Website Audit Report Example
This is what your client receives. One URL in, 18 analyzers across 8 tabs, and an AI action plan that names the fixes in priority order — then the whole thing as a PDF under your agency's name. Below is one audit read from the outside, scores and findings and all.
About this sample: Northwind Dental is a fictional client and northwind-dental.example is a reserved-TLD domain that can never be registered by anyone, so nothing here lands on a real business. The findings and the scores are the shape and the arithmetic of a genuine audit of a small WordPress site — every number reconciles with the formulas published in the analyzer reference. Real audits list every finding; this page shows a representative few per tab.
The Audit at a Glance
The first screen after a scan. Six headline numbers, deliberately never rolled into one grade — an overall score of 78 sitting next to a GEO score of 46 tells you where to spend the afternoon, which a single letter never would.
Average of the four Lighthouse scores below
The 100-point composite built from 8 weighted components
No structured data anywhere
Our WCAG analyzer, not Lighthouse
4 of 7 headers present and valid
Specificity, !important, and a11y features
The Lighthouse Quartet Behind the Overall Score
The overall score is the plain average of these four Google PageSpeed Insights results: (58 + 84 + 79 + 92) ÷ 4 = 78. When the PageSpeed phase fails or times out, there is no overall score at all rather than a guess.
Mobile
Mobile
Mobile
Mobile
Scan Details
| URL audited | https://northwind-dental.example |
| Pages crawled | 24 |
| Scan time | 22 s core phase, then 41 s for PageSpeed |
| SSL certificate | Valid, Let's Encrypt, 41 days remaining |
| Stack detected | WordPress, Nginx, Cloudflare, Google Tag Manager, jQuery |
The AI Action Plan
Every audit ends with an executive summary and a ranked list of fixes, each one grounded in that audit's own findings rather than in generic advice. It is included on every plan, it goes into the PDF unless you switch it off, and this is exactly the format a client reads.
Executive Summary
The foundations here are sound: a valid certificate, a clean crawl of all 24 pages, and a title tag on every one of them. The gaps are in three places a prospective patient would actually feel. The homepage takes 4.1 seconds to paint its main content on mobile, the two highest-risk security headers are absent, and the appointment form has a field that screen-reader users cannot identify. Nothing here is an emergency, but the first three items below are the ones a visitor notices.
Recommendations, Highest Priority First
Add Content-Security-Policy and Strict-Transport-Security headers
Both are missing. Without HSTS, a first visit over http:// is exposed before the redirect fires; without a CSP, any injected script runs with the same trust as your own code. These are the two highest-risk headers of the seven checked.
Fix: Send Strict-Transport-Security: max-age=31536000; includeSubDomains, and roll out CSP in report-only mode first so you can see what it would block before you enforce it.
Label the phone field on the appointment form
Three of the form's four inputs have a matching label element. The phone field has only placeholder text, so a screen reader announces it as an unlabeled edit box — on the form that books appointments.
Fix: Add <label for="phone">Phone number</label>. A placeholder is not a label: it is unreadable to assistive technology and it disappears the moment someone types.
Largest Contentful Paint is 4.1 s on mobile
The hero photograph is the element Lighthouse measures, and it ships as a 1.8 MB JPEG at full resolution that the browser then scales down. Total Blocking Time of 610 ms compounds it, because three page-builder scripts load in the head.
Fix: Export the hero at the size it actually renders, serve WebP with a JPEG fallback, and mark it fetchpriority="high" so it is not queued behind those scripts.
Add Organization and FAQPage structured data
The site ships no JSON-LD at all, so an AI answer engine has no machine-readable statement of who the practice is or what it answers. The Common Questions page is already written as questions followed by short answers — the shape FAQPage exists to describe.
Fix: Add an Organization block site-wide and a FAQPage block on the questions page. Mark up only what is genuinely on the page; invented schema is worse than none.
Two service pages ship without a meta description
The whitening and implants pages have none, so search engines write their own snippet from whatever body copy they find first. A third page's description is 38 characters, short enough to read as truncated.
Fix: Write a 150-160 character description for each of the three pages, leading with the service itself rather than the practice name.
In the app the card shows the top three and expands to the rest, and each recommendation links straight to the tab holding the finding behind it. Recommendations are AI-generated from your audit's results, so read them before they go to a client — the severity ranking is deterministic, the prose is not.
Findings, Tab by Tab
Eight tabs, each backed by its own analyzers. Below is a representative slice of each one — a real audit lists everything it found, including the checks that passed. The Overview tab is the scores and scan details above.
PageSpeed
Performance 58 · Accessibility 84 · Best Practices 79 · SEO 92
- Largest Contentful Paint 4.1 s — the hero image is a 1.8 MB JPEG served at full resolution.
- Total Blocking Time 610 ms, from three render-blocking page-builder scripts in the head.
- Cumulative Layout Shift 0.02 and First Contentful Paint 2.4 s — both fine; nothing to fix here.
Accessibility
71 / 100
- One error: body copy over white measures 3.1:1, below the 4.5:1 WCAG AA minimum for normal text.
- 3 of 4 appointment-form inputs are labeled; 22 of 25 images carry alt text (88% completeness).
- Three warnings: no skip-to-content link, four "Read more" links with no surrounding context, and one video without captions.
SEO
Composite 76 / 100
- All 24 pages have titles. Two have no meta description and one is 38 characters, so metadata consistency scores 77.
- 47 of 50 checked links returned 2xx or 3xx — link health 94. The three failures: two 404s and one 500 on an external directory listing.
- 3 pages carry no canonical tag (canonicals 85); 6 internal redirects, none longer than a single hop (redirects 88).
- Sitemap present but missing 3 crawled pages (94); 2 of 24 pages are orphaned, linked from nowhere (92).
AI Readiness
GEO 46 / 100
- Zero JSON-LD blocks, so Organization, FAQPage and HowTo schema are all absent — the single largest component of the GEO score.
- 12 of the 14 AI crawlers we check are allowed. robots.txt blocks GPTBot and CCBot, both training crawlers; every search indexer and assistant fetcher is open, so AI citations are not being turned away.
- One H1, six H2s, no question-and-answer heading pattern and no FAQ section. Flesch reading ease 52, just under the 55-70 band that reads best in AI answers.
- No llms.txt. Reported for context only — no major AI search crawler fetches it today.
Security
Headers 57 / 100
- Present: X-Frame-Options (SAMEORIGIN), X-Content-Type-Options (nosniff), Referrer-Policy, X-XSS-Protection.
- Missing: Content-Security-Policy and Strict-Transport-Security, the two rated high risk, plus Permissions-Policy.
- Certificate valid, issued by Let's Encrypt, 41 days remaining. Two homepage images are referenced over http:// from an https:// page, so mixed content scores 80.
CSS
81 / 100
- 63 !important declarations across four stylesheets, and an average selector specificity of 112.
- Focus styles are defined. There is no prefers-reduced-motion query and no dark-mode support.
- No CSS framework detected: the payload is the theme's own stylesheet plus one the page builder injects.
Hosting
Informational — no score
- Nginx behind Cloudflare. Two A records and two AAAA records, all Cloudflare edge addresses, so the origin server is not exposed in DNS.
- MX records point at Google Workspace. The TXT records include an SPF entry but no DMARC policy.
- Five technologies detected, all at high confidence: WordPress, Nginx, Cloudflare, Google Tag Manager, jQuery.
What the Results Screen Looks Like
Findings like the ones above, on screen, before anything is exported. Both shots below are from a real scan of example.com, not from the Northwind sample — a nearly-empty page makes a poor client story but an honest screenshot.
What the Client PDF Contains
Everything above, laid out for someone who was not in the room. The report opens with your agency name and logo top right, the audited domain as the title, and a "Prepared for" line carrying the client name and logo when you set them. Every page footer reads "Prepared by {your agency name}". On the Starter plan those branding fields are ignored and the report carries Web Audit Suite branding instead; white-label is a Pro and Agency feature.
The eight tab sections are independently toggleable, so a performance-only report for a developer and a full technical audit for a marketing director come off the same scan. The AI Recommendations block has its own toggle and is on by default. Layout is fixed — A4, portrait — and the file downloads as website-analysis-{domain}-{date}.pdf.
On the Agency plan the same audit also exports as versioned JSON, and the REST API returns that identical structure — so the report a client reads and the data your dashboard consumes never disagree. White-label reports and JSON export documents the section list, the branding fields, and the export schema in full.
Run This on Your Own Site
A scan takes about a minute: 17 analyzers finish in the core phase while PageSpeed runs behind them, and the tabs fill in as results land. Starter and Pro include a 7-day free trial.
Start a free trial- How to run a website audit — signing up, the two scan phases, and their timings.
- Website audit scores explained — where every number on this page comes from.
- The 18 website audit checks we run — the exact formula behind each score above.