Combined Audit Guide: What It Checks and How to Read It
The Combined Audit runs many of our single-purpose checks against one website in a single pass and returns the results as one PDF report. It has two modes: a free Quick Audit with up to 21 checks, and a signed-in Full Audit that runs 35 audits. This guide is the reference for the tool itself. It lists what every Quick Audit check reads, what the Full Audit adds, how the report is laid out, how to read each type of result, what the advanced controls do, and where the limits are.
Quick Audit and Full Audit
The tool page offers two starting points. Both run their checks together rather than one after another, and both end in the same style of report. The difference is how much they cover and what they ask of you.
| Quick Audit | Full Audit | |
|---|---|---|
| Account | Not needed. Signed out it runs 19 checks; signed in with a free account it runs 21. | Must be signed in. |
| Coverage | Technical SEO, structured data, speed, accessibility, images, crawling, international and local, security, trust and GDPR. | Every audit available, 35 in total, including the Quick Audit checks. |
| Extra inputs | Website address and your name, company optional. | Also a competitor URL, a Maps keyword and location, your Business Profile name and up to 10 AI search queries. |
| Time | About five minutes. | About ten minutes. |
| Cost | Free, within a daily allowance per connection. | Uses credits. See Pricing. |
If you reach the daily free allowance, the page says so instead of leaving the audit running indefinitely. The two checks that need a free account are the Site Crawler and the Trust Audit.
The 21 Quick Audit checks
In the Combined Audit these checks run against the same address at the same time, and each gets its own section of the report. The descriptions below summarise what each one reads and returns.
Technical SEO and markup
- Meta Tag Analyzer. Reads every tag in the page head and checks the ones that shape search listings and shared links: title and its length, meta description and its length, viewport, Open Graph title, image and site name, and X (Twitter) Card tags. It lists every tag found with its full content.
- HTML Checker. 23 structural checks, from DOCTYPE, language attribute and UTF-8 charset
to a single H1, heading order, alt text, descriptive link text, an absolute canonical, valid JSON-LD,
rel="noopener"on new-tab external links, form labels, deprecated elements, deferred or async external scripts and main and nav landmarks. - CSS Checker. 25 checks across syntax and structure, performance and loading, specificity and maintainability, accessibility, animation and motion, and responsive design.
- JavaScript Checker. 14 checks covering security, speed and reliability, including
innerHTMLset from variable content, uncached DOM lookups, listeners never removed and timer-driven animation, and it confirms good practice such as noeval()ordocument.write().
Structured data
- JSON Checker. Confirms each JSON-LD block parses, then checks
@context,@typeand the properties that type needs, with passes and issues listed per block. - Schema Debugger. Scores each block from 0 to 100, shows its type, purpose, the rich result it can qualify for and every property with its value, and lists missing properties, AEO gaps, duplicates and invalid markup.
- Rich Snippets Suite. One table of every block's eligibility against Google's rich result requirements: ready for rich results or supporting schema only, with its score and issue count.
Speed and stability
- Page Speed Analyzer. Runs the page through Google PageSpeed Insights on mobile and reports the performance score with FCP, LCP, Total Blocking Time, CLS, Speed Index, Time to Interactive and TTFB, plus diagnostics and passed audits.
- Core Web Vitals. Rates LCP, CLS and INP, along with FCP and TTFB, as good, needs improvement or poor against Google's thresholds, using PageSpeed Insights data, with fixes for each failing metric and the threshold table.
- CLS Debugger. Looks for likely causes of layout shift such as unsized images and embeds, lists each risk element with a risk level, reason and fix, and says so plainly when it finds none.
Accessibility and images
- Accessibility Audit. Tests the reliably measurable parts of WCAG 2.1: text contrast against level AA, link text, form labels, button names, the lang attribute, a single H1, heading order, landmarks and a skip link.
- Image Optimisation. A table of every image with format, alt text, dimensions and loading status, plus totals for missing alt text, missing size attributes, non-lazy images and images not in WebP or AVIF.
Crawling, redirects and errors
- Redirect Chain Checker. Follows the address hop by hop, recording each status code and URL, and flags chains, loops and temporary redirects where a permanent one belongs.
- Robots & Sitemap Tester. Lists user-agents, sitemap references and disallow rules, checks that GPTBot, ClaudeBot and PerplexityBot can reach the site and whether a Content-Usage line is declared, and validates the sitemap's XML, URL count, lastmod dates, duplicates and hash-fragment URLs. Each part gets its own score.
- Site Crawler (free account). Follows links across the site, scores each page, finds broken internal links, orphaned pages and repeated issues, and builds a prioritised site-wide fix list.
- HTTP Error Audit. Records the status of the pages your site links to, reporting 404, 410, 500, 502 and 503 responses alongside redirects and successful pages, worst first, with the page each link was found on.
International and local
- Hreflang Checker. Validates language and region codes, return tags, conflicting values and x-default. A single-language, single-country site with no tags is reported as fine.
- Local SEO Checker. Reads LocalBusiness schema (name, address, telephone, hours, geo, price range, sameAs, service area) and on-page signals such as visible name, address and phone, a Business Profile link and review content, then gives a standard name, address and phone, a ranked directory list for your country and a checklist.
Security, trust and privacy
- Security Audit. Passive checks of security headers, TLS, cookie flags, mixed content, subresource integrity, the http to https redirect, exposed secrets or source maps, revealing error pages, mail and DNS security records, fingerprinting, known CVEs for detected versions, CMS exposure, robots.txt and security.txt. Each result is pass, fail, warning, info or not applicable, with OWASP and CWE references.
- Trust Audit (free account). Domain age and WHOIS, reputation with Google Web Risk, backlink spam score and authority, published contact and identity details, and robots.txt.
- GDPR Audit. 16 checks across consent, disclosure, cookies, tracking, security, third parties, forms and data rights, with a score and grade. It covers the cookie banner, cookies set on first load, trackers loading before consent, third-party domains, privacy and cookie policy content, data-rights links, form consent wording and the HSTS, CSP and frame protection headers.
What the PDF report contains
When the checks finish you enter an email address and receive a verification email with a link to download the report as a PDF. The verification step means the report only reaches someone who can open that inbox.
The report is laid out in a fixed order:
- An overall score and a summary of every audit that ran, each with its own score, so you can see at a glance where problems cluster.
- One section per audit. Problems inside each section are listed worst first. Each problem states what is wrong, why it matters to your visitors and how to fix it.
- Quote links. Every section has a link to request a quote for that audit's fixes alone.
- The AI fix prompt at the end, a single block of instructions you can copy into an AI coding tool.
If you uploaded a logo through the advanced controls, it appears on the report, which is useful when the report is going to a client.
The AI fix prompt in detail
The prompt is built from your own results. It orders the work as file fixes first, then suggestions, then server settings. It is limited to your site's own HTML, CSS and JavaScript; anything on the server, hosting or DNS is listed separately for you or your host, and the prompt tells the AI tool not to touch it. It also tells the tool to work on a copy or staging version, back up every file first, make one fix at a time and check the page still looks and works the same after each one. Suggestions are listed for you to choose from and are never applied automatically. The prompt can also be copied straight from the results screen, and the tool page offers an example report to download.
Requesting a quote
At the end of an audit, Request a quote for this work sends a request that already includes the file fixes, the server and DNS work and the suggestions from your report, with a box for anything else such as deadlines or access details. A reply with a quote comes by email.
How to read each type of result
The audits do not all use one scale, because they measure different kinds of thing. Knowing which scale a section uses stops you misreading it.
| Result type | Used by | How to read it |
|---|---|---|
| Good / needs improvement / poor | Core Web Vitals, Page Speed Analyzer metrics | Measured values against Google's thresholds. Good LCP is within 2.5 s, good INP within 200 ms, good CLS 0.1 or less. |
| Score from 0 to 100 per block | Schema Debugger | How complete one structured data block is. Read alongside the separate AEO issues list. |
| Ready or supporting | Rich Snippets Suite | Whether a block can qualify for a rich result itself, or only supports other markup. |
| Pass, fail, warning, info, not applicable | Security Audit | Fails need action; warnings are weaker settings; info is context; not applicable means the check did not fit your site. |
| Score and grade | GDPR Audit | An overall view of the 16 checks; read the failing checks rather than the grade alone. |
| Risk level per element | CLS Debugger | How likely each element is to move content as the page loads. |
| Status code per link | HTTP Error Audit | 4xx codes are client errors, such as 404 (not found) and 410 (gone); 5xx are server errors; 3xx are redirects. |
| Status code per hop | Redirect Chain Checker | Each step of the redirect path with its code (301, 302, 307, 308 or 200), ending at the final page. |
| Score per page | Site Crawler | Shows which pages need most work and whether a problem repeats site-wide. |
| Must-have, high priority, recommended | Local SEO Checker directory list | The order to work through directory listings. |
The overall score at the top is a summary. It is useful for comparing one run of the same site with the next, but individual findings tell you what to do.
What the Full Audit adds
The Full Audit includes every Quick Audit check and adds 14 more, taking it to 35 audits in one run:
- Competitor analysis, putting your site side by side with a competitor's.
- The ecommerce crawl.
- The Google Maps audit and the Geo-Grid, which shows your Maps ranking from a 5×5 grid of points around the business.
- The Google Business Profile audit.
- Backlinks, internal links, keyword analysis and readability.
- E-E-A-T.
- The AEO / AI Visibility Checker, which scores visibility across ChatGPT, Perplexity, Google AI Overviews and Microsoft Copilot with fixes for each.
- AI Agent Compatibility, which shows what GPTBot, ClaudeBot and PerplexityBot see on the page, including blocked bots, JavaScript-only content and missing AI signals.
- AI Visibility tracking, using up to 10 of your search queries to see whether the site is cited in Google AI Overviews and AI Mode.
- The LLMs.txt auditor, which checks your llms.txt against the published specification.
Because several of these need context the page cannot provide, the Full Audit form asks for a competitor URL, a Google Maps keyword and location (City, Region, Country), your Business Profile name exactly as on Google Maps, and the AI search queries, one per line. The competitor URL is optional.
The Full Audit inputs screen (signed in) also has an optional Server log security events field for the Results file for the Security Audit from the Real Traffic Audit, a .json file that is read in your browser, not uploaded and not scored. The Real Traffic Audit Guide explains where that file comes from.
Advanced controls
Signed-in users can open Advanced controls, which shows the full audit form. It changes three things: which checks run, how many pages they cover and the logo on the report.
Which checks run
Every audit has a tick box. The Quick, Full and None buttons set the boxes to a preset that you can then adjust, so you can, for example, start from Quick and add backlinks, or start from None and run only the speed and image checks while you work on performance.
How many pages
Choose 1 page, up to 10, up to 25 or up to 50. Each selected audit runs across that many pages of the site, so a multi-page run shows whether a finding is confined to one page or comes from a shared template.
Your logo
Add your own logo as a PNG and it appears on the report. Agencies and freelancers use this when the PDF is going to a client.
What the audit does to your site, and whose sites you can audit
The audit reads pages as a visitor or search engine would. Nothing is installed, it never asks for your login or hosting details, and it never writes to your server.
For most checks you can audit any public website: a competitor, a client, or a site you are considering buying, because they only read pages anyone can already see. Security is handled differently. The Security Audit is passive on every site, looking only at what the site already sends to all visitors, such as headers, the certificate and DNS and email authentication records. Before a security scan runs you tick a box confirming that you own the domain or have written permission from the owner, and the form notes that scanning a site without permission may be unlawful in some jurisdictions. Anything more active than passive checks is only run on domains you have verified as yours.
Running the audit, step by step
Step 1
Decide between Quick and Full
Choose the Quick Audit when you want a free, broad health check of technical SEO, structured data, speed, accessibility, images, crawling, security, trust and privacy in about five minutes. Choose the Full Audit when you also need competitor, Maps, Business Profile, backlink, keyword, readability, E-E-A-T and AI visibility results, and you are prepared to sign in, use credits and spend about ten minutes. You can start with Quick and run Full later.
Step 2
Sign in if you want 21 checks
Signed out, the Quick Audit runs 19 checks. Signing in with a free account adds the Site Crawler and the Trust Audit, taking it to 21. Those two are worth having on a first run, because the crawler shows whether problems repeat across many pages and the Trust Audit looks at domain, reputation and identity signals that the page-level checks cannot see. Signing in also unlocks the advanced controls described in this guide.
Step 3
Enter the address and your name
Type
the full address of the page to audit, including https://, and your name; company is optional.
Use the address visitors actually land on, normally the homepage of the preferred host, so the Redirect
Chain Checker starts from the right place. For a Full Audit, fill in the Maps keyword and location, the
Business Profile name exactly as it appears on Google Maps and up to 10 AI search queries, one per line,
plus a competitor URL if you want the side-by-side comparison, which is optional.
Step 4
Set the advanced controls
If you are signed in and want more than the defaults, open Advanced controls. Pick a preset with the Quick, Full or None buttons and adjust the tick boxes, choose how many pages each audit should cover from 1, up to 10, up to 25 or up to 50, and add your own PNG logo if the report is going to a client. Leave these alone on a first run if you simply want the standard Quick Audit.
Step 5
Confirm permission for the security scan
Tick the box agreeing to the address being checked by the audit tools. If the Security Audit is included, also tick the authorisation confirmation, where the form shows it, that you own the domain or have written permission from its owner to run a security scan. The security checks stay passive on any site, but the confirmation is still required. If you cannot honestly tick it for a site you do not control, untick the Security Audit in the advanced controls instead.
Step 6
Let the audit finish
Start the run and leave the page open while the progress screen is showing. A Quick Audit takes about five minutes and a Full Audit about ten, because every selected check runs together against the same address. You do not need to watch it while it works. If you have reached the daily free allowance for your connection, the page tells you rather than appearing to run without end.
Step 7
Verify your email and download the PDF
When the checks are complete, enter an email address you can open. A verification email arrives with a link to download the report as a PDF. Keep this first PDF as a baseline, because comparing the next run against it is the clearest way to see what your fixes changed. From the results screen you can also copy the AI fix prompt or use the quote link if you want the work done for you.
Limits worth knowing
- Automated accessibility testing is partial. Text over images or gradients cannot be measured, so the checker reports how many elements need checking by eye, and contrast is measured in the default colour scheme only, so a dark mode needs a separate look. Keyboard use and screen reader experience still need a human test.
- Speed figures vary. PageSpeed Insights results move between runs. Compare more than one run before drawing conclusions.
- Eligibility is not display. Structured data that passes makes a page eligible for rich results. Google decides what to show.
- No tags can be correct. The Hreflang Checker treats a single-language, single-country site with no hreflang tags as fine.
- Some signals change slowly. Domain age and authority in the Trust Audit cannot be fixed on the day.
- Security checks are passive. They show what the site exposes to visitors, not the results of active security tests, which are only run on verified domains.
- Free use has a daily allowance per connection.
For how to act on the findings, and in what order across all the sections, use the Combined Audit Fixes hub.
1. What does the Combined Audit give me in one run?
It runs its checks together against one address and gathers the results into one PDF with an overall score, a summary of every audit and a section for each, with problems listed worst first. The free Quick Audit covers up to 21 checks in about five minutes, and the signed-in Full Audit covers 35 audits in about ten. It suits a first look at a site, a client report or a periodic review where you want everything in one place.
2. Why does my report have 19 sections instead of 21?
The Site Crawler and the Trust Audit only run when you are signed in with a free account. A signed-out Quick Audit runs the other 19 checks, which is why their sections are missing. Sign in and run the audit again to include them. If you were signed in and a section is still missing, check whether it was unticked in the advanced controls, since a custom selection only runs the checks you chose.
3. Does the audit cover every page of my site?
The Quick Audit's page-level checks look at the address you enter. The Site Crawler follows links across the site, and the HTTP Error Audit checks the pages your site links to, so those two give a wider view. In Advanced controls, for signed-in users, the page count defaults to up to 10 pages, and you can choose 1, up to 25 or up to 50, which is the best way to see whether a problem belongs to one page or to a shared template.
4. Why do I have to verify my email to get the report?
The report can contain details about a site's weaknesses, such as missing security headers or exposed information, so it is only sent to someone who can open the inbox they entered. You type the address when the audit finishes, a verification email arrives, and its link lets you download the PDF. Use an address you check regularly, because the link is how you get the report, and keep the PDF somewhere safe if it relates to a client.
5. Can I use the report for a client?
Yes. Signed-in users can add their own logo to the report through Advanced controls, added as a PNG file. Choose the checks that suit the engagement, set the number of pages, and send the PDF on. If your client wants the work done, every section has its own quote link, and the request at the end of the audit includes the file fixes, the server and DNS work and the suggestions automatically.
6. Will the AI fix prompt change my server settings?
No. The prompt only covers your site's own files, meaning HTML, CSS and JavaScript. Server, hosting and DNS items are listed separately for you or your host, and the prompt tells the AI coding tool not to touch them. It also instructs the tool to work on a copy or staging version, back up files first, make one change at a time and check the page after each one. Suggestions are listed for you to choose, never applied automatically.
7. Does the Quick Audit check AI search visibility?
Only partly. The Robots and Sitemap Tester confirms whether GPTBot, ClaudeBot and PerplexityBot can reach the site, and the Schema Debugger lists gaps that matter to AI answer engines. The dedicated AI checks, the AEO and AI Visibility Checker, AI Agent Compatibility, AI Visibility tracking and the LLMs.txt auditor, are in the Full Audit, which needs you to be signed in and uses credits. You can also add up to 10 search queries there.
The Combined Audit Fixes hub groups the findings from all 21 Quick Audit checks into eight areas, shows which fixes clear several sections at once and sets out an order of work.
Open Combined Audit Fixes →