How to audit a website

«Is my website OK?» sounds like a simple question and isn't one at all, because a website isn't judged on one thing: it's judged on dozens of different aspects at the same time — by Google, by browsers, by users and, more and more, by regulations. Auditing a website means X-raying it across all these fronts at once, and finding where it's losing points. This guide was born while building Skanno, a tool that runs 315 tests on a site: here I explain the same areas, so you can check them by hand.

The areas that really matter

A serious audit looks at far more than SEO. These are the main areas, with what they mean and how to check them for free:

• Performance — how long the page takes to become usable. Check it with Google PageSpeed Insights or the «Lighthouse» tab in your browser's developer tools (F12).
• On-page SEO — title, meta description, a single <h1>, image alt text, structured data. Much of it is visible via right-click → «View page source».
• Security — a valid HTTPS certificate, security headers (HSTS, X-Content-Type-Options), no old libraries with known flaws.
• Cookies and GDPR — which cookies you set, whether you ask consent before the non-essential ones, whether you have a complete privacy policy.
• Accessibility — color contrast, alt text, keyboard navigation: is your site usable by someone who can't see well or doesn't use a mouse?
• Mobile — it reads and works well on a phone, no zooming and no buttons too small to tap.
• Structured data — the markup (schema.org) that helps Google understand what the page is about.
• Sustainability — the weight of the page and the energy of its hosting (there's a free API, The Green Web Foundation, to tell whether hosting is «green»).

Not all errors weigh the same

The first mistake in an audit is treating every problem the same way. They aren't. Some are critical: get those wrong and no amount of speed or SEO will save you. The classic is HTTPS: a site with no valid certificate fails outright, because browsers flag it as «not secure» and Google penalizes it. In Skanno this is a hard rule — a critical test that fails caps the global score at a D, no matter how well everything else goes. In your hand-made audit, apply the same principle: fix the critical problems first (HTTPS, the site loads, content is reachable), then move on to the polish.

And where it makes sense, think in degrees rather than pass/fail: 3 HTML validation errors are not the same as 300. A small problem is a small problem.

The trick almost everyone gets wrong: static vs rendered

This is the most important part and the least known. When you check «view source», you see the static HTML — what the server sends. But many of the real problems aren't there: they appear only when the page is actually opened in a browser. Cookies written after load, third-party scripts that fire once the page is open, banners covering the content, performance as the user feels it — all of that exists only in the rendered DOM.

To see it, view source isn't enough: open the developer tools (F12), go to the «Application» (or «Storage») tab and look at the real cookies and localStorage, the ones written while you browse. That's where you discover the tracking cookies you didn't know you had. Skanno solves this with a double scan — one server-side and one via a browser extension that reads the rendered page — but you can apply the idea by hand: check the site as it really is when it runs, not just as it is on the wire.

Trust and technical quality are two different things

A site can be technically impeccable and still inspire little trust, or the other way round. «Is it well built?» and «can I trust it?» don't always have the same answer. In your audit, judge the trust signals separately: easy-to-find contacts, a real «About» page, complete legal information, consistency between what the site promises and what it shows. These are the things a user (and a Google reviewer) looks at before the technical details.

The new dimension almost nobody checks: the AI Act

If your site uses artificial intelligence — a chatbot, generated content or images — the European EU AI Act introduces concrete transparency obligations: the user must know if they're talking to a bot, generated content must be labelled, deepfakes declared. These are verifiable things, and almost nobody checks them yet. If you use AI, add one item to your audit: am I clearly disclosing where and how I use AI? It's a problem everyone will soon have.

By hand, or all at once

You can get far with free tools: PageSpeed for speed, the W3C validator for HTML, developer tools for cookies and network, accessibility extensions. The limit is that they're ten different tools, and you end up with ten fragments of a verdict that don't talk to each other. If you want a single picture with one grade from A+ to F across all these areas together, that's exactly the problem I built Skanno for: paste a URL and get the full report. But the real value, tool or not, is the mental checklist: knowing what to look at and why. Now you have it.