What each category actually checks

Fifteen categories go into every audit. These explain what each one looks at, written from the rules in the code rather than from general advice — thresholds quoted, sources named.

Where a claim needs a number, it comes from a public source you can check: a Google threshold, a WCAG criterion, an RFC. Where we have no number, the sentence is written without one.

• AccessibilityWhat an accessibility audit actually checksWhat the accessibility audit measures: contrast at 4.5:1, alt text, form labels, landmarks and tap target size on the rendered page, and what a scan misses.
• Analytics setupWhat the analytics check actually looks forWhat the analytics check reads on a small business website: tracking tags, conversion events, error monitoring, Search Console and a live uptime probe.
• Broken linksBroken links, dead ends, and what they costWhat a broken link costs you, how the check works, why it stops at 30 links, and why a link our own check could not reach is never called dead.
• Code qualityCode quality: what it costs, and what it predictsWhat the code quality check reads: W3C validation, semantic markup, inline styles and source maps — and why a low score predicts cost, not lost sales.
• Content structureWhat the content checks read, and what they don'tWhat the content check measures on a small business page: heading order, thin content, reading level and spelling — and the parts it refuses to judge.
• Email protectionSPF, DKIM and DMARC: why your email lands in spamWhat SPF, DKIM and DMARC actually do, in plain words, and how our audit reads them from public DNS without guessing when a lookup does not answer.
• Forms that workWhat an audit checks on a contact formWhat an audit can read on a contact form: labels, field names, where it submits, CSRF tokens, and the runtime errors that stop a submit button.
• Hosting & uptimeServer response time: your host, or your siteWhat the audit measures on your hosting: how fast the server answers, how it behaves under ten requests at once, compression, caching, CDN and DNS.
• Loading speedCore Web Vitals: lab score vs real user dataA lab speed score is one run on one machine. Google's field data is what real Chrome users saw over 28 days. Here is what our audit measures, and why.
• Local searchLocal search: what the audit actually checksWhat the local search checks read: LocalBusiness structured data, opening hours, a phone number, an embedded map, and the live Google listing.
• Mobile layoutWhat breaks when your site loads on a phoneHow mobile layout is checked: a real browser at 375, 640, 768 and 1280 pixels wide, measuring horizontal overflow, tap-target size and small text.
• Privacy & cookiesCookies, consent, and when a banner is requiredWhat the audit reads about cookies and consent: which banner platforms it detects, what the policy text must say, and when a site needs no banner at all.
• Search visibilityWhat actually stops a page being foundThe technical SEO checks: titles, meta descriptions, canonicals, robots directives, sitemaps and indexability — judged on the rendered page, not the raw HTML.
• SecurityWhat a website security check actually looks atWhat a security check reads on a small business website: the certificate, response headers, cookies, DNS records and outdated JavaScript libraries.
• Social presenceLink previews, and what a blank one costsWhat the audit checks when your link is pasted into WhatsApp or LinkedIn: Open Graph tags, the og:image itself, social profiles and review schema.
• Trust signalsThe trust signals a first-time buyer looks forWhat a first-time buyer checks before enquiring: reviews, a phone number, a refund policy. What the audit measures, and how each finding is ranked.
• What an audit report contains, and how to read itA score out of 100, three findings ranked by what they cost, every issue tied to the page it came from, and an honest list of what could not be measured.