What a real website audit actually looks at (and what it skips).

A real website audit looks at five distinct layers. Skip any one of them and the audit is incomplete. Add a sixth and the audit is bloat.

• Technical. Crawlability, indexability, site speed, Core Web Vitals, structured data, mobile rendering, redirects, canonical tags, robots.txt, XML sitemap. This is the plumbing layer.
• Content. Page-level quality, thin content, duplicate content, keyword targeting, content gaps versus competitors, internal linking. This is what the site says.
• Links. Backlink profile health, toxic link patterns, anchor text distribution, lost links worth recovering, link-building opportunities. This is the off-site authority layer.
• User experience. Navigation logic, mobile usability, accessibility, page flow, friction in primary user paths. This is what the site feels like to use.
• Conversion. Calls to action, form design, trust signals, page-level conversion data, funnel leakage. This is whether the traffic that arrives turns into business.

An audit that covers only the first category is a technical SEO audit, not a website audit. The distinction matters because most "website audits" sold in the wild are really technical audits with the other four categories missing. Google's SEO Starter Guide remains the cleanest free reference for what the technical and content layers should actually cover.

The free audit you received from a cold email was almost certainly generated by Sitebulb, Screaming Frog, SEMrush Site Audit, or Ahrefs Site Audit. The tool crawled your site, flagged everything it considers a "problem" according to a generic rubric, and stuffed the output into a templated PDF. The agency that sent it spent roughly four minutes of human time on the entire process.

The reason these audits flag so much: the tools are designed for risk-averse output. They report every missing alt tag, every long title, every thin page, every minor warning. A serious auditor knows that 80% of the warnings do not matter and that the 20% that do are buried under noise. The PDF is a sales document because surfacing real issues was never the point.

A useful auditor sorts findings into three buckets and reports honestly on all three.

• Will materially move rankings or conversion. Usually 10 to 30 items on a mid-sized site. Each one has a clear cause, a clear fix, and an expected outcome.
• Worth fixing during normal maintenance. Another 20 to 50 items. They are not blocking results, but they are technical debt worth paying down over time.
• Cosmetic. Hundreds of warnings the automated tools flag. Most can be safely ignored. A few are worth knowing about for context.

The Nielsen Norman Group has spent decades studying how users actually behave on websites. Their ten usability heuristics are still the cleanest framework for the UX layer of a real audit. If your auditor cannot explain why a finding ties back to user behavior or search ranking signals, the finding is likely noise.

A useful audit is shorter than you expect. Twenty to fifty findings, each documented with a specific URL, a screenshot or code snippet showing the problem, a clear fix, and an honest estimate of impact. Ranked by what would move the needle most if you fixed it tomorrow.

It includes a prioritization roadmap. Which fixes go first, which can wait, and which are best handled by your engineering team versus your content team versus an external agency. The deliverable should be usable as a project plan, not just a report.

It cites primary data. Google Search Console for indexing and query data, PageSpeed Insights for performance, Screaming Frog for crawl data, your analytics for conversion data. An auditor who relies on a single off-the-shelf tool is showing you a slice of the picture.

Five questions surface most of what you need to know.

• "Can I see a redacted sample of a past audit deliverable?" Real auditors have samples. The samples should look like project plans, not like screenshots of dashboards.
• "What tools do you use, and how do you decide what to report on?" The right answer mentions several tools and explicitly says that the human ranks and filters the output.
• "How many hours of human work go into a typical audit at this price point?" Compare the answer to the price. An audit billed at $3,000 should reflect 15 to 40 hours of qualified work.
• "Do you implement the fixes or just report them?" Both models are valid. Make sure you know which one you are buying before you sign.
• "What will I be able to do differently after receiving this audit?" If the answer is "you will know what is wrong with your site," that is the wrong answer. The right answer connects the audit to a specific set of decisions.

A few specific moments are the right time to pay for a real audit. Before a major site redesign or migration, so you do not lose accumulated SEO equity. After a major redesign or migration, so you catch the things that broke. After a Google core update if traffic moved noticeably. When organic traffic has been flat for six months despite content investment. When you are about to spend significantly on content or paid traffic and want to confirm the destination is set up to convert.

The wrong time: on a brand-new site under six months old, before you have enough data for the audit to find anything meaningful. Or annually as a check-the-box exercise. Audits are diagnostic tools. Use them when you have a specific question, not as a recurring expense.

The best audit in the world does nothing if you do not implement the findings. We have seen excellent audits sit in shared drives for years while the underlying problems compound. Before you commission one, decide who on your team is responsible for the implementation, when the work will happen, and what budget supports it. An unimplemented audit is more expensive than no audit at all, because it makes you feel like you addressed the problem.