What Is a Website Audit? What It Covers and How Often to Run One
A website audit checks speed, SEO, security, DNS and email setup in one pass. Learn what a good audit covers, how to read the results and how often to run one.
Most website problems don't announce themselves. A plugin update slows the homepage, a DNS change drops the DKIM record, a certificate renewal quietly fails, and you find out weeks later from a customer or a traffic dip. A website audit is a structured check that catches these issues before they cost you. This guide explains what a useful audit covers, how to read the results without getting lost in the noise, and how often you should run one.
Key takeaways
- A website audit checks performance, SEO, security, DNS and email authentication together, because problems in one layer show up in another.
- Fix anything that breaks the site or email first, then issues that hurt users at scale, and leave hardening and polish until last.
- Audit monthly for rarely changed sites, weekly for active WordPress or e-commerce sites and daily for sites under active development.
- Always run an audit after any DNS, hosting, CDN or email provider change, as that is when records go missing.
What a website audit is
A website audit is a systematic review of a site's technical health against known standards: Google's Core Web Vitals, search engine guidelines, email sender requirements, browser security practices and DNS standards. The output is a list of what's working, what's broken, and what to fix first.
There are two broad kinds:
- Automated audits scan a URL or domain and test it against hundreds of rules in a few minutes. They're fast, repeatable and good at catching the technical problems that cause most real-world damage.
- Manual audits add human judgment: content quality, user experience, conversion paths, brand consistency. They take days and cost more, and they're most useful once the technical basics are clean.
This guide focuses on the technical side, which is where an automated audit earns its keep.
What a complete audit covers
People often mean only "SEO audit" or only "speed test" when they say website audit. A useful audit looks at every layer a visitor or email touches, because problems in one layer show up as symptoms in another.
1. Performance
How quickly the page loads and responds, measured against Google's Core Web Vitals. According to web.dev, a page has good user experience when, at the 75th percentile of visits:
| Metric | Measures | Good |
|---|---|---|
| Largest Contentful Paint (LCP) | Loading | 2.5 s or less |
| Interaction to Next Paint (INP) | Responsiveness | 200 ms or less |
| Cumulative Layout Shift (CLS) | Visual stability | 0.1 or less |
INP replaced First Input Delay as a Core Web Vital in 2024, so any audit still reporting FID as a headline metric is out of date. A good audit separates field data (from real Chrome users, when Google has enough of it) from lab data (a single simulated load). Our Core Web Vitals guide explains the difference.
2. On-page and technical SEO
Whether search engines can crawl, understand and index your pages:
- Title tag and meta description present, unique and sensibly sized
- One clear H1 and a logical heading structure
- Canonical tag pointing to the right URL
robots.txtnot blocking important content- An XML sitemap that exists and lists the right URLs
- Internal links that don't lead to 404s or redirect chains
Google's own SEO Starter Guide is a useful sanity check here: it confirms, for example, that the meta keywords tag isn't used by Google Search, so an audit that flags a missing one is padding its list.
3. Security
- A valid TLS certificate covering every hostname, with time left before expiry
- HTTP security headers such as
Strict-Transport-Security,Content-Security-Policy,X-Content-Type-Optionsand a frame-embedding policy - No exposed sensitive files:
.env,.git/, backups and debug pages that leak credentials or source code
Certificates matter more than they used to. Under CA/Browser Forum ballot SC-081, the maximum lifetime of public TLS certificates dropped to 200 days from March 15, 2026, and is scheduled to fall to 100 days in 2027 and 47 days in 2029. Shorter lifetimes mean more renewals and more chances for a renewal to fail unnoticed. See SSL certificate lifetime changes.
4. DNS
The records that make everything else work: A/AAAA, NS, MX, TXT, SOA, CAA and DNSSEC status. DNS problems tend to cause total outages rather than slowdowns, and they often appear right after a hosting or provider change. DNS records explained covers what each one does.
5. Email authentication
If your domain sends email, an audit should check SPF, DKIM and DMARC, plus MTA-STS and BIMI if you use them. These aren't optional extras any more. Google's sender guidelines, enforced since February 1, 2024, require all senders to Gmail accounts to use SPF or DKIM, and senders of more than 5,000 messages a day to use SPF, DKIM and DMARC. Yahoo and Microsoft have introduced similar rules. A website audit that ignores email misses one of the most common reasons small businesses lose customer messages.
6. Technology
What the site runs on: CMS, frameworks, analytics, CDN. This helps you spot outdated software and gives agencies a quick picture of a prospect's stack.
How to read audit results
A raw audit can list dozens of issues. Most of them are minor. Read the results in this order:
- Anything that breaks the site or email. Expired or mismatched certificates, missing MX records, SPF errors, a
robots.txtthat blocks the whole site, exposed.envfiles. Fix these today. - Things that hurt users at scale. Failing Core Web Vitals on mobile, broken internal links on key pages, missing DMARC on a domain that sends invoices.
- Hardening and polish. Missing security headers, CAA records, meta descriptions on low-traffic pages.
A letter grade or score is useful for tracking progress over time and for explaining status to non-technical people. It isn't the goal in itself. A site can score well and still have a single critical problem, so always read the top of the fix list, not just the grade.
How often to run a website audit
There's no industry-mandated schedule. A sensible cadence depends on how often the site changes:
| Situation | Suggested cadence |
|---|---|
| Brochure site that rarely changes | Monthly, plus after any change |
| Active WordPress or e-commerce site with regular plugin and content updates | Weekly |
| Sites under active development, or client sites an agency is responsible for | Daily automated re-scans |
And always run one:
- Before and after a launch or redesign. See the website launch checklist.
- After any DNS, hosting, CDN or email provider change. This is when records go missing.
- After major CMS, theme or plugin updates.
- When something feels off: a traffic drop, more spam complaints, slower pages.
Automated audits are cheap enough to run often, which turns them from a one-off report into monitoring. Our website monitoring guide covers what to watch continuously.
Doing it yourself vs. hiring someone
You can run a technical audit yourself. Free tools cover most of it, and the free website audit tools compared guide explains which tool is best at what.
Bring in a specialist when the audit surfaces something you can't interpret, when the fixes require server or code changes you're not comfortable with, or when you need a deeper manual review of content and UX. Having an automated report in hand makes that conversation faster and cheaper.
Run your first audit
Run a free audit on MakeItFlow. One scan checks performance (PageSpeed Insights and Core Web Vitals), on-page SEO, DNS, email authentication, security headers, your TLS certificate and exposed files, then gives you an A-F grade and a prioritised fix list you can share or download as a PDF. The free plan includes 5 scans a day; paid plans add history, scheduled re-scans and a competitor website audit that compares your site with a rival's.
Frequently asked questions
What is the difference between an SEO audit and a website audit?
An SEO audit focuses on whether search engines can find, crawl and rank your pages. A website audit is broader: it includes SEO, plus performance, security, DNS and email setup. Many SEO problems actually start in those other layers, such as a slow server or a misconfigured redirect.
How long does a website audit take?
An automated technical audit of a single page or domain takes a few minutes. A whole-site crawl takes longer, depending on the number of pages. A manual audit by a consultant typically takes days, because it includes human review of content and UX.
Is a free website audit good enough?
For catching technical problems, free tools are often enough, especially if you combine a couple of them. Paid tools add history, scheduled monitoring, multi-page crawls and reporting features, which matter more as the number of sites you manage grows.
What should I fix first after an audit?
Start with anything that breaks the site or email for everyone: certificate errors, DNS or MX mistakes, SPF/DMARC failures and pages blocked from indexing. Then tackle mobile Core Web Vitals and broken links, and leave cosmetic items for last.
What to do next
Run an audit on your main domain now and save the report as a baseline. Fix anything in the critical tier this week, then pick a cadence from the table above and put it on your calendar, or let scheduled re-scans do it for you.
Related reading
- How to Read a Website Audit Report and Decide What to Fix First: Read a website audit report by sorting issues by impact and effort: fix anything blocking indexing, security or email first, then speed, then polish.
Sources
Written by the MakeItFlow team
We build the website audit these guides are based on. Every fact is checked against the primary sources listed above and this guide was last reviewed on 31 October 2026 . How we research and check
Check your own site in 30 seconds
Run a free audit covering speed, SEO, DNS, email authentication and security headers — and get a prioritised fix list.
