What a website audit actually includes — and what “free audit” tools leave out
Search for a website audit and most of what comes back is a free automated scanner. They are fast, accurate at what they do, and cost nothing. In the three assessments Aroc ran in July 2026, not one of them could have found the fault that had to be fixed first.
The word “audit” has been taken by software.
On a read of the results for website audit taken on 3 August 2026, eight of the first ten organic results were free automated audit tools. Not one was a service. The searcher typing that phrase overwhelmingly wants a box to paste a URL into, and the market has arranged itself accordingly.
That matters if you are buying rather than scanning, because it means the most visible answers to “what is a website audit” are written by companies whose product is a crawler. The definition you find is the definition that suits the tool.
A crawler can only report on things that exist at a URL it was given. Most of the expensive faults are neither.
How that figure was obtained, and its limits. The read was done on DuckDuckGo, not Google, because Google blocked automated access from that environment. Result composition— directory versus real agency — is the measure the source read treats as reliable — DuckDuckGo correlates well with Google on result composition — and composition is what is being reported here. Exact positions will differ, and Google’s local results are not represented at all. Treat the composition as reliable and the ordering as indicative.
What a free scanner does well, and it is real work.
Title tags. Meta descriptions. Heading structure. Image alt text. Broken links. Page speed. Whether structured data is present. Whether the site is telling search engines it is in one language while serving another.
All of that is genuine, checkable, and worth fixing. Run the free tool. If your title tags are missing, a scan that costs nothing is the correct price for finding out.
The limitation is not accuracy. It is scope. A scanner is given one address and reports what is at that address. It cannot ask whether the address is still yours, whether anyone is watching what happens there, or whether the customer trying to reach you ever gets that far.
Three assessments. Three faults no crawler would report.
These were run in July 2026, on three real businesses in two countries and three different trades. In each one the fault that mattered most was somewhere an automated audit could not look.
Why the businesses are not named. None of the three has given written permission to appear here, and an assessment is a confidential document. The findings are reported as recorded; the identities are not. None of the three is Evergreen Spa — where a business has given recorded permission, as Evergreen did on 3 August 2026, the name and every number are published in full and can be checked.
- Assessment one · vehicle service contracts, Missouri
The domain was not theirs any more.
The only web address the company had ever published — it appears on every post of their own blog — still resolves. It serves a template consulting site for a different company, listing a different street address in the same city and a New York area-code phone number. Not a 404. Not a parked page. Another business, taking the call.
Point any audit tool at that address and it will crawl a stranger’s website and hand back a report on it — quite possibly a healthy one. The tool has no way to know the site it is measuring is not the site you meant.
Searching the company’s own name plus the word “reviews” surfaced something worse. The highest-ranking review page scored barely over one star out of five— and the assessment separates it, with high confidence, from the business being assessed. It belongs to a similarly named company in a different county. A prospect doing the obvious check reads a stranger’s one-star rating and stops there.
Confirmed by direct fetch, 31 July 2026. Whether the domain lapsed or was sold was not established — WHOIS history could not be obtained, and the run says so rather than guessing.
- Assessment two · restaurant delivery, Phuket
Nothing was measured, so nothing could be judged.
This one had a real site, indexed by Google, with a full menu and published prices. A scanner would have found genuine faults and would have been right about all of them: no meta description on either page checked, no
h1on the home page, fifteen images with no alt text, no structured data anywhere checked on a restaurant site with a fully priced menu, andlang="en"declared on a Russian-language page.What a scanner would not have reported was the fault that mattered most. There was no analytics of any kind installed — no GA4, no Tag Manager, no Yandex Metrica, no Meta Pixel. Ten script sources on the page and not one of them was measurement. The intended funnel ran from the site into a Telegram ordering bot, which is exactly the handoff where an untracked business stops being able to know anything at all.
Fixing the alt text is worth doing. But fixing it in a business that cannot tell whether anything changed is spending money in the dark, and the order of operations matters more than the list.
Verified by live browser inspection, 31 July 2026, after an earlier automated pass got it wrong. See the correction below.
- Assessment three · massage and spa shop, Phuket
There was no website to audit, and that was the finding.
Nine separate searches turned up no owned domain. A crawler-based tool needs a URL; there was not one. Everything a customer could find about this business was on a surface somebody else controlled.
What the assessment found instead: six live variants of the business name across platforms, three different addresses — one with no street number at all — and a phone number published in zero of the two directories that could be fetched. Both verified absent, not assumed.
The review equity was split three ways, and the weakest number was the most public one: over a thousand reviews on one platform, against a few hundred — and a lower rating — on the platform tourists actually browse before they arrive. The strongest thing this business owned was sitting on a surface almost nothing links to.
Those two counts are exact in the assessment and rounded here. A review total is a searchable fingerprint, and rounding it is the price of not naming a business that did not agree to be named.
US-desktop search only. The result that decides this business’s sales is the local map pack, which was not observable from where the run was done — stated as the single largest limitation of that assessment.
One of those three assessments was wrong first, and had to be corrected.
The restaurant run originally led with a much more dramatic headline: every internal page of the site returned a redirect loop, so the entire menu was unindexable. Two independent automated fetchers were pointed at it. Both agreed. It went into the draft as the central finding.
It was false. A site: check in Google returned about forty-one indexed pages, including the contacts page, five category pages and four individual dish pages, priced. Google was crawling the site perfectly well. The redirect loop was real, but it only affected cookieless non-browser clients — which is exactly what both fetchers were.
Two tools agreeing is not corroboration when both share the same blind spot.
The correction was written up rather than edited away, and the ten-second site: check now runs before any conclusion about indexing is recorded. The corrected diagnosis was also the more useful one: the site was indexed, priced and well reviewed, and simply carried none of the signals that would make it relevant — with nothing measuring whether that ever changed.
This is the argument for a human doing it. Not that people make fewer mistakes than software — the mistake above was made by a person trusting software. It is that a person can be held to noticing, correcting and publishing the correction, and a crawler cannot.
So what should a paid audit actually contain?
Eight things. If you are paying for a website audit and the document does not contain these, you have bought a longer version of the free report.
- The primary constraint, named. One thing, in your words. A list of forty faults ranked by severity is a tool's output; deciding which single one is costing you the most is the job you are paying for.
- The evidence behind it, screenshotted and dated. Every finding should be one you can verify yourself. If you cannot check it, you are being asked to take it on trust.
- Where the business stands at each stage. Discoverable, Credible, Preferred, Converting, Compounding. They run in order, and a later stage cannot be fixed while an earlier one is broken.
- What each fault costs — in customers and money. Not in metrics nobody can spend. A score out of 100 is not a cost.
- A Now / Next / Later order. Sequenced by commercial consequence, not by what the person writing it happens to sell.
- A measurement baseline. Where things stand today, recorded, so progress can be proved later — by whoever does the work, including someone else.
- A recommendation that is allowed to be “not yet”. A diagnosis where every road leads to a project is an advertisement. Sometimes the honest answer is that major work is not justified.
- A stated list of what it could not see. The limits belong in the document. An audit that presents itself as complete is the one to distrust.
Item eight is the one most often missing and the easiest to check. Aroc’s own assessment is built entirely from what anyone can see from outside — no account access — so it cannot show what people searched for before they found you, or what they did once they arrived. That limit is written into the document itself rather than discovered later.
One difference worth naming. Seven of the eight above are numbered deliverables in an Aroc assessment. The eighth — the list of what could not be seen — is not a deliverable; it is a section of the document, and it sits alongside the one deliverable this article does not discuss — the sixth: the single first thing to do next week. The full list is on the Assess page, which is the honest place to compare it.
The same standard, applied to Aroc.
It would be convenient to end an article about audits without auditing ourselves, so here is the number. For the 28 days to 3 August 2026, Aroc’s own site was shown in Google 157 times, earned 2 clicks, and appeared for 13 distinct searches — which averaged position 69.61 across the 137 impressions those searches produced. Nobody scrolls that far. Twelve of those thirteen searches were a service term plus a place Aroc no longer targets; the thirteenth was the word “aroc”.
That is a bad baseline and it is published because a company selling diagnosis should be willing to be diagnosed. It was also recorded before the site changed, so the next reading can be compared against it rather than against a memory.
And the first version of this paragraph was wrong. It said 60.75, taken from the baseline file. Checking it for this article showed the number was an arithmetic fault in the script that produced it: an average weighted across the thirteen queries was divided by the total impressions for the whole site, which is a larger figure. The script and the baseline file were corrected on 4 August 2026 and the real number — 69.61, which is worse — is the one above. It is recorded here rather than quietly swapped, for the same reason the restaurant correction is.
The method behind all of this — five stages, one constraint, fix the earliest broken one — is set out on the Growth System page.
When the free tool is the right answer.
If the question is which tags are missing from this page, use the free scanner. It is faster than a person, it is accurate, and paying for it would be waste.
Pay for a diagnosis when the question is what should I do next, and why that first — because answering it requires judgement about the business rather than the page, evidence gathered from outside the website, and someone prepared to write down what they could not see and what they got wrong.
Sources for every figure above
- Eight of ten results are free tools — manual read of the top ten organic results for website audit, DuckDuckGo desktop, unpersonalised, 3 August 2026. Google blocked automated access; the caveat is stated in the section above.
- The three assessments — Aroc assessment runs 001, 002 and 003, all dated 31 July 2026, plus the recorded correction to run 002. Internal documents, businesses unnamed by default.
- About forty-one indexed pages —
site:query in Google, 31 July 2026, run as the check that overturned the earlier automated finding. - 157 impressions · 2 clicks · 13 queries · average position 69.61 across 137 query impressions — Google Search Console, domain property, 6 July to 3 August 2026, captured 3 August 2026. The position figure is weighted by impressions across those 13 queries. The equivalent figure across the whole site for the same period is 62.01. The baseline file originally published 60.75, which was an arithmetic fault; it was corrected on 4 August 2026 and the correction is described above.
- Evergreen Spa figures — Google Search Console, 28 June to 27 July 2026, published with recorded client permission at /work/evergreen-spa.
Nothing above is estimated. Where a number could not be verified it is absent rather than approximated, and where a finding rests on weaker evidence than it sounds, that is said in the same sentence.