Website audits for small businesses
Your website is your digital shopfront.
A slow, unsafe or invisible one does not fail loudly. It just quietly stops bringing you customers.
to the report
reported as a defect
on this website
Read off our own audit: 4 findings that stand — 1 critical, 0 warning, 3 informational — and 11 checks that could not be measured, listed as conditions of the run rather than as defects. See the report.
Why it matters
Three ways a website quietly loses you money
None of these show up as an error. That is exactly what makes them expensive.
It loads too slowly
Every extra second sends visitors back to the search results — and straight to whoever loads faster.
Search engines can't read it
Missing titles, blocked pages, broken links. The site exists, but parts of it may as well not.
It isn't secure
Browsers now warn visitors before they reach the page. A warning on your shopfront is a customer already gone.
How it works
Four steps. You do one of them.
No call to book, no form with fourteen fields, no account to create. Send me the address and I do the rest.
You send the address
Just the website, and one competitor if you have one in mind.
Takes you 30 secondsThe audit runs
Fifteen categories across your key pages. Nothing is installed.
Same dayI read it before you do
Automated tools produce false alarms. Anything that does not hold up is removed, not padded in.
The part that takes the timeYou get the report
A shareable page and a PDF, ordered by what each issue costs you.
Within 2 business daysThe bounce figure is Google’s: as load time goes from 1s to 3s, the probability of a visitor leaving rises 32% (Google/SOASTA, 2017).
What gets checked
Fifteen categories. One plain-English report.
The checks a developer runs before handing a site over — written so you do not need one to read the answer.
Since people started asking assistants instead of searching, the audit also reads whether a page is quotable: are the questions marked up as questions, and does each one get a short answer directly beneath it, or is the answer buried three paragraphs down. It reports the structure — not whether an assistant will pick you, which nobody can promise.
- Loading speed
- Search visibility
- Security
- Mobile layout
- Accessibility
- Broken links
- Forms that work
- Trust signals
- Content structure
- Local search
- Privacy & cookies
- Email protection
- Hosting & uptime
- Code quality
- Analytics setup
- Social presence
- Stores nothing you type
- Checks against RFC 7208, 6376 and 7489
- Tested to WCAG 2.1 AA
- Report within 2 business days
Our own declarations, not third-party certifications. The first two you can verify here: the DNS lookup runs through a proxy that writes nothing down, and the free check reads the records those RFCs define. The third is measured across every page of this site on each change.
Real users, not a lab
The number Google actually ranks you on.
Most speed reports run the page once, on one machine, on one connection. That is a lab test. We also read what Google recorded from real Chrome users on your site over the last 28 days.
The distinction matters commercially, not academically. Google's Core Web Vitals — the part of ranking that measures experience — is fed by the field data, not by the lab run. A site can score well in a test and still be failing the signal that counts.
Five measurements come back, each against Google's own published threshold, at the 75th percentile — so it describes what three quarters of your visitors actually got, not an average that hides the slow quarter.
- LCP — main content visible. Good under 2.5s
- INP — response to a tap. Good under 200ms
- CLS — the page shifting under you. Good under 0.1
- FCP — first paint. Good under 1.8s
- TTFB — your server answering. Good under 0.8s
Those five thresholds are Google's, published and checkable — not ours, and not adjustable by us to make a report look worse than it is.
One competitor, measured
The sentence that ends the argument.
Name one competitor and we measure them the same way, on the same day, with the same tool.
That sentence works for a reason no report design can copy: it is specific, it is about you, and you can check it yourself in a browser in ten seconds. “Your site could be faster” is an opinion. This is not.
What gets compared is deliberately small, because everything in it has to be verifiable by you: load time, page weight, the number of resources requested, HTTPS, HSTS, the page title, the meta description, whether there is an H1, and whether structured data is present. Nine measures, taken from one fetch of each homepage.
It is not a competitive-intelligence product and does not pretend to be. No backlink database, no keyword corpus, no estimated traffic — those are a different product and a worse one, because none of it can be checked by the person reading it.
A separate service
Authorised security scanning.
Everything above reads only what your server already tells every visitor. This is the other kind, and it only runs on your written say-so.
An authorised scan sends your server requests it did not invite:
it asks for files that were never linked — the
.env and .git directories that leak
credentials when a deploy goes wrong — sends a forged Origin
header to see whether your CORS policy actually holds,
feeds parameters into redirects to find open ones,
enumerates which HTTP methods are enabled, and runs a
maintained vulnerability template set against what it finds.
None of it is destructive. All of it is unsolicited traffic aimed at someone's server, which is exactly what the UK Computer Misuse Act, the US CFAA and Pakistan's PECA make an offence without permission.
So the code is inert by default. It does nothing on the network unless it is explicitly authorised, the gate fails closed, and authorisation is per domain, not per customer — being our client does not authorise scanning a site you do not own.
What the report looks like
A score you can argue with.
Every finding carries the measurement behind it and the reasoning that ranked it. Something concrete to disagree with — which is the point.
Overall health Weighted across fifteen categories, dropping any that could not be measured.
Form found without labels — on your /contact page
Screen readers and autofill cannot tell what the fields are, and a confused visitor abandons the form rather than guessing.
Ranked first because it is a critical issue that blocks a conversion, on the page that exists to convert.
An illustration of the format — not a real client's site. See a real report instead, produced by this engine on this website.
What makes this different
We only tell you what we actually measured.
Most free scans are a sales trick: a long red list designed to frighten you into buying. If a check here cannot be completed, it is marked not assessed — never guessed at, never counted against your score.
Every finding names the page. Not "a form on your site has no labels" — "the form on your /contact page has no labels". You can check it yourself in ten seconds.
And it is ranked by cost, not by jargon. A broken enquiry form outranks a missing tag on your terms page, because one is losing you customers today and the other is not.
What you get
A report you can actually act on.
A shareable page and a PDF. Hand it to a developer, or read it yourself — the fixes are in plain English.
Every report ends with a developer action list: the findings that stand, in priority order, each with the change to make. Forward that one page and nobody has to read the rest to act on it. See it in the sample report.
-
Your score, out of 100
All fifteen categories, so you see the strengths too.
-
A ranked fix list
Ordered by cost, with the reasoning shown.
-
Page-by-page findings
Each issue tied to the page it was found on.
-
Real-world loading times
From Google's own field data — what your visitors actually get.
-
One competitor, side by side
Real measured gaps against one rival. Never a manufactured one.
Honest scope
Who this is for — and who it isn't.
Turning down the wrong work is cheaper for both of us.
A good fit if…
- Your website is meant to bring in enquiries, bookings or sales
- You suspect something is wrong but cannot say what
- You are about to pay someone to "fix the SEO" and want a second opinion
- Someone built it years ago and nobody has looked since
Not the right thing if…
- You want a rebuild — an audit finds problems, it does not fix them
- You need ongoing SEO work month to month
- You want a guarantee of ranking first on Google. Nobody can honestly offer that
Who you're dealing with
Two people, and the tool behind them.
Lightening Auditor · Lahore, Pakistan
Not a form that lands in an agency queue. You are emailing the people whose names are on this page.
Most agencies run someone else's scanner and add their logo. Kumail built this engine — fifteen categories of checks, over five hundred tests whose main job is stopping it reporting things that are not true.
So we can tell you why a finding ranks where it does, and be wrong usefully: tell us one is off and we check it against the measurement rather than defend it.
What a slow page is plausibly costing you
Your three numbers, and one published multiplier. Nothing here is measured from your site — for that, the audit has to actually run.
Multiplier: Deloitte and Google, Milliseconds Make Millions (2020) — a 0.1s mobile speed improvement lifted lead-generation conversion by 8.1%. That is the only figure measured; larger savings here follow a curve that matches it at 0.1s and stops at 30%, because speed alone does not multiply without limit. Shown as a range, since one exact number would be a number we invented. It assumes speed is what is holding the page back; the audit is what tells you whether it is.
- The scan startsWe run the fifteen categories against your site from the outside. Nothing is installed and nothing changes on your end. Within the hour
- The report arrivesA page you can read and a PDF you can forward, ordered by what each issue is costing you rather than by severity. Within 2 business days
- You ask us anythingIf you or your developer are unsure what a finding means, ask. We answer for 14 days after the report. 14 days after
Auditing is the only thing we sell, which is the point: there is no second invoice at the end of the report and nothing to be gained by making the list longer than it is. Our own sample report has twenty findings a person took out because they would not have survived scrutiny.
Pricing
Paid once. Not a subscription.
The tools that do this charge every month, forever, and leave the reading to you. This is one payment for a report a person actually wrote — and priced under what a UK agency charges for the same scope.
There are no credits to run out of, either. The subscription tools meter what you can look at and top you up once a month; here the fee buys an audit, and the audit finishes.
Billed in GBP.
- All fifteen categories, on your homepage
- Shareable report plus a PDF you own
- Every finding checked by hand
- Follow-up questions included
The right size if you want to see the work before committing to more.
- All fifteen categories, across your key pages
- Homepage, pricing and contact — each finding named to its page
- One competitor measured the same way, the same day
- Shareable report plus a PDF you own
- Every finding checked by hand
- Follow-up questions included
Fixed. Priced on page count, nothing else — and the number is on this page, so there is no discovery call to sit through. Prices are set per market, not converted, so the figure you see is the figure you pay.
Questions
The things people ask before saying yes.
If yours is not here, ask it — I would rather answer before you buy than after.
Do I need a developer to understand it?
No. Every finding is in plain English with the business consequence next to it. If you do have a developer, it also names the exact page and the exact fix.
Will you try to sell me a rebuild afterwards?
No. The audit is the product, and it reads the same either way. A report written to create work is one you cannot trust.
What if my website turns out to be fine?
Then that is what it says. Most sites have two or three real problems and a long tail that does not matter — separating those is most of the value.
Do you need access to my website or hosting?
No. Everything is measured from the outside, using what your visitors' browsers already receive. Nothing on your site changes.
How long does it take?
Two business days. The automated part finishes the same day; the rest is checking findings by hand.
Is my report shown to anyone else?
Never. It is not published, not used as a sample, and not shared with anyone.
Can you guarantee I will rank higher on Google?
No, and be careful of anyone who does. What an audit can honestly tell you is which technical problems stand in the way, and which are worth fixing first.
Get in touch
Send me your website. I'll tell you what it's costing you.
Message me on whichever suits you. Include your website address and I'll come back with what I find.
No password, no cPanel, no account. Everything is checked from the outside, the way a visitor and a search engine see it. These two boxes only fill in the message — nothing is submitted to us or stored anywhere until you press send in your own email or WhatsApp app.
Based in Lahore, working with businesses in the UK, the US and Pakistan. Every audit is run by hand and checked before it is sent.