How to Audit Your Own Website in 30 Minutes

You can audit your own website in about 30 minutes with free tools and no code. Check five things: how fast it loads, whether it is secure, whether anything is broken (especially forms), whether it works on a phone, and whether the software behind it is out of date. Here is exactly how, step by step, and what to fix first.

Keep a notepad open. The point is not to fix things as you go. It is to end up with a short, ranked list.

Step 1: Check how fast it loads

Slow pages lose visitors and rank worse. Run your homepage and one important inner page (a service or product page) through PageSpeed Insights. It is free and needs no login.

Write down two numbers: the performance score and the Largest Contentful Paint time. If the score is green and LCP is under about 2.5 seconds, you are fine. If it is red, or LCP is over 4 seconds, note it. The most common causes are huge unoptimised images and too many plugins, both of which are fixable. Why is my website so slow ranks the usual culprits.

Step 2: Check security and the SSL certificate

Load your site and look at the address bar. You want a padlock and an address that starts with https. Now type the plain http:// version of your address. It should redirect to https automatically. If it does not, or you see a "not secure" warning, that is a priority. Visitors see that warning too, and most leave. The "not secure" warning explains the fix.

Click the padlock and check the certificate expiry date. Most certificates renew automatically, but a lapsed one takes a site offline for anyone who notices the warning.

Step 3: Find the broken things

This step catches the failures that quietly cost you money.

1. Run the site through a free broken-link checker to find dead links and missing images.
2. Then do the check that matters most: send a real enquiry through every form on the site, from your phone, using an outside email address. Confirm it actually arrives.

Forms fail silently more often than anything else on a website. A plugin update, an expired API key, or a spam filter change can stop them without any visible sign. If yours is broken, you are losing enquiries right now. My contact form stopped sending emails is the fix-it guide.

How do I know if my website works on mobile?

Open it on an actual phone, not just a narrow browser window. Tap through your main journeys: read a service page, start a form, find your phone number. Most of a small business site's traffic is on mobile, so a site that is awkward on a phone is awkward for most of your visitors.

Check three things as you go. Is the text readable without zooming? Are buttons and links far enough apart to tap without missing? Does anything run off the edge of the screen? Note anything that fails.

Step 4: Check what is out of date

Log in to your site's admin. If you run WordPress, the dashboard shows pending updates for the core software, your theme, and every plugin. Write down how many are waiting and how far behind the core version is.

Out-of-date plugins are the single most common way small sites get hacked, because public vulnerabilities get scanned by bots within hours. You do not have to update right now, especially without a backup, but a long list of pending updates is a real risk. What happens if you never update WordPress covers what actually goes wrong.

While you are in there, find out when the last backup ran and where it is stored. If you cannot answer that, treat it as the top of your list.

Step 5: A quick sense-check on ownership and hosting

Two questions worth answering while you are auditing. Do you have the logins to your own domain registrar and hosting, in your name? And do you know who would fix an outage at 9pm on a Saturday? Neither is a technical check, but both decide how bad a problem gets. Who actually owns your website walks through how to confirm it.

What to do with your list

You now have a ranked list. Sort it by damage, not by effort:

Most of these you can fix yourself with an afternoon and some searching. The ones that need a professional are usually the security findings and anything involving code you did not write.

If you would rather hand the whole list to someone who does this daily, that is exactly what a proper site health audit is for. Run this checklist first either way. It costs nothing and it tells you where you actually stand.