Website Audit Checklist 2026: What Changed This Year and What It Costs to Fix

This website audit checklist covers what a small business site needs to pass in 2026, and what changed this year that makes an older site fail. It is built on our 2026 speed and accessibility statistics and on the Chrome, certificate, Google and PHP changes announced this year, each with its date and source.

Work through it in about 30 minutes for the quick checks. At the end, a cost table and a fix-or-rebuild guide help you decide what to do next.

The short answer

A website audit in 2026 should check six things: HTTPS and certificates, speed, accessibility, search setup, the code platform underneath, and whether your forms still deliver leads. Several of those changed this year. Chrome now warns before HTTP pages, certificate lifetimes are shrinking, Google dropped FAQ rich results, and a critical PHP security release landed on October 21, 2026. Each change below has its date and source.

Most items on this checklist are small fixes. A few, when they pile up on an old site, add up to a rebuild. The tables tell you which is which, with prices from our own price sheet where we publish one.

What changed in 2026

These are the changes from 2026 that affect an ordinary business website, in date order. We checked each one against its source on October 23, 2026.

We will update this page as new changes are confirmed.

1. HTTPS, certificates and security

Every address people use to reach your site must load over HTTPS with a valid, automatically renewed certificate. Chrome now asks visitors for permission before opening a public HTTP page, and certificates must be replaced far more often than before. Our guides to Chrome's HTTP warning and the 2027 certificate changes cover both in detail.

• Open your domain with http:// typed in Chrome, with and without www. No warning should appear.
• Do the same for every subdomain and secondary domain.
• Confirm all HTTP addresses 301-redirect to HTTPS.
• Confirm certificate renewal is automatic, and that someone gets an alert if it fails.
• If your site runs on PHP, check the version in your hosting panel. Install the October 21, 2026 security release, and plan to move off PHP 8.2 before its security support ends on December 31, 2026.
• Remove plugins, themes and admin accounts nobody uses.
• Check that backups run and that you have restored one at least once.

The PHP release is serious. php.net says the new versions "fix two critical vulnerabilities that can allow unauthenticated remote code execution" and that "all PHP users are strongly encouraged to update immediately." Most managed hosts patch this for you. If you manage your own server, do it now.

2. Speed and Core Web Vitals

Your site should pass Core Web Vitals on mobile. In September 2026, 63.3% of US websites did and the rest did not, by our calculation from HTTP Archive counts. Google says Core Web Vitals are "used by our ranking systems" but that there is "no single signal" (Google). Speed matters more for whether visitors stay. Our website speed statistics for 2026 have the full data.

• Open the Core Web Vitals report in Google Search Console and check mobile first.
• Run your home page and top service page through PageSpeed Insights and read the field data.
• Compress and resize the hero image, set its width and height, and do not lazy-load it.
• Count third-party scripts: chat, reviews, heatmaps, pixels. Remove the ones you do not use.
• Check server response time. Only 32.2% of US WordPress sites had good Time to First Byte on mobile in September 2026, by our calculation from the same data, so hosting is often the cause.
• If you use old analytics, chat or form scripts, check they still work. Chrome no longer fires the unload event, and its documentation says "unload handlers won't execute."

3. Accessibility

Your site should meet WCAG 2.2 Level AA, and at minimum pass an automated scan. WebAIM found detectable failures on 95.9% of the top one million home pages in February 2026 (WebAIM Million), and federal website accessibility suits rose 27% in 2025. Our web accessibility statistics cover the numbers.

• Scan your key pages with our free accessibility checker.
• Fix text contrast, missing alt text, form labels and empty buttons, which are the most common failures.
• Tab through your contact form, booking and checkout with only a keyboard.
• Test the same pages with VoiceOver on an iPhone.
• Remove any overlay widget you bought as a fix.
• Publish an accessibility statement with a working contact route.

If the scan finds a lot, our guide to website accessibility audit cost explains what an audit includes and when it is worth paying for.

4. Search setup

Make sure Google can crawl your site, that your pages have good titles and descriptions, and that you are reading the right reports. Two Google changes this year affect what you see in Search Console and search results.

• Verify the site in Google Search Console, submit your sitemap, and check the Pages report for errors.
• Check that every important page has a unique title and meta description.
• Do not expect FAQ rich results. Google's changelog says the feature "will no longer appear in Google Search starting May 7, 2026." FAQ sections still help readers, and the structured data does no harm, but it will not earn the expanded snippet.
• Look at the new generative AI performance reports. As of August 31, 2026 they show impressions from AI Overviews and AI Mode for all sites, per Google.
• Know what the new opt-out does before touching it. Google's help page says that if you exclude your site, "links to your site and your site's content won't appear in Search generative AI features." For most small businesses that would cost visibility, not protect it.
• Keep your Google Business Profile, hours and contact details current and pointing to your https:// address.

Google also ran a September 2026 spam update, complete on October 8, 2026, per its status dashboard. If traffic fell around then, check the Manual actions report in Search Console before changing anything else.

5. Forms and lead flow

Your contact form should deliver every enquiry to a person who reads it. This is the cheapest item on the list and the one most likely to be silently broken.

• Submit your own contact form from a phone. Check the email arrives, and check the spam folder.
• Check the address the form sends to is still monitored.
• Test any booking, quote or payment form end to end.
• Check the thank-you page loads and any confirmation email reaches the customer.
• Check form error messages are clear and are read out by a screen reader.
• Click your phone number on a mobile. It should start a call.

What it costs to fix

Most single items are small jobs. The table shows typical fixes and, where our price sheet lists the work, its band in USD. Items marked "small job" are configuration work we quote in writing once we have seen the site.

For a planning range on a rebuild or redesign, use the free website cost calculator. It uses the same price sheet and lets you add accessibility and SEO setup as options.

Fix it or rebuild it?

Fix the site if it fails on one or two areas and runs on a current platform. Rebuild it if it fails on three or more, or if it cannot be updated safely. Here is how we would call it.

Our website redesign cost guide explains the budget side in more detail.

Checklist before you hire someone to fix it

• Ask for a written list of what will be fixed, page by page or template by template.
• Ask how they will test accessibility: automated only, or with a keyboard and screen reader too.
• Ask whether certificate renewal will be automated and monitored after they leave.
• Ask which PHP or platform version the site will run on when they finish.
• Ask who owns the hosting, domain and code at the end. It should be you.
• Ask what is not included, so you can compare quotes on the same scope.

Our guide on how to compare web development quotes walks through this line by line.

Next steps

1. Spend 30 minutes on the quick checks: HTTP in Chrome, a contact form test, a PageSpeed run and an accessibility scan.
2. Write down what failed, using the six areas above.
3. Fix the small items first: certificate, PHP update, form delivery.
4. Decide fix or rebuild from the table above.
5. Get a planning range from the website cost calculator, or contact us for a fixed-scope quote.

Dates and figures were checked against their sources on October 23, 2026. Prices are from our price sheet on the same date. Not legal advice.