Combined Audit Example: Walking Through One Report
This page walks through an illustrative Combined Audit report for Harbour Lane Bakery, a fictional bakery and café, shown at the placeholder address example.co.uk. It is not a real business and none of the findings or figures come from a real audit; they were written to show the kinds of results each section of the report produces and how to respond to them. Read it before your first run to know what to expect, or alongside your own report to compare.
About this example
The imaginary owner runs a bakery with a small café. The site was built on a popular CMS a few years ago and has a homepage, a menu page, an online order page, a wedding cakes page, a delivery areas page, an about page and a contact page. It has never been audited.
The owner signed in with a free account and ran a Quick Audit on https://www.example.co.uk/,
so all 21 checks ran: 19 that work signed out, plus the Site Crawler and the Trust Audit. No advanced
controls were changed. After about five minutes the owner entered an email address, clicked the verification
link and downloaded the PDF.
The real report opens with an overall score and a summary of every audit, each with its own score. Rather than invent numbers for those scores, this walk-through describes the headline finding of each section in words. Where a section measures something against a published threshold, such as Core Web Vitals, illustrative values are used so you can see how the ratings work.
The summary at a glance
This is how the bakery's summary reads once each section's main finding is noted down.
| Audit | Headline finding in this example |
|---|---|
| Meta Tag Analyzer | Homepage title likely to be cut off; no Open Graph image |
| HTML Checker | Two H1 headings; newsletter field without a label; a script without defer; JSON-LD that does not parse |
| CSS Checker | Web font without font-display; focus outline removed |
| JavaScript Checker | innerHTML set from variable content in the menu filter |
| JSON Checker | LocalBusiness block does not parse |
| Accessibility Audit | Low contrast on buttons; no skip link |
| Image Optimisation | Large hero photo; images without dimensions or alt text |
| Redirect Chain Checker | No chain: the address returns 200 directly |
| Robots & Sitemap Tester | Sitemap not referenced in robots.txt; no lastmod dates |
| Hreflang Checker | No tags, single language: fine |
| Page Speed Analyzer | Image savings available on the hero photo |
| Core Web Vitals | LCP and CLS need improvement; INP good |
| CLS Debugger | Hero image and Instagram embed flagged |
| Schema Debugger | Only a plugin's WebSite block readable |
| Rich Snippets Suite | No block ready for rich results |
| GDPR Audit | Analytics loads before consent; policy gaps |
| Local SEO Checker | Phone number in schema differs from the page; no Business Profile link |
| Site Crawler | Broken footer link on every page; one orphaned page |
| Security Audit | http to https redirect in place; no HSTS or CSP; no DMARC record |
| Trust Audit | Contact details found; young domain |
| HTTP Error Audit | One 404 and one redirect among linked pages |
Even before opening a section, two patterns stand out: the hero photo appears in several rows, and the LocalBusiness block affects both structured data and local results. That is the cue to look for shared causes later.
Links, redirects, robots and the crawl
HTTP Error Audit
The worst-first list starts with a 404 for /files/christmas-menu.pdf,
found on the order page. Last year's seasonal menu was deleted, but the link stayed. Below it is a 301
redirect for /cakes, which now forwards to /wedding-cakes, and then the pages
returning 200 OK. The fix is to change the link on the order page to the current menu, or remove it.
Site Crawler
The crawler shows that the footer link to /delivery fails on every page it visited, because
the page was renamed /delivery-areas. A single footer edit fixes every instance. It also
lists /wedding-cakes as orphaned: no page links to it directly; the only route in is through
the old /cakes redirect. Adding it to the main menu solves that.
Redirect Chain Checker
Because the owner entered https://www.example.co.uk/, the address visitors actually land
on, the chain is a single step: 200 OK, with no redirect hops, loops or temporary redirects to report.
Had the owner typed an older variant of the address, this section would have shown each hop on the way
to the final page. Whether plain http is sent on to https is reported separately, by the Security Audit.
Robots & Sitemap Tester
robots.txt allows normal crawling and the main AI crawlers, with no Content-Usage line declared. It
does not reference the sitemap. The sitemap itself is valid XML but none of its URLs carries a lastmod
date, and it still lists /delivery. Adding the sitemap line to robots.txt and regenerating
the sitemap clears all three.
Page code and structured data
Meta Tag Analyzer and HTML Checker
The homepage title is long enough that it is likely to be truncated in Google, and the page has no
Open Graph image, so shared links show as plain text. The HTML Checker adds that the LocalBusiness JSON-LD
block is not valid, covered under structured data below; that the logo is wrapped in an H1 as well as
the main heading, giving two H1s; that the newsletter email field has no label; and that the booking
widget's script loads without defer. All five are in the theme templates or the SEO plugin
settings.
CSS Checker and JavaScript Checker
The CSS Checker reports an @font-face rule without font-display, which can
leave text invisible while the font loads, and outline:none on buttons with no replacement
focus style, which hides where keyboard users are. The JavaScript Checker flags the menu filter setting
innerHTML from a variable, a common route for cross-site scripting, alongside maintainability
notes such as old var declarations that can wait.
JSON Checker, Schema Debugger and Rich Snippets Suite
The JSON Checker reports that the hand-written LocalBusiness block does not parse: there is a comma after the last opening hours entry. Because one stray comma makes the whole block unreadable, the Schema Debugger can only score the SEO plugin's WebSite block, and the Rich Snippets Suite shows no block ready for rich results. Removing that comma brings the bakery's name, address, phone and hours back into view for search engines, and the Schema Debugger will then show which recommended properties are still missing.
Speed, images and accessibility
Core Web Vitals and Page Speed Analyzer
In this illustration the homepage has an LCP of 3.6 seconds and a CLS of 0.16, both rated needs improvement, and an INP of 180 milliseconds, rated good against Google's 200 millisecond threshold. The Page Speed Analyzer's diagnostics point at the hero photo as the largest image saving.
Image Optimisation and CLS Debugger
The image table shows the hero as a JPEG thousands of pixels wide, far larger than any screen displays it, with no width or height attributes. Six of fourteen images have no alt text, none are in WebP or AVIF, and the gallery images further down the page do not lazy-load. The CLS Debugger lists the hero image and an Instagram embed with no reserved space as risk elements, each with its reason and fix.
Put together, one photo explains most of the speed and stability results. Resizing it, converting it to WebP, giving it dimensions and leaving it to load straight away, rather than lazily, should improve LCP and CLS together. Reserving space for the Instagram embed handles the rest of the shift.
Accessibility Audit
Cream text on the pale gold order buttons fails WCAG AA contrast. There is no skip-navigation link, and the newsletter field label is missing here too. The checker also notes three text elements sitting over the hero photo that it cannot measure, so someone needs to check those by eye.
Local, international, security, trust and privacy
Hreflang Checker
The site is in English for UK customers, has no hreflang tags, and the report says that is fine. Nothing to do.
Local SEO Checker
Once the LocalBusiness block parses, the schema half will read it, but the on-page half already shows a mismatch: the footer phone number is the new shop line, while the schema still has the old one. There is no Google Business Profile link and no review content on the page. The section ends with the exact name, address and phone to use everywhere, a list of directories ranked must-have, high priority and recommended, and a checklist.
Security Audit and Trust Audit
The certificate is valid and plain http redirects to https, but there is no HSTS header and no Content-Security-Policy, and the domain has an SPF record but no DMARC record. Each result carries its fix and OWASP and CWE references. The Trust Audit finds a published email, phone number and address, a clean reputation and a domain only a few years old, which is a slow signal to note rather than fix.
GDPR Audit
The cookie banner appears, but Google Analytics loads before anyone clicks accept. The privacy policy is linked but does not name the ICO as the complaints authority or say how long data is kept. The third-party list includes the analytics service, the booking widget, Instagram and a web font host. This is illustrative and not legal advice.
Reading this report, step by step
Step 1
Read the summary before any detail
The owner starts with the overall score and the summary of every audit rather than the first section. Noting one line per audit, as in the table above, takes ten minutes and shows where the problems cluster: images and speed, structured data, consent and a handful of broken links. It also shows what is healthy, such as hreflang, the certificate and the INP result, which tells the owner where no time needs to be spent.
Step 2
Mark anything that blocks visitors or crawlers
Next the owner looks for findings that stop people or search engines reaching content, or that affect visitors without their agreement. For the bakery that means the footer link failing on every page, the 404 on the order page and analytics loading before consent. None of these is technically difficult, but each affects real visitors every day, so they go to the top of the list ahead of anything cosmetic.
Step 3
Group findings that share one cause
The hero photo appears in Image Optimisation, the CLS Debugger, Core Web Vitals and the Page Speed Analyzer, so it becomes one task. The broken LocalBusiness block explains results in the JSON Checker, Schema Debugger, Rich Snippets Suite and Local SEO Checker, so that becomes another. The missing newsletter label appears in both the HTML and Accessibility Audits. Grouping like this turns several dozen findings into a short list of real jobs.
Step 4
Split page files from server work
Theme, content, CSS, JavaScript and structured data changes are page-file work that the owner's developer, or an AI coding tool using the fix prompt, can do. HSTS, the Content-Security-Policy and the DMARC record are hosting and DNS settings. The report already keeps these apart, so the owner copies the server items into an email for the host, word for word, and keeps the rest for the developer.
Step 5
Set aside what does not apply
Some results need no action. The bakery serves one country in one language, so having no hreflang tags is correct. The young domain will age on its own. JavaScript maintainability notes such as old variable declarations can wait for the next rebuild. Writing a short reason next to each one means nobody spends time on them again when the report is passed to someone else or the audit is re-run.
Step 6
Turn the rest into a dated plan
Finally the owner orders the remaining jobs: broken links and consent this week; the hero image, the LocalBusiness comma and the header fixes next; contrast, alt text and the focus style after that; server settings in parallel with the host; directory listings and the Business Profile link over the following month. A re-run of the Quick Audit after each batch shows which findings have cleared.
What the bakery hands to whom
The finished plan has three destinations.
For the developer, or an AI coding tool
The AI fix prompt at the end of the report lists the file fixes first, then the suggestions, then
the server settings for information. For this bakery the file fixes would include removing the trailing
comma, correcting the phone number in the schema, adding font-display, restoring a visible
focus style, labelling the newsletter field, deferring the booking script, sizing the hero image and
adding the skip link. The prompt tells the tool to work on a staging copy, back up each file and check
the page after every change.
For the host
Add HSTS, introduce a Content-Security-Policy in report-only mode first so the booking widget and Instagram embed are not blocked, and publish a DMARC record.
For the owner
Fix the footer and order page links, set analytics to wait for consent in the cookie tool, update the privacy policy, write alt text for the six photos, add the Business Profile link and work through the directory list.
If the owner would rather not manage any of this, each section of the PDF has its own quote link. For how these priorities apply to any report, see the Combined Audit Fixes hub, and for what every section measures, the Combined Audit Guide.
1. Is this a real audit of a real bakery?
No. Harbour Lane Bakery and every finding on this page are invented, example.co.uk is only a placeholder address, and the whole page exists to illustrate how a Combined Audit report is laid out and how to respond to it. The sections, result types and wording style follow what the real tool reports, but no figures come from a real audit. Your own report will contain different findings, and some sections may be much cleaner or much busier than the ones described here.
2. Why does this example not show the overall score?
The real report starts with an overall score and a score for each audit. Inventing numbers for those would suggest a precision this example does not have, so the walk-through describes each section's headline finding in words instead. Where a result is rated against a published threshold, such as the Core Web Vitals ratings, illustrative values are used so you can see how good, needs improvement and poor relate to Google's targets.
3. Why is one photo mentioned in so many sections?
Each audit in the report looks at the page from its own angle. Image Optimisation sees an oversized file without dimensions, the CLS Debugger sees an element likely to shift the layout, Core Web Vitals sees a slow Largest Contentful Paint, and the Page Speed Analyzer sees a large potential saving. They are all describing the same photo. That overlap is useful, because it tells you one change is likely to improve several results together.
4. Why did one comma break so many results?
Structured data is written in JSON, which has strict rules. A comma after the last item in a list makes the whole block unreadable, so search engines ignore everything in it, not just the line with the mistake. In the example, that means the bakery's name, address, phone number and opening hours were invisible to machines, which affected the structured data sections and the local checks at the same time. Removing one character restores the whole block.
5. Should the bakery remove Google Analytics because of the GDPR finding?
Not necessarily. The finding in this example is about timing: the analytics script loads before the visitor has made a choice in the cookie banner. Most consent tools and tag managers can hold the script back until the visitor accepts analytics cookies, which addresses the finding without losing the data from people who agree. Whether analytics is needed at all is a separate business decision. This is general information, not legal advice.
6. Would a Full Audit have found more for this bakery?
It would have covered more ground. The Full Audit adds 14 audits to the Quick Audit, including the Google Maps audit, the Geo-Grid, the Google Business Profile audit, backlinks, internal links, keywords, readability, E-E-A-T and the AI visibility checks. For a local bakery the Maps and Business Profile results would be especially relevant. It needs you to be signed in, uses credits and asks for extra details such as a Maps keyword and location.
The Combined Audit Fixes hub groups findings from all 21 Quick Audit checks into eight areas and sets out which to fix first, as this example does for one fictional business.
Open Combined Audit Fixes →