Sample audit
This is what $150 gets you.
Not a made-up example. It's the audit of my own site, done before relaunching it. I found twelve problems, one of them critical, on a site I built myself. That's the point: nobody had tested it again.
Scope
What I checked, and how.
- 1critical
- 1high
- 4medium
- 6low
Findings
In order of severity.
Each item says what I found, why it matters, how to fix it and what it would cost if the site were yours. The status is today's, after fixing what was mine to fix.
-
D-01CriticalSecurity · privacyFixed
Internal files could be downloaded from the domain.
- What I found
- Nine files that were never linked anywhere responded normally to anyone who typed their address: infrastructure migration notes, strategy and market-research drafts, email signatures, an operations script and the editor's configuration.
- Why it matters
- A file with no link isn't private. On this kind of hosting, everything in the published folder is public. A strategy draft in the wrong hands is free information.
- Fix
- Remove those files from what gets published and add a rule that keeps them out. Longer term, publish from a subfolder so the repository and the site stop being the same thing.
- Cost
- $40
-
D-02HighPerformance · brandFixed
Returning visitors kept seeing the old design.
- What I found
- In a browser that had visited before, the homepage loaded the old stylesheet (Hanken Grotesk typeface) even though the server was already sending the new one (Archivo). Styles and scripts were served with
Cache-Control: max-age=31536000, immutable, meaning "don't ask again for a year", and the file names never changed between versions. - Why it matters
- Returning visitors, usually the most interested ones, can see a mix of old design and new content for months after every change.
- Fix
- Version the style and script links on every release so the browser fetches the new file.
- Cost
- $25
-
D-03MediumPerformance · mobileFixed
A single image was 77% of the homepage's weight.
- What I found
- The main image weighed 322 KB out of the 416 KB the homepage downloads on a first visit. Phones downloaded exactly the same image as desktops.
- Why it matters
- It's the first thing that has to appear. On mobile data, every extra KB shows up in how long the page takes to look complete.
- Fix
- Two versions by size, and the browser picks the one it needs: 41 KB on phones and 125 KB on desktops, with no visible difference.
- Cost
- $25
-
D-04MediumLegalFixed
The privacy policy named a provider the site no longer uses.
- What I found
- The text said the form was processed by Web3Forms. Today the form runs through a Cloudflare function and the email goes out through Resend.
- Why it matters
- The policy has to tell the truth about who handles your customers' data. Outdated text is a legal and trust risk.
- Fix
- Update the form section and the list of fields collected.
- Cost
- $20
-
D-05MediumLegal · analyticsOpen
Google Analytics loads before any consent.
- What I found
- Analytics starts with the page. The cookie notice only informs; it offers no way to decline.
- Why it matters
- For visitors from the European Union, that doesn't meet the GDPR. For Peru and the US the risk is lower, but it depends on who you sell to.
- Fix
- Consent mode: analytics waits until the visitor accepts, or a decline option is offered. You lose some measurement in exchange for compliance.
- Cost
- $50
-
D-06MediumSecurityPartly fixed
Two of six security headers were missing.
- What I found
- Set up correctly:
X-Content-Type-Options,X-Frame-Options,Referrer-PolicyandPermissions-Policy. Missing:Strict-Transport-Security(forces HTTPS) andContent-Security-Policy(limits where the page can load code from). - Why it matters
- They're layers that limit the damage if something fails elsewhere. Not an open hole, but their absence is the first thing any scanner flags.
- Fix
- The first one is already in. The second needs testing against analytics, fonts and the WhatsApp buttons before it goes live, so nothing breaks.
- Cost
- $40
-
D-07LowAccessibility · mobileFixed
Links too small for a finger.
- What I found
- On mobile, 19 links and buttons were under 32 px tall, and the footer links were 21 px: below the 24 px the WCAG 2.2 accessibility standard asks for.
- Fix
- More tap area on the footer links and arrow links, without changing how they look.
- Cost
- $20
-
D-08LowAccessibility · SEOFixed
The main image's description didn't match the image.
- What I found
- The alt text described a person. The image is a desk with a keyboard and a notebook.
- Why it matters
- It's what a screen-reader user hears and what image search reads.
- Cost
- Included
-
D-09LowSEOFixed
One page asked not to be indexed and was in the sitemap anyway.
- What I found
- The privacy policy is marked
noindex, but the sitemap offered it to Google as a page to index. - Fix
- Take it out of the sitemap. Mixed signals make Google ignore one of them.
- Cost
- Included
-
D-10LowSEO · search enginesFixed
Change notices to Bing pointed at a file that doesn't exist.
- What I found
- The IndexNow notice, which tells Bing and other search engines about new pages, pointed to a key at an address that returns 404, so the notices can't be validated.
- Fix
- Point to the right key and add the new pages to the list.
- Cost
- $10
-
D-11LowLegibilityOpen
10 and 11 px labels.
- What I found
- 19 pieces of text on the homepage are 10 or 11 px: uppercase labels and header stats. Fine on desktop, borderline on a phone.
- Fix
- Raise them to at least 12 px. It's a design call, so I'm leaving it for the next visual review.
- Cost
- $10
-
D-12LowContactOpen
Without JavaScript, the email link leads to an error page.
- What I found
- Cloudflare rewrites email links to hide them from bots. If the browser doesn't run JavaScript, the link ends up on a 404 page.
- Fix
- Turn that feature off in Cloudflare, or show the address as plain text. It's a setting, not code.
- Cost
- $10
Costs
If the site were yours.
You can fix everything, only what's urgent, or nothing: the report is yours either way. If you hire me for the fixes, the $150 audit comes off.
| Item | Fix | Cost |
|---|---|---|
| D-01 | Remove internal files from what's published | $40 |
| D-02 | Version styles and scripts | $25 |
| D-03 | Main image by size | $25 |
| D-04 | Update the privacy policy | $20 |
| D-05 | Analytics consent | $50 |
| D-06 | Security headers | $40 |
| D-07 | Mobile tap areas | $20 |
| D-08, D-09 | Alt text and sitemap | Included |
| D-10 to D-12 | IndexNow, label size, email link | $30 |
| All fixes | $250 | |
| Minus the audit already paid | −$150 | |
| What you'd pay for the fixes | $100 |
What's working
I also tell you what not to touch.
- All 12 sitemap pages respond correctly, with no broken internal links.
- Every page has a single main heading, a well-sized title and description, and a canonical address.
- Structured data for search engines is valid on all 11 indexable pages.
- robots.txt lets AI search engines in.
- The WhatsApp number is the same on every page.
- Nothing overflows sideways on a 375 px phone.
- HTML revalidates on every visit, so text changes show up right away.
What I didn't check
And the limits, in writing.
- A real form submission. With clients I test it on the call, with a test email we agree on.
- Penetration testing or attacks. The audit looks at what's visible from outside; it doesn't try to break in.
- Timing on real slow connections. I measured download weight, not an actual 3G network.
- Server code beyond what it returns to the browser.
Your site
Want yours?
$150, within 3 business days of payment, in this same format. And if you hire me for the fixes, it comes off.