- Finding
- Nine advertising and analytics cookies are set on the first page view, before the visitor makes a consent choice.
- Evidence
- Clean-browser capture of the homepage and two landing pages, listing each cookie, its domain and the script that set it.
- Impact
- Breaches PECR regulation 6, and means Consent Mode is not doing its job, so conversion data is both non-compliant and unreliable.
- Fix
- Hold the Google Ads and Meta tags until consent is granted, and start the analytics tag in Consent Mode's default-denied state.
- Effort
- Low: around half a day for your developer or tag manager.
- Owner
- Marketing operations
In-Depth Website Audit
Your website is your shop window, your sales team, your recruitment brochure and, for attackers, your front door. The In-Depth Website Audit is an independent, evidence-based review of all of it.
We cover 14 areas, from security, SEO and performance to accessibility, cookie compliance and AI search visibility, and turn the findings into a board-ready summary and a prioritised plan your team can act on. We build, host and secure websites ourselves, so every recommendation is practical, costed and ready to hand to your developers, your current agency or us. See our security and SEO services for the ongoing work behind it.
14 areas, one report13 scored health areas plus a competitor benchmark
Written for two audiencesA board-ready summary and a developer-ready fix list
Safe for live sitesPassive checks, no downtime and no passwords
When organisations commission an audit
- Before a redesign, replatform or CMS migration, so the brief is built on evidence
- When appointing or reviewing a web agency, to get an independent baseline
- After a security scare, a traffic drop or a failed compliance check
- During due diligence on an acquisition, merger or investment
- As an annual governance check for your board or risk register
- When a new marketing, digital or IT lead needs to know what they have inherited
What the website audit covers
Every area is checked with automated tooling and then reviewed by hand, so each finding comes with evidence and a clear explanation of why it matters to your organisation.
- Area 01
Security exposure
An outside-in review of what an attacker can see and probe on your public website.
- TLS configuration, certificate chain and renewal
- Security headers: CSP, HSTS, frame, referrer and permissions policies
- CMS, plugin and JavaScript library versions checked against known vulnerabilities
- Exposed admin logins, backup files, directory listings and debug output
- Cookie security flags, mixed content and third-party script integrity
Why it matters: One outdated plugin can expose customer data and start the 72-hour clock on a UK GDPR breach report.
- Area 02
Email and domain security
The DNS and email records that stop criminals sending mail in your name.
- SPF, DKIM and DMARC alignment, policy strength and reporting
- MTA-STS, TLS reporting and BIMI readiness
- DNSSEC, CAA records and registrar lock
- Dangling DNS records that would allow a subdomain takeover
Why it matters: Gmail, Yahoo and Microsoft now junk or reject bulk mail that fails authentication, and a weak DMARC policy leaves the door open to invoice fraud using your domain.
- Area 03
Performance and Core Web Vitals
How fast your site feels to real visitors, and exactly what is slowing it down.
- Real-user Chrome UX Report data for LCP, INP and CLS on mobile and desktop
- Lab testing of each key template: home, category, product or service, article and checkout
- Page weight, image formats, font loading and render-blocking resources
- Third-party tag cost, caching, CDN and server response time
- Estimated carbon per page view, for ESG and sustainability reporting
Why it matters: Core Web Vitals feed into Google rankings, and slow pages lose visitors before they ever see your offer.
- Area 04
Technical SEO and indexation
Whether search engines can crawl, understand and index the pages that matter to you.
- Full site crawl: status codes, redirect chains, orphan pages and crawl depth
- robots.txt, XML sitemaps, canonical tags and noindex conflicts
- Search Console coverage and crawl stats, with read-only access
- Structured data validity and rich result eligibility
- Hreflang, international targeting and duplicate content
Why it matters: A page Google cannot crawl or index cannot rank, however good the content on it is.
- Area 05
Content and on-page SEO
Whether your pages answer what buyers are searching for, and say so clearly.
- Titles, meta descriptions and heading structure across every template
- Thin, duplicate and competing pages that split your rankings
- Internal linking and coverage of your priority services or products
- Expertise and trust signals: authorship, case studies, credentials and policies
Why it matters: Larger sites build up years of overlapping content. Consolidating it is often one of the quickest organic wins available.
- Area 06
AI search visibility
How your organisation is represented in AI Overviews and AI assistants.
- Spot checks of your priority queries in Google AI Overviews, ChatGPT, Gemini, Copilot and Perplexity
- AI crawler rules in robots.txt: GPTBot, ClaudeBot, PerplexityBot and Google-Extended
- Entity clarity: Organization schema, consistent company facts and linked profiles
- Content structured for citation: direct answers, FAQs and comparison tables
Why it matters: More buyers now start their research inside AI answers. Being cited depends on being crawlable, consistent and unambiguous.
- Area 07
Mobile experience
How your site works on the phones and tablets your customers actually use.
- Testing across iOS and Android at common screen sizes
- Tap target sizes, text legibility, viewport and horizontal scrolling
- Mobile navigation, forms, site search and checkout usability
- Mobile-first indexing parity: content, links and structured data match desktop
Why it matters: Google crawls and ranks the mobile version of your site, so anything hidden or broken on mobile is effectively missing.
- Area 08
Accessibility (WCAG 2.2 AA)
Whether disabled people can use your site independently, measured against WCAG 2.2 AA.
- Automated scans of every key template, plus manual keyboard-only testing
- Screen reader checks with NVDA and VoiceOver on your critical journeys
- Colour contrast, focus visibility, alt text, form labels and error messages
- Accessibility statement review
Why it matters: The Equality Act 2010 requires reasonable adjustments, and the European Accessibility Act has applied since June 2025 to many businesses selling to EU consumers.
- Area 09
Privacy, cookies and compliance
Whether your cookies, consent and policies would stand up to ICO scrutiny.
- Cookies and trackers set before consent, tested in a clean browser
- Consent banner design against ICO guidance: rejecting as easy as accepting
- Google Consent Mode v2 behaviour and tag firing
- Privacy and cookie policies matched against what the site actually does
- Form data collection, retention notices and data sent abroad by third-party scripts
Why it matters: The ICO has been reviewing cookie compliance on the UK's most visited websites, and the Data (Use and Access) Act 2025 raises cookie fines to UK GDPR levels: up to £17.5 million or 4% of global turnover.
- Area 10
Analytics and tag governance
Whether the numbers your team makes decisions on can actually be trusted.
- GA4 configuration: key events, cross-domain tracking, filters and data retention
- Tag Manager hygiene: duplicate, orphaned and unapproved tags
- Conversion tracking reconciled against your CRM or order data
- Ad platform tags and enhanced conversions for Google, Meta and LinkedIn
Why it matters: Double-counted conversions and missing events quietly distort budgets. Fixing measurement often changes where the next pound goes.
- Area 11
Conversion and user experience
How easily visitors can do the thing you need them to do.
- Walkthroughs of your key journeys: enquiry, quote, purchase, booking or sign-up
- Form friction, validation and error handling
- Value proposition, calls to action and trust signals near the point of decision
- Navigation, site search and content findability
Why it matters: A small lift in conversion rate applies to every visitor you already pay to attract, paid and organic alike.
- Area 12
Hosting, infrastructure and resilience
How well your platform would cope with a bad day.
- Uptime history, DNS, CDN and server configuration
- Backup frequency, retention and evidence of restore testing
- Server software, CMS and runtime versions against end-of-life dates
- Staging environments, deployment process and change control
Why it matters: End-of-life software stops receiving security patches, and a backup that has never been restored is only a hope.
- Area 13
Reputation and trust signals
What buyers, candidates and investors find when they check you out.
- Branded search results, knowledge panel and review profiles
- Google Business Profiles for each location: categories, consistency and reviews
- Legal disclosures: company name, number and registered office as UK law requires
- Consistency of company facts across your website, social profiles and directories
Why it matters: People research you before they get in touch, and inconsistent or missing details cost credibility at the shortlist stage.
- Area 14
Competitor benchmarking
How you compare with up to three competitors you choose.
- Side-by-side Core Web Vitals, technical health and accessibility checks
- Rankings for your priority keywords: where they appear and you do not
- Content depth, site structure and conversion approach
- Gaps you can close quickly, and the areas where you already lead
Why it matters: A score means more in context. Benchmarking shows where you are losing ground and where you are already ahead.
What your report looks like
Your leadership team gets a one-page scorecard. Your developers get a prioritised list of findings, each with evidence, impact, a fix and an effort estimate. The example below is illustrative.
Example scorecardOverall website health
62/ 100Needs attention
- Security exposure58 out of 100, Needs attention
- Email and domain security41 out of 100, At risk
- Performance and Core Web Vitals63 out of 100, Needs attention
- Technical SEO and indexation72 out of 100, Needs attention
- Content and on-page SEO66 out of 100, Needs attention
- AI search visibility47 out of 100, At risk
- Mobile experience81 out of 100, Good
- Accessibility (WCAG 2.2 AA)52 out of 100, Needs attention
- Privacy, cookies and compliance38 out of 100, At risk
- Analytics and tag governance55 out of 100, Needs attention
- Conversion and user experience69 out of 100, Needs attention
- Hosting, infrastructure and resilience77 out of 100, Needs attention
- Reputation and trust signals84 out of 100, Good
How the website audit works
Scoping call
Thirty minutes to agree your goals, key journeys, competitors and any areas of concern. We confirm the price and timeline in writing before anything starts.
Read-only access, if you want it
Most checks need no access at all. Read-only Search Console and GA4 access deepens the findings. We never ask for passwords.
The audit
Automated crawling and testing, followed by hands-on expert review of every finding so nothing in the report is unverified tool output.
Report and presentation
We present the scorecard, findings and roadmap live to your stakeholders, then answer follow-up questions by email for 30 days.
90-day progress check
Three months later we re-run the automated checks and send an updated scorecard, so you can show progress internally.
Safe for business-critical websites
Written with your IT and security teams in mind.
- Passive, read-only checks by default. No exploitation, load testing or penetration testing without your written authorisation.
- Rate-limited crawling with a clearly identified user agent, scheduled out of hours on request.
- No passwords requested. Optional access is read-only and can be revoked at any time.
- Happy to sign your NDA, or to provide ours for electronic signature, before any access is shared.
- Findings shared only with the contacts you nominate.
- Vendor-neutral recommendations that work with your in-house team, your current agency or us.
Website audit pricing
Pay online for a Standard or Large audit, or contact us for an Enterprise quote. If the scoping call shows your website needs a different tier, we will tell you before any work starts.
Standard
£1,249
One website with up to 500 indexable pages.
- All 14 audit areas
- Benchmarking against up to three competitors
- 60-minute findings presentation
Delivered within 15 business days
Large
£2,495
Up to 5,000 indexable pages, or up to three websites, brands or regions.
- Everything in Standard
- Template-level review across each site
- Separate leadership and technical presentations
Delivered within 20 business days
Enterprise
Bespoke quote
Over 5,000 pages, large product catalogues, or multi-brand and international estates.
- Everything in Large
- Scope, sampling and timeline agreed in a written proposal
- Optional quarterly re-audits
Timeline agreed at scoping
Complimentary audits for selected organisations
Each quarter we complete a small number of audits free of charge for selected UK organisations. It is the clearest way we know to show how we work: a scored report, real findings and a conversation about what to fix first, with no obligation to use us for any of it.
We prioritise organisations that:
- Employ 20 or more people, or run several sites, brands or locations
- Rely on their website for enquiries, sales, recruitment or investor confidence
- Are planning a redesign, replatform or change of supplier in the next 12 months
Already heard from us? Mention it in your message and we will pick it up from there.
Running a smaller website?
For a single small business site, our Site Health & Security package covers the essentials for £495, with critical SEO fixes included. For a quick check right now, try our free website health scanner.
Deliverables
- Board-ready executive summary with an overall health score, top risks and top opportunities
- Scorecard rating each audited area out of 100, with red, amber and green status
- Detailed findings report: evidence, business impact, severity, effort and recommended fix for every issue
- Prioritised 90-day roadmap, ranked by impact against effort
- Developer-ready issue list in CSV, ready to import into Jira, Azure DevOps or Trello
- Competitor benchmark against up to three competitors you choose
- 60-minute findings presentation for your stakeholders, online or in person across Hampshire
- 30 days of follow-up questions by email, plus a 90-day progress re-check
Package Terms
- Billing: One-off fixed price
- Contract: Single purchase with no ongoing contract
- Turnaround: Standard audits delivered within 15 business days of the scoping call; larger estates within 20
- Cancellation: You may cancel before the audit begins for a full refund minus any admin costs. Once the audit has started, the fee is non-refundable. See our refund policy for full details.
Full refund and cancellation terms are in our refund policy.
Related Services
Price & Delivery
Price From: From £1249.00No setup fee
Delivery: 15 business days
Ready to Get Started?
Fixed price for In-Depth Website Audit. No hidden fees. Choose how you want to proceed.
Get StartedAppointment
Interested in this service? Book a free consultation at a time that suits you.
Package FAQs
Frequently Asked Questions
What is a website audit?
A website audit is an independent review of how well your website works for visitors, search engines and your business: its security, speed, search visibility, accessibility, legal compliance and ability to turn visitors into enquiries. A useful audit gives evidence for every issue, explains what it costs you, and ranks the fixes by impact and effort, rather than handing over a raw tool export.
Who is the In-Depth Website Audit for?
Medium and large organisations whose website matters to sales, recruitment, reputation or compliance: typically 20 or more employees, several sites or locations, or a site with hundreds of pages. It suits marketing, digital and IT leads who need an independent view before a redesign, a change of agency, an investment or a board review.
How is this different from the Site Health & Security package?
Site Health & Security is a fixed-price check for small business websites, with critical SEO fixes included. The In-Depth Website Audit covers 14 areas including accessibility, privacy compliance, analytics, AI search and competitor benchmarking, and delivers a scored report, a 90-day roadmap and a stakeholder presentation for larger sites and teams.
Will the audit affect our live website?
No. Checks are passive and read-only, crawling is rate-limited and identifies itself clearly, and we can schedule it out of hours. We do not run penetration tests, load tests or exploit anything unless you authorise it in writing.
What access do you need?
None for most of the audit, because the majority of checks work from the outside, as a visitor or search engine would. Read-only access to Google Search Console and GA4 lets us go deeper on indexation and measurement. We never ask for passwords, and access can be revoked the moment we finish.
Is this a penetration test?
No. The security section is a passive review of your public attack surface: configuration, headers, software versions and exposed files. If the findings suggest you need a full penetration test, we will say so and can help you scope one with an accredited tester.
Do we have to use you to fix the issues?
No. The report and issue list are yours, and every recommendation is written so your in-house team or current agency can act on it. If you would like us to help, we will quote for the work separately, with no obligation.
How much does an audit cost for a larger website?
Standard: £1,249 (one website with up to 500 indexable pages). Large: £2,495 (up to 5,000 indexable pages, or up to three websites, brands or regions). Enterprise audits are quoted after a scoping call.
How long does a website audit take?
We deliver Standard audits within 15 business days and Large audits within 20 business days of the scoping call, and agree Enterprise timelines at scoping. Automated crawling takes hours; most of the time goes on checking each finding by hand and writing fixes your team can act on.
How often should a website be audited?
Once a year is a sensible baseline, plus before any redesign, replatform or change of agency, because those are the moments when problems are cheapest to fix. Every audit includes a 90-day re-check of the automated scores, and Enterprise clients can add quarterly re-audits for sites that change often.
Can we pay online?
Yes. Standard and Large audits can be paid online through PayPal from the pricing section, and we email you straight afterwards to book your scoping call. Enterprise audits are invoiced once the proposal is agreed. If your organisation needs to pay a Standard or Large audit by invoice, contact us instead.
Do you offer complimentary audits?
Yes, in limited numbers. Each quarter we complete a small number of audits free of charge for selected UK organisations, covering the same areas with a scorecard and findings call. For very large estates we may focus a complimentary audit on your main website or most important journeys. Apply through our contact form and we will let you know if a place is available.
Will you sign our NDA?
Yes. We are happy to sign your NDA, or to provide ours for electronic signature, before any access or internal information is shared.