How to audit a website, pillar by pillar

The order of the work, and why

Each step builds on the one before. Change the order and you end up judging before measuring, or measuring pages picked at random.

1. Scope. The page inventory is drawn up before any measurement, because a page missing from the inventory will never be examined.
2. Two reads of every page. The raw server response, then the page as the browser shows it. The gap between the two is already a result.
3. Measurements, pillar by pillar. Whatever can be measured or observed is recorded, with the page concerned and the value observed.
4. Judgment, based on those measurements. How clear a text is or how usable a journey is gets judged, but from recorded facts, never from an impression.
5. The score, last. It summarizes the findings under scoring set in advance. It does not come before the facts and does not replace them.

Everything happens from outside, the way a visitor would see it: no access to the back office and nothing changed on the site. That is also why the same approach works on a competitor's site, within the limits covered in the guide to auditing a competitor's website.

Which pages: what the law requires comes first

A site often has more pages than an audit examines, so the selection order decides what gets seen. Ours follows the site's real structure: the sitemap and internal links give the inventory, then pages are grouped by type (home page, product pages, articles, contact pages).

Pages the law requires us to check come first: legal notice, privacy, terms of sale. Next come the pages your navigation puts forward, such as the home page and the purchase or contact journey. Then the pages most often linked from the rest of the site. On an online store, the checkout journey is therefore in scope, and the guide to ecommerce website audits covers what gets checked there.

The report lists the pages analyzed; pages not examined stay distinct from the audited scope. The number of pages is also what changes the price, as the guide to website audit cost explains.

What each pillar requires you to look at

Each of the nine pillars asks a different question and needs a different kind of look. Some can be read in what the server returns, some only in a browser, and some need a person to read the pages.

• Security & encryption: the certificate, the encryption versions the server still accepts, security headers, cookie protections, and what the site gives away about how it is built. Most of it can be read in the server response.
• Performance: how long the main content takes to appear, layout shifts, real page weight and the share taken by third-party services. None of this can be measured without a browser, and it is measured twice, under phone and desktop conditions.
• SEO & search visibility: titles, descriptions, canonical addresses, structured data, language versions, dead links. Comparing the server response with the displayed page shows what search engines may never see. An SEO audit often stops here; SEO audit vs website audit compares the two.
• Accessibility: contrast measured on the rendered page, image alternatives, the names of links and buttons, and keyboard use, tested with real key presses. Reading order and the experience of a screen reader user still need checking another way.
• Compliance & privacy: what lands in the browser before any click, the consent banner as it actually works, third-party recipients, the legal notice and the privacy policy. Only a browser shows what is sent before the visitor has answered.
• Domain & network: the domain's expiry date, the name servers, and the records that stop someone else from sending email in your name. All of it is read in public registries and DNS, outside the pages.
• Independence & resilience: the provider behind each layer of the site, the law it answers to, the layers that rely on the same one, and the personal data that leaves the EU during a visit. The report records the exposure without giving it a legal qualification.
• Content & trust: how clear the offer is, how fresh the content is, text that was never finished, facts that contradict each other from page to page. Part of this is judgment: each finding cites the page and the excerpt behind it, so you can dispute it.
• User experience & reliability: errors during loading, resources that fail to respond, the error page, layout at three widths and controls actually triggered. This pillar has no dedicated standard: it rests on measured facts and a human review.

What only a browser shows

These percentages cover about 30 websites we audited between August 14, 2026 and September 24, 2026. Each one counts only the sites where the point could be checked. Many were audited because a defect showed up quickly, so these figures describe our audits, not websites in general.

Neither fault shows on screen. The first is found by loading the page without clicking anything, then looking at what has already been stored and what has already gone to third parties. The second shows in what the page runs, not in what it displays. The guide to JavaScript errors explains what they can break.

Some faults only exist at one screen width: a button pushed off screen with no scrolling to reveal it, a menu that no longer opens. That is why layout is checked on phone, tablet and desktop.

What takes a person

A screenshot does not prove that a button works. A control that seems to do nothing may open a menu on hover, or it may really be broken: someone has to trigger it and watch what happens. The report separates what was actually triggered from what was only observed.

How credible a text is, how strong a promise is, or how clear a journey is cannot be measured. It has to be judged, by reading the pages together rather than one at a time: that is how a figure that changes from one page to the next shows up. An AI-assisted review helps cross-check observations, but it does not invent measurements or set scores.

Reading the result without overrating it

The score is a summary tool, not a universal measure of website quality. The 9 pillars carry different weights depending on what the site is for, so an overall score is always read with the weighting that produced it.

A fault is judged at its real scale, not on its own. An error on one page does not weigh the same as a barrier on nearly every page, which is why pages are scored one by one before being rolled up.

Every limit of the examination is stated in the report. A point that cannot be verified is never presented as compliant. A clean result on a point that could not be checked says nothing about that point.

A tool score and a reviewed report answer different questions; tool or audit explains when one is enough, and the guide to free website audits covers what they see well. To judge for yourself, a real online store report is published in full.

What this check doesn't tell you

By Quentin Mathis, Z29K · updated September 28, 2026