What a website health check covers

A health check begins by naming what the website must let people do: understand an offer, find an address, submit an enquiry, make a purchase or access support. Record the pages and integrations involved in each journey. This prevents an audit from becoming a list of technical trivia. Also note recent changes, known complaints and high-risk dates such as a domain renewal. The check should cover the live public site, not merely the administration screen or an automated score.

Read representative pages on phone and desktop, follow navigation and complete the important tasks. Test forms end to end, including validation, confirmation and mailbox delivery. Look for broken links, missing images, outdated facts, confusing actions and unexpected downloads. Check keyboard operation, focus visibility, page headings, labels, text enlargement and contrast against W3C guidance. Every finding should include the affected address, device or browser, steps to reproduce and a screenshot where that makes the fault clearer.

Review HTTPS, redirects, error pages, indexing controls, sitemaps and obvious performance bottlenecks. Identify the content management system, theme, extensions and versions without assuming every available update is safe to install immediately. Inspect backups: where they are stored, how often they run and whether restoration has ever been tested. Check third-party services such as forms, payments, maps and analytics, because a page may load correctly while its essential integration has quietly expired.

Map the domain registrar, DNS, hosting, website administrators, business email, analytics and any consent platform to named business-controlled accounts. Note missing multi-factor authentication, shared administrator accounts and obsolete suppliers. Compare forms, cookies and trackers with the published privacy information and choices; use the ICO’s current guidance for UK data protection questions. The health check should not declare legal compliance from a visual scan, but it can identify mismatches that need a competent owner or adviser.

Classify findings by business effect and urgency. A failed enquiry form is normally more urgent than inconsistent spacing. Separate confirmed faults from improvement ideas and unknowns requiring access. Give each item an owner, next action and verification method. The completed sheet should also say what was not tested, such as payment refunds or a restore procedure. A good health check is reproducible: another person can follow the evidence, fix the fault and rerun the same test to close it.