--- title: "Website audit checklist — 2026 edition" description: "A 48-point website audit checklist covering performance, SEO, security, accessibility and monitoring. Free, no signup." canonical: "https://lemwatch.com/resources/website-audit-checklist" source: "https://lemwatch.com" --- # The website audit checklist > 48 checks across 7 areas — performance, SEO, security and monitoring — each one measurable, each one fixable. ## Performance & Core Web Vitals Speed is a confirmed Google ranking factor and the #1 lever for conversion rate. Every item below is measurable and fixable. - Largest Contentful Paint under 2.5s on 4G mobile — check it free - Interaction to Next Paint under 200ms across the site — check it free - Cumulative Layout Shift under 0.1 on every template — check it free - Time to First Byte under 800ms from your primary market - Images served in AVIF or WebP with width/height set — check it free - Below-the-fold images and iframes are lazy-loaded — check it free - Web fonts use font-display: swap and are self-hosted or preconnected — check it free - Third-party scripts audited; no surprise trackers blocking render — check it free ## Security & SSL Browsers are getting noisier about insecure pages every year. These checks prevent the kind of warnings that destroy conversion in a single afternoon. - Valid SSL certificate with at least 30 days remaining - HTTP → HTTPS redirect enforced site-wide - Strict-Transport-Security header with max-age ≥ 6 months — check it free - Content-Security-Policy in place (even if report-only) — check it free - X-Frame-Options, X-Content-Type-Options, Referrer-Policy set — check it free - No mixed-content warnings on any page — check it free - Clean on Google Safe Browsing and major malware blocklists — check it free - If WordPress: core, themes, plugins on current versions, no known CVEs — check it free ## On-page SEO The fundamentals that decide whether Google understands your pages. Skip these and even great content will struggle. - Unique on every page, ≤ 60 characters - Unique meta description on every page, ≤ 160 characters — check it free - Exactly one <h1> per page, matching the primary keyword - Canonical tag pointing to the preferred URL on every page - Valid JSON-LD schema (Article, Product, FAQ, etc.) where applicable — check it free - sitemap.xml lists every indexable URL with current lastmod — check it free - robots.txt is correct and references the sitemap — check it free - Important pages return 200 and are not blocked by noindex — check it free - Zero broken internal links; outbound 404s reviewed — check it free - Cornerstone pages updated in the last 12 months — check it free ## AI search readiness ChatGPT, Claude, and Perplexity now drive measurable referral traffic. These checks decide whether they cite you accurately or hallucinate around you. - llms.txt published at the root with top docs listed — check it free - OpenGraph and Twitter card tags present and accurate - 1200×630 OG image renders for every shareable URL — check it free - Visible last-updated date on every guide and tool page - Author byline + bio link on long-form content (E-E-A-T) ## Email deliverability Mail you send from the domain matters even if you're not running campaigns. Forgotten transactional senders are the #1 cause of password-reset bounce. - MX records resolve to your provider - SPF record exists with the right includes and terminator — check it free - DKIM selector is set up and signs every outbound send - DMARC record published at _dmarc with rua reporting — check it free - Full deliverability check passes on the apex domain — check it free ## UX, mobile, accessibility What's measurable in code, not what's subjective in design. - Mobile viewport meta tag and responsive layout at 320px wide - Touch targets ≥ 44×44px; no accidental tap traps — check it free - Body text meets WCAG AA contrast (4.5:1 minimum) - Every meaningful image has descriptive alt text - Skip-to-content link present; landmarks used correctly - HTML validates with no parse errors — check it free ## Operations & monitoring All the above passes once is good. Catching it the day it breaks is what keeps it that way. - Uptime monitoring on every revenue-critical URL — check it free - SSL expiry alerts at 30 and 7 days out - Domain expiry alerts at 60 days out - Off-site backups verified within the last 30 days - Public status page available for customer-facing services - On-call rotation with at least two notification channels ## Lemwatch at a glance - What it is: website monitoring that checks uptime, page changes, SEO, security, SSL and speed in one tool. - Free plan: 10 sites, no time limit, all check types. - Pro: $19/mo, 50 sites, public API and webhooks. - Agency: $59/mo, 150 sites, white-label status pages. - Source: https://lemwatch.com/pricing (facts verified from the product's own plan limits). ## Related - [Free checking tools](https://lemwatch.com/tools) - [Lemwatch pricing](https://lemwatch.com/pricing) - [All monitoring checks](https://lemwatch.com/features) - [Visual guides](https://lemwatch.com/guides)