DIY Website Checklist for beginners (Version 1)
Many small business clients and those just getting started out sometimes ask a lot of questions many of which are trivial if you already know but not necessarily impossible to understand and do yourself given a bit of a nudge in the right direction. Usually I'll say give it a try yourself first and if you struggle give me a shout. If anything this will give a basic understanding on what is needed and why.
So here is a DIY checklist that small businesses who run their own website can follow to get a head start, I've tried to keep this as simple as possible for a target audience with minimal experience. This won't make you an expert or put specialists out of a job as this can only scratch the surface but hopefully it will either empower you to perform some of these optimisations yourself or at least help you build a vocabulary you can discuss with specialists so they don't need to rip you off.
This is by no means comprehensive, I'd encourage users to do some additional follow up research but the aim here is to take it one step at a time one section at a time!
Try your best to follow along a few at a time, maybe start with the low effort / easy ones in one category and go from there, if you get stuck take a break and come back later and try again. If you still struggle, feel overwhelmed or simply just can't be arsed head over to our contact page and drop us a message via our contact page :) Downloadable spreadsheet near the bottom of this article.
With any of these measures I'd say keeping a backup copy before making changes so you can always roll back if it's not working out or you make a mistake!

SEO
SEO Checklist
| Check | Why this matters | How to check this | How to remediate / apply | Effort | Impact |
|---|---|---|---|---|---|
| Page is indexed by Google | Unindexed pages cannot rank or receive organic traffic** | Search site:yourdomain.com/page-url or use GSC "URL Inspection" | Remove noindex tags, fix blocked URLs, or request indexing in GSC | Low | High |
| Unique page titles | Prevents keyword cannibalisation and improves rankings | Open multiple pages and compare browser tab titles (hover over the tab or right click the page view source, look for <title>) | Write unique, keyword-focused titles (under 60 chars) | Low | High |
| Meta descriptions present | Improves click-through rate from search results | View page source (right click view source) or SEO browser extension | Add concise summaries (140–155 chars) with a Call to Action | Low | Medium |
| One H1 per page | Helps search engines understand main topic hierarchy | Inspect page headings using browser dev tools (right click inspect page or similar) | Ensure a single clear H1; move secondary titles to H2 or H3 | Low | Medium |
| Clean, readable URLs | Clear URLs improve crawlability and user trust | Look at address bar | Use hyphens; remove IDs, symbols, and "stop words" | Medium | Medium |
| Sitemap exists and submitted | Helps search engines find all pages, including deep ones | Check /sitemap.xml or Search Console (Also can view page source and look for sitemap as it may be a different address e.g. /sitemap_index.xml) | Generate sitemap via CMS or plugin and submit to GSC | Low | High QUICK WIN |
| Robots.txt not blocking pages | Accidental blocks can remove site from search | Visit /robots.txt | Remove incorrect Disallow rules blocking core content or CSS | Low | High QUICK WIN |
| Internal links exist | Distributes "link equity" and helps crawlers find pages | Use GSC "Links" report to find "Orphan Pages" | Add contextual links between related pages | Medium | Medium |
| Image alt text present | Improves accessibility and image search ranking | Right-click image → Inspect → alt attribute | Add descriptive alt text to images (avoid keyword stuffing) | Low | Medium |
- GSC - Google Search Console
A word on SEO
SEO isn't just something that you have or do not. Even with the best SEO in the world you are not guaranteed visitors. Be aware of competition for your keywords and user intent based on their searches. There's a lot of misinformation regarding SEO on the web and many older techniques that are no longer relevant. Ultimately you can't force Google (or other search engines) crawlers to do anything you can request crawls, and provide hints for the search engines and guide them. Do focus on local search as competion will be smaller and your potential audience will be more accessible and relevant. I encourage further reading on this subject but take any information with a pinch of salt.
Old McDonald had a farm AEO SEO GEO
While Answer Engine Optimization (AEO) and Generative Engine Optimization (GEO) are evolving fields, they are largely extensions of high-quality SEO, they are also out of scope of this article, if you're following the best principles to building your content well for humans, you should be already headed in the right direction but if you're not discoverable to begin with the optimisation is moot. Feel free to read up on AEO and GEO and decide for yourself if they're just a subset of SEO or not.
The SEO Toolkit (If you're feeling brave)
| Tool | Best For | Cost | Why use it? |
|---|---|---|---|
| Google Search Console | Performance & Indexing | Free | The "source of truth" for how Google sees your site and any crawl errors. |
| Screaming Frog SEO Spider | Technical Audits | Free/Paid | An industry-standard "crawler" that finds broken links and missing meta data. |
| Semrush / Ahrefs | Keywords & Competitors | Paid | Powerful "Swiss Army knives" for seeing what keywords your competitors rank for. |
| Google PageSpeed Insights | Speed & UX | Free | Checks your "Core Web Vitals" to ensure your site isn't too slow for users. |
| AnswerThePublic | Content Ideation | Free/Paid | Visualizes the actual questions people type into Google to help you plan posts. |
| Surfer SEO / Clearscope | Content Optimization | Paid | Uses AI to tell you exactly which terms to include in a post to help it rank. |
For those just starting out, Google Search Console and the free version of Screaming Frog are the ultimate "power couple," providing almost all the technical insights you need without costing a penny.
Further Reading
- Google's own SEO Starter guide - straight from the horses mouth https://developers.google.com/search/docs/fundamentals/seo-starter-guide
- Google My Business Getting Started: https://support.google.com/business/answer/15697615
- WordPress SEO (If you're already using Wordpress you have some SEO built in but can still be improved): https://wordpress.com/support/seo/

Performance
Performance Checklist
| Check | Why this matters | How to check this | How to remediate / apply | Effort | Impact |
|---|---|---|---|---|---|
| LCP under 2.5s | Largest Contentful Paint measures perceived load speed | PageSpeed Insights → LCP metric | Optimize hero images, use a CDN, and prioritize critical CSS | Medium | High |
| INP under 200ms | Interaction to Next Paint is the 2026 standard for responsiveness | GSC → Core Web Vitals → INP | Defer non-critical JS, minify scripts, and use web workers | High | High |
| Text compression (Brotli) | Reduces the "weight" of HTML, CSS, and JS files | PageSpeed → "Enable text compression" | Enable Brotli (preferred) or Gzip via server or CDN | Low | High QUICK WIN |
| HTTP/2 or HTTP/3 enabled | Faster parallel asset loading and zero round-trip (0-RTT) | WebPageTest → Protocol | Enable via hosting provider or CDN (e.g., Cloudflare) | Low | High |
| Lazy loading enabled | Prevents loading off-screen images until needed | Inspect <img> tags for loading="lazy" | Add loading="lazy" attribute to all non-hero images | Low | High QUICK WIN |
| No self-hosted video | Large video files stall page loading and eat bandwidth | Check if videos are hosted on your own server | Use YouTube, Vimeo, or a dedicated video CDN for embeds | Low | High |
| Modern image formats | AVIF and WebP are significantly lighter than JPEG/PNG | PageSpeed → "Efficiently encode images" | Convert images to AVIF; use <picture> tags for fallbacks | Low | Medium QUICK WIN |
| Browser caching enabled | Returning visitors load pages significantly faster | PageSpeed Insights → Caching warnings | Set Cache-Control headers via server (.htaccess/nginx) | Low | Medium |
| Eliminate render-blocking | Prevents the "blank screen" while CSS/JS loads | PageSpeed → "Eliminate render-blocking resources" | Inline critical CSS; use defer or async on script tags | Medium | High |
| Layout stability (CLS < 0.1) | Cumulative Layout Shift prevents frustrating "page jumps" | PageSpeed → CLS score | Set explicit width/height on images and ad containers | Medium | Medium |
- GSC - Google Search Console
- Pagespeed Insights - Page Speed Insights
- WebPageTest - WebPageTest
A word on Performance
In 2026, "fast enough" is no longer a fixed number; it’s about responsiveness. With the replacement of FID with INP (Interaction to Next Paint), Google now measures how quickly your site reacts when a user actually clicks something, not just how fast the pixels appear.
Don't fall into the trap of "plugin bloat"—every "speed-up" plugin you add can ironically slow you down by adding more JavaScript. Start with the basics: high-quality hosting, HTTP/3 protocol, and a solid CDN. If your server is slow, no amount of front-end optimisation can save the user experience.
Performance Toolkit
| Tool | Best For | Cost |
|---|---|---|
| PageSpeed Insights | Comprehensive Google-official lab and field data | Free |
| WebPageTest | Advanced "waterfall" charts and multi-location testing | Free/Paid |
| Squoosh.app | Manual one-off image compression (AVIF/WebP) | Free |
| DebugBear | Monitoring Core Web Vitals and INP over time | Paid |
Further Reading
- Web.dev Core Web Vitals Guide: https://web.dev/vitals/
- Optimizing for INP: https://web.dev/optimize-inp/

Security
Security Checklist
| Check | Why this matters | How to check this | How to remediate / apply | Effort | Impact |
|---|---|---|---|---|---|
| HTTPS enforced | Prevents data interception; required by browsers | Visit http:// version of site | Force HTTPS redirect in hosting or CMS | Low | High QUICK WIN |
| Valid SSL certificate | Invalid certs scare users and break trust | Browser lock icon or SSL Labs | Renew or install SSL certificate (e.g., Let's Encrypt) | Low | High |
| Sensitive files blocked | Exposed configs (.env, .git) leak credentials | Try visiting /.env or /.git | Block via server rules (.htaccess/nginx) | Low | High QUICK WIN |
| Admin area protected | Prevents brute-force attacks | If you have a CMS or visit /admin,/login or /wp-login for example. If your site is static this will likley not apply. | Add strong passwords and 2FA | Medium | High |
| Software up to date | Outdated software is the #1 hack vector | Check CMS/plugin versions | Enable auto-updates for security patches | Low | High QUICK WIN |
| No mixed content | Mixed HTTP/HTTPS assets break the secure padlock | Browser console warnings | Replace HTTP asset links with HTTPS versions | Low | Medium |
| Automated Backups | The only "undo" button for a total site compromise | Check for recent backups in hosting/CMS | Schedule daily off-site backups | Medium | High |
| Principle of Least Privilege | Reduces damage if one account is compromised | Review User/Admin list | Delete old users; only give "Admin" to those who need it | Low | Medium |
A word on Security
Security is not a "once and done" task—it is a continuous practice of reducing your attack surface. Most hacks aren't targeted strikes; they are automated bots looking for the easiest possible door to kick in. By keeping your software updated and enforcing Two-Factor Authentication (2FA), you essentially move your site to a "safer neighborhood."
For those looking to go further, a Content Security Policy (CSP) is a powerful way to prevent cross-site scripting (XSS) by telling the browser exactly which scripts are allowed to run. However, it can be incredibly tedious for beginners to configure correctly and often breaks legitimate tools like analytics or video embeds. It is worth investigating once your fundamentals are solid, but handle it with care.
Security is a huge landscape that is ever growing as new threats and vulverabilities are discovered, especially with the rise of vibe coding. Depending on your industry and purpose of your business, site, application you may require more extensive security auditing in which case a DIY approach may not be the best and you may have additional compliance requirements. Get in touch with us if you believe this to be the case and we can either assist or connect you with suitable specialist security professionals.
Security Toolkit
| Tool | Best For | Cost |
|---|---|---|
| Qualys SSL Labs | Deep analysis of your SSL certificate health | Free |
| Google CSP Evaluator | Checking the strength of your Content Security Policy | Free |
| Have I Been Pwned | Checking if your admin email has been leaked | Free |
| Wordfence / Sucuri | Real-time firewall and malware scanning | Free/Paid |
| UpdraftPlus / VaultPress | Managing automated off-site backups | Free/Paid |
Further Reading
- Google CSP Evaluator: https://csp-evaluator.withgoogle.com/
- OWASP Top 10 Security Risks: https://owasp.org/www-project-top-ten/
- Web.dev - "Security": https://web.dev/security/

User Interface & User Experience
UI / UX Checklist
| Check | Why this matters | How to check this | How to remediate / apply | Effort | Impact |
|---|---|---|---|---|---|
| Purpose clear in 5s | Users leave if they don't understand the value immediately | Load homepage and perform a "squint test" | Rewrite the H1 headline to state exactly what you do | Medium | High |
| Mobile-friendly | 60%+ of traffic is mobile; Google uses mobile-only indexing | Use GSC "Mobile Usability" or test on a real phone | Use a responsive theme; ensure no horizontal scrolling | Low | High |
| Touch targets (44px+) | Thumbs are less precise than mice; tiny buttons frustrate | Try clicking buttons on a mobile device | Increase button size and add padding between links | Low | High QUICK WIN |
| Accessible contrast | 1 in 12 men are colorblind; low contrast is unreadable | Check with WebAIM Contrast Checker | Ensure text-to-background ratio is at least 4.5:1 | Low | Medium |
| Clear Navigation | Confused users don't convert | Ask a friend to find a specific page in <10s | Use plain-language labels (e.g., "Pricing" vs "Investment") | Medium | High |
| Legible Typography | Tiny or thin fonts cause eye strain and high bounce rates | Check if body text is at least 16px-18px | Increase font size and use a line-height of 1.5–1.7 | Low | Medium QUICK WIN |
| Visual Hierarchy | Guides the user's eye to the most important action | Identify the "loudest" element on the page | Use size and color to make your primary CTA button pop | Medium | Medium |
- WebAIM Contrast Checker - WebAIM Contrast Checker
A word on UI/UX
In 2026, great design isn't about how your site "looks"—it's about how it functions for the user. Modern UX is heavily focused on Accessibility. If a user with a visual impairment or a motor disability can't navigate your site, you aren't just being exclusive; you're losing a massive portion of your potential audience and hurting your SEO.
Keep it simple. White space is your friend. Don't try to be clever with navigation or icons that nobody recognises. A user should never have to "think" about how to use your website; it should feel like an invisible slide leading them directly to the information or product they need.
UI / UX Toolkit
| Tool | Best For | Cost |
|---|---|---|
| Hotjar / Clarity | Visualizing where users click and "rage-click" | Free/Paid |
| WebAIM Contrast Checker | Ensuring your colours are accessible to all users | Free |
| Uizard | AI-powered wireframing for non-designers | Free/Paid |
| Figma | The industry standard for mockups and design systems | Free/Paid |
Further Reading
- Nielsen Norman Group (UX Basics): https://www.nngroup.com/articles/ten-usability-heuristics/
- The A11Y Project (Accessibility): https://www.a11yproject.com/
This isnt a checklist!! I can't use this!
Yep, theres a lot of supporting information interspersed between, the attachment below can be used as a checklist with each category it's own sheet and checkboxes and notes columns for your convenience.
Give it a go and see how many of these items you can check off! Feel free to use it as a template and add your own to the list from your own research & discovery.
websitechecklistv1.xlsx
Document/Spreadsheet
Part 2 coming soon
I wanted to keep this bite sized but these lists have already gotten quite long while still only touching the surface, if you've managed to get through all of the points above or at least considered them, stay tuned for part 2 where I'll list further metrics, checks and improvemnts you can apply and perhaps go more indepth into some of the measures.
Possible future guides
If it is of any help at all, I may further expand this guide to some of the following, in the meantime you can use the below as search phrases or prompts for your favourite LLM:
- How to read, understand & action Google Page Speed Insights
- Setting up redirects for SEO the right way
- How to [Any of the checklist items above] in detail
Let me know if any of these guides would be of help!
