Website audit online: a step-by-step plan from scan to re-check

A website audit online is a process, not a score: set the scope, capture a baseline, triage findings, turn them into tickets and prove the fixes with a rescan.

Infrastructure · Published: 14 October 2026 · 6 min read · Дмитрий Орлов

A website audit online often gets confused with a check: run the scanner, get a score, call it an audit. In practice a check is a measurement and an audit is a process. It has a goal, a scope, tasks with owners, and a second measurement that proves the tasks are done. Without those last steps the report stays a nice PDF in somebody's inbox. Below is a plan that turns an online scan into an audit with an outcome.

Audit versus one-off check

A website check online answers "what is wrong right now?". An audit answers three questions: what is wrong, which of it we fix and in what order, and how we will know it is fixed. So the outputs differ: a check produces a report; an audit produces closed tasks and a second report in which they no longer appear. That is why an audit is always at least two scans — before and after.

Step 1. Set the goal and the scope

Before running anything, answer three questions in writing:

1. Why. A release, accepting a site from a contractor, a traffic drop, a security requirement, a move to a new domain.
2. What is in. Which domains and subdomains, which language versions, which templates are critical — product page, checkout, article.
3. Who decides. Who signs off and who fixes: developer, sysadmin, content editor, agency.

The goal decides which categories you read first. Before a migration that is redirects, robots.txt and canonicals; when mail lands in spam, SPF and DMARC; when conversion drops, forms, console errors and speed.

Step 2. Capture the baseline

Run a scan and keep the report link — that is your starting point. Note the overall score, the category scores, the number of critical and high findings, and the date. If the site has several languages or key sections, scan them separately: the free check reads up to ten pages, and they should be the pages you care about.

Do not skip what only shows at domain level: certificate and domain registration expiry, the http-to-https redirect, security headers, mail records. Manual audits miss these most often, because a browser never shows them.

Step 3. Triage the findings

This is where the report becomes a decision. Reading scores, severities and reach is covered in website analysis online. In short:

• critical and high go into work without debate;
• medium go in if they affect a template or the whole site;
• low are the owner's call — some are deliberate choices;
• disputed ones are checked against the measured values and recorded as an exception with a reason.

The output is a list in which every line has a decision: fix, won't fix because…, or verify by hand.

Step 4. Turn findings into tickets

A good audit ticket has four fields: what is wrong, where (addresses or "whole site"), how to fix it, and how to accept it. In SiteScan you do not write that by hand: Copy fix brief assembles the critical, high and medium findings into a Markdown list sorted by severity and reach, with page addresses and an acceptance criterion. Paste it into a tracker, an email or a chat — or hand it to a developer's AI assistant as the task description.

Group tickets by owner, not by page: one edit to a CMS template or an nginx config closes a finding across the site. For the technical layer — TLS, headers, caching, DNS — use the checklist in technical website audit.

Step 5. Re-check and record the result

An audit ticket is closed when a fresh scan no longer reports it — not before. After the deploy, press Rescan (a saved report is reused for fifteen minutes; the button forces a new crawl). "What changed since the last scan" sorts findings into three groups:

• New — appeared after your changes; these are regressions to look at right away;
• Fixed — there last time, gone now;
• Still there — found both times.

The acceptance rule: everything planned is under Fixed, and no new critical or high finding has appeared in exchange.

Step 6. Make it recurring

A site changes with every release, certificates and domains expire on schedule, plugins update themselves. Watch this site in the report header adds the domain to your account's scheduled checks — from hourly to monthly — and notifications by email, Telegram or SMS can tell you about critical and high findings, a score drop, or a check that could not run. More in automated website check.

Starting an audit with SiteScan

1. Write down the goal and scope — five lines in any document.
2. Run the baseline scan from the home page and keep the report link.
3. Triage, copy the fix brief and split the tasks by owner.
4. After the fixes, rescan and compare before and after.
5. For larger sites and deeper audit types, see pricing — credits do not expire.

If the audit has to cover everything at once — SEO, speed, security, accessibility, mail and legal pages — see comprehensive website audit.