Free Website Health Check: A 10-Point Checklist for UK Local Businesses

Your website probably looks fine to you. It loads on your laptop, the photos are there, and the phone number is in the footer. What you can’t see from your desk is whether Google has actually indexed your service pages, whether the site is painful to use on a customer’s phone, or whether the contact form stopped sending emails three months ago.

Here are ten checks you can run yourself with free tools from Google and official UK guidance, each with a pass sign, a fail sign and a next step. No code needed. Allow about half an hour (our rough estimate, not a measured time; a failed check takes longer to dig into).

What you need before you start

• A computer, your own smartphone and your Google Business Profile login.
• Google Search Console, if you have it. This is Google’s free dashboard showing which of your pages it has indexed and any problems it has found. Checks 1, 4 and 5 use it. If you don’t have access, ask whoever manages your site to add you as a user. If nobody set it up, that’s your first finding; the other checks still work. Our Search Console guide for beginners shows how to set it up so your business owns it.
• The table below, to note each result as you go.

The checklist at a glance

#	Check	Free tool	Pass sign	Pass / fail
1	Google has indexed your key pages	Search Console (URL Inspection, Page indexing)	Homepage and service pages say “URL is on Google”
2	It’s fast enough on a phone	PageSpeed Insights (Mobile)	Core Web Vitals “Passed” (or a lab score of 90+ if there’s no field data)
3	It works on a real phone	Your own phone	Readable without zooming, easy to tap, nothing blocking the content
4	It’s secure and up to date	Browser padlock; Search Console HTTPS and Security issues	Every page on https://, no security issues, updates applied
5	Search engines and AI tools can get in	yoursite/robots.txt; Search Console	Key pages not blocked; search and AI search crawlers allowed
6	Your details match your Business Profile	Your Business Profile + your site	Name, address or area, phone and hours identical
7	Google can read your business details	Rich Results Test	LocalBusiness structured data detected, no errors
8	Your contact routes work	Your phone + a test enquiry	Number dials, form arrives, contact details easy to find
9	Everyone can use it	PageSpeed Insights (Accessibility) + manual checks	No contrast or alt-text warnings; usable with a keyboard
10	Your cookie banner does its job	A private browser window	No advertising cookies or tags before consent

The 10 checks

1. Is Google indexing your key pages?

“Indexed” means Google has stored the page in its database of pages it can show. A page that isn’t indexed can’t appear in search at all, so this comes first.

How to check: in Search Console, paste your homepage address into the search bar at the top. This runs the URL Inspection tool. Repeat for each main service and location page, then open the Page indexing report to see which pages aren’t indexed and why.

Pass: every page you want customers to find says “URL is on Google”.

Fail: an important page says “URL is not on Google”, or is listed as not indexed with a reason such as a noindex tag or a 404 (page not found) error.

What to do: don’t panic at a long “not indexed” list. Google says not to expect every URL to be indexed, only the main (canonical) version of each page, so redirects and duplicates are normal. If an important page is missing, pass the reason to your web developer (check 5 explains noindex), then press “Request indexing”, though Google doesn’t promise to index it. And “URL is on Google” means the page can appear in search, not that it ranks.

2. How fast is it on a phone?

Google publishes pass marks for its speed measures, the Core Web Vitals, so you needn’t guess at “a couple of seconds”:

• Largest Contentful Paint (LCP): how long the main content takes to appear. Good is 2.5 seconds or less.
• Interaction to Next Paint (INP): how quickly the page responds to a tap or click. Good is 200 milliseconds or less.
• Cumulative Layout Shift (CLS): how much the page jumps around as it loads (the button that moves just as you tap it). Good is 0.1 or less.

To pass, all three must be good for at least 75% of real page loads (the 75th percentile), with mobile and desktop assessed separately. These thresholds come from Google’s web.dev.

How to check: enter your homepage in PageSpeed Insights and choose Mobile. The top section is field data: what real Chrome users experienced over 28 days. The Performance score below is lab data: one simulated load. Repeat for your busiest service page.

Pass: the Core Web Vitals assessment says “Passed”. If there’s no field data, a lab Performance score of 90 or more counts as good by Google’s scoring bands (50–89 needs improvement; under 50 is poor).

Fail: the assessment says “Failed”, or the lab score is below 90 (below 50 is the urgent end).

If you see “no data”: a smaller site may not have enough real-user visits for field data. That isn’t a fail. Use the lab score as a guide rather than a verdict.

What to do: send the report link to your developer; it lists specific problems under the scores. Google uses Core Web Vitals in ranking, but its page experience guidance says good scores don’t guarantee top rankings. Fix speed for your visitors’ sake, and treat any ranking effect as uncertain.

3. Does it work on a real phone?

Google indexes and ranks the mobile version of your site, and its mobile-first indexing guidance says it should carry the same content as desktop. If your phone layout hides your service list, Google may never see it. Older guides still recommend Google’s Mobile-Friendly Test, but Google has retired it.

How to check: on your phone (on mobile data if you can), open your homepage and two or three service pages. Read a paragraph without zooming, tap the menu, buttons and phone number, and compare with the desktop version.

Pass: text is readable at normal size, buttons are easy to hit with a thumb, no pop-up covers the content, and nothing important is missing compared with desktop.

Fail: you have to pinch and zoom, you keep hitting the wrong link, a pop-up blocks the page, or whole sections vanish on mobile.

What to do: note each problem and its page for your developer. Fix missing mobile content first, because it affects what Google indexes too.

4. Is it secure (HTTPS, no warnings, kept up to date)?

HTTPS is the encrypted version of a web address, shown by the padlock in your browser bar. Google “strongly recommends” it; without it, customers see a “Not secure” warning.

How to check

1. Type your address starting with http:// (no “s”). It should jump to https:// and show a padlock.
2. In Search Console, open the HTTPS report, which shows indexed pages still served over HTTP and why.
3. Open the Security issues report, which lists hacked content, malware and deceptive pages Google has detected.
4. Ask whoever maintains your site when the software (WordPress or similar), plugins and theme were last updated, and whether updates are automatic.

Pass: every page loads on https:// with a padlock, Security issues is empty, and updates are applied promptly.

Fail: “Not secure” warnings, HTTP pages in the HTTPS report, anything in Security issues, or nobody can tell you when the site was last updated.

What to do: a security issue is the most urgent fail on this list. Google asks you to fix it site-wide, then request a review, which can take several days or weeks, so start immediately. On updates, the National Cyber Security Centre advises organisations to update by default: apply software updates as soon as possible, ideally automatically. That’s general advice for organisations; applying it to your website is our reading.

5. Can search engines and AI search tools get in?

A small file called robots.txt tells automated visitors (“crawlers”) which pages they may access. One wrong line can shut out Google, or the crawlers behind ChatGPT search and Perplexity. A “noindex” tag on a page tells Google not to show it in search.

How to check

1. Go to yourdomain.co.uk/robots.txt in a browser (using your own domain).
2. Look for Disallow: / directly under User-agent: *, which blocks the whole site for every crawler that follows the rules. A Disallow line for an admin or login folder is normal.
3. Search the file for OAI-SearchBot and PerplexityBot, the crawlers that let ChatGPT search and Perplexity find and cite your pages.
4. In Search Console’s Page indexing report (check 1), look for important pages excluded by noindex or blocked by robots.txt.

Pass: no rule blocks your key pages, no important page carries a noindex tag, and OAI-SearchBot and PerplexityBot aren’t disallowed (if you want to appear in those tools).

Fail: a blanket Disallow: /, a key page blocked or set to noindex, or the AI search crawlers disallowed.

What to do: ask your developer to remove the blocking rule. Two details are easy to get wrong:

• Search and training are separate. OpenAI says sites that block OAI-SearchBot won’t be shown in ChatGPT search answers (they can still appear as navigational links), while its training crawler, GPTBot, has its own rule. So you can opt out of training and stay in ChatGPT search. Perplexity says PerplexityBot surfaces and links sites in its results and isn’t used to train foundation models.
• robots.txt isn’t the only gate. Firewall or bot-protection settings at your host or content delivery network can block these crawlers even when robots.txt allows them. Ask for those to be checked too.

Robots.txt is not a way to keep a page out of Google; noindex does that. A sitemap is optional: Google says small, well-linked sites may not need one.

Getting crawled is only the start of being mentioned by AI tools. We cover the rest in why ChatGPT recommends your competitor.

6. Do your business details match your Google Business Profile?

Google’s local results depend on relevance, distance and popularity, and it says complete, accurate information makes a business more likely to show up in local search results. Its Business Profile guidelines set the rules for your listing’s name, address or service area, phone and hours. Google doesn’t say your website must match the listing, but our advice is to make them identical, so customers and Google see one consistent business.

How to check: open your Business Profile next to your website’s footer and contact page. Compare, character by character, the business name, address or service area, phone number and opening hours. Then click the website link on your profile and check where it goes.

Pass: all four details are identical, and the profile links to a working page on your site.

Fail: an old phone number, different hours, a trading name on one and a limited-company name on the other, or a profile link that goes nowhere useful.

What to do: decide which version is correct and update both. While you’re there, look at your reviews, which Google counts towards prominence: ask every customer, and never offer incentives. There’s more in our guide on how to get more Google reviews.

7. Can Google read your business details (LocalBusiness schema)?

Structured data (often called “schema”) is a small block of code, invisible to visitors, that labels your name, address and opening hours so search engines don’t have to guess. For a local business the relevant type is LocalBusiness.

How to check: enter your homepage or contact page address in Google’s Rich Results Test and look at the structured data items it detects.

Pass: LocalBusiness structured data is detected with no errors, and the details match your Business Profile. Google’s LocalBusiness documentation requires name and address and recommends phone, hours and web address.

Fail: nothing detected, errors flagged, or details that don’t match your real ones (a stale phone number in the schema is easy to miss because nobody sees it).

What to do: ask your developer to add or correct it. Google doesn’t guarantee structured data leads to any special display in search; the point is clear, consistent details. If checks 6 and 7 both need work, our local SEO page explains how we approach this.

8. Do your contact routes actually work?

No tool runs this check, which is why it gets missed. A broken form doesn’t flash up an error; the enquiries simply stop arriving.

How to check

1. On your phone, tap every phone number on the site. Each should open the dialler with the right number.
2. Fill in your contact form as a customer would, using an email address you can check, and send it. Look for it in the inbox and the spam folder.
3. Tap any email links and WhatsApp or booking buttons.
4. From two or three random pages, see how quickly you can find a way to get in touch.

Pass: numbers dial, the test enquiry lands in the inbox, and contact details are a tap or a scroll away from every page.

Fail: a number that isn’t tappable or dials the wrong line, a form that errors or never arrives, or an enquiry sitting in spam.

What to do: fix a failed form straight after any security issue, and meanwhile put your phone number prominently on the contact page.

9. Can everyone use it? (Accessibility basics)

Accessibility means disabled people, including those with sight loss or who can’t use a mouse, can use your site. The recognised benchmark is the Web Content Accessibility Guidelines, currently WCAG 2.2, with levels A, AA and AAA. AA is a sensible target for any business.

How to check: in PageSpeed Insights (from check 2), scroll to the Accessibility score and read the issues listed underneath. An automated score can’t catch everything, so also check by hand:

• Is the text easy to read against its background?
• Do images have alt text (a short description read out by screen readers)?
• Is any important text only inside an image, such as a price list saved as a graphic?
• With the mouse aside, press the Tab key repeatedly. Can you reach the menu, links and form, and see where you are?

Pass: no contrast or alt-text warnings, no important information locked inside images, and the site is usable with the keyboard alone.

Fail: warnings in the Accessibility section, text only in images, or parts of the site you can’t reach without a mouse.

What to do: send the list to your developer. On the legal side, here is what official sources say (this is not legal advice). Public sector bodies must meet WCAG 2.2 AA. For private businesses WCAG isn’t a legal standard in the same way, but the government’s accessibility guidance notes that all UK service providers must make reasonable adjustments under the Equality Act 2010. The Equality and Human Rights Commission’s Code of Practice for services says “the obligation also applies to the provision of services on a website”, and one of its examples is a website with all its text embedded in graphics. If you’re unsure where you stand, take advice.

10. Is your cookie banner doing its job?

Cookies, tracking pixels and analytics tags store or read information on a visitor’s device. UK rules changed with the Data (Use and Access) Act 2025, and the Information Commissioner’s Office (ICO) published final guidance on 29 April 2026. This is a summary of the ICO’s guidance on exceptions, not legal advice:

• Advertising always needs consent, including ad-platform pixels and remarketing tags.
• Some analytics may not. A new statistical exception applies only if you explain clearly what the analytics is for, give people a simple and free way to object, use the data only for aggregate statistics, don’t use it for tracking or profiling, and third parties can’t use it for their own purposes. Whether your setup qualifies depends on its configuration, so check the guidance or take advice before relying on it.
• Strictly necessary cookies are exempt.

How to check: open your site in a private or incognito window, so you arrive as a new visitor, and read the banner before clicking. Does it explain what the cookies are for? Then ask whoever added your analytics, advertising or social media tags whether any load before a visitor agrees, especially if you run Google or Meta ads with tracking.

Pass: the banner explains what’s used and why, advertising and marketing tags wait for consent, and any analytics running without consent meets every condition of the statistical exception.

Fail: no banner despite advertising tags, tags that load before consent, or a banner that doesn’t say what anything is for.

What to do: this is usually a settings job for whoever manages your tags or consent tool. Give them your notes and the ICO link, and take proper advice if you’re unsure.

What free tools can’t tell you

A row of passes means the site works. Whether it’s winning you customers is another matter. Indexed isn’t ranking, a lab speed score is one simulated visit, automated accessibility scores miss things, and structured data promises nothing. Above all, free tools look at your site in isolation. They won’t tell you who appears above you in the Maps results, or which businesses ChatGPT or Google’s AI Overviews name when someone asks for your trade in your town.

How often to re-check

There’s no official schedule, so here’s our rule of thumb. Re-run check 8 after any change to your site, email or hosting, because that’s when forms break. Re-run checks 4 and 5 after any update, redesign or change of developer. Otherwise, run the full list every few months, and whenever enquiries drop without an obvious reason. Search Console’s Performance report is worth a glance too: it shows which searches bring people to your site.

What to do with your results

Fix fails in this order: security issues, broken contact routes, then anything stopping Google indexing your key pages, because those stop the site doing its basic job. Speed, mobile layout, accessibility, structured data and cookies come next; most are developer jobs, and your notes will speed that conversation up.

If speed, mobile, structured data and accessibility all fail, ask whether patching the site still makes sense or a rebuild would. Our web design page explains how we build sites, with Core Web Vitals checked before launch and Search Console, analytics and Business Profile linked up from the start.

If your checks mostly pass but you still aren’t getting found, the problem may be visibility, not site health. Get Found’s free visibility audit looks at where you rank for your key searches on Google, whether you make the Maps pack and who beats you, what ChatGPT, Perplexity and AI Overviews say when asked about your trade in your town, and which fixes we’d make first, in plain English. It’s free, with no obligation. We’re based in Worcester and Stockport and work UK-wide by phone and video, so if you’d rather talk it through, get in touch.