Audit any website

What it checks, and why each part matters

Performance

Lighthouse scores for mobile and desktop, the Core Web Vitals (Largest Contentful Paint, layout shift and blocking time), how quickly your server answers, whether pages are compressed, and the usual causes of slow pages: oversized HTML, scripts that block the first paint, images without dimensions, and too many third-party scripts.

Speed matters because visitors leave before a slow page finishes, and because Google uses Core Web Vitals as part of how it ranks pages. Most slow sites I see are slow for one or two boring reasons, usually images, and the report points straight at them.

SEO

The page title and meta description (present, unique, and the right length), a single H1, whether the page tells search engines not to index it, the canonical URL, robots.txt, the XML sitemap, the mobile viewport, social share tags, structured data, the favicon, and whether the content is in the HTML or only appears once JavaScript runs.

These are the signals search engines use to understand and display a page. A single stray noindex left over from a staging site can hide a whole website from Google, and this is the first place I look on any audit.

Accessibility

Alt text on images, labels on form fields, names on links and buttons, the page language, pinch-to-zoom, heading order, duplicate IDs, a skip link, and vague link text like "click here". With Lighthouse, it also checks color contrast and ARIA usage on the rendered page.

Accessible sites work for people using screen readers, keyboards or zoom, and in many places accessibility is a legal expectation. Most fixes are small and cost nothing once you know where they are.

Security and best practices

HTTPS, whether the http:// version redirects, when the SSL certificate expires, security headers (HSTS, Content-Security-Policy, X-Content-Type-Options, clickjacking protection), mixed content, insecure forms, cookie flags, software versions that are visible to anyone, and outdated jQuery.

An expired certificate takes a site offline in every browser, and old libraries are how a lot of small sites get compromised. These checks are cheap to pass and expensive to ignore. One thing the tool can't see is your server's PHP version; my PHP2Shell explainer shows how to check it.

Links and images

Broken internal and external links, links that go through redirects, images that fail to load, missing scripts or stylesheets, images over 300 KB, old image formats, links that go nowhere (href="#"), and in-page anchors with no target.

Broken links frustrate visitors and waste the time search engines spend crawling your site. Heavy images are the most common reason a page is slow on mobile.

Content and polish

Leftover lorem ipsum and "your text here" copy, unrendered shortcodes and template tags, an out-of-date copyright year, whether missing pages return a proper 404, a privacy policy link, click-to-call and email links, and whether analytics is installed.

None of these break a site, but every one of them tells a visitor that nobody is looking after it.

How to read the report

• The overall score is the average of the six section scores. Each section blends its Lighthouse score (where there is one) with the tool's own checks.
• Critical issues are the ones costing you traffic, trust or sales right now. Warnings are worth fixing but not urgent. Notes are information, not problems.
• Fix these first ranks the biggest problems across every section, so you don't have to work out the order yourself.
• Items tagged Lighthouse come from Google's test of the rendered page. Untagged items come from the page's code and headers.
• Lab results are one simulated visit and move a few points between runs. Real-visitor data appears when Google has enough Chrome users on the site to report it.
• Open any issue to see why it matters, how to fix it, and exactly which links, images or elements are affected.

What to fix first

When I hand a client a list like this, I work through it in this order:

1. Anything that hides the site from search. A noindex tag, a robots.txt that blocks everything, or key pages returning errors. Nothing else matters until these are fixed.
2. Anything that breaks trust. An expiring SSL certificate, mixed content, broken links and missing images.
3. The heaviest images and the slowest load. Compressing and resizing the largest image above the fold usually does more for Largest Contentful Paint than any plugin.
4. Titles, descriptions and headings. Quick to write, and they shape how every page appears in search results.
5. Accessibility labels and alt text. Small, repetitive fixes that make the site usable for more people.
6. Security headers and polish. Mostly one-off server settings and copy edits.

Limitations

• It audits the page you enter in depth and samples up to ten more. It isn't a full crawl of every page on a large site.
• It can't see anything behind a login, and it reads the HTML before JavaScript runs. Lighthouse covers the rendered page, but some checks only see the raw HTML.
• Firewalls like Cloudflare, Sucuri and Wordfence often block automated requests. The report tells you when this happens and which IP address to allowlist.
• Some sites (LinkedIn, Instagram, Facebook) block link checkers outright, so links to them are marked "couldn't be verified" rather than broken.
• Automated accessibility checks catch a useful share of problems, not all of them. Testing with a keyboard and a screen reader is still worth doing.
• Lighthouse numbers vary between runs. Treat a single score as a guide, and compare runs over time rather than chasing a perfect 100.