What is a website audit?

A useful audit covers six areas. A tool that only reports on one of them is a checker, not an audit.

• Does it work — broken links, dead buttons, forms that fail silently, leftover placeholder text.
• Mobile and accessibility — real phone rendering, horizontal overflow, tap target sizes, and automated WCAG checks.
• Speed — real Lighthouse measurements rather than an invented score.
• Search and AI visibility — titles, descriptions, headings, sitemap, structured data, and whether search engines and AI crawlers can read the page at all.
• Public security — HTTPS and certificates, security headers, accidentally exposed files, and libraries with known vulnerabilities.
• Trust and conversion — a clear call to action, reachable contact details, and the tells of a site shipped unfinished.

This matters as much as what it does see, and any tool that is vague about it should be treated carefully.

A public audit examines what your site shows the outside world. It does not inspect your server, your database, your source code or anything behind a login. It is a launch-readiness and public-health check, not a penetration test.

Automated accessibility checks have a similar limit: they reliably catch machine-detectable problems, but some WCAG questions genuinely need a human. Any tool implying otherwise is overselling.

Before every launch, without exception — that is when the expensive mistakes are cheapest to fix.

After that, a monthly check is enough for most sites. Sites that change frequently, or that people manage on a client's behalf, benefit from something automatic, because the failure mode is not knowing something broke rather than not knowing how to fix it.