Website Audit Tools: 7 Worth Knowing and What Each One Checks

A website audit tool is software that checks your live site against a set of rules and hands back a list of problems. Most of them focus on one job: speed, search, accessibility, or security. None of them checks everything, so the best website audit tools for you are the 2 or 3 that cover what your site can't afford to get wrong.

If you search for a website audit tool, most of what comes back is SEO software. That's useful, but it's only part of the picture. This guide maps the whole set: what each kind of tool checks, 7 tools worth knowing (ours is one of them, and we'll say so when we get there), what they cost, and how to put a few together without drowning in reports. If you're paying someone to audit your site instead, our guide to choosing a website audit service is the better read.

What is a website audit tool, and why use one?

It's a checker that reads your site and compares what it finds to a fixed list of rules. Some rules are about speed (how fast the page shows up), some about search (can Google read it), some about access (can a person using a screen reader get through it), and some about security settings.

The reason to automate this is simple. You can't click every link on every page every week, and a tool can. Automation is great at the boring, repeatable checks: broken links, missing page titles, a header that should be there and isn't. That frees you to spend your own attention on the questions a rule can't answer, like whether a customer understands what you sell.

I think of a website audit tool the way I think of a smoke detector. It's cheap, it's always on, and it tells you something is wrong. It doesn't tell you whether the house is nice to live in.

What kinds of website audit tools are there?

These 6 kinds cover almost everything a founder will run into.

There's one more kind worth knowing exists: code review tools, which read your source code rather than your live pages. None of the 7 below do that. If your app takes payments or stores private data, that's a job for a developer or a security specialist, and our vibe coding security guide covers what to check yourself first.

Which 7 website audit tools are worth knowing?

1. PageSpeed Insights (with Lighthouse). Lighthouse is an open-source tool, documented on Google's Chrome for Developers site, that audits a page. PageSpeed Insights runs it for you and reports on Performance, Accessibility, Best Practices, and SEO: paste a URL and you get lab results (a simulated page load) for mobile and desktop. It can also show field data, meaning measurements from real Chrome users over the previous 28 days. What it can't tell you is whether a fast page makes sense to a customer.

2. Google Search Console. This is Google's free service for seeing your site the way Google Search does. It shows whether Google can crawl your pages (visit and read them), which pages are indexed (stored so they can appear in results), what searches show your site, and how often people click. It also sends alerts when Google hits a problem. You add your site and prove it's yours (more on that below). It's the only tool here that reports what Google actually did, not what a checker predicts. Our Lovable SEO guide shows what to look for if you built with Lovable.

3. Screaming Frog SEO Spider. A desktop program for Windows, macOS, and Linux that crawls your whole site the way a search engine would. It reports broken links, server errors, redirect chains (one address forwarding to another, then another), and missing or duplicate titles and descriptions. The free version crawls up to 500 URLs, which covers most small sites. Its pricing page lists a paid licence at $279 a year (read 20 October 2026).

4. Semrush Site Audit. An online crawler that runs over 140 technical and on-page SEO checks (on-page means what's written on each page, like titles and headings), including HTTPS, broken links, duplicate content, and whether pages can be crawled and indexed. It's built for repeat runs, with re-crawls scheduled daily or weekly. Its knowledge base lists 100 pages a month without its SEO Toolkit, with bigger limits on paid plans.

5. WAVE. WebAIM's accessibility checker. You can paste a URL into the online tool or use the browser extensions for Chrome, Firefox, and Edge, which run inside your browser. WebAIM says the extensions can check password-protected pages too. WAVE marks errors and alerts right on the page. Its own help pages are refreshingly honest: WAVE can't tell you whether your content is accessible, and only a person can decide that. So a clean WAVE run is a start on accessibility compliance, not proof of it.

6. Mozilla HTTP Observatory. A security header scanner from Mozilla. Enter your domain and it checks settings like redirects to HTTPS (the encrypted version of your site), Strict-Transport-Security (a header that tells browsers to always use the secure version of your site), Content-Security-Policy (a header that limits which scripts a page may run), and insecure cookies, then gives a grade like A+ with a score. Mozilla is clear that an A+ doesn't mean your site is secure, and that it doesn't check things like outdated software or weak password storage.

7. Is My App Slop. This is ours, so read this one knowing that. It's a visitor-eye audit: an AI audit scored against a fixed rubric, reading your public pages the way a customer would. It reads the rendered page plus desktop and mobile screenshots, clicks through public pages, may submit a form once with clearly labeled test details, and checks for fingerprints AI builders leave behind. You get a score out of 100 across six product dimensions: Clarity and Promise, Craft and Design Integrity, Trust and Legitimacy, Flow and Usability, Mobile and Access, and Conversion and The Ask. Your overall score and all six dimension scores are free (one free check per site). The full report is $27 and adds every finding, the fixes ranked by impact, ready-to-paste prompts, screenshots, and a PDF. It's not a security review or a full accessibility audit, and it can't see anything behind a login.

What features should a website audit tool have?

The feature lists are long. These are the 6 I'd actually look for on a small team.

1. Clear scope. It should say which pages it read and which it couldn't. A tool that hides its limits makes you trust it more than you should.
2. Mobile and desktop. If your customers find you on their phones, a tool that only tests desktop is grading the wrong site.
3. Ranked findings. A list of 80 issues with no order is a to-do list you'll never start. Look for severity or impact so the worst problem is first.
4. Evidence. Screenshots, the exact URL, or the line of code, so you can see the problem yourself before you fix it. I don't act on a finding I can't see.
5. History. A record of past runs (an audit trail) lets you show that a fix worked and spot when something breaks again.
6. Reporting and dashboards you'll actually read. A one-page summary beats a 40-tab export if you're the only one reading it.

Nice extras: scheduled runs and alerts for continuous monitoring, workflow automation like Lighthouse CI (a companion to Lighthouse that runs checks on each change so a fix doesn't quietly get undone), and an API or other integration (a way for other software to start a run or pull results) if you want audits wired into your build process.

Free or paid: what does website audit software really cost?

Some of the strongest tools cost nothing: Google calls Search Console a free service, and Lighthouse is open source. Others use a free tier with a ceiling, like Screaming Frog's 500 URLs or Semrush's 100 pages a month, then charge by the year or by plan. Ours gives you the scores free, then the full report is one payment of $27, with no account and nothing that renews.

The bigger cost is usually your time. Every tool you add is another report to read, another login, and another list of warnings to sort. I'd rather a founder run 3 tools well than 7 tools badly.

One more cost: false alarms. Automated checkers flag things that turn out to be fine, and every one takes time to rule out. That's not a reason to skip them, just a reason to start small.

So test before you commit. Run each tool you're considering on your home page and one other page, and read what comes back. If the first report is something you'd act on this week, the tool has earned a place. If it's 60 warnings you don't understand, it hasn't, however good its reviews are. Most of these take minutes to try, which is the cheapest proof of value you'll get.

What access and data does each tool need?

This is where tools differ more than people expect, and it's worth a look before you hand anything over.

• No access needed: PageSpeed Insights, the WAVE online tool, Mozilla HTTP Observatory, and our audit all read public pages from the outside. Mozilla notes that scan history for each domain is public.
• Proof you own the site: Search Console starts collecting data when you add your site, but full access goes to verified owners. You verify by adding a DNS record (a setting where you bought your domain), uploading a small file, adding a tag to your home page, or through Google Analytics or Tag Manager. These access controls matter, because owners can see sensitive search data and change how the site shows up in Google.
• Software on your computer: Screaming Frog installs locally. WAVE's browser extensions run inside your browser, and WebAIM says no information is sent to its server, which is why they can check pages behind a login.
• An account: Semrush Site Audit runs inside a Semrush account.

A good habit: give each tool the least access it needs. A security header scanner has no business asking for your passwords, and I'd be wary of any outside checker that does.

How do the 7 compare side by side?

If you only pick one from each row of needs, here's how I'd sort it. Launching soon with no traffic yet: PageSpeed Insights, WAVE, and a visitor-eye audit. Already live and wondering why Google isn't sending anyone: Search Console first, then a crawler. Growing a bigger site with lots of pages: a scheduled crawler for continuous monitoring, with the free tools as spot checks.

How would a founder put 3 tools together?

Hypothetical example: a founder (we made her up) has built an app that helps youth soccer coaches organize carpools. It has a home page, a sign-up form, and a short pricing page, and she wants to share it with her league next week. Here's a simple risk assessment, sorted by what would hurt most.

Search Console and a crawler can wait until she has more pages and some search traffic. That's the point of ordering by risk: 3 tools, one afternoon, and the problems a parent would hit get fixed first. Then she'd want real people to try it, and our website usability testing guide has a 3-task script for that.

Can you trust AI in a website audit tool?

Partly, and it depends on the job. Rule-based checks (is there a page title, does this link return an error) are reliable because the answer is yes or no. AI is useful where judgment comes in, like reading a page and asking whether the headline matches what the app does, and that's how our audit works. But AI judgment is still judgment. It can miss things, and it can't know whether your claims are true or whether your tone fits your customers.

My rule: let automated tools do the repeatable checks, use an AI audit for the customer's-eye read, then check the top fixes yourself before you act. Our guide on what automated checks catch and miss goes deeper, including where a human review still earns its keep.

How do you know your audits are working?

Pick a few numbers and watch them move. For a small site, these are plenty:

• Your score or error count over time, from the same tool on the same pages. Same tool, same pages, or the comparison means nothing.
• Issues fixed vs issues found each round. If the list only grows, you're running more tools than you're acting on.
• One real outcome, like sign-ups or contact form submissions, checked in your analytics before and after a fix.

Re-run your audit after any big change, and set a monthly reminder for the free tools. Continuous monitoring doesn't have to mean expensive software. A recurring calendar block counts. And remember that no tool here makes you compliant with an accessibility or security standard on its own. They help you find problems, and they don't certify anything.

If you want the full do-it-yourself version for search, our website SEO audit checklist walks through 8 checks. The tools are the easy part. Acting on what they find, one fix at a time, is where your site actually gets better.

Sources, all read 20 October 2026: Lighthouse overview (developer.chrome.com, updated 2 June 2025); About PageSpeed Insights (developers.google.com, updated 21 October 2024); About Search Console and Verify your site ownership (support.google.com); Screaming Frog SEO Spider page and pricing page (screamingfrog.co.uk); Semrush Site Audit knowledge base (semrush.com/kb, undated); WAVE home, help, and extension pages (wave.webaim.org); HTTP Observatory page and FAQ (developer.mozilla.org).