A website auditing checklist covers every part of a site that affects traffic and revenue, not just SEO. Check eight areas in this order: your data (is tracking accurate?), technical SEO, content, user experience and accessibility, conversion paths, security and privacy, AI visibility, and competitors. Each area has a different owner, so the output of a good audit is a list of fixes with names next to them.
This page is the broad, whole-business version. For the 40 crawl, index and speed checks a developer needs, use the technical SEO audit checklist. For the step-by-step process of running an SEO audit (including on a competitor's site), see how to do a website audit.
Key takeaways
- Audit your data first. Google's removal of the &num=100 results parameter in September 2025 cut median Search Console impressions by 33% and moved average position from 29 to 13 with no ranking change (Outrank, 1,503 sites).
- Falling CTR alone is not a finding: across 415 sites, median CTR dropped 40% from October 2025 to August 2026, yet 59.5% of those sites still grew clicks.
- Accessibility is where most sites fail: 95.9% of the top million home pages have detectable WCAG failures, and 83.9% have low-contrast text (WebAIM Million 2026).
- Small sites are invisible to AI assistants too: 67% of sites with fewer than 50 pages visible in Google had zero AI citations in Outrank's 200-site study.
- Give every finding an owner and a date. An audit without owners is a document, not a plan.
Website audit vs technical audit vs content audit
People use "website audit" for three different jobs. Pick the right one before you open a single tool.
| Audit | The question it answers | Usually owned by | Our guide |
|---|---|---|---|
| Website audit (this page) | Is the whole site helping the business: traffic, trust, conversions, compliance? | Marketing lead, with dev and legal | You're on it |
| Technical SEO audit | Can Google crawl, render and index every page we care about? | Developer or technical SEO | 40-check technical list |
| SEO audit (process) | Why are we not ranking, and what should we fix first? | SEO lead | How to do a website audit |
| Content audit | Which pages should we keep, update, merge or delete? | Content lead | Content audit template |
Step zero: check that your data is telling the truth
Most bad audit conclusions start with bad data. Before you call anything "down", rule out these three traps. All three come from Outrank's own studies of customer Search Console data.
−33%
median Search Console impressions within days of Google dropping &num=100
Sept 10–13, 2025, 1,503 sites. Average position moved from 29 to 13 with no real ranking change. Zero-click study
−40%
median CTR, October 2025 to August 2026
415 sites; 79% lost CTR, but 59.5% still grew clicks. Same study.
95–98%
of machine-written queries in Search Console never get a click
79% of 111 sites already receive them. Query fan-out study
What that means for your audit:
- Never compare impressions or average position across mid-September 2025. The scraper impressions Google stopped counting made older numbers look bigger and positions look worse. A year-over-year report that straddles that week will show a fake collapse in impressions and a fake jump in rankings.
- Judge pages on clicks and conversions, not CTR. AI Overviews and AI Mode have pushed CTR down almost everywhere. A page whose CTR halved while clicks held steady is fine.
- Filter out long, prompt-like queries (10+ words, written like a chatbot request) before you build a keyword report. They come from AI tools fanning out searches and almost never click.
Then check the plumbing. GA4 keeps event-level data for only two months by default; change it to 14 months under Admin → Data collection and modification → Data retention, or your next audit will have nothing to compare against. Our guide on how to monitor website traffic covers the rest of the tracking setup.
The website auditing checklist
Tick items as you go; progress stays in your browser. Each group lists who usually owns it.
Interactive checklist
Website auditing checklist (40 checks, 8 areas)
0/40
1. Data and tracking (marketing ops)
0/62. Technical SEO (developer)
0/63. Content (content lead)
0/54. UX and accessibility (design and dev)
0/65. Conversion (marketing)
0/46. Security, privacy and legal (dev and legal)
0/57. AI visibility (SEO)
0/48. Competitors (SEO and marketing)
0/4Your progress is saved in this browser, so you can come back to it later.
Area by area: what "good" looks like
1. Data and tracking
A tracking audit is the cheapest part of the job and the one most often skipped. Complete each conversion yourself (buy something, sign up, submit the contact form) with GA4's DebugView open, and confirm each event fires once. Double-firing purchase events and forms that report success but never reach the CRM are both common, and both make every later conclusion wrong.
If your traffic dropped and you need to know why before auditing anything else, start with the traffic-loss diagnosis in how to do a website audit.
2. Technical SEO
For a whole-site audit you don't need all 40 technical checks; you need to know whether anything is badly broken. The six in the checklist above catch most of the disasters (an indexing gap, a blocked section, a duplicate version of the site, a dirty sitemap, broken internal links, failing Core Web Vitals). If any of them fails, hand the developer the technical SEO audit checklist and the broken links guide.
3. Content
Export pages from Search Console → Performance → Pages for the last three months and sort by impressions. Three groups need attention: pages with impressions but almost no clicks (fix the title or intent), pages with no impressions at all (improve, merge or remove), and pairs of pages trading places for the same query (merge them). Our content audit template gives you the spreadsheet to sort them into keep, update, merge and delete.
Look at formats as well as individual pages. In Outrank's study of 6.2 million pages, free tools and calculators earned 2.11× the click-through rate of the same site's articles at positions 4 to 10, while "what is" definitions earned 0.52×. If your site is all definitions and no tools, that is a content finding.
4. UX and accessibility
Accessibility is where nearly every site fails something. The WebAIM Million 2026 report found detectable WCAG failures on 95.9% of the top million home pages, with an average of 56 errors per page. The six most common failures are also the easiest to fix:
| Failure | Share of home pages |
|---|---|
| Low-contrast text | 83.9% |
| Missing image alt text | 53.1% |
| Missing form input labels | 51.0% |
| Empty links | 46.3% |
| Empty buttons | 30.6% |
| Missing document language | 13.5% |
This is not only good manners. The European Accessibility Act has applied since June 28, 2025 to many consumer-facing digital services sold in the EU, including ecommerce. Run WAVE or Lighthouse's accessibility audit on each main template, then fix the template rather than individual pages.
5. Conversion
Watch ten session recordings of visitors who reached your pricing or checkout page and left. You will learn more than from any heatmap summary. Then open GA4 → Explore → Funnel exploration, build the steps from landing page to conversion, and find the step with the biggest drop. That step is your conversion finding.
6. Security, privacy and legal
Check that the certificate renews automatically (an expired certificate puts a full-page browser warning in front of every visitor), that every plugin and theme is current, and that admin accounts use two-factor authentication. Then compare your privacy policy with the scripts actually loading on the site; tags added by past agencies are the usual mismatch. For the SEO side of HTTPS, see what an SSL certificate fixes.
7. AI visibility
An audit in 2026 should check whether AI assistants can find and describe you correctly. Ask ChatGPT, Perplexity and Google's AI Mode the questions your buyers ask ("best [category] for [use case]", "[your brand] pricing") and note what they say. Then check that robots.txt is not blocking AI search crawlers by accident: OpenAI's crawler documentation says sites that block OAI-SearchBot will not appear in ChatGPT search answers.
Size matters here too. In Outrank's AI citation study of 200 sites, 67% of sites with fewer than 50 pages visible in Google had zero AI citations, and none of the 110 sites with 400+ visible pages had zero. If you want this tracked over time rather than checked by hand, Outrank's AI visibility tracker monitors mentions across ChatGPT, Perplexity, Gemini, Copilot and Google's AI features. Bing also shows Copilot citations for free in its AI performance report.
8. Competitors
Your search competitors are whoever ranks for your queries, which often means publishers and directories rather than the companies you lose deals to. List the top three for each main topic, export the keywords they rank for and you don't, and note the page types they use. Our SEO competitor analysis guide walks through it in Ahrefs and Semrush.
Who owns what, and how often
| Area | Owner | Full check | Quick check |
|---|---|---|---|
| Data and tracking | Marketing ops | Every quarter and after any tag change | Monthly glance at key events |
| Technical SEO | Developer or SEO | Quarterly, and before and after migrations | Weekly look at Indexing → Pages |
| Content | Content lead | Twice a year | Monthly Performance report |
| UX and accessibility | Design and dev | Twice a year, and on every new template | On release |
| Conversion | Marketing | Quarterly | Monthly funnel check |
| Security, privacy, legal | Dev and legal | Twice a year | Weekly updates and backups |
| AI visibility | SEO | Quarterly | Monthly brand prompts |
| Competitors | SEO and marketing | Twice a year | When rankings move |
Rank the findings by impact and effort, fix the high-impact, low-effort ones first, and write each finding as a task with an owner and a date. If you would rather have someone else do the audit, here is what website SEO audit services include.
FAQ
What should a website audit checklist include?
A complete website audit checklist covers eight areas: data and tracking accuracy, technical SEO, content quality, user experience and accessibility, conversion paths, security and privacy, AI visibility, and competitors. An SEO-only audit covers the technical and content parts; a full website audit adds tracking, conversion, accessibility and compliance.
How often should you audit a website?
Run a full website audit once or twice a year and a technical SEO check every quarter. Also audit before and after any redesign, migration or CMS change. Between audits, weekly glances at Search Console's Pages report and monthly checks of GA4 key events catch most problems early.
What is the difference between a website audit and an SEO audit?
An SEO audit asks why a site isn't ranking and covers technical SEO, content and links. A website audit is broader: it also checks whether tracking is accurate, whether visitors can use and trust the site, whether it converts, and whether it meets privacy and accessibility rules.
What tools do I need for a website audit?
Google Search Console, GA4 and PageSpeed Insights cover data, indexing and speed for free. Add a crawler such as Screaming Frog (free up to 500 URLs), WAVE or Lighthouse for accessibility, Microsoft Clarity for session recordings, and an SEO suite like Ahrefs or Semrush for competitor and backlink data.
Can I audit my own website without an agency?
Yes. Every check in this list can be done with free tools by someone comfortable in Search Console and GA4. Agencies add speed and experience on large or complex sites, but for a site of a few hundred pages a careful in-house audit usually finds the same problems.
