How the 22 point audit works
Every check, the rule it has to pass, and who wrote that rule. All of it published here before you see your own result.
How to read the scale
- A1, failed
- A2, failed
- A3, passed
- A4, passed
- A5, failed
- A6, failed
- A7, passed
One tile per check. A solid tile passed, an outline did not. The score is a fraction rather than a percentage, so you can see at a glance how much is left to do.
What gets checked
Five sections, 22 checks running tools, then the writing. Each check has a plain description first. The smaller line under it is the exact rule and the tool, which is there for whoever looks after your site, so skip it if it is not useful to you.
Found
7 points
Can anyone reach you, human or machine
A1 Whether Google knows your website exists at all
Any result returned for a site: search
Google Search. Checked with a site: search in Google.
A2 Whether searching your business name finds you first
Your site is result one, above directories and Facebook
Google Search. Checked with a search for the exact business name.
A3 Whether each page has its own headline in Google
Every page a different title, 50 to 60 characters, keywords first
Google result display width, about 600 pixels. Checked with a Screaming Frog crawl.
A4 Whether each page has its own summary in Google
Every page different, 150 to 160 characters, the point inside the first 120
Google result display width, about 920 pixels on desktop. Checked with a Screaming Frog crawl.
A5 Whether you appear in the local map results
Profile appears, primary category correct, opening hours set
Google Business Profile. Checked with a search for the business name plus the town.
A6 Whether search engines can read your business details
LocalBusiness or the correct subtype, carrying name, address, phone, hours and geo, with no errors
schema.org LocalBusiness. Checked with Google’s Rich Results Test.
A7 Whether AI assistants are allowed to read your site
GPTBot, ClaudeBot, PerplexityBot, Google-Extended and CCBot allowed in robots.txt and at the CDN
Each crawler’s published user agent. Checked with robots.txt, then the CDN bot controls separately.
Trusted
2 points
Does the site give a stranger a reason to believe it
B1 Whether your phone, address and name match everywhere
No placeholders, the phone is a tel: link, and name, address and phone match the Business Profile
Local ranking name, address and phone consistency. Checked with the Business Profile listing, and the phone tapped on a real phone.
B2 Whether the services listed are ones you actually offer
Every service, capability and brand claim on the site is one you offer today
Your own answer at intake, plus the licence behind any regulated work. Checked with the service list on the site, read against what you said you do.
Works
5 points
Does it function
C1 Whether an enquiry sent through the site reaches you
Mail arrives, and SPF, DKIM and DMARC all exist and align with the From domain
Gmail sender requirements. Checked with a real submission, then a DNS lookup on the domain.
C2 Whether the site works on an actual phone
Nav works, form usable, tap targets reachable, nothing scrolls sideways
Hand-checked, no external standard. Checked with a real phone rather than a resized browser window.
C3 How fast the page becomes usable on a phone
LCP under 2.5s, INP under 200ms, CLS under 0.1
Google Core Web Vitals. Checked with PageSpeed Insights, mobile first.
C4 Whether any image is far heavier than it needs
No image far above what its slot needs, and modern formats used
HTTP Archive Web Almanac page weight. Checked with the oversized image audit inside the PageSpeed run.
C5 Whether every link on the site goes somewhere
Zero 404s, and no nav links to pages that were never built
HTTP status codes. Checked with a Screaming Frog crawl.
Protected
5 points
What happens when it breaks
D1 Whether the connection to your site is encrypted
Valid, not expiring inside 30 days, and no mixed content
The browser’s own certificate check. Checked with the browser padlock and the certificate expiry date.
D2 Whether the site tells browsers how to protect visitors
HSTS, CSP, X-Content-Type-Options nosniff, Referrer-Policy and Permissions-Policy all present
OWASP secure headers baseline. Checked with securityheaders.com.
D3 Whether the software running your site is up to date
Core, theme and every plugin on a current version
Each vendor’s current release. Checked with Wappalyzer, or the page source.
D4 Whether a copy exists that you have actually restored
An offsite copy exists and has been restored from at least once
Nothing outside the site can show this. Checked with your answer to intake question four.
D5 Whether a named person answers when the site breaks
A named person, a stated response window, stated hours and a timezone
Nothing outside the site can show this. Checked with your answer to intake question five, plus any uptime monitoring.
Measured
3 points
Would you know if something went wrong
E1 Whether anything records how many people visit
A tag is present and firing
Hand-checked, no external standard. Checked with Wappalyzer, or the page source.
E2 Whether you would see it if Google removed you
Property verified, and someone reads it
Nothing outside the site can show this. Checked with your answer at intake.
E3 Whether the text is readable against its background
4.5:1 for normal text, 3:1 for large text, where large means 24px or 18.66px bold
W3C WCAG SC 1.4.3, Level AA. Checked with the Chrome DevTools colour picker.
What the number means
Four bands. Each one describes what a site at that level is and is not doing.
- Unfinished0 to 7
- The site is live and at least one thing it was hired to do is not happening. Nothing on the site would tell you which.
- Working8 to 13
- The things a visitor touches do work. The work that keeps them working has not been done yet.
- Looked after14 to 18
- The site does its job and most of the work behind it has been done. Nobody is watching it continuously.
- Maintained19 to 22
- Someone is responsible for this site and answers within a stated time. What is left is judgement calls.
What it is not
The audit only covers what can be checked from outside your site, against a rule someone else published. Anything it cannot check, your report names.
Not an accessibility conformance review
One check covers colour contrast, which is one rule out of roughly fifty in the WCAG 2.1 AA standard. Passing it does not mean your site is accessible, and telling you otherwise would be misleading. That matters if the European Accessibility Act applies to your business.
Not a penetration test
Security here means the headers your site sends and whether its software is current. Nothing is probed and nothing is attacked.
Not a rankings forecast
Nobody can promise a position. The audit checks whether the things Google documents as signals are present, and stops there.
Speed is measured in a lab unless it says otherwise
Real-user speed data needs enough traffic to enter Google's dataset. Most sites do not have it, so the number is a simulation on a throttled connection. Your report names which one it read.
The tools
- a site: search in Google
- a search for the exact business name
- a Screaming Frog crawl
- a search for the business name plus the town
- Google’s Rich Results Test
- robots.txt, then the CDN bot controls separately
- the Business Profile listing, and the phone tapped on a real phone
- the service list on the site, read against what you said you do
- a real submission, then a DNS lookup on the domain
- a real phone rather than a resized browser window
- PageSpeed Insights, mobile first
- the oversized image audit inside the PageSpeed run
- the browser padlock and the certificate expiry date
- securityheaders.com
- Wappalyzer, or the page source
- the Chrome DevTools colour picker
Thresholds last checked against their sources on 27 July 2026.
The audit is free. You get the score, the findings ranked by what they cost you, and the things you can fix yourself this week without paying anyone.