The Digital Doctor
What does a website audit actually include?
Mine come in four sizes. The free check runs 10 automated checks on your homepage and costs nothing. The Security Check-Up runs 15 on what an attacker can already see, for R1,950. The Vitals runs 29 automated plus five by hand, for R2,800. The Full Body Scan runs 51 across your whole site plus social, advertising and reviews by hand, for R7,600. Every single check in all four is named below.
How do the four packages compare?
| Package | Automated checks | By hand | Turnaround | Price |
|---|---|---|---|---|
| The free check | 10 | — | Instant | R0 |
| The Security Check-Up | 17 | 5 | 48 hours | R1,950 |
| The Vitals | 29 | 5 | 48 hours | R2,800 |
| The Full Body Scan | 51 | 6 | 5 working days | R7,600 |
The free check — R0
Who it is for. Anyone who wants to know whether there is a problem before spending anything.
No sign up. The score and every finding are shown in full whether or not you give me an email address.
The 10 automated checks
- How fast your site loads on a phone
- How easily someone can contact you
- The name Google shows for your site
- The description under your name in Google
- Descriptions on your images
- The padlock in the address bar
- Business details a machine can read
- Whether AI assistants can recommend you
- Whether someone can send email pretending to be you
- How your link looks when someone shares it
The Security Check-Up — R1,950
Who it is for. A business that has been attacked, or wants to know what an attacker can see before one is.
This finds what an attacker can see for free. It is not a penetration test and cannot prove a site is secure. Nothing is probed, injected or logged into.
The 17 automated checks
- The padlock in the address bar
- Protective settings on your server
- Whether browsers are told to always use the secure version
- Insecure files on a secure page
- When your security certificate expires
- When your domain name expires
- How well your domain itself is protected
- Whether someone can send email pretending to be you
- Whether your domain can receive email
- Whether your website software is current
- Whether your website software is a known target
- The add-ons your site runs, and what they give away
- Information your site hands out to anyone who asks
- Whether your login page is open to the whole internet
- Old copies of your site still reachable
- An independent security grade for your site
- Whether browsers are warning people away from your site
Done by hand
- Search for your domain in known data breaches and list which staff addresses appear
- Open each forgotten subdomain the scan finds and confirm what is running on it
- Check your platform and plugin versions against published advisories for that exact release
- Ask who holds the backups, how often they run, and when one was last restored
- Confirm two factor authentication is on for every administrator account
The Vitals — R2,800
Who it is for. Most small businesses. This is the one I sell most often.
Every finding carries a fixed price to fix it and an honest note on whether you can do it yourself.
The 29 automated checks
- How fast your site loads on a phone
- How easily someone can contact you
- The name Google shows for your site
- The description under your name in Google
- Descriptions on your images
- The padlock in the address bar
- Business details a machine can read
- Whether AI assistants can recommend you
- Whether someone can send email pretending to be you
- How your link looks when someone shares it
- Whether your site is built for phones
- Your main page heading
- Whether you can see who visits you
- What your visitors actually experience
- Whether browsers are warning people away from your site
- Protective settings on your server
- Whether your website software is current
- Links to your social pages
- Whether someone can send email pretending to be you
- Whether your domain can receive email
- How your link looks when someone shares it
- Whether Google knows which address is the real one
- The small icon on your browser tab
- Insecure files on a secure page
- Your privacy and cookie obligations
- The pages people look for before buying
- Whether the site works with a screen reader
- When your security certificate expires
- What your homepage actually weighs
Done by hand
- Submit a real test enquiry through your contact form and confirm it arrives
- Check your Google Business Profile: claimed, categories, hours, photos and how recent they are
- Count your reviews, rating and reply rate, then do the same for your three closest competitors
- Ask ChatGPT, Gemini and Perplexity for a business like yours, several ways, and screenshot the answers
- Check where you appear in the local map results for two search terms your customers would type
The Full Body Scan — R7,600
Who it is for. More than about ten pages, selling online, or wanting social, advertising and reviews included.
The only package that looks past your homepage. It follows your internal links and checks the pages nobody has opened in two years.
The 51 automated checks
- How fast your site loads on a phone
- How easily someone can contact you
- The name Google shows for your site
- The description under your name in Google
- Descriptions on your images
- The padlock in the address bar
- Business details a machine can read
- Whether AI assistants can recommend you
- Whether someone can send email pretending to be you
- How your link looks when someone shares it
- Whether your site is built for phones
- Your main page heading
- Whether you can see who visits you
- What your visitors actually experience
- Whether browsers are warning people away from your site
- Protective settings on your server
- Whether your website software is current
- Links to your social pages
- Whether someone can send email pretending to be you
- Whether your domain can receive email
- How your link looks when someone shares it
- Whether Google knows which address is the real one
- The small icon on your browser tab
- Insecure files on a secure page
- Your privacy and cookie obligations
- The pages people look for before buying
- Whether the site works with a screen reader
- When your security certificate expires
- What your homepage actually weighs
- Whether the page jumps around while loading
- The size of your homepage code
- Whether your images use a modern format
- How efficiently your server sends the page
- When your domain name expires
- Files that hold up the first thing a visitor sees
- Code your visitors download but never use
- Pictures bigger than the space they fill
- lighthouse_a11y
- Whether the site is built to current standards
- Whether Google can read your homepage properly
- An independent security grade for your site
- How long your site has been on the record
- Whether your website software is a known target
- The add-ons your site runs, and what they give away
- Information your site hands out to anyone who asks
- Whether your login page is open to the whole internet
- Old copies of your site still reachable
- The instructions you give search engines
- What happens when a link is wrong
- Whether your site answers to two addresses
- How quickly your server starts answering
- Whether browsers are told to always use the secure version
- How well your domain itself is protected
- The rest of your website
- Links that go nowhere
- Whether your pages have their own names in Google
- Descriptions on your other pages
- Main headings across the site
- The map you give search engines
- Image descriptions across the whole site
- Machine-readable details beyond the homepage
- Pages with almost nothing on them
Done by hand
- Everything in The Vitals
- Last post date and profile completeness on every active social platform
- What you and your three closest competitors are running in the Meta Ad Library
- Google Ads presence, and whether the landing page matches what the ad promised
- Email list health and follow up, if you give access
- Reviews and reputation across Google and Facebook, side by side with competitors
What is the difference between the free check and the paid ones?
The free check tells you what is wrong. That is genuinely useful and it is genuinely free, with no sign up and nothing hidden behind an email address.
What it cannot tell you is what to do about it. The paid audits put a fixed price against every finding, say honestly which ones you could do yourself, and put them in the order I would tackle them if it were my business. They also include work no scanner can do. A tool cannot submit a test enquiry through your form and confirm it arrived, and it cannot screenshot what ChatGPT said when somebody asked it to recommend a business like yours.
What do none of them include?
Any of the fixes. An audit tells you what is wrong and what each repair costs, and then it is yours to do with as you like. Do them yourself, hand the list to your own developer, or ask me. Nothing obliges you to buy anything, and nothing in the report expires.
If the paid audit does not find at least five specific, fixable issues worth acting on, I refund the fee in full.
Start with the free one
10 checks on your homepage, instantly. You will see the score and every finding without giving me anything.
Run the free check