Start with a full content and URL inventory, then layer on technical SEO, accessibility, security and consent checks — in that order, since the inventory determines what the rest of the audit even needs to cover.
Before checking anything else, get a complete list of what exists: every URL, its traffic, its owner, and whether anyone still needs it. Most audits skip this and check quality on pages that should have been retired years ago.
Technical SEO (indexability, structure, multilingual targeting), accessibility against EN 301 549 and WCAG 2.1 AA, security hardening and account review, and consent implementation each need their own dedicated pass. See technical SEO audit, accessibility compliance and GDPR and consent for how we run each specifically.
The output should be a ranked list of what actually needs fixing first based on impact and risk, not a long undifferentiated list of every issue found — a hundred low-impact findings are less urgent than three high-risk ones.
Parts of this can be done internally, but technical SEO, accessibility and security audits typically benefit from specialist tools and experience most internal teams do not use day to day. A hybrid approach, where internal teams handle content review and a specialist handles the technical checks, often works well.
This should happen at least annually for an active site, and always before a major project such as a redesign or migration, since undertaking major changes without a current audit risks carrying forward problems no one has flagged. An annual cadence also catches gradual drift, such as broken links or outdated content, before it accumulates.
Orphaned or forgotten properties tend to be the single most valuable finding, since they often carry compliance risk no one is actively managing. See how many websites does a pharma company need for how to think about what should happen to a site once an audit surfaces it as forgotten or redundant.
A useful audit report should prioritise findings by risk and effort rather than simply listing every issue found, so a team can act on the highest-impact items first. It should also include enough specific detail, such as the exact page or URL affected, that someone unfamiliar with the audit can act on it directly.
Tell us what you have and we will tell you what a proper audit would cover.