Website audit: what do you actually measure?

A website audit is not a casual opinion about your homepage. It is a repeatable set of measurements and checks that records how the site loads, how safe the connection and browser instructions are, whether the page works on a phone, and whether people with disabilities can use the content. The outcome is a report with scores, findings and (ideally) concrete next steps.

In practice three kinds of audits get mixed up. A content or SEO audit judges search intent, titles, internal links and content quality. A technical audit looks at crawlability, redirects, indexing and server behaviour. A user-experience audit measures performance, accessibility and security as visitors experience them. Searching for "website audit" often surfaces SEO agencies that mainly sell the first type. That is useful, but it is not the same as a technical review of the four pillars WebYes uses.

A classic SEO audit asks: is this page found and understood? Think canonical URLs, meta titles, heading structure, internal links and whether Google can crawl the page at all. Those questions belong to search optimisation. They say little about whether your TLS is sound, whether security headers are missing, whether LCP on 4G stays under 2.5 seconds, or whether forms are reachable with a keyboard.

WebYes deliberately reviews four pillars that together form the technical foundation of a trustworthy site:

That separation is honesty, not a marketing trick. WebYes is not a substitute for an editorial SEO content audit. We do not scan search volumes, write content briefs or judge keyword strategy. We do measure whether the technical foundation holds: Core Web Vitals within speed, security headers within security, and digital accessibility within a11y. If you need both, combine a content audit with a technical review.

Every serious audit must make clear whether the numbers come from a lab test or from real visitors. Lab data is produced in a controlled environment: fixed device profiles, simulated networks, reproducible runs. That is ideal for finding problems and verifying fixes. Field data (such as the Chrome User Experience Report) comes from real users on real devices. Google uses field data for Core Web Vitals in search results when there is enough traffic; the thresholds are on web.dev.

An audit that only shows lab is not "fake". It answers a different question: what happens under fixed test conditions? An audit that only shows field data says little about a site with little traffic. Good practice is to understand both: lab to improve, field to know whether real visitors notice the difference. The WebYes scan is deliberately lab: reproducible, immediately available, and suited to checking whether your fix works before you wait on field data.

One of the best-known lab tools is Lighthouse, the open-source audit product from Chrome for Developers. Lighthouse runs a series of automated checks on a URL (including performance, accessibility and SEO) and delivers a report with scores and failed audits. You can run it in Chrome DevTools, from the command line, as a Node module or via a web UI. Chrome documents that a DevTools run typically takes 30 to 60 seconds.

PageSpeed Insights uses Lighthouse under the hood for the lab part and also shows field data when it is available. Both tools are useful when you want to check a single page yourself. They are not a keurmerk: they review one URL per run, they have no paid re-audit cycle, and they do not publish a public register of certified domains. A Lighthouse score of 95 on your homepage says nothing about your checkout or about missing security headers on another template.

If you want to learn how to measure website speed yourself, continue at testing website speed. For a quick external check, PageSpeed Insights remains a solid start. For a broader technical review across multiple pages and pillars, a scan like WebYes fits the question "is this site sound as a whole?" better.

The free WebYes scan (beta) crawls up to six pages of your domain and scores the four pillars: speed, security, mobile and accessibility. Per domain there is a 60-minute dedupe window: scanning the same site again within that hour does not start a new run. That prevents scanner spam and keeps results comparable.

The keurmerk requires an average score of at least 80 across the four pillars, and each pillar separately at least 60. A site with a high speed score but a security pillar below 60 therefore does not get the keurmerk, even if the average is above 80. With a paid subscription, periodic re-audits follow (including fresh full audits when the newest scan is older than 30 days) and a public profile while the order is active.

What you do not get: a content strategy, a keyword report or an editorial review of your copy. That is deliberate. A keurmerk that claims to cover "SEO + content + tech + conversion" without delivering that depth is dishonest. WebYes covers the technical four pillars with lab measurements and fix guides. For content you stay with an editor or SEO specialist; for the technical foundation you can scan first and then fix with focus.