Site Audit Report: How to Read It and What to Fix First

A site audit report (or website audit report) is a document produced by a crawler or audit tool that lists the problems found on a website, such as pages blocked from search, slow loading, security gaps or broken email authentication. A useful one shows how serious each problem is, which pages it affects and how to fix it.

To read a site audit report, ignore the overall score at first and sort the findings by impact and effort. Fix anything that stops search engines indexing your site, puts visitors or data at risk, or breaks email first. Then tackle problems affecting many pages or key journeys. Leave cosmetic warnings until last, and re-scan to confirm fixes.

This guide explains what a good site audit report should contain, how reports are structured, what scores really mean, how to triage issues with a simple framework, and how to turn findings into a plan your team or agency can act on.

Key takeaways

A site audit report lists the technical problems found on a website, how serious each is, which URLs it affects and how to fix it.
Ignore the overall score at first and sort findings by impact, reach, effort and the risk of waiting.
Fix indexing blocks, exposed sensitive files, expired SSL certificates and broken email authentication first.
Remove false positives, group findings by cause, assign owners, then re-scan to confirm each fix.

What should a good site audit report contain?

Tools differ, but a report you can actually act on has these parts:

A summary with the overall result, the date and time of the scan, the URL or number of pages tested, and the device or settings used. Without the date and settings you can't compare it with a later scan.
Category scores for areas such as performance, SEO, security and email, so you can see where the problems cluster.
Individual findings with a severity, such as error, warning or notice, rather than a single score.
Evidence for each finding: the affected URLs, the value found (a missing header, a 4.8-second LCP, an SPF record with too many lookups) and, ideally, what the tool expected instead.
A plain-language explanation and fix: why the issue matters and the specific change to make, not just a label.
A way to prioritise: issues ordered by impact, or at least grouped so the urgent ones stand out.
A shareable format, such as a link or PDF, so the report can go to the developer, host or client who will make the change.
History, once you scan regularly, so you can prove a fix worked and spot regressions.

If a report gives you a score and a list of jargon with no affected URLs or fixes, it is a sales hook rather than an audit. You can run a free website audit to see what a complete report looks like for your own site.

What is in a typical website audit report?

Most reports, whatever the tool, group findings into similar sections:

Section	What it checks	Why it matters
Performance	Load speed, Core Web Vitals, page weight	Conversions, user experience, a search ranking signal
SEO	Titles, meta descriptions, headings, canonicals, robots.txt, sitemaps, structured data	Whether search engines can find and understand pages
Security	HTTPS, certificate, security headers, cookie flags, exposed files	Visitor trust, data protection, browser warnings
DNS and email	DNS records, SPF, DKIM, DMARC, MTA-STS	Whether your email reaches inboxes and your domain is protected
Accessibility	Contrast, alt text, labels, language	Usability for disabled people, legal duties
AI search readiness	AI crawler rules, snippets, rendered text	Whether AI assistants can read and cite you

Each finding is usually marked as an error, a warning or a notice (or red, amber and green). Those labels come from the tool's general rules, not from knowledge of your business, so treat them as a starting point.

What does the overall score actually mean?

Scores summarise, they do not prioritise. A site can score 92 overall and still have a noindex tag on its services page, which matters more than every other finding combined.

The Lighthouse performance score, used in PageSpeed Insights and many audit tools, is a weighted blend of lab metrics: Total Blocking Time (30%), Largest Contentful Paint (25%), Cumulative Layout Shift (25%), First Contentful Paint (10%) and Speed Index (10%). Scores of 90 to 100 are "good", 50 to 89 "needs improvement" and 0 to 49 "poor". Google notes that scores vary between runs because of network conditions, ads, extensions and device differences, so look at trends rather than one result. Our PageSpeed Insights score explained guide goes deeper.

Field data matters more than lab scores where you have it. Core Web Vitals are assessed at the 75th percentile of real visits: LCP of 2.5 seconds or less, INP of 200 milliseconds or less and CLS of 0.1 or less count as good.

How do I decide what to fix first?

Use four questions for each finding:

Impact: if this is broken, what happens? Lost rankings, lost sales, security risk, or just a missed best practice?
Reach: does it affect one page, a template used by hundreds of pages, or the whole domain?
Effort: is it a five-minute setting or a developer project?
Risk of waiting: will it get worse, or is it stable?

Then place each issue in a simple grid:

	Low effort	High effort
High impact	Do now	Plan and schedule
Low impact	Batch together when convenient	Probably skip

Which issues are almost always urgent?

Some problems should jump the queue regardless of how a tool labels them:

Pages blocked from indexing: an accidental noindex, a Disallow: / in robots.txt, or canonicals pointing to the wrong site. See our robots.txt guide.
Exposed sensitive files such as .env, .git folders or database backups. These can leak passwords and should be removed immediately.
Expired or invalid SSL certificates and broken HTTPS redirects, which trigger browser warnings that stop visitors cold.
Missing or broken SPF, DKIM or DMARC, especially if you send invoices or marketing email. Gmail, Yahoo and Microsoft now require authentication from bulk senders; see the sender requirements.
Broken key journeys: contact forms, booking or checkout pages returning errors.
Signs of compromise: spam links, unexpected redirects or unknown admin users.

Which issues can usually wait?

Meta descriptions slightly over the recommended length.
Missing Open Graph tags on low-traffic pages.
Minor heading order warnings on blog posts.
Images missing width and height on pages that do not visibly shift.
"Consider adding" recommendations for optional headers or features.

These are worth batching into a tidy-up sprint, but they rarely move results on their own.

How do I spot issues that affect many pages at once?

Look for patterns. If 300 pages share the same missing meta description or the same slow LCP, the cause is usually one template, plugin or setting. Fixing the template fixes all 300. Group findings by page type (home, category, product, post) before assigning work. A whole-site crawl, such as the MakeItFlow site crawl on paid plans, makes these patterns obvious because it shows how many URLs share each issue.

How do I turn findings into an action plan?

Export or list every finding with the affected URLs.
Remove false positives: a "missing H1" on a login page or a "noindex" on a thank-you page may be intentional.
Group by cause, not by symptom.
Assign an owner to each group: developer, content editor, hosting provider or email administrator.
Set a priority and a deadline, starting with the urgent list above.
Fix, then re-scan to confirm each issue is resolved and nothing new has broken.
Record the before and after so you can show progress to clients or managers.

If you produce audit reports for clients, presentation matters as much as accuracy: a client should be able to see the three most important problems on the first page. MakeItFlow's white-label reports put your agency's name, logo and colour on the PDF, so the report goes to the client under your name.

Our SEO audit checklist is a useful companion when working through the SEO section.

What can an automated audit not tell me?

Automated tools are good at technical checks, but they cannot judge content quality, whether your offer is compelling, how competitors compare on links, or whether a disabled person can actually complete your checkout. They also only see what they can reach: pages behind logins or rarely linked pages may be missed. Use the report as a technical health check, alongside analytics, Search Console and real user feedback.

Frequently asked questions

What is a website audit report?

It is a list of the problems an audit tool or consultant found on a website, usually grouped into areas such as performance, SEO, security, accessibility and email, with the affected pages, a severity for each issue and how to fix it. For the wider process behind the report, see what is a website audit.

What is the difference between a site audit report and an SEO audit?

An SEO audit looks only at how search engines find, understand and rank your pages. A site audit report is usually broader and can also cover speed, security, accessibility and email setup. Many tools use the terms loosely, so check which sections a report actually includes.

Why do different audit tools give different scores?

They test different things, use different weightings, run from different locations and devices, and test at different moments. Compare like with like over time, rather than comparing one tool's number with another's. Our comparison of free website audit tools explains the differences.

Should I aim for a score of 100?

No. Chasing a perfect score often means effort on changes with no real benefit. Aim to pass Core Web Vitals, fix every high-impact issue and keep the rest under control.

How often should I run a website audit?

Monthly for active business sites, and always after a redesign, migration, theme change or major plugin update. Scheduled re-scans make regressions easy to spot.

What if my developer disagrees with the report?

That is healthy. Ask them to explain why a finding does not apply, and record the decision. Some warnings are context-dependent; others are genuine issues that are inconvenient to fix.

Can I fix audit issues myself without a developer?

Many, yes: titles and meta descriptions, alt text, image compression, DNS records and plugin updates. Server configuration, security headers and template performance usually need a developer or your host.

What to do next

Run a fresh scan, list every finding, and pick the three highest-impact issues to fix this week. MakeItFlow groups results into performance, SEO, security, DNS, email, accessibility and AI readiness, so you can run a free website audit and start triaging straight away. Paid plans add scheduled re-scans with email reports and history, which makes it easy to prove that fixes stuck. For agency workflows, see website audits for agencies.

Chrome 154 Turns On HTTPS by Default: What Websites Must Fix: Chrome 154 now asks users before loading any public HTTP page. What the warning means for your website, plus a technical SEO checklist to fix it fast.
How to Audit a WordPress Website: A Step-by-Step Checklist: Audit a WordPress website by checking updates, plugins, security, speed, SEO and backups in order. A step-by-step checklist with Site Health and WP-CLI.

Site Audit Report: What It Is, How to Read It and What to Fix