The 50-Point Website Audit Checklist

Why most website audits miss what matters

Most "free website audit" tools spit out a PageSpeed score and a list of meta tags, then sell you a subscription. That misses the point. A real audit answers one question: what would stop this site from making money next quarter?That spans seven independent disciplines — performance, security, SEO, AI search, email, accessibility, and monitoring — and a weak link in any one of them costs traffic, conversions, or trust. This checklist is the operational version we use at LemWatch before signing off on any client launch.

We've kept it short on theory and heavy on what to check. Every line is testable today — either with a free tool linked from this page, with a browser DevTools tab, or with a 30-second DNS lookup. There's no fluff and no upsell gates: tick the box when you've confirmed something works; flag the ones that don't and prioritise the worst by revenue impact.

How to use this checklist

Work top-to-bottom. The order is intentional: performance and security regressions can wipe out everything below them, so fixing those first means later checks are measured against a stable site. Aim to spend about 10–15 minutes per section on a first pass. A complete first audit usually takes around two hours; subsequent quarterly re-audits drop to under thirty minutes once you've fixed the structural issues.

Each section below is independent — feel free to do them in any order if you already know one area is weak. The progress bar at the top tracks your completion across the whole list and saves to your browser, so you can leave and come back. To audit a different site or hand the list to a teammate, hit Reset and start fresh, or hit Print and export the whole thing to PDF.

What good looks like in 2026

A few benchmarks worth carrying through the whole audit. LCP under 2.5 seconds on a 4G connection is now table stakes — anything slower puts you outside the top quartile of indexed pages. SSL certificates with under 30 days remaining are an outage waiting to happen; renewals should be automated, not manual. DMARC at p=none isn't a finished setup — it's a one-month staging point before promoting to quarantine and then reject. And on the AI side, an llms.txt file at the root is now a small but real ranking factor for being cited correctly by ChatGPT, Claude, and Perplexity. None of these are aspirational; they're the baseline for sites that show up in 2026.

What to do once the checklist is green

Getting everything to pass once is the easy part. Keeping it green is the job. The two compounding failure modes we see most often are silent SSL or DKIM expiries — both have specific renewal dates that are trivial to monitor and catastrophic to miss — and slow performance drift from accumulated third-party scripts. Set continuous monitoring on the URLs that drive revenue, alert on SSL within 30 days of expiry, and re-run this whole checklist quarterly. Most regressions are caught at this cadence before customers notice.

If you'd rather have all of this watched for you — uptime, SSL, Core Web Vitals, security headers, DNS, SEO crawl health, and AI search readiness — that's what LemWatch does. The free tier covers up to five sites with no credit card, so you can put your audit on autopilot from today.