A Website Health Check You Can Run Yourself
By CodexierPublished 7 min read
Websites do not fail all at once. They decay: a plugin falls two versions behind, a form's notification email starts landing in spam, a large image gets uploaded and the homepage slows, Google flags a page nobody looks at anymore. None of it triggers an alarm. This quarterly check takes about ninety minutes with free tools and finds the decay before a customer does. Put it in the calendar now, then read on.
Security basics
Start by loading your site with https and without; the plain version should redirect to the secure one. Check the certificate's expiry date in the browser's padlock; if it is under a month away and not auto-renewing, fix that today. Log in to the CMS and look at the updates screen: the core system, every plugin and the theme should be current, and anything not updated by its author in over a year should be replaced. Then open the user list. Remove accounts of people who have left, downgrade anyone who does not need admin, and confirm that every admin has two-factor authentication. Finally, check that a backup exists from this week and, once a year, actually restore one to a test location; a backup that has never been restored is a hope, not a backup.
- HTTPS forced, certificate valid, auto-renewal working.
- CMS core, plugins and theme updated; abandoned plugins removed.
- Admin accounts reviewed; two-factor authentication on for all of them.
- Backups running, stored off the server, and restore-tested at least yearly.
- Login page not exposing the CMS version or accepting unlimited attempts.
Speed and Core Web Vitals
Speed drifts because content changes: someone uploads a full-resolution photo, a marketing tool adds a script, a new plugin loads on every page. Run Google's PageSpeed Insights on the homepage and your two most visited pages, on mobile, and look at three numbers: Largest Contentful Paint (how long until the main content shows), Interaction to Next Paint (how quickly the page responds to taps) and Cumulative Layout Shift (how much things jump around). Compare with last quarter's result, which is why you write them down. If a number has worsened, the report lists the causes in order; the top item is almost always an oversized image or a third-party script.
| Symptom | Usual cause | Quick fix |
|---|---|---|
| Main content appears late | Uncompressed hero image, slow server response | Resize and compress the image; enable caching |
| Page jumps while loading | Images without dimensions, late-loading ads or banners | Set width and height on images; reserve space |
| Slow to respond to taps | Heavy scripts from chat, analytics or marketing tools | Remove unused tools; load the rest after content |
| Everything slow on one page | A gallery, map or embed loading all at once | Lazy-load below-the-fold content |
Record the three numbers per page each quarter. The trend tells you more than any single score.
Forms, emails and notifications
The most common silent failure on a small business website is a form that looks fine, says thank you and delivers nothing. The notification email lands in spam, the mail service's credentials expired, or the address it sends to belongs to someone who left. Submit every form on the site yourself, from a phone, with a realistic message. Confirm the notification arrives at the inbox a person actually reads, and that any auto-reply to the customer arrives too. While you are there, check the spam folder for real enquiries from the last quarter; there are usually some. If your forms send through the site's own server, consider switching them to a transactional email service with proper authentication, which we cover in the maintenance work.
Contact and quote forms
Submit, confirm receipt, check the reply-to address works, and verify the thank-you page loads.
Booking and order confirmations
Make a test booking or order and check both the customer and the internal confirmation.
Newsletter sign-up
Subscribe with a personal address; confirm the double opt-in email arrives and the unsubscribe link works.
Sending domain
Check SPF, DKIM and DMARC records exist for the domain your site sends from; without them, delivery is luck.
Broken links and errors
Links rot as pages are renamed, products are removed and partners change their sites. Run a free link checker across the site and fix or redirect every internal broken link; external ones can be updated or removed. Then open your analytics and look at the pages that returned a not-found error in the last quarter. Each one with real traffic needs a redirect to the closest live page. Check the 404 page itself: it should look like your site, say what happened and offer a search or a link home. Finally, click through the main navigation and footer on a phone; menus that work on desktop and fail on mobile are more common than anyone expects.
Search Console warnings
Google Search Console is free, and it is where Google tells you about problems it found before those problems cost you rankings. Open it once a quarter and work through four screens. Pages: how many are indexed and how many are excluded, and whether anything important is in the excluded list. Core Web Vitals: the same speed numbers as above, measured from real visitors. Security and manual actions: this must be empty; anything here is urgent. Sitemaps: submitted, read successfully, and recent. Then look at the performance report for the queries that bring traffic and check whether the pages that rank for them still say what searchers want.
When you do not need a professional audit: if this check comes back clean for two quarters in a row, keep doing it yourself and spend your money elsewhere. Where a website and app health audit adds something is when the check finds more than you can fix, when the site has custom code or integrations you cannot inspect, or when you are about to invest in marketing and want to know the foundation will hold. Between quarterly checks, uptime monitoring covers the sudden failures. Which one you need is a 15-minute call.
- Website and app health auditA one-off professional audit of security, performance, SEO and code, with a prioritised fix list.
- Uptime monitoring for small businessesFor the failures that happen between quarterly checks.
- Book a free 15-minute callBring the results of your check; we tell you what to fix first and what can wait.
Frequently asked questions
How long does the health check take?
About ninety minutes the first time, less once you have the routine and last quarter's numbers to compare against. Security and forms take the longest; Search Console is quick once you know the four screens to open.
Which free tools do I need?
A browser, Google PageSpeed Insights, Google Search Console, a free link checker and your CMS's own update and user screens. For email authentication records, any free DNS lookup tool shows whether SPF, DKIM and DMARC exist.
What if I find something I cannot fix?
Write it down with the tool's exact message and a screenshot, and hand it to whoever maintains the site with a priority: security first, then anything blocking enquiries, then speed and search. A clear list makes the fix cheaper than a vague "something is wrong".
Is a quarterly check enough?
For the slow decay this check targets, yes. Sudden failures need monitoring that runs every few minutes, and updates need a monthly rhythm at least. The quarterly check is the layer that catches what those two miss.
Ran the check and found more than you expected?
Fifteen minutes with an engineer: send us your notes and we tell you which items are urgent, which are cosmetic and whether a full audit or a maintenance plan is the right next step.
Book a free 15-minute call