All audits
SEO
- Title tag
- Meta description
- Headings
- Thin and placeholder content
- Duplicate and competing content
- Images
- Indexability
- Canonical tags
- Hreflang and language versions
- Structured data and social tags
- URL format
- Status codes and redirects
- Internal linking and site structure
- XML sitemaps
- robots.txt
- Host and protocol variants
- Mobile rendering
- Page speed and Core Web Vitals
- Delivery and caching
- Keyword use on the page
- Rank tracking
- Keyword research
- Backlinks
- Competitor comparison
- Search traffic checks
- Change monitoring
- Local listings
- Search bot activity from logs
- Structured data as one entity graph
- robots.txt blocks a page that carries noindex
- A newly blocked path that has search traffic
- Canonical signals that point in different directions
- HTTP header, HTML source and rendered page disagree
- The sitemap asks for indexing, the page refuses
- Language and region signals disagree
- Structured data says something the page does not
- The page names itself differently in each place
- Internal links contradict the indexing directives
- Several URLs each claim to be the page
AI
- AI crawler access
- Visibility in AI answers
- AI Overviews for tracked keywords
- Traffic from AI assistants
- Page readiness for AI answers
- Checks that need judgement
- AI usage signals and agent files
- llms.txt invites what robots.txt forbids
- robots.txt allows a bot the server turns away
- AI access is blocked while AI visibility is the goal
- The content exists only after JavaScript runs
- The site gives different answers to the same question
- AI answers contradict the site
- Organisation and author markup contradicts the visible page
- The page has four different dates
- Snippet and reuse controls contradict each other
- Bots and people are served different content
QA
- Broken links
- Page resources and script errors
- Spelling
- Readability
- Language declaration
- Content freshness
- Inventory
- Custom policies
- Markup validity
- Error pages and server messages
- Usability rules
- Uptime and response time
- Documents
- Tag coverage
- Page carbon estimate
- Scores and benchmarks
- Findings over time
- Leftovers that shipped with the site
- Forms that lose submissions
- Contact details differ across the site
- The same product has different prices
- Dates that contradict the calendar or each other
- Translations that drifted apart
- The link promises one thing and delivers another
- Several versions of the same document are live
- The site spells its own names in several ways
- The status code and the page say different things
- Analytics and the crawl see different sites
- The same component differs from page to page
Privacy
- Cookies and browser storage
- Trackers and third-party requests
- Consent banner behaviour
- Privacy and cookie policy
- Personal data on pages
- Personal data in documents
- Exposed contact details
- Data collection forms
- Device read or written before consent, beyond cookies
- What visitors type, say or do is captured
- Which regulations apply
- The cookie list says one thing, the browser shows another
- The banner promises a choice the site does not honour
- A tracker is filed under the wrong consent category
- The consent signal says denied, the tags behave as granted
- The privacy policy names other vendors than the site uses
- Visitors from different regions get the wrong regime
- Stated retention and real lifetimes differ
- Forms collect or send what the policy does not mention
- The organisation's own sites disagree on privacy
- Privacy claims on the page that the page itself disproves
Accessibility
- Automated WCAG rules
- Assisted review
- Colour contrast
- Alternative text quality
- Alternative text checked against the image itself
- Audio and video
- Interactive states and flows
- PDF accessibility
- Office document accessibility
- Compliance status and evidence
- The visible label and the accessible name differ
- ARIA contradicts the element or its real state
- Reading, focus and visual order disagree
- Alternative text contradicts its surroundings
- The accessibility statement claims more than the site delivers
- What looks like structure is not marked up as structure
- Desktop and mobile give different access
- The document alternative is not equivalent to the page
- A script overlay hides problems that remain in the source
- The same function is named differently across pages
Security
- Session tokens readable in the browser
- TLS certificate and configuration
- HTTPS enforcement
- Mixed content and insecure forms
- Security headers
- Cookie security attributes
- Outdated and vulnerable libraries
- Information exposure
- Outbound link safety
- Site reputation
- Email authentication records
- Domain and DNS
- Unexpected changes
- Sensitive content
- security.txt
- External attack surface
- HSTS promises HTTPS everywhere, the site does not deliver it
- The content security policy and the page disagree
- Security headers differ between parts of the same site
- Cookie attributes contradict each other or the connection
- robots.txt hides paths that are open to everyone
- Script integrity and versions do not match what loads
- DNS points at things that are gone or unlisted
- Certificates and the hosts in use do not line up
- Security claims and security.txt that the site contradicts
- Pages meant to be private are published as public