How it works
This page explains exactly what WebsiteAudit.in checks, how the score is worked out, and what an automated audit can and can’t tell you. Every result in your report comes from a check that actually ran against your site: the HTML we downloaded, the headers your server sent, or a direct lookup like your SSL certificate or domain registry record.
What happens when you scan
- We download the page you entered, the same way a browser would.
- We follow up to 4 links from it to other pages on your site, so up to 5 pages in total, to check site-wide issues like duplicate titles.
- In parallel, we look up things your browser can’t show you: the SSL certificate, domain registration, email security records, robots.txt, sitemap and common exposed files, and we check the sizes and caching of images and scripts.
- Separately, we ask Google PageSpeed Insights for real-world Core Web Vitals. That data comes from Google, can take up to 40 seconds, and isn’t part of our score.
- We grade every check, rank the fixes by how much each would raise your score, and write a ready-made AI prompt for each.
How the score works
Every check ends as Good (full credit), Check this (half credit) or Fix now (no credit). Each category score is the share of credit it earned, out of 100. The overall score weights the categories:
- Performance: 35%
- SEO: 35%
- Mobile: 15%
- Security: 15%
The “+pts” next to each item in your fix list is how many overall points fixing it would add on its own. Grades: A is 90+, B is 75+, C is 60+, D is 40+, and below that is F.
Everything we check
Performance · 35% of the score
How fast the page loads and how much it makes visitors download.
- Page weight
- Total size of the page and its main files. Under 1 MB is healthy; over 3 MB is heavy on mobile data.
- Server response time
- How long the server takes to start answering. Slow servers delay everything else.
- Modern image formats
- Whether images use WebP or AVIF, which are usually 40–60% smaller than PNG or JPEG at the same quality.
- Image size attributes
- Whether images declare width and height, so the page doesn't jump around while they load.
- Lazy-loading of images
- Whether images further down the page wait until visitors scroll to them.
- Render-blocking scripts
- Scripts in the page's head that stop the browser drawing anything until they finish.
- Text compression
- Whether the server compresses HTML, CSS and JavaScript (gzip or Brotli) before sending them.
- Browser caching
- Whether images, scripts and styles are cached, so returning visitors don't download them again.
- HTML document size
- The size of the HTML itself, before any images or scripts. Large HTML usually means page-builder bloat.
- Page complexity (DOM size)
- How many HTML elements the page has. Very large pages render and respond slowly.
- Third-party scripts
- How many outside domains load scripts on the page. Each one adds weight and risk.
- Redirect chain
- How many redirects happen before the page loads. Each hop adds delay.
SEO · 35% of the score
Whether search engines can find, understand and properly show the page.
- Page title
- The headline shown in Google. 30–60 characters works best; longer titles get cut off.
- Meta description
- The text under the headline in Google. 70–160 characters gives you room to pitch without being cut off.
- Main heading (H1)
- Whether the page has one clear main heading saying what it's about.
- Image descriptions (alt text)
- Text describing each image, for Google Images and screen-reader users.
- Broken internal links
- Links to your own pages that return "not found". Only real 404/410 responses count, to avoid false alarms.
- Duplicate page titles
- Pages across the crawl that share the same title, which makes it hard for Google to tell them apart.
- Missing meta descriptions (site-wide)
- Crawled pages with no meta description.
- Thin-content pages (site-wide)
- Crawled pages with under 250 words, which rarely rank.
- Canonical URL
- A tag telling Google which address is the official version of the page.
- www / non-www duplicate
- Whether the www and non-www versions of your domain lead to one place.
- Social sharing preview (Open Graph)
- Tags that control the preview card on WhatsApp, LinkedIn and Facebook.
- X/Twitter card tags
- Tags that control how links look when shared on X.
- Structured data
- JSON-LD markup that helps Google show rich results like stars, FAQs and breadcrumbs.
- Heading structure
- Whether heading levels follow in order (H1 → H2 → H3) without skipping.
- Content depth
- How much visible text the page has. Under 250 words is thin.
- Favicon
- The small icon shown in browser tabs and bookmarks.
- Page language attribute
- Whether the page declares its language, for search engines and screen readers.
- robots.txt
- The file that gives search engine crawlers their instructions.
- XML sitemap
- The list of your pages that helps Google discover them.
- 404 error handling
- Whether missing pages correctly return a 404 status instead of a normal page.
- Indexability
- Whether a noindex or nofollow directive is keeping the page out of Google.
- Content readability
- A Flesch reading-ease score of the page text. Shown when there's enough text to score fairly.
Mobile · 15% of the score
Whether the page is set up to display properly on phones.
- Mobile-friendly setup
- Whether the page has a viewport tag, so it scales to the phone's screen instead of showing a shrunken desktop page.
Security · 15% of the score
The things you can't see from your own browser: certificates, domains, email and exposed files.
- Secure connection (HTTPS)
- Whether the site loads over HTTPS.
- SSL certificate
- Who issued it and how many days are left before it expires.
- Domain registration
- When the domain registration expires, from official registry (RDAP) data.
- Email spoofing protection
- Whether SPF and DMARC records stop scammers sending email that looks like it's from your domain.
- Software version
- The platform (for example WordPress) and whether an outdated version is visible in the page code. Only shown when a platform is detected.
- Exposed sensitive files
- Whether files like .git, .env, backups or config files are publicly downloadable.
- Security headers
- Six server settings that protect against clickjacking, malicious scripts and data leaks.
- Mixed content
- Insecure http:// files loading on a secure https:// page.
- Cookie security flags
- Whether cookies set on the page have the Secure flag (and HttpOnly where appropriate).
AI readiness (not part of the score)
A separate section answering one question: can ChatGPT, Claude and Perplexity read and cite your site? It isn’t in the 0–100 score because AI visibility isn’t a proven ranking factor yet. You can run the crawler part on its own with the free AI crawler checker.
- AI crawler access
- Your robots.txt rules for each AI bot. Blocked search bots (OAI-SearchBot, ChatGPT-User, Claude-SearchBot, Claude-User, PerplexityBot, Perplexity-User) are flagged, because those assistants then can't read or cite you. Blocked training bots (GPTBot, ClaudeBot, Google-Extended, Applebot-Extended, CCBot) are reported but not counted against you; that's a fair choice.
- Content readable without JavaScript
- How much text is in the page's HTML before any JavaScript runs. Most AI crawlers don't run JavaScript.
- Structured data for AI
- Whether the page says who you are and what it offers (Organization, LocalBusiness, Product, Article and similar).
- llms.txt
- An optional, emerging plain-text guide to your site for AI tools. Labelled as a nice-to-have.
AI fix prompts
Every fixable issue comes with a copy-paste prompt for ChatGPT, Claude, Gemini or any AI assistant. Each prompt is built from your scan’s real details (file names and sizes, missing headers, your current title) and the platform we detected, so you get steps for your site rather than generic advice. We don’t send anything to an AI ourselves.
What an automated audit can’t see
- Pages behind a login, and anything beyond the 5 pages we crawl.
- Sites whose bot protection blocks automated tools. When that happens we tell you, rather than reporting made-up problems.
- Design, copywriting quality, and whether the site actually sells. Those need a person.
- Speed figures vary a little between runs, because networks and servers vary.
Treat the report as a strong, honest starting point, not a replacement for someone reviewing your site.
Your data
We fetch public pages only and never need access to your site. Scan results are held for 2 hours so you can share them, and kept for 90 days only if you create a share link. Details are in the privacy policy.
Something look wrong in your report, or a check you’d like added? Tell us.