How we audit a website and rebuild it
We scored our own site, fixed it, and scored it again. Here is how a scan, a mockup and a review page work.
Before we touch a website, we score it. When we show an owner what we found, we put it on a page they can read in five minutes, next to a mockup they can click.
To prove it works, we ran it on our own site first. On the first scan, chimaeraco.dev scored 38 out of 100, an F. After one working session of fixes, a fresh scan of the live site scored 90, an A. The look of the site barely changed. Most of the gain came from things a visitor never sees.
This post walks through each step, shows what we changed, and lists what we left undone. If you run a business with a website, the checklist near the end takes about ten minutes.
Why we scan before we build
Most website conversations start with opinions. Someone says the site feels old, or slow, or that nobody finds it. A scan replaces the opinions with a list.
A scan is a program that visits your site the way a search engine would. It opens your pages, reads the code behind them, follows the links, and checks each page against a long list of rules. Then it groups the results into areas such as search basics, accessibility, speed and trust. Each area gets a score, and the scores roll up into one number.
That number is a rough guide, not a verdict. A site can score 95 and still be hard to use, and a site can score 60 and bring in good work every week. What a scan does well is find the dull problems nobody notices: a missing sitemap, pages with no description, a phone screen that will not zoom. Those are cheap to fix and easy to miss, so we look for them first.
What our own scan found
Our first scan crawled 25 pages of chimaeraco.dev. It found four errors and 29 warnings. Both scans used the same settings and a fresh crawl, and they reached 25 and 23 pages. Here is where each area stood and what moved it.
BEFORE
38
Grade F
4 errors and 29 warnings
First scan of the live site, 25 pages crawled
AFTER
90
Grade A
0 errors and 9 warnings
Up 52 points
Fresh scan of the live site, 23 pages crawled
A page from our first report
This is what an owner gets: grades by area first, then the findings in plain language. Everything below is from our first scan of chimaeraco.dev, before any fixes.
SITE HEALTH GRADES
Needs work
Legal
Grade F, 44 of 100
Core search basics
Grade F, 47 of 100
Content
Grade F, 52 of 100
Trust signals
Grade F, 57 of 100
Images
Grade D, 61 of 100
Performance
Grade D, 68 of 100
Doing well
URL structure
Grade A, 100 of 100
Reliability
Grade A, 100 of 100
Local search
Grade A, 100 of 100
Social media
Grade A, 100 of 100
FINDINGS, IN PLAIN LANGUAGE
ERROR
No sitemap
Search engines had no list of our pages to work from. A sitemap is a short file that lists them.
ERROR
No robots file
Nothing told search engines where they may and may not go.
ERROR
A menu button pointing at a menu that was not there
The phone menu button referred to a menu that only exists while it is open, which screen readers read as a broken reference.
WARNING
Page titles and descriptions the wrong length
Many titles and descriptions were too long, too short or missing, and that text is what a search result shows.
WARNING
No privacy policy and no About page
Visitors could not find who we are or how we handle their details.
WARNING
Thin pages and doubled headings
Several pages had fewer than 300 words, and a few pages had more than one main heading.
Every area, before and after
AREA, SCORE BEFORE AND AFTER, AND WHAT MOVED IT
Crawlability
Before 60, after 100
a sitemap and a robots file
Core search basics
Before 47, after 100
a title and description for each page, and a canonical address
Content
Before 52, after 100
real copy on thin pages, a visible date on each post, outside links in our guides
Legal
Before 44, after 100
a privacy policy linked from every page
Trust signals
Before 57, after 100
an About page and author details on each post
Accessibility
Before 77, after 100
one main heading per page, readable button colors, labeled form fields
Images
Before 61, after 81
explicit sizes, lighter page captures
Performance
Before 68, after 73
smaller images; the rest is still open
By the end, errors were down from four to none and warnings from 29 to nine.
The fixes, in the order they paid off
1. Crawl basics
We had no sitemap and no robots file. A sitemap is a list of the pages you want found, in a format search engines expect (the protocol is public, at sitemaps.org). A robots file tells search engines where they may go. Both took a few lines of code, and the crawl area went from 60 to 100.
2. Titles, descriptions and canonical addresses
Every page needs its own title and a short description, because that text is what a search result shows. Ours were too long, too short, or missing on many pages. We rewrote them to fit. We also gave each page a canonical address, which tells search engines which web address is the official one. Google's SEO starter guide covers both.
3. Trust pages
The scan wanted an About page and a privacy policy, and so would a careful customer. We wrote both from what the site really does. The privacy page lists what we collect, who handles it, and how to ask us to delete it. Because we wrote it from the code, every sentence is something we can stand behind.
4. Structured data
A page can carry a small block of labeled data that tells search engines who runs the site and what the page is. We added it to the pages meant to be found, and we kept it off the concept pages we ask search engines to skip. The scan had flagged that conflict. These blocks follow the public schema.org types.
5. Accessibility
Each page now has one main heading. Our design previews, which are small sites inside a page, had been using that heading too, so one page had five. We moved the previews down a level. We darkened an orange button so its text passes the contrast check, labeled the fields on our nonprofit form so browsers can fill them in, and made the mobile menu point at itself only while it exists. Accessibility went from 77 to 100.
6. Thin pages
Several pages had under 300 words. Padding would have been pointless, so we added what a visitor actually wants to know. The contact page now says what to send us and what comes back, and each project page ends with how to start. Content went from 52 to 100.
One more catch before it went live
A security review caught one more thing before this went live. The titles of our posts come from outside the site's code, and a title containing a closing tag could have ended the data block early and run code on the page. We now escape that text before it goes in. It was a real risk, so we fixed it first.
A scan warning that changed our tools
The scan said our guides had no outside links. That was true, and the cause was our own design tool: it could not put a link inside an article. We added link support to it, released that, and then added source links to all three guides. Each guide now links to the standards and official pages it relies on.
The two files as they appear on our live site
chimaeraco.dev/sitemap.xml
chimaeraco.dev/robots.txt
How we know it is real
We built the site and scanned the copy on our own computer first. Then we pushed it live and scanned the live site with a forced fresh crawl.
The forced refresh matters because the scanner we use remembers pages it has already seen. A second scan without it can report the old site. Our first rescan barely moved and still showed the old text. It had read its own notes.
Scanning a copy on our own computer also made our sitemap look like it belonged to a different domain, and the scanner flagged an error. We tested that properly by pointing the sitemap at the test address, instead of ignoring the error. On the live site the sitemap and the pages agree.
What we left alone, and why
A score of 91 leaves some work undone. Here is what is still open.
Small link text in one guide
Adding outside links to our Ad Grants guide made the scanner flag seven small tap targets on phones. They are links inside body text.
Inline scripts
The site still allows them. Closing that door would make every page build on demand, which would slow the site down.
A CAPTCHA on the forms
It needs keys, and we will not ship a half-working one.
Speed
Performance is 73. A stylesheet that blocks first paint and tall page captures hold it down.
Our email policy
It is set to monitor only. Changing it is a DNS decision that we make on purpose, not in the middle of a scan pass.
We list these so you can see the whole picture.
From scan to mockup
For a business we have not worked with, the scan is only the first half. The second half is something they can touch.
We build one thing: a clickable mockup of the new home page, on a desktop screen and a phone screen. It uses the business's own photos, its own words and the colors from its logo. We do not start from a template, and we do not reuse a look from one job to the next, so no two mockups share a layout.
Before it leaves our hands, we test it the way a visitor would. Every link and button gets clicked. The request form gets a bad entry first, then a good one, and the confirmation has to appear. We check the phone version at phone width, and we run a contrast check on every piece of text. You can see the kind of range we mean on our design range page, which holds six working mini-sites in six different looks.
Salt ’n Spool, a concept restaurant site
Old Field, a concept hunt club site
Two of the six mini-sites on our design range page, chimaeraco.dev/styles. Same studio, different looks.
The review page
The mockup goes on one private page, with the findings beside it. The page holds the clickable mockup, a short video that moves from the current site to the new design, the findings in plain language, and a PDF of the screens.
We word the findings as help. Each one says what a visitor would notice, why it matters, and that it is a quick fix. The page shows the strong areas next to the weak ones, because a list of nothing but bad news helps nobody decide anything.
The link is private, and we can see when it is opened. We use that to know when to follow up, and for nothing else.
What it costs the owner
The audit is free, and the owner keeps it whether they hire us or not. If the mockup fits, a fixed quote comes before any work starts. Prices for the full range of work are on our pricing page.
Check your own site in ten minutes
You can run most of this yourself. Replace the example with your own address.
1
Visit yoursite.com/sitemap.xml. A list of your pages should appear.
2
Visit yoursite.com/robots.txt. Some plain text should appear.
3
Search for the name of your business. Does the title of your home page include it, and your town?
4
On a phone, try to pinch and zoom. If the page will not zoom, ask whoever built it to allow it.
5
Open your contact page. Does it name the right town, and does it work on a phone?
6
Look in the footer for a privacy page.
7
Tap into each form field. Do the labels stay visible, and does your browser offer to fill them in?
8
Ask whoever built the site whether every photo has a short description for people who cannot see it.
If four or more of these fail, a scan will find plenty more.
Want us to run it on yours?
Send us your address on our contact page. We will send back the audit within 48 hours, whether you hire us or not.
Where the standards live
Google Search Central SEO starter guide: https://developers.google.com/search/docs/fundamentals/seo-starter-guide
Web Content Accessibility Guidelines: https://www.w3.org/WAI/standards-guidelines/wcag/
The sitemap protocol: https://www.sitemaps.org/protocol.html
Article structured data types: https://schema.org/Article
The Chimaera Co.. We design custom websites, set up the email and IT teams run on, and build the systems behind them.
Related essays & playbooks
Why Most Small Business Websites Break After Two Years (And How to Prevent It)
Most small business websites don't break because of traffic spikes or hackers. They break because 37 plugins updated out of order on a cheap shared host on a Tuesday. Here is how modern web architecture eliminates maintenance decay entirely.
The Plain-English Email Deliverability Checklist: SPF, DKIM, and DMARC
In 2024, Google and Yahoo made DMARC mandatory for bulk senders. If you haven't touched your DNS records since 2019, your domain reputation is leaking. Here is how to lock it down in 20 minutes.