How long does an audit take?

A real audit on one site is a few hours of crawling, running structured-data validators, checking Lighthouse, and writing it up. The output should be a document you can read in fifteen minutes.

Do I need to give site access?

No. Most checks run against the public site. Access only matters when the auditor is going to actually apply the fixes, which is a different engagement.

Audits should be free or nearly free. If a vendor is charging for the audit but won't tell you what they're going to check before they start, walk away.

What do I do with the findings?

Hand it to whoever maintains your site, or to me if you'd rather I quote the fixes. Almost every finding on a small-business site is fixable without rebuilding.

What a small business website audit actually is

A small business website audit is a written report that names what’s broken or weak on one specific site. A useful one cites file paths and numbers. A useless one is a checklist that could apply to any business on the internet. When I audit a small-business site I look at five things: mobile page speed, structured data (the markup that tells Google and AI engines what kind of business this is), broken internal links, conversion tracking, and whether AI engines like ChatGPT, Gemini, or Claude name the business when a customer asks for one nearby. If a report doesn’t cover those five and doesn’t tie each finding to a specific URL on your site, it isn’t an audit. It’s a sales pitch dressed as diagnosis.

What an audit actually measures

Mobile Lighthouse (Google’s free site-quality test) below 90 is a warning sign. The ranking input is Core Web Vitals measured on real users in Google’s field data, not the lab score, but a sub-90 Lighthouse usually means the field metrics are failing too. Google has used Core Web Vitals as a ranking input since 2021 and replaced the original responsiveness metric with the stricter INP in March 2024.

Missing or generic structured data means the site is invisible to AI engines. A WordPress site with only the default WebPage and BreadcrumbList markup tells ChatGPT nothing about what kind of business this is. For most small sites, the three to add are LocalBusiness, Organization, and FAQPage.

Internal 404s leak crawl budget and trust.

Conversion tracking that only measures pageviews tells you nothing about what drives the business. For most small businesses, the events to track are calls and form submissions.

AI-engine visibility is the newest of the five. The question is whether ChatGPT names the business by name when asked for “a [thing you do] near [your town].” If it doesn’t, the business is invisible where customers increasingly start looking.

In May 2026 I scanned every member of the Hendersonville Chamber of Commerce. 582 businesses. Of the 427 reachable websites, the single most common gap was structured data: missing entirely or generic page-level only. Most local sites are invisible to AI engines for that reason alone.

I ran this on my own site

While writing this post I ran the same Lighthouse on bufferedllc.com. Mobile Performance came back at 88, in the orange band.

Lighthouse mobile scores for bufferedllc.com: Performance 88 (orange, sub-90), Accessibility 100 (green), Best Practices 100 (green), SEO 100 (green). The legend at the bottom shows 0-49 red, 50-89 orange, 90-100 green. — Mobile Lighthouse on my own site at the start of this post. Three of the four categories are clean. The one that isn’t is the one Google weights for ranking.

Lighthouse Core Web Vitals breakdown: First Contentful Paint 1.5s green, Largest Contentful Paint 3.9s orange, Total Blocking Time 10ms green, Cumulative Layout Shift 0 green, Speed Index 1.5s green. — What’s driving the 88: Largest Contentful Paint at 3.9 seconds, the one orange light in the row. A useful audit names the metric and the cause. “Your site is slow” doesn’t tell you to look at LCP.

The dependency-tree view said the analytics script was loading on the LCP (Largest Contentful Paint, how fast the main thing on the page shows up) critical path, blocking the largest paint by about a second. Deferring it past first paint took a couple dozen lines of code. Same site, an hour later:

Lighthouse mobile scores for bufferedllc.com after the fix: Performance 93 (green), Accessibility 100 (green), Best Practices 100 (green), SEO 100 (green). — Same site, same Lighthouse run, after the fix. Performance 93. Desktop hit 100. The lift came from one file.

Lighthouse Core Web Vitals breakdown after the fix: First Contentful Paint 0.4s green, Largest Contentful Paint 0.8s green, Total Blocking Time 0ms green, Cumulative Layout Shift 0 green, Speed Index 0.4s green. — And what fell out the bottom: LCP from 3.9 seconds to 0.8. Five greens.

The score isn’t the point. The point is the audit named what to change, and the change was small enough to ship before the post did.

What the report should look like

Every finding cites a specific URL or filename on the site, not a generic page type. Every finding has a measurable number attached, not a verbal grade. A marketing PDF does neither.

“Your site is slow” is not a finding. “Your home page LCP is 4.2 seconds on mobile because the hero image is 1.8MB and unoptimized” is a finding. The first version sounds like an audit. The second version is one.

A finding from a Buffered audit titled 'Google knows your prices. Your visitors don't.' The body references the page's PriceSpecification and OfferCatalog schema blocks, explains that AI engines quote prices the visitor never sees on the page, and ends with the change: either publish the price on the page or remove the schema block so the two surfaces tell the same story. — One finding from an audit I wrote about my own firm’s site. The schema block is named. The discrepancy is named. The change is named.

If the report ends with “let’s get on a call to discuss your strategy” and doesn’t include the specific changes in priority order, the document was the lead magnet. The audit was the bait.

What an audit isn’t

A site audit is not a rebuild quote. It also isn’t an SEO retainer pitch. The output is a written document you can hand to whoever maintains your site, and they can act on it without you in the room.

If a “free audit” comes back as a screencast with no written document attached, that’s a sales call. The screencast format exists because it’s harder to compare to another vendor’s report side by side.

If you’d like a written audit on your own site, I do them free. Send your URL and I’ll look.