and reasonably recent? Our guide to writing website content that converts covers how to fix weak copy once you have found it.

Keep a separate list of pages that should not exist at all. Old landing pages for finished campaigns, near-duplicate service pages and leftover placeholder content all make a site harder to use and harder to understand. Removing them, or redirecting them to the right page, is part of the audit too.

Step 6: check the on-page search basics

You do not need to be a search specialist to check the basics. Each important page needs a clear, specific title, a short description that would make someone want to click, and one main heading that says what the page is about.

The quickest way to review titles and descriptions is to look at your pages in Google’s results. The Performance report in Search Console adds the searches each page appears for, which tells you whether a title matches what people are actually looking for. Look for duplicates, where several pages share the same title, and for titles that only say your business name. Each core service deserves its own page with its own title, rather than one long page trying to cover everything.

Check that images carry alt text that describes them, that headings run in a sensible order, and that pages link to each other where it helps the reader. Then look for broken links, both internal ones and links to other sites that have since moved or disappeared. Search Console lists pages that return errors, which is a good place to start.

If this step turns up more than a handful of problems, our no-nonsense guide to SEO for small business websites explains what to fix first and what you can safely ignore.

Step 7: check your listings and reviews

For a local business, the website and the Google Business Profile work as a pair. Customers move between them, and so does Google. Your business name, address, phone number and hours should match exactly across both.

Google’s own guidelines ask businesses to represent themselves as they are consistently represented and recognized in the real world, across signage, stationery and other branding, and to keep addresses and service areas accurate and precise. If your website says one thing and your profile says another, fix whichever is wrong today.

Read your recent reviews and check that each one has a reply, especially the critical ones. A calm, specific response to a bad review can do more for the next customer than the review did harm. Then check the other directories you appear in, such as industry sites and local business listings, for old addresses, old phone numbers and businesses that look closed when they are not.

Our guides to local SEO for small business and getting more Google reviews cover both halves in detail.

Step 8: confirm analytics and tracking work

Analytics that are installed but broken are worse than none, because they make you confident about the wrong numbers. Check that Google Analytics is receiving data today, not just that the code is on the site. Open the realtime view, visit your own site from your phone, and watch yourself appear.

Then check that the actions you care about are measured. In Google Analytics these are called key events, which exist to measure actions that are important to your business and to show which marketing channels lead people to take them. For a small business, the obvious candidates are a form submission, a booking and a tap on your phone number. Submit your own test enquiry and confirm it is recorded. If nothing is tracked, you cannot tell whether a change to your site helped or hurt.

Check the boring connections too. Is Search Console linked to the right Analytics property? Do reports go to an email address someone still reads? Does anyone in the business actually look at the numbers each month? Our guide to website analytics explains what to track and what to ignore.

Step 9: security, updates and backups

Website security problems often start with something dull: an outdated plugin, a weak password, or an admin account nobody remembers creating. The audit is your chance to close those doors before someone else finds them open.

Start with HTTPS. Every page should load with the padlock and no warnings, and the plain http version of your address should redirect to the secure one. The free SSL Server Test from SSL Labs performs a deep analysis of the HTTPS setup of any public website. While you are there, note when your certificate expires and who is responsible for renewing it.

Next, updates. If your site runs on WordPress, minor and security releases of WordPress itself apply automatically in the background on most sites, but major releases still need someone to start them. Themes and plugins need watching too: log in, look for anything waiting to update, and remove plugins that are no longer used rather than leaving them switched off.

Then people. Open the list of users and remove anyone who no longer needs access: former staff, past agencies, the relative who helped once. Make sure the remaining admins use strong, unique passwords and two-factor sign-in where your platform supports it. Do the same for your hosting account and your domain registrar, which control more than the website itself.

Our guides to small business website security and website backups go deeper on each of these.

Step 10: check accessibility

An accessible website works for people using screen readers, keyboards instead of a mouse, zoomed-in text or high contrast settings. It also tends to be a clearer website for everyone else.

The problems are widespread. WebAIM’s 2026 analysis of the top one million home pages found detected WCAG 2 failures on 95.9% of them, with low contrast text on 83.9% and images missing alternative text on 53.1%.

Run your key pages through WebAIM’s WAVE tool. WAVE can identify many accessibility errors against the Web Content Accessibility Guidelines, and it is built to support your own review of the page as well.

Then do three manual checks that no tool fully covers. Press Tab repeatedly and make sure you can reach, and see, every link and button. Zoom the page in several steps and check that nothing breaks or overlaps. Read the alt text on your images and ask whether it describes what a sighted visitor would see. Our guide to website accessibility standards explains the rules in Canada and the WCAG levels behind them.

Step 11: check AI search access

ChatGPT now has search features that surface websites in its answers, and whether yours can appear starts with a technical question: are the crawlers that feed those answers allowed in?

Open your robots.txt file again and look for rules naming AI crawlers. They are not all the same. OpenAI, for example, uses OAI-SearchBot to surface websites in ChatGPT’s search features, and says sites that opt out of it will not be shown in ChatGPT search answers, although they can still appear as navigational links. Its separate GPTBot crawler collects content that may be used to train its models. Because they are separate, you can allow one and block the other.

Google works differently. Its Google-Extended token lets you control whether content Google crawls can be used to train future Gemini models and to ground answers in some Gemini products, and Google states that it does not affect a site’s inclusion in Google Search or act as a ranking signal there.

Next, structured data. This is code on the page that describes your business in a format machines read easily: your name, address, opening hours, services, reviews or frequently asked questions. Google uses structured data it finds on the web to understand the content of a page, and its Rich Results Test checks whether yours is valid.

You may also see advice to add an llms.txt file. It is a proposal to standardize a file that helps AI agents use a website, not an established requirement, so treat it as a low-cost extra rather than a priority. The bigger win is plain, specific content: your services, your service area and clear answers to real customer questions, stated on the page where any reader, human or machine, can find them. Our explainer on answer engine optimization goes further, and our free website scanner checks AI crawler access and structured data alongside your speed scores.

Step 12: domain, email and the admin nobody owns

Some of the most damaging website failures have nothing to do with the website. A domain name that lapses can take the site and the email down with it. An email setup that falls short of modern checks can send your quotes and invoices to spam.

Log in to your domain registrar and check three things: the renewal date, that auto-renew is switched on with a valid card, and that the domain is registered to your business rather than to a former employee or supplier. Our guide to domain names and business email explains why ownership matters and how to fix it if it is wrong.

Then check your email authentication. Since February 2024, Gmail has required everyone who sends email to Gmail accounts to set up SPF or DKIM, and anyone sending more than 5,000 messages a day to Gmail accounts to set up SPF, DKIM and DMARC. Whoever manages your email can confirm what is in place. If any of the three is missing, ask for it to be set up, for your own mailbox and for any service that sends email on your behalf, including your website’s forms.

Last, check the hosting account: who holds the login, when it renews, and whether the plan still suits the site. Our guide to website hosting for small business covers what to look for.

Step 13: privacy and legal pages

Your privacy policy should describe what your site actually does today. If you have added a booking tool, a chat widget, analytics, a newsletter sign-up or advertising pixels since the policy was written, it is probably out of date. Each of those handles personal information in some way, and visitors should be able to find out how.

Check that the privacy policy is linked from every page, usually in the footer, and from every form. Check that any newsletter sign-up says clearly what people are signing up for, and that sign-ups actually reach your email platform. If you sell online, compare your terms, refund and shipping pages against what you really do.

This is not legal advice, and the rules can differ by province and by industry. Our guide to website privacy policies in Canada explains the basics and when to involve a lawyer.

How to rank what you find

By now you have a list, probably longer than you expected. That is normal. The mistake is to start at the top and work down, or to fix the easiest things first because they feel productive. Rank the list by what each problem costs you.

“Fix what costs you customers first. A perfect speed score on a site whose contact form sends nowhere is just a faster way to lose a lead.”

Within each group, put the pages that matter most first. A slow homepage and a slow page from a campaign that ended two years ago are not the same problem. Your main service pages, your contact page and your homepage come before everything else.

Then decide who fixes what. Content changes, listings and user accounts are often jobs an owner can do. Speed, security, tracking and structured data usually need whoever looks after the site technically. If nobody does, that gap is itself a finding, and an important one.

The whole audit, in order

If you want to run the whole website audit checklist in one sitting, this order puts the most expensive problems first and groups the steps that use the same tools.

1. Complete the money path on a phone. Form, call, booking or purchase, end to end, with a check that the message arrived.
2. Open Search Console. Page indexing report, URL Inspection on your key pages, sitemap status, then robots.txt.
3. Run PageSpeed Insights on mobile. Homepage and main service page, noting the scores and the top opportunities.
4. Do the phone walkthrough. Menu, a full page, the contact form and checkout, on two different phones if you can.
5. Read every page for stale details. Hours, prices, staff, dates, offers, and contact details that must match everywhere.
6. Check titles, links and listings. Page titles and descriptions, broken links, your Google Business Profile and your reviews.
7. Test tracking. Watch yourself arrive in realtime analytics and confirm a test enquiry is recorded.
8. Review security and backups. HTTPS, waiting updates, user accounts, and when a backup was last restored.
9. Run WAVE and the keyboard test. On the homepage and the contact page at a minimum.
10. Check AI access, domain and email. Robots.txt rules for AI crawlers, structured data, renewal dates and email authentication.
11. Rank the list and assign owners. Today, this month or later, with a name and a date next to every item.

Keep the sheet. Next time, start by checking that the last audit’s fixes are still in place. A problem that comes back points to a gap in how the site is looked after, not a one-off accident.

Free tools for each part of the audit

You do not need paid software for a small business audit. These cover almost every step, and all of them are free to use.

Paid audit tools add crawling at scale, historical tracking and competitor data. They earn their keep on large sites and for agencies running many audits. For a site of a few dozen pages, they mostly produce longer reports, not better decisions.

Do it yourself, hire an auditor, or hand it over

There are three realistic ways to keep a small business website healthy, and they suit different businesses.

Whichever you choose, be wary of any audit that promises rankings. A good audit finds what is holding a site back. Nobody controls Google, and anyone who promises a position is guessing.

If you are weighing those options, our explainer on what a managed website service is covers what is usually included and what to ask before signing up. And if the audit turns up so many problems that patching no longer makes sense, the seven signs your website needs a redesign will help you decide.

How often to run a website audit

Run a full audit at least once a year. Run another after any big change: a redesign, a move to new hosting, a new booking or payment system, a rebrand, or a change in who looks after the site. Those are the moments when things break, because many things change at once.

In between, do a short monthly check of the money path and the details that change most. Submit the form, tap the phone number, glance at the hours and prices, and open Search Console for anything new under page indexing. It takes a few minutes and catches the expensive surprises early.

If your website is the main way customers find you, add a quarterly look at speed, tracking and content as well. Our guide to what website maintenance involves explains how these checks fit into ongoing care.

Audit mistakes that waste the effort

Audits tend to go wrong in a few predictable ways.

Frequently asked questions