The Free Website Audit Every NZ Business Should Run
A 47-point website audit checklist used on every Webgun build — speed, SEO, GEO, conversion, and security. Audit your own site in under an hour.
TL;DR
A solid website audit takes about an hour and surfaces the issues actually costing you traffic, leads, and revenue. The 47 points below are the same checks Webgun runs against every site we ship — covering speed, SEO, GEO, conversion design, and security. Run them on your own site as a baseline, or skip ahead and get a Webgun audit done for free.
- →47 specific checks, organised into five categories: Speed, SEO, GEO, Conversion, Security.
- →No paid tools needed — Google PageSpeed Insights, Search Console, and a browser are enough for most checks.
- →The five highest-impact wins for typical NZ business sites are: image compression, schema.org markup, FAQ content, local-suburb specificity, and sub-2-second mobile load time.
- →A clean audit takes about 60 minutes per site. Most issues, once found, can be fixed in a day.
- →Webgun runs the same audit free of charge before any engagement. The output is a written report you can act on yourself.
Speed (8 checks)
1. Largest Contentful Paint under 2.5 seconds on mobile (test in Google PageSpeed Insights). 2. INP (Interaction to Next Paint) under 200ms. 3. CLS (Cumulative Layout Shift) under 0.1. 4. No images larger than 200KB unless absolutely necessary. 5. WebP or AVIF format used for hero images. 6. Render-blocking JavaScript deferred or async. 7. Critical CSS inlined for above-the-fold content. 8. Hosting served from a CDN (Cloudflare, Fastly, etc.) — not a single regional datacentre.
SEO foundations (12 checks)
9. One H1 per page, containing the primary keyword. 10. Title tag under 60 characters with primary keyword first. 11. Meta description 140-155 characters, benefit-led. 12. Canonical tag set on every page (self-referencing, no .html). 13. Sitemap.xml present and submitted to Google Search Console. 14. Robots.txt present, allowing search engines, blocking AI scrapers selectively. 15. All images have descriptive alt attributes. 16. Internal linking — every page links to at least one other page. 17. Logical heading hierarchy (H1 → H2 → H3, no skipping). 18. URLs are clean and readable (no .html, no query strings). 19. HTTPS with valid SSL certificate. 20. No duplicate content across pages.
GEO readiness (10 checks)
21. Schema.org structured data present (use the most specific @type for the business — Plumber, AutoBodyShop, Dentist, etc.). 22. FAQPage schema on pages with FAQ sections. 23. AggregateRating schema if Google reviews exist. 24. sameAs property in schema linking to Google Business Profile and social profiles. 25. First paragraph answers the page's main query in 2-3 sentences (no preamble). 26. Each H2 section is self-contained and citable in isolation. 27. At least one specific fact, number, or named reference per H2. 28. Suburb-level location specificity ("Ponsonby, Grey Lynn, Mt Eden") — not "Auckland area". 29. Llms.txt file at the site root with curated business summary. 30. AI crawlers (GPTBot, ClaudeBot, PerplexityBot) explicitly allowed in robots.txt for indexing.
Conversion design (10 checks)
31. Phone number visible in the header on every page. 32. Primary CTA above the fold on every landing page. 33. Lead form with no more than four required fields. 34. Trust signals visible (Google reviews, certifications, real client logos) within the first scroll. 35. FAQ section above the footer addressing the top customer objections. 36. Pricing transparent or pricing-conversation framework explained. 37. Mobile tap targets at least 44×44px. 38. Service area clearly stated with named suburbs. 39. Contact form submission handled gracefully (success state, no plain alert dialogs). 40. No popups that block content within 5 seconds of page load.
Security and trust (7 checks)
41. HTTPS enforced (HTTP redirects to HTTPS). 42. HSTS header set with a long max-age. 43. X-Frame-Options or CSP frame-ancestors blocking clickjacking. 44. Content-Security-Policy in place (even a minimal one). 45. No mixed content (HTTPS pages loading HTTP resources). 46. Privacy policy and terms accessible in the footer. 47. Cookie banner if any third-party scripts set tracking cookies (NZ Privacy Act 2020 compliance).
How to interpret the results
A typical NZ small business site scores between 25 and 35 out of 47 on the first run. Most failures cluster in three areas: speed (oversized images and slow hosting), GEO readiness (missing schema and unstructured content), and security (no CSP, no HSTS). The fastest wins come from tackling those three areas first. A site scoring 40+ is unusual and signals real care has gone into the build.
FAQ
Frequently asked.
How often should I run a full audit?
Once a quarter for live business sites is a sensible cadence. Speed regresses naturally as content is added and plugins update. SEO and GEO requirements evolve. Quarterly is enough to catch slippage before it costs you visibility.
Do I need paid tools to run this audit?
No. The 47 checks above can be run with Google PageSpeed Insights, Google Search Console, and a browser with developer tools — all free. Paid tools (Ahrefs, SEMrush, Screaming Frog) help at scale but aren't required for a single-site audit.
How long does the audit take?
About an hour for someone familiar with web fundamentals. Two to three hours for a first-timer. The longest part is interpreting the speed results and cross-referencing the schema markup against the visible content.
What's in the Webgun audit that this checklist doesn't cover?
The Webgun audit adds: a competitive comparison against your top three local competitors, a written report of the highest-impact fixes ranked by effort and impact, and a 30-minute call to walk you through the findings. The 47-point self-audit gives you the same data; the Webgun audit gives you the priorities and the conversation.
Is the Webgun audit really free?
Yes, no card required, no obligation to sign up. We run audits as the start of every conversation with a potential client because honest audit data is the only fair basis for a quote.
More from the blog
Browse the Audits hubNZ Local Pack in 2026: 4 New Ranking Signals
Google's local-pack algorithm shifted in 2026. The 4 ranking signals that gained measurable weight — and what NZ businesses should action.
Why Your NZ Site's Bounce Rate Lies
GA4's bounce rate is misleading for most NZ businesses — what it actually measures, what real engagement looks like, and why you should stop worrying about it.
NZ Business Schema.org Cheat Sheet for 2026
Practical schema.org reference for NZ businesses — which schema types matter for which business type, what to include, what to skip.
Apply this to your site.
Free audit, no commitment. We'll show you which of these wins are sitting on the table for your business right now.
Get a Free Audit