What the free website audit checks
Most firm websites were built once and then left alone. Over the years the theme gets heavier, a plugin stops being maintained, a certificate renewal is missed or a marketing script is added without anyone checking what it sends to third parties. None of this is visible from the homepage, but clients, search engines and regulators notice it.
This audit runs the same kinds of checks a technical agency would run before taking over a site, and it does them in one pass. It fetches your homepage the way a browser does, loads it in headless Chrome with Google Lighthouse on a simulated mobile phone and a desktop, inspects the HTTP response headers and the TLS certificate, queries the DNS records of your domain and crawls a sample of internal pages.
- On-page SEO: title, meta description, headings, canonical, robots.txt, sitemap, structured data and hreflang.
- Speed and Core Web Vitals on mobile and desktop, with the opportunities Lighthouse found.
- Security headers, exposed files, cookie flags and CMS version leaks.
- SSL/TLS certificate validity, expiry, protocol versions and redirect to HTTPS.
- Email authentication for your domain: MX, SPF, DKIM, DMARC, MTA-STS and BIMI.
- GDPR signals: trackers and Google Fonts loaded before consent, cookie banner, privacy policy and imprint links.
- Accessibility issues Lighthouse can detect automatically, and broken internal and external links.
Why it matters for law firms, notaries and accountants
Professional services are bought on trust. A prospective client who lands on a slow page, sees a browser warning about the certificate or receives your reply in their spam folder does not file a complaint — they simply call the next firm on the list. Search engines take the same signals into account: speed, mobile usability and HTTPS all feed into how pages are ranked.
European firms also carry specific obligations. Under the GDPR and the ePrivacy rules, non-essential cookies and trackers need prior consent, and in 2022 a Munich court held that loading Google Fonts from Google's servers without consent disclosed the visitor's IP address unlawfully. In German-speaking countries an imprint is mandatory for business websites. The audit flags these points so that you can raise them with whoever maintains the site.
How to read your score
Every module produces a score from 0 to 100. For Lighthouse modules this is Lighthouse's own category score; for the others we start at 100 and deduct points per issue according to its impact. The overall score is a weighted average that gives the most weight to SEO and performance, followed by security and TLS, and the letter grade runs from A+ to F.
Treat the grade as a summary, not a verdict. Start with the red items marked high impact, then work through the warnings. Each finding states what we measured, why it matters and what to change. The report has a shareable link valid for 30 days, so you can send it to your web developer or IT provider as a work list.
What this audit cannot tell you
Automated checks are a starting point. They cannot judge whether your copy speaks to the clients you want, whether your privacy policy is legally accurate, or whether a page passes every WCAG criterion — some of those require a human review. We do not log in, submit forms or test anything behind a password, and we only scan the public pages you point us to.