What each category actually checks

Fifteen categories go into every audit. These guides explain what they look at, and cover the platforms we are asked about most, written from the rules in the code rather than from general advice — thresholds quoted, sources named.

Where a claim needs a number, it comes from a public source you can check: a Google threshold, a WCAG criterion, an RFC. Where we have no number, the sentence is written without one.

• AccessibilityWhat an accessibility audit actually checksWhat the accessibility audit measures: contrast at 4.5:1, alt text, form labels, landmarks and tap target size on the rendered page, and what a scan misses.
• Analytics setupWhat the analytics check actually looks forWhat the analytics check reads on a small business website: tracking tags, conversion events, error monitoring, Search Console and a live uptime probe.
• Broken linksBroken links, dead ends, and what they costWhat a broken link costs you, how the check works, why it stops at 30 links, and why a link our own check could not reach is never called dead.
• Code qualityCode quality: what it costs, and what it predictsWhat the code quality check reads: W3C validation, semantic markup, inline styles and source maps — and why a low score predicts cost, not lost sales.
• Content structureWhat the content checks read, and what they don'tWhat the content check measures on a small business page: heading order, thin content, reading level and spelling — and the parts it refuses to judge.
• Email protectionSPF, DKIM and DMARC: why your email lands in spamWhat SPF, DKIM and DMARC actually do, in plain words, and how our audit reads them from public DNS without guessing when a lookup does not answer.
• Forms that workWhat an audit checks on a contact formWhat an audit can read on a contact form: labels, field names, where it submits, CSRF tokens, and the runtime errors that stop a submit button.
• Hosting & uptimeServer response time: your host, or your siteWhat the audit measures on your hosting: how fast the server answers, how it behaves under ten requests at once, compression, caching, CDN and DNS.
• Loading speedCore Web Vitals: lab score vs real user dataA lab speed score is one run on one machine. Google's field data is what real Chrome users saw over 28 days. Here is what our audit measures, and why.
• Local searchLocal search: what the audit actually checksWhat the local search checks read: LocalBusiness structured data, opening hours, a phone number, an embedded map, and the live Google listing.
• Mobile layoutWhat breaks when your site loads on a phoneHow mobile layout is checked: a real browser at 375, 640, 768 and 1280 pixels wide, measuring horizontal overflow, tap-target size and small text.
• Privacy & cookiesCookies, consent, and when a banner is requiredWhat the audit reads about cookies and consent: which banner platforms it detects, what the policy text must say, and when a site needs no banner at all.
• Search visibilityWhat actually stops a page being foundThe technical SEO checks: titles, meta descriptions, canonicals, robots directives, sitemaps and indexability — judged on the rendered page, not the raw HTML.
• SecurityWhat a website security check actually looks atWhat a security check reads on a small business website: the certificate, response headers, cookies, DNS records and outdated JavaScript libraries.
• Social presenceLink previews, and what a blank one costsWhat the audit checks when your link is pasted into WhatsApp or LinkedIn: Open Graph tags, the og:image itself, social profiles and review schema.
• Trust signalsThe trust signals a first-time buyer looks forWhat a first-time buyer checks before enquiring: reviews, a phone number, a refund policy. What the audit measures, and how each finding is ranked.
• What an audit report contains, and how to read itA score out of 100, three findings ranked by what they cost, every issue tied to the page it came from, and an honest list of what could not be measured.
• WixWhat a Wix site does that breaks most audit toolsWix serves a different page to a phone than to a desktop browser, and its own bundles are not your code. Five behaviours an audit has to know before it reports anything about a Wix site.
• WordPressWordPress, and the buttons an audit cannot seeDivi, Elementor and WordPress blocks each name their buttons differently. A checker that only knows Bootstrap told a barbershop with ten booking buttons that it had no call to action.
• ShopifyAuditing a Shopify store without crying wolfA Shopify storefront token is public by design, and reporting it as a leak wastes a developer’s afternoon. What a shop audit should read, and the contradiction only a person finds.
• SquarespaceSquarespace, and the faults that are not yoursSquarespace does much of the technical work for you. What is left is your words, your evidence and your reachability — and that is where the findings land.
• RefusalsThe ten things we will not write a report aboutA parked domain, a bot challenge and an empty shell all answer 200 OK. None of them is a website, and a report about one is worthless however tidy it looks.