Sample Report

Sample Website Audit Report: Care Home Example

An adapted version of a real audit for a live care home website, with all identifying details removed. Shown in full: the report structure diagram, strategic summary, what the site does well, overall verdict grades, and the first three priority actions — each with business impact, what to do, and developer instructions. The remaining 32 actions are listed by title only. The site health scorecard appears in full at the end.

Customer: [Care Provider]
Website: [example.co.uk]
Generated: 07 May 2026
For viewing only — not for reproduction

Adapted sample — diagram, strategic summary, strengths, grades, and first 3 actions shown in full • actions 4–35 listed by title only • site health scorecard shown in full • reproduction not permitted

D Overall
D SEO
D Security
D Usability
D Content
F Legal
N/A Paid Search
SEO Security Usability Content Legal

Strategic Summary

Your website has some genuine strengths worth building on: the trust logos from CQC, the Alzheimer’s Society, and Dementia Friends displayed on the homepage immediately signal credibility to families searching for care, and the individual care home pages with named managers and direct phone numbers create a personal, approachable feel that many competitors lack. However, the data reveals several serious problems that are almost certainly costing you enquiries right now. One page on your site displays completely unrelated spam content — if a visitor sees that, they will leave instantly and never come back. On top of that, a counter section meant to showcase your experience is displaying “0” for everything — zero years, zero care homes, zero client satisfaction — which directly contradicts every trust claim you make. The single most important action to take first is to remove the spam content from the [Care Home A] page and fix those broken counters, because both issues actively destroy the trust you have worked hard to build.

What the Site Does Well

1

Strong trust signal placement. The homepage displays logos from CQC, carehome.co.uk, the Alzheimer’s Society, and Dementia Friends immediately below the hero section. For families making an emotional decision about a loved one’s care, these third-party endorsements provide instant reassurance and are positioned exactly where visitors will see them first.

2

Personal, accessible care home pages. Each of the three care home pages includes the manager’s name, a direct phone number, and a personal email address. This humanises the business and gives anxious families a clear, low-pressure way to make contact — a significant advantage over larger corporate providers who hide behind generic contact forms.

3

Clear navigation structure. The main menu logically separates services (Dementia Care, Residential Care, Respite Care, Day Care) from individual care homes, with a prominent “Book a Visit” button in the header. Visitors can find what they need within two clicks, which is exactly right for this type of site.

4

Relevant blog content. The blog targets genuinely useful topics like “Care Homes in [Region] Support Healthy Ageing & Wellbeing,” showing an understanding of what families search for. This is a solid foundation for attracting early-stage visitors who are researching care options.

5

Comprehensive footer with legal links. The Privacy Policy, Terms & Conditions, Cookie Policy, Modern Slavery Statement, and Complaints Procedure are all linked in the footer across every page. This demonstrates an awareness of legal obligations, even though the content of some of these pages needs improvement.

6

Basic encryption is in place. The site uses HTTPS, meaning data exchanged between visitors and the site is encrypted. This is the baseline expectation for any website, and it is met.

Overall Verdict

D
SEO (Search Visibility)
With 84 pages missing titles and descriptions, 94 pages missing headings, a broken sitemap, and no structured data, the site is essentially invisible to search engines for the vast majority of its pages.
D
Security
While basic encryption exists, the site is missing all essential protective headers, has a known security vulnerability, and has no email spoofing protection — leaving visitors and the business exposed to common attacks.
D
User Experience
The navigation and trust logos are solid, but broken counters showing “0” for everything, spam content on a care home page, and a vague homepage headline actively push visitors away rather than drawing them in.
D
Content & Messaging
The site covers the right topics but 87 pages have too little content to be useful, the homepage fails to clearly state what the business does or who it serves, and irrelevant text undermines credibility on key pages.
F
Legal & Compliance
The Privacy Policy is missing multiple legally required elements, there is no cookie consent mechanism despite tracking being in use, and the Terms and Conditions lack cancellation rights — all of which expose the business to regulatory fines.
N/A
Paid Search
No Google Ads or Microsoft Ads data was provided for this analysis. To include a paid search audit, export CSV reports from Google Ads and/or Microsoft Ads and drop them into the relevant data/ads/ subfolders before re-running.
D
Overall Site Grade
The business has a strong foundation of services, experience, and trust signals, but the combination of technical failures, content problems, and compliance gaps means the site is significantly underperforming and actively losing potential customers.

Priority Actions

35 actions
01 Remove spam content from the [Care Home A] page High
Business Impact

The page at /[care-home-a-page]/ contains completely unrelated text about “[unrelated spam content]” and “[unrelated spam content].” Any visitor — especially a family member researching care homes — who sees this will immediately question whether the business is legitimate. This single page could be driving away every visitor who lands on it.

What to Do

Delete all unrelated copy from the page body. Leave only content that describes the [Care Home A], its facilities, care types offered, and how to get in touch.

Developer Task

Edit the page in WordPress (Elementor). Remove all paragraph blocks containing references to “[unrelated spam content]” or any other unrelated text. Verify the page URL is corrected from /[care-home-a-page]/ to /[care-home-a]/ (or a clean slug) if possible, with a 301 redirect from the old URL.

02 Fix the broken counter animations on the About page High
Business Impact

The “Our Impact in Numbers” section on the About page displays 0+ Years of Experience, 0 Care Homes, 0+ Care Specialists, and 0% Client Satisfaction. This directly contradicts the “23+ Years” claim elsewhere on the site and makes the business appear brand new with no track record.

What to Do

Either repair the JavaScript animation counter so it displays the correct numbers, or replace the animated counters with static text showing the real figures (e.g., “23+ Years,” “3 Care Homes,” “50+ Care Specialists,” “98% Client Satisfaction” — use verified numbers only).

Developer Task

Inspect the Elementor counter widget on the About page. The animation likely requires JavaScript to trigger on scroll. Check for JavaScript errors in the browser console. If the counter library is failing (possibly due to a plugin conflict or missing dependency), either fix the trigger or replace the Elementor counter widget with a static HTML/text block displaying the verified numbers. Test on both desktop and mobile after fixing.

03 Implement missing security headers across the entire site High
Business Impact

The site is missing every essential protective header, leaving it vulnerable to attacks where criminals could embed your site in a fake page to trick visitors, intercept data, or inject malicious code. If Google detects exploitation, it can flag the site as unsafe in search results, which would destroy organic traffic overnight.

What to Do

Add the following protective headers to the server configuration: Strict-Transport-Security (forces secure connections), X-Frame-Options (prevents the site being embedded in attacker-controlled frames), Content-Security-Policy (blocks unauthorised code from running), X-Content-Type-Options (prevents file type confusion attacks), Referrer-Policy (controls what information is shared with other sites), and Permissions-Policy (disables unused browser features like camera and microphone access).

Developer Task

Add the following to the Apache .htaccess file in the site root (or equivalent Nginx configuration):

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains" Header always set X-Frame-Options "SAMEORIGIN" Header always set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://www.googletagmanager.com https://www.google-analytics.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data:; frame-src 'self' https://www.google.com" Header always set X-Content-Type-Options "nosniff" Header always set Referrer-Policy "strict-origin-when-cross-origin" Header always set Permissions-Policy "geolocation=(), microphone=(), camera=()"

Note: Adjust script-src and frame-src as needed based on all third-party scripts in use. Test thoroughly after implementation.

Each action below includes full Business Impact, What to Do, and Developer Task sections in the actual report.

04 Patch the TLS vulnerability (POODLE) and upgrade PHP High
05 Add a DMARC record to prevent email spoofing High
06 Overhaul the Privacy Policy to meet UK GDPR requirements High
07 Implement a compliant cookie consent banner High
08 Add unique title tags and meta descriptions to all 84 pages missing them High
09 Add H1 headings to all 94 pages missing them High
10 Fix the broken sitemap so search engines can discover all pages High
11 Rewrite the homepage hero section with a clear, benefit-driven message High
12 Implement structured data (schema markup) on key pages High
13 Add Cancellation and Refund Rights clause to Terms & Conditions Medium
14 Fix broken CQC widget links and display inspection ratings Medium
15 Hide server version information to reduce attack surface Medium
16 Optimise images to reduce page weight (approx. 199 KiB savings) Medium
17 Defer render-blocking CSS and JavaScript resources Medium
18 Audit and reduce font file sizes (465 KB icon font identified) Medium
19 Add alt text to all 40 images missing it Medium
20 Expand thin content pages, especially conversion-critical pages Medium
21 Fix 66 orphaned pages by building internal links Medium
22 Fix 6 broken external links Medium
23 Add a sticky mobile call-to-action bar Medium
24 Remove placeholder “Project offers” text Medium
25 Standardise phone number formatting across all pages Medium
26 Add Open Graph images to the 8 pages missing them Medium
27 Create a “Fees & Funding” page Medium
28 Replace weak “Read More” CTAs with benefit-oriented button text Medium
29 Add GA4 analytics to measure and optimise performance Medium
30 Create a security.txt file for vulnerability disclosure Low
31 Replace generic hero images with real photography Medium
32 Add a lead capture form above the fold on the homepage Medium
33 Add a “What Happens Next” section to the Contact page Low
34 Enrich blog posts with conversion pathways Low
35 Add an enquiry type dropdown to the Contact form Low

Paid Search Audit

Google Ads data required

This section is produced by the Paid Search Analyst — a dedicated specialist that only runs when Google Ads or Microsoft Ads CSV exports are provided. The example below shows the kind of findings it produces when account data is available.

Example output — Google Ads account with data provided

Paid Search: C — The account has a functional campaign structure but is wasting 18% of spend on zero-conversion terms, Quality Score is dragging CPCs up across two ad groups, and eCPC bidding should be migrated before Google forces the change.

Category 9 — Keywords

  • Quality Score: Weighted average 5.8 (warning). 3 keywords pulling the average below 5 — "residential care home cost", "nursing home near me fees", "dementia care pricing". Low Ad Relevance scores suggest headlines don't closely mirror the search term. Add dedicated ad group per intent cluster with matching headlines.
  • Lin-Rodnitzky ratio: 2.4 (warning — approaching waste). Average CPA across all terms is £147; average CPA on converting terms is £61. Ratio of 2.4 indicates moderate targeting sprawl — tighten with negative keywords before scaling budget.
  • Zero-conversion wasted spend: £310 spent on 47 terms with zero conversions in 90 days. Top candidates for negatives: "care home jobs", "care home inspection report", "CQC ratings care home".
  • Keyword cannibalization: "care home" (Broad) and "care home" (Phrase) running in two separate ad groups — bidding against itself, inflating CPCs by an estimated 12–18%.

Category 12 — Responsive Search Ads

  • Ad Strength: 2 of 5 active RSAs rated Poor. Both in the "General Care" ad group. Needs a minimum of 10 headlines (currently 6) and 4 descriptions (currently 2) to unlock full rotation.
  • Legacy ads: 1 Expanded Text Ad still active in the "Respite Care" ad group. ETAs are deprecated — add an RSA to this group and pause the ETA.

Category 13 — Assets / Extensions

  • Sitelinks: Main campaign has only 2 sitelinks (minimum 4 recommended). Add: Respite Care, Meet the Team, Fees & Funding, Book a Visit.
  • Callouts: 3 callouts present (minimum 4). Add one more — e.g. "CQC Registered", "24/7 Nursing Support".
  • Call asset: Missing. Add a call asset with the main enquiries number — click-to-call from mobile ads is a direct lead driver for care homes.

To unlock this section for your report, export CSV files from Google Ads (Search Terms, Keywords, Campaigns, Ads, Assets, and optionally PMax) and include them when submitting your data.

Site Health Scorecard

Deterministic checks

Deterministic checks run directly against the collected data — independent of the AI analysis above. Each item is factual, not inferred.

The full report includes an explainer for each item below — what it is, why it matters, and what the finding means for this site.

SEO — On-Page 9 / 11 checks passed
✓
Title Tag
54 characters — within the recommended 50–60 range.
✓
Meta Description
136 characters — present and within the recommended range.
✓
H1 Heading
Present — “[Homepage H1 heading] Experience our Excellence in Care.”
✓
H2–H6 Subheadings
27 H2 headings found — good content hierarchy in place.
✓
HTML Language Declaration
Set — lang="en-US". Helps browsers and search engines identify page language.
✓
Content Amount
1,854 words — sufficient depth on the homepage for search engine understanding.
✗
Image Alt Attributes
1 of 24 images missing alt text (5% uncovered). Alt text is required for accessibility and image search visibility.
✓
Canonical Tag
Present — pointing to https://[example.co.uk]/. Prevents duplicate content issues.
✓
Noindex Tag
Not present — homepage is correctly indexable by search engines.
✗
Schema.org Structured Data
Not found. No structured data markup on the homepage. Missing opportunity for rich search results.
✓
Analytics
Google Tag Manager detected — analytics likely configured via GTM.
Technical SEO 4 / 4 checks passed
✓
XML Sitemap
Found at /sitemap.xml. Note: the sitemap_index.xml contains zero URLs — see priority action 10.
✓
Robots.txt
Present and valid. Controls which pages search engine crawlers can access.
✓
HTTPS Redirect
HTTP correctly redirects to HTTPS on all pages.
✓
SSL Certificate
Valid — SSL Labs grade: A. TLS configuration scores well.
Security 1 / 6 checks passed
✗
HSTS Header
Missing. Without Strict-Transport-Security, browsers do not enforce HTTPS, leaving connections vulnerable to SSL stripping attacks.
✗
Content Security Policy
Missing. No CSP header set — the primary defence against XSS attacks is absent.
✗
DMARC (Email Authentication)
DMARC DNS record not found. Anyone can send emails pretending to be from your domain.
✓
SPF (Email Authentication)
SPF record present — helps prevent basic email spoofing.
✗
X-Frame-Options
Missing. The site can be embedded in attacker-controlled frames, enabling clickjacking attacks.
✗
X-Content-Type-Options
Missing. Browsers may interpret files as a different MIME type than intended, enabling content injection attacks.
Performance 1 / 2 checks passed
✗
PageSpeed — Mobile
No data — PageSpeed Insights did not return a result. PageSpeed measures how fast your page loads and identifies specific improvements. A score of 90+ is good, 50–89 needs improvement, below 50 is poor.
✓
PageSpeed — Desktop
80/100 — Needs improvement. Google PageSpeed Insights scores your page’s loading performance on desktop on a 0–100 scale. Scores of 90+ are good, 50–89 need improvement, below 50 is poor.
Content & Discoverability 2 / 3 checks passed
✓
Google Business Profile
Found — [Care Home B] | Rating: 4.1/5. A Google Business Profile makes your business visible in Google Maps and local search results. Reviews and profile completeness are key local SEO ranking factors.
✗
External Link Profile
No data — export the GSC Top Linking Sites CSV to see your link profile. External backlinks are one of Google’s most important ranking signals.
✓
Privacy Policy
Found at /privacy-policy. A Privacy Policy is a legal requirement under UK GDPR for any website that collects personal data, including via analytics cookies.
GEO — Generative Engine Optimisation 2 / 3 checks passed
✗
Identity Schema
Not found — no Organization, LocalBusiness, or Person schema on the homepage. Without it, Google and LLMs have to infer what your business is from unstructured text, increasing the chance of being misrepresented or omitted from AI-generated answers.
✓
LLM Content Readability
11.5% JS-rendered — content is predominantly in raw HTML (good for LLM readability). LLMs and many crawlers read raw HTML without executing JavaScript — a low rendering percentage means your content is fully readable by AI systems.
✓
llms.txt (AI Discoverability)
Present at /llms.txt. llms.txt is an emerging standard that helps AI assistants (ChatGPT, Perplexity, Copilot) understand what your site offers, improving your chances of being cited in AI-generated answers.
Legal & Compliance 0 / 3 checks passed
✗
Privacy Policy
Missing mandatory UK GDPR disclosures — the policy does not name the data controller, specify retention periods, or explain data subject rights. A non-compliant Privacy Policy exposes the business to ICO enforcement action and reputational risk.
✗
Cookie Consent
No cookie consent mechanism detected despite analytics tracking being active. UK GDPR and PECR require informed, prior consent before placing non-essential cookies. Absence is an ICO enforcement risk.
✗
Accessibility (WCAG 2.1)
7 critical violation instance(s) detected across crawled pages (image-alt, button-name) — fails WCAG 2.1 Level AA. UK websites must not discriminate against disabled users under the Equality Act 2010. Fix critical violations first: missing alt text on images and unlabelled form fields.

Appendix: Page Performance Data

Included in full report

The full report includes the following appendix sections. Content is not shown in this sample.

Page Performance Scores
Real-user data (CrUX)
Desktop lab score
Diagnostics
Render blocking requests — Est. savings of 560 ms
Tasks
Resources Summary
LCP request discovery
3rd parties
Image elements do not have explicit width and height
Layout shift culprits
Avoid large layout shifts — 4 layout shifts found
LCP breakdown
Server Backend Latencies — 10 ms
User Timing marks and measures — 5 user timings
Network dependency tree
Use efficient cache lifetimes — Est. savings of 1,316 KiB
Avoid non-composited animations — 5 animated elements found
Legacy JavaScript — Est. savings of 12 KiB
Forced reflow
Network Requests
Optimize DOM size
Improve image delivery — Est. savings of 199 KiB
Network Round Trip Times — 0 ms
Avoid enormous network payloads — Total size was 3,091 KiB
Avoid long main-thread tasks — 6 long tasks found

Appendix: Web Security Audit Raw Data

Included in full report

The full report includes the following appendix sections. Content is not shown in this sample.

Web Security Audit
HTTPS & TLS
TLS Grade
Security Headers
Information Disclosure
Cookie Consent Banner
Sensitive Paths
Email Security (DMARC / SPF / DKIM)
Security.txt (Vulnerability Disclosure)
Rendering Consistency (Googlebot vs Bingbot vs browser)
Schema Markup Validation (Google Rich Results Test)
AI Bot Access — 36 crawlers checked via robots.txt and live HTTP
Robots.txt — with platform-specific setup instructions and sample file if missing
llms.txt — with generated sample file if missing

Appendix: Site Crawler Data

Included in full report

The full report includes the following appendix sections. Content is not shown in this sample.

Site Crawler Data
URL Structure Analysis (depth, slug quality, taxonomy consistency)
Search Intent & Schema Alignment
Structured Data Property Completeness — JSON-LD and Microdata objects extracted per page, showing which recommended properties are present vs missing for each schema type
Internal Link Graph • 312 pages • 4,847 followed internal links
Inlink distribution: 66 orphan pages (0 inlinks) • 43 pages with 1 inlink • 118 pages with 2–5 inlinks • 71 pages with 6–20 inlinks • 14 pages with 21+ inlinks
Top pages by internal PageRank (link equity concentration): / • /care-homes/ • /dementia-care/ • /about/ • /contact/ • /locations/ • /nursing-care/ • /respite-care/ • /blog/ • /fees-funding/
Sample orphan pages (66 total — see action 21): /care-home-ashford/ • /care-home-dover/ • /care-home-folkestone/ • /news/spring-activities-2023/ • /news/dementia-awareness-week/
Crawl depth: 41 pages at depth 1 • 98 pages at depth 2 • 127 pages at depth 3 • 46 pages at depth 4+ ⚠ buried content
Accessibility — WCAG Violations (axe-core) • 23 violation instances across 8 pages
[CRITICAL] image-alt — Images must have alternate text (7 instances)
[SERIOUS] color-contrast — Elements must meet WCAG 2 AA colour contrast ratio thresholds (6 instances) • on: /, /about/, /care-home-b/
[SERIOUS] link-name — Links must have discernible text (4 instances) • on: /, /care-home-a/, /care-home-c/
[SERIOUS] label — Form elements must have labels (3 instances) • on: /contact/
[MODERATE] heading-order — Heading levels should only increase by one (2 instances) • on: /blog/, /care-home-b/
[MINOR] region — All page content should be contained by landmarks (1 instance)

Appendix: SERP Position Checks

Included in full report

Live Google rankings checked for up to 10 priority keywords — selected from GSC data as the highest-impression queries where the site ranks between positions 5 and 30 (the most improvable targets). Checks are run at report time against the live SERP.

Keywords Where Client Is Ranking
care home [location] — #6 • Competitors: carehome.co.uk, caredirectory.co.uk, nhs.uk • Features: people_also_ask, local_pack
residential care [location] — #8 • Competitors: carehome.co.uk, carehomeselect.com, nhs.uk • Features: local_pack, featured_snippet
dementia care home [location] — #9 • Competitors: dementiauk.org, carehome.co.uk, nhs.uk • Features: people_also_ask, knowledge_graph
Keywords Where Client Is Not in Top 10
nursing home near me, care home with nursing [location], elderly care [location]
Most Frequent Organic Competitors
carehome.co.uk (7×) • nhs.uk (5×) • caredirectory.co.uk (4×) • carehomeselect.com (3×) • dementiauk.org (2×)
SERP Features Present (opportunities to capture)
People Also Ask on 6 keywords — structured FAQ schema could earn these positions
Local Pack on 8 keywords — Google Business Profile optimisation directly affects local pack visibility
Featured Snippet on 3 keywords — concise definition-style answer content could capture these

Appendix: Data Sources

Included in full report

The full report documents all data sources used in the analysis. Content is not shown in this sample.

Ready to See Yours?

Get a report for your website

Every Wise Ranker report is tailored to your specific site — your traffic, your competitors, your compliance obligations. Delivered to your inbox within 24 hours.

Get Your Report

Not ready to order? Start with a free automated website check — no card required.

Questions? hello@wiseranker.co.uk