Website Audit Checklist 2026 — 35 Things to Check
Whether you're launching a new site, troubleshooting a traffic drop, or onboarding a client, this checklist covers everything a thorough website audit should include.
Performance (8 checks)
- 1Mobile PageSpeed score above 50 (check at pagespeed.web.dev)
- 2Largest Contentful Paint under 2.5 seconds
- 3Cumulative Layout Shift under 0.1
- 4Interaction to Next Paint under 200ms
- 5All images in WebP or AVIF format with width/height attributes
- 6No render-blocking JavaScript in the document head
- 7Browser caching enabled for static assets
- 8Text compression (gzip or Brotli) enabled on the server
SEO (10 checks)
- 9Every page has a unique title tag (under 60 characters)
- 10Every page has a unique meta description (under 160 characters)
- 11One H1 per page containing the target keyword
- 12Logical heading hierarchy (H1 > H2 > H3, no skips)
- 13All important pages indexable (no accidental noindex tags)
- 14XML sitemap exists and is submitted to Search Console
- 15robots.txt allows crawling of important pages
- 16Canonical tags on all pages
- 17Internal linking between related pages
- 18Structured data (JSON-LD) on key pages — at minimum Organization and BreadcrumbList
Accessibility (9 checks)
- 19All images have descriptive alt text
- 20Color contrast ratio meets WCAG AA (4.5:1 for normal text)
- 21All form inputs have associated labels
- 22Keyboard navigation works for all interactive elements
- 23ARIA labels on icon-only buttons
- 24Focus indicators visible on interactive elements
- 25No auto-playing media without user control
- 26Text is resizable to 200% without content loss
- 27Skip navigation link present
Security (8 checks)
- 28HTTPS enabled on all pages (no mixed content)
- 29SSL certificate valid and not expiring soon
- 30Strict-Transport-Security header present
- 31Content-Security-Policy header present
- 32X-Frame-Options or frame-ancestors CSP directive set
- 33X-Content-Type-Options set to nosniff
- 34No sensitive data exposed in HTML source or JavaScript
- 35Server version headers hidden
Don't want to check all 35 manually?
SiteAudit AI checks most of these automatically in under 60 seconds. Enter any URL, get a prioritized report telling you what's wrong and how to fix it. Try the free website audit or run a full SEO audit.