Site Audit

What Gets Measured

The audit runs against the production site, not a copy. Staging environments hide the problems that matter: real traffic, real product counts, real third-party tags, real database size.

Performance is measured on the templates that carry the traffic:

• The home page
• The highest-traffic landing page, taken from your analytics rather than guessed
• A category or listing page, at its real product or post count
• A detail page
• For a store, the checkout, measured separately, because it is the only journey where a slow page has a directly countable cost

Each of the four areas is checked against a published standard, not against an opinion:

Area	What is measured	Against
Performance	LCP, INP, CLS, transfer size, request count, server response time	Core Web Vitals thresholds, field data where it exists
Security	Versions, known advisories, exposed endpoints, file permissions, backup state	CVE database, vendor advisories
GDPR	What is set before consent, what the consent tool actually blocks, where data goes	GDPR Art. 5–7, ePrivacy, EDPB guidance
Accessibility	Contrast, keyboard paths, focus order, labels, headings, media alternatives	EN 301 549 v3.2.1, which incorporates WCAG 2.1 AA

Where a standard genuinely has room for interpretation, the report says so rather than reporting a judgement call as a failure.

How Findings Are Ranked

Findings are ordered by what fixing them returns, not by how alarming they look in a scanner. A render-blocking script on the busiest template outranks a theoretical vulnerability in an admin screen two people use.

Each finding carries an effort estimate in hours or days, and lands in one of four bands:

Now

Actively costing money, leaking data, or breaking the law today.

Next

Clear return, bounded effort. The bulk of most reports sits here.

Worth doing

Real improvement, but the effort is large or the return is slow.

Noted

True, and not worth your money. Recorded so nobody re-raises it later.

Where a fix is cheap and the return is uncertain, that is stated plainly rather than padded into a recommendation.

The Report Itself

A written report, in plain language, with the evidence attached: traces, headers, queries and screenshots. It is written to be read by whoever ends up doing the work, whether that is me, your existing developer, or an agency you have not chosen yet.

There is no presentation deck, no scorecard out of one hundred, and no retainer attached to the end of it.

What It Costs, And Why That Number

€1,200, excl. VAT. Fixed before anything starts, and it does not move because the audit found more than expected. Finding more is the job.

It buys five working days: four spent measuring, one spent writing. If the fixes are then worth doing, they are quoted separately and this fee is not a deposit against them. You are free to take the report to your own developer, to another agency, or to nobody at all.

For EU businesses outside Romania the reverse charge applies, so the invoice carries no VAT where you supply a valid VAT number.