Find out what state your site is in
Most owners of a business website cannot say whether it is fast, whether it is safe to leave as it is, or what it would take to fix. The Website Risk Analysis is a deep audit of the site's security, code, search and speed that answers those three questions in writing, in five working days, for a fixed price. The report is yours whatever you do next.
- Fixed price and fixed scope.
- Delivered within five working days of access.
- The report is yours. No obligation to proceed with us.
More than a speed test
You may already have run a free speed test on your site, such as Google's PageSpeed Insights. It is useful, but it answers a much smaller question than this audit.
What a free speed test tells you
How fast one page loads, as a score, in about a minute. It does not check whether the site can be broken into, whether the code is sound, or whether search engines and AI can read it.
What this audit tells you
Where your whole site stands on security, code, search and speed, checked by hand by an engineer. You get a ranked list of what to fix, what each fix costs and what happens if you do nothing.
What we check
Security
We check
Platform and plugin versions against known flaws; abandoned plugins; how exposed the login is; encryption and headers; backups; signs of past compromise.
You get
The exposures ranked by likelihood and damage, and the actions for this week.
Code
We check
Markup; accessibility spot checks against WCAG 2.2 AA; broken links and duplicate addresses; redirect chains; third-party scripts and tags.
You get
A defects list with severity.
Search
We check
Whether pages can be indexed; sitemap and robots file; titles; structured data; how the site reads to AI search; which pages earn visits.
You get
What holds the site back, and what to keep if you move it.
Speed
We check
The home page and the three pages that matter most, on a mobile phone: time to main content, layout shift, page weight.
You get
Pass or fail against the published thresholds, the three biggest causes, and the fix for each.
How each check is done
- Security
- Vulnerability databases, header scans, a file and user review where you give access.
- Code
- A crawler, a validator, an accessibility checker.
- Search
- A crawl and Search Console where you give access.
- Speed
- Google's real-visitor data where it exists, lab runs where it does not.
Every measurement is taken one at a time with everything else held equal, so the report says what is causing each problem rather than guessing.
What you get
A short report in plain English, in two parts. Page one is a summary an owner reads in five minutes: the three answers, a rating for each area and the recommendation. The appendix is for whoever does the work: every finding, its evidence and its fix. It ends with three options, each with an honest cost and consequence. Sometimes the recommendation is to do nothing yet, and we say so.
See page one of a real report
The three answers
- Is it fast?
- Partly. Main content on screen in 3.5 s on a phone in a lab test, against our target of under 2.0 s and Google's 2.5 s. Nothing moves while it loads, and the page is light at 732 KB.
- Is it safe to leave as it is?
- Yes, with one fix. There is no login, plugin or database to attack. But Google Analytics starts and sets two cookies the moment the page opens, with no notice and no choice.
- What would it take to fix?
- Fixing in place means four small changes, set out below. Moving it is a larger job and is not needed to fix any of them.
Ratings, from the source outwards
1. Code ▲ Needs work
Analytics loads and sets the cookies _ga and _ga_JKX0NB0SM7 before any visitor has chosen. It is the only third-party script on the page.
2. Speed ▲ Needs work
Main content in 3.5 s (median of five runs, from 1.9 to 4.2 s). The lab score of 91 out of 100 hides it.
3. Security ● Low risk
No application to attack. No Content-Security-Policy is sent, and Mozilla's Observatory grades the headers B (70 of 100).
4. Search ▲ Needs work
The page title and description are added by a script, so none of the 13 pages crawled sends one in its HTML. The sitemap named in robots.txt returns a 404 error.
Three options, and our recommendation
Our recommendation. Fix the analytics today, whatever else you decide: it is the only finding that is a legal exposure, not a technical one. The site is otherwise sound. We rebuilt it for its content and design, not because the findings demanded it.
Method. Lighthouse 13.6.0, mobile profile, five runs on the home page, 31 October 2026. Headers read from the live response the same day, and Mozilla HTTP Observatory run the same day. Pages found by following links from the home page, to two levels. Cookies and requests listed from a fresh page load with no interaction.
Before you start
What we need from you
The address and the three pages that matter most. For the security and search parts, a read-only login and viewer access to Google Search Console, both removable the day the report arrives. Without access, the analysis runs on what is visible from outside and says which findings that limits.
Turnaround
We agree a fixed price before we start, and deliver within five working days of receiving access.
What it is not
Not a free audit that turns into a sales pitch, and not a quotation. The report gives cost ranges for each option so you can get other quotes with it.
Send us your site address.
An engineer will reply within one working day to confirm scope and start date.
Last reviewed 28 October 2026.