How to Do a Full Website Audit (Step-by-Step Checklist)

Introduction

Most "website audits" are really just a quick glance at page speed and a few meta tags. A real audit is a repeatable process — crawl, analyze, prioritize, fix, re-check — that covers technical health, on-page SEO, user experience, and off-page signals in one pass. This guide walks through that process step by step, with a copyable website audit checklist you can run on any site, whether by hand or with an automated tool that does it all in a single scan.

Step 1: Crawl the Entire Site, Not Just the Homepage

Every audit starts with discovery. Pull your XML sitemap (and any sitemaps declared in robots.txt), then crawl outward from your homepage following internal links, the same way a search engine would. This surfaces pages that aren't in your sitemap, reveals your actual site structure, and flags orphan pages — pages with zero inbound internal links, which get almost no ranking equity no matter how good the content is.

A proper crawl should be same-host, depth-limited, and JavaScript-aware, since many modern sites inject navigation and links via client-side code that a naive crawler would simply miss.

Step 2: Audit Technical SEO Foundations

With a full page list in hand, check the technical layer that everything else depends on:

• Indexability — scan for noindex tags, X-Robots-Tag headers, and robots.txt disallow rules that might be silently hiding important pages from Google.
• Canonical tags — verify each page's canonical points to itself (or the correct target), and flag subpages that mistakenly canonicalize to the homepage, which de-indexes them entirely.
• Sitemap health — confirm the sitemap is valid, up to date, and actually includes the pages you want ranked.
• Redirects — map any redirect chains or loops; each extra hop dilutes link equity and slows crawling.

Step 3: Run the On-Page SEO Checks

Per page, verify:

• Title tags and meta descriptions exist, are within optimal length, and are unique across the site (duplicate titles and descriptions split ranking signals).
• Heading hierarchy is logical — one H1 per page, no erratic jumps like H1 straight to H4.
• The page's apparent primary keyword aligns across the title, H1, meta description, URL slug, and opening paragraph, without tipping into keyword stuffing.
• Structured data (JSON-LD or Microdata) is present and valid for the page type, with required properties like offers.price for commerce pages.

This is also the stage to run duplicate content detection — comparing page bodies, titles, and meta descriptions across the whole crawl to catch both exact duplicates and near-duplicate "thin variant" pages that cannibalize each other's rankings.

Step 4: Check Performance and Core Web Vitals

Technical SEO means nothing if the site is slow. For each key page (and at minimum the homepage), measure:

• LCP, CLS, and INP using the official web-vitals library rather than estimates.
• TTFB to isolate server-side responsiveness from front-end rendering time.
• Unused JavaScript and CSS, since bloated, unused code delays interactivity even when the visible page looks done loading.
• Real-world network conditions — re-testing under throttled 3G reveals problems a fast office connection completely hides.

Step 5: Test Accessibility (WCAG)

Inject an automated accessibility engine (like axe-core) to catch the most common and highest-impact WCAG violations: insufficient color contrast, missing alt text, unlabeled form fields, and broken focus order. Categorize findings by impact level — critical and serious issues first — since fixing every minor violation before addressing a critical one is a poor use of engineering time.

Step 6: Review Mobile Experience Separately

Desktop and mobile are genuinely different audits. Re-check Core Web Vitals under mobile device emulation, confirm a proper viewport meta tag is present, and scan for horizontal overflow and undersized tap targets (below 44px) — all common mobile-specific failures that a desktop-only check will never surface.

Step 7: Check Security and Privacy

• Confirm HTTPS is enforced and HTTP requests redirect properly.
• Check for Content-Security-Policy, Strict-Transport-Security, and X-Frame-Options headers.
• Inspect the live SSL/TLS certificate for issuer, expiry, and protocol version — an expiring certificate is an easy miss that causes real damage.
• Audit cookies and third-party scripts fired before user consent, a common and often accidental GDPR/CCPA violation.

Step 8: Assess AI Search Readiness (GEO)

This is the newest — and most overlooked — layer of a modern audit:

• Check whether robots.txt blocks major AI crawlers like GPTBot, ClaudeBot, or PerplexityBot.
• Verify whether an /llms.txt manifest exists and is correctly formatted.
• Evaluate content extractability — are answers structured in a way an AI engine could actually lift and cite, using lists, tables, or clear Q&A formatting?
• Check E-E-A-T signals: author attribution, published/modified dates, and outbound citations to authoritative sources.

Step 9: Check Off-Page Signals (Where Available)

If you have access to a backlink data provider, layer in domain authority, referring domain count, anchor-text distribution, and a toxic-link heuristic. This step is optional for smaller sites but valuable for anything competing on more contested keywords.

Step 10: Prioritize, Fix, and Re-Audit

The final step is the one most audits skip: turning findings into an actual remediation plan. Sort issues by impact and effort — fix high-impact, low-effort items first — and pair every "detected" finding with a concrete fix action, not just a vague warning. Once fixes ship, re-run the audit. A website audit is not a one-time event; it's a cycle that should repeat after every major change and on a regular schedule even when nothing obvious has changed.

Copyable Quick-Reference Checklist

[ ] Crawl site via sitemap + BFS link discovery
[ ] Check indexability (noindex, X-Robots-Tag, robots.txt)
[ ] Verify canonical tags site-wide
[ ] Confirm sitemap validity
[ ] Map redirect chains/loops
[ ] Check title tags & meta descriptions (length + uniqueness)
[ ] Verify heading hierarchy (one H1, logical order)
[ ] Check keyword alignment (title/H1/meta/slug/intro)
[ ] Validate structured data (JSON-LD/Microdata)
[ ] Run duplicate content check (exact + near-duplicate)
[ ] Measure LCP, CLS, INP, TTFB
[ ] Check unused JS/CSS
[ ] Test under throttled network conditions
[ ] Run WCAG accessibility scan
[ ] Test mobile Core Web Vitals + viewport + tap targets
[ ] Confirm HTTPS enforcement + security headers
[ ] Inspect SSL/TLS certificate expiry
[ ] Audit pre-consent cookies/trackers
[ ] Check AI crawler access in robots.txt
[ ] Validate llms.txt (if present)
[ ] Assess content extractability + E-E-A-T signals
[ ] Review backlink profile (if data available)
[ ] Prioritize fixes by impact/effort
[ ] Re-audit after fixes ship

Conclusion

Running through this checklist manually, page by page, is a multi-day undertaking even for a modest site — and it needs repeating every time you make a meaningful change. That's exactly the gap an automated auditing tool closes: one scan covers every step above — crawl, technical SEO, performance, accessibility, security, mobile, and AI readiness — and hands back a prioritized report instead of a pile of raw data.

Run a free automated audit on your site today and see exactly where the checklist above turns up gaps you didn't know you had.

Start Your Free Website Audit Today

Now that you know what a website audit is, it’s time to see how your own site performs. You don't need to hire an expensive agency to find out what's holding your traffic back.

BugViso runs a deep, automated audit of your website—checking Core Web Vitals, SEO, accessibility, security, and AI search readiness—and delivers a prioritized, beautifully branded PDF report in seconds.

👉

Run an instant, free website audit with BugViso today!