How a website is scored
Obris Audit runs 34 checks across seven areas and adds them up to a score
out of 100. Every check is listed here with the points it carries, so a score can be
read back to exactly what produced it.
Three things worth knowing. A check that cannot run on a site (a speed test that did not
answer, a check that does not apply to a store or a publication) is left out of the total
rather than counted as a fault, and the report says so. The site is read the way a visitor's
browser reads it, following its robots rules. And one check asks Claude,
an AI assistant, about the business by name and records whether it finds the site; it is the
only check that costs money to run, which is why the free report runs everything else and the
full report runs that one too.
Quick Links Search visibility AI assistant visibility Speed Content Presentation Technical health Trust signals SEO report Security report Compliance report
Search visibility
22 points, 6 checks
Titles and descriptions, heading structure, whether each service and each town you serve has a page of its own, internal links, and whether your pages are competing with each other.
Your services do not have individual pages
8 points
Critical when it fails
What good looks like. Give every service its own page with its own title, its own description and at least 300 words about that service specifically. One page listing all of them gives search engines and assistants nothing specific to point at when someone asks for one service by name.
Page titles are missing, too short, or duplicated
3 points
Important when it fails
What good looks like. Give each page a title of roughly 40 to 60 characters that names what the page is about and where you work. No two pages should share a title, or they compete with each other instead of covering separate ground.
Pages are missing meta descriptions
3 points
Quick win when it fails
What good looks like. Write a 120 to 155 character description for each page. It is the sentence a searcher reads before deciding whether to click, and a missing one lets the search engine invent its own.
The homepage does not say where you work
4 points
Important when it fails
What good looks like. Name the towns and areas you serve in the homepage copy, not only in the footer. Local searches are matched on this, and yours currently has to be guessed.
Heading structure is broken or missing
2 points
Quick win when it fails
What good looks like. Give every page exactly one H1 that states the subject, then use H2 and H3 in order beneath it. Skipped levels and multiple H1s make the page harder to read for both people and machines.
Pages are barely linked to each other
2 points
Quick win when it fails
What good looks like. Link from your homepage to every service page, and from each service page back to related services. Pages with no internal links pointing at them are treated as unimportant.
AI assistant visibility
18 points, 4 checks
Whether the assistants people now ask for recommendations can read who you are, what you do, and where you do it.
Your business details are not in the page code
6 points
Critical when it fails
What good looks like. Add LocalBusiness structured data with your name, address or service area, phone, hours and services. Your details may be readable by a person, but assistants answering 'who does this near me' are reading the structured version.
Nothing on the site is written as a direct answer
5 points
Important when it fails
What good looks like. Add a questions and answers page, and put a short direct answer under each heading before the detail. Assistants quote sentences that answer a question cleanly. Marketing prose gives them nothing to lift.
AI crawlers are blocked from reading your site
4 points
Critical when it fails
What good looks like. Your robots.txt currently blocks the crawlers the assistants use. Allow GPTBot, ClaudeBot, PerplexityBot and Google-Extended unless you have a specific reason not to. Blocking them removes you from those answers entirely.
Assistants do not name your business for your own services
3 points
Important when it fails
What good looks like. This is the downstream result of the other fixes rather than a separate task. Structured details, direct answers and per-service pages are what get a business named. Re-run the audit after those are done. Uses the assistant.
Speed
13 points, 4 checks
Real loading measurements on a phone connection, image weight, and what a visitor sees while they wait.
The main content takes too long to appear on a phone
6 points
Important when it fails
What good looks like. Largest Contentful Paint should land under 2.5 seconds. The usual causes are an oversized hero image, a slow host, or fonts and scripts loading before the page can paint.
Images are far larger than they need to be
4 points
Important when it fails
What good looks like. Resize images to the size they actually display at and save them as WebP. Most sites carry photographs several times larger than the space they appear in, and phone visitors pay for every byte.
The page jumps around while it loads
2 points
Quick win when it fails
What good looks like. Set width and height on images and reserve space for anything that loads late. Content shifting under a reader's finger is the most irritating thing a page can do.
Scripts and stylesheets are delaying the first paint
1 point
Quick win when it fails
What good looks like. Defer scripts that are not needed for the first screen and inline the small amount of CSS that is.
Content
18 points, 5 checks
Whether the pages answer the questions your customers actually ask, whether prices or process are explained, and whether every page gives a reader plenty to go on.
Several pages have almost nothing on them
5 points
Important when it fails
What good looks like. Pages under roughly 200 words rarely rank and rarely convert. Either write them out properly or fold them into a page that is already working.
There is no page answering common questions
5 points
Important when it fails
What good looks like. Write down the questions you answer on the phone every week and publish them with real answers. It is the single cheapest page to write and one of the most useful to both customers and assistants.
The site does not explain what happens next or what it costs
4 points
Important when it fails
What good looks like. Explain your process, and give a price, a range, or a plain explanation of how pricing works. Sites that say nothing about either lose visitors who are ready to act but unwilling to ask.
Pages do not ask the visitor to do anything
2 points
Quick win when it fails
What good looks like. Put one clear action on every page, above the fold and again at the end. A phone number in the footer is not a call to action.
Nothing on the site has changed in a long time
2 points
Quick win when it fails
What good looks like. Add or update something monthly. A site that has not moved in two years reads as abandoned to visitors and to search engines alike.
Presentation
12 points, 5 checks
Whether the site looks like a real business built it. Text sizes that follow a scale, body copy large enough to read on a phone, buttons and colors that stay consistent, even spacing, and no leftover placeholder text from the template.
The site still has placeholder content on it
3 points
Critical when it fails
What good looks like. Replace the leftover template text, and remove any badge advertising the software the site was built with. Nothing costs a visitor's confidence faster than finding the words the template shipped with still sitting on the page.
Text sizes do not follow a consistent scale
3 points
Important when it fails
What good looks like. Settle on six to eight text sizes and use only those. Pick a base size for body copy and step up from it in even ratios for headings. A page with a dozen near-identical sizes reads as assembled rather than designed, and the reader feels it without being able to name it.
Buttons and colors change from place to place
3 points
Important when it fails
What good looks like. Define one primary button and one secondary button, and use only those two. Do the same for your colors: a handful of them, each with a job. Every extra variant is a small signal that no single person was in charge of how the site looks.
Body text is too small to read comfortably on a phone
2 points
Important when it fails
What good looks like. Set body copy to at least 16 pixels. Below that, phone readers zoom or give up, and most of your visitors are on a phone. This is one line of CSS and it is the single cheapest improvement on this list.
Spacing between elements is uneven
1 point
Quick win when it fails
What good looks like. Pick a spacing step, usually 8 pixels, and make every gap a multiple of it. Uneven spacing is the most common reason a site looks slightly wrong to a visitor who cannot say why.
Technical health
9 points, 5 checks
Links landing where they should, clean redirects, layouts that hold together on a phone, pages search engines are free to read, and descriptions on your images.
Some links on the site are broken
3 points
Important when it fails
What good looks like. Fix or remove links that return an error. Every broken link is a visitor who hit a dead end and a small signal that the site is not maintained.
Pages are telling search engines to ignore them
2 points
Critical when it fails
What good looks like. One or more pages carry a noindex instruction, which removes them from search results entirely. This is almost always left over from when the site was built.
The site is not fully served over a secure connection
2 points
Critical when it fails
What good looks like. Serve every page over HTTPS and redirect the insecure versions. Browsers warn visitors about the alternative.
Images have no description text
1 point
Quick win when it fails
What good looks like. Add alt text describing what each image shows. Twenty minutes of work. It helps people using screen readers and gives search engines something to read where there is currently nothing.
The site is not set up for phones
1 point
Critical when it fails
What good looks like. Add a viewport meta tag and check the layout at 390 pixels wide. Most of your visitors are on a phone.
Trust signals
8 points, 5 checks
Contact details, a real address or service area, reviews, licences and credentials where the trade calls for them, and the privacy basics.
Contact details are hard to find
3 points
Critical when it fails
What good looks like. Put a phone number and an email address in the header or footer of every page, as real text rather than inside an image.
There is no address or stated service area
1 point
Important when it fails
What good looks like. Publish either a street address or the areas you cover. Customers checking whether you come to them should not have to call to find out.
No reviews or ratings appear on the site
2 points
Important when it fails
What good looks like. Show real reviews on the site and link to where they live. Only genuine, unedited reviews, and never gate them by rating.
Licences and credentials are not shown
1 point
Important when it fails
What good looks like. Publish licence numbers, insurance and trade credentials where the trade calls for them. In several trades this is the first thing a customer checks.
There is no privacy policy
1 point
Quick win when it fails
What good looks like. Publish a privacy policy and link it in the footer. Any site with a contact form needs one, and some advertising platforms require it.
How the score is made
Each check has a ceiling, the points above. A check that fails outright loses all of them; many
award part marks, so a site with two thin pages out of twelve loses less than a site with ten.
The seven category scores are the checks in each area added up, and the overall score is the
seven added together. The report ranks every failed check by the points its fix is worth, which
is why the list is ordered by what moves the score rather than by what is easiest to describe.
Scores are a measurement of the site on the day, from the pages that could be read. Running the
audit again after changes shows the movement.
The SEO report: 10 checks
The SEO report is the search visibility and AI assistant visibility parts of the score,
sold as their own report: the 10 checks above that decide whether a business can be found,
each one as a pass or a fail on the site, with what it is worth on the score, where it
fails, and the fix. Nothing is measured twice; the report reads the same scan.
Search visibility
6 checks
Titles and descriptions, heading structure, whether each service and each town you serve has a page of its own, internal links, and whether your pages are competing with each other.
- Every service has a page of its own (8 points)
- Every page has its own title, at the right length (3 points)
- Every page has a meta description (3 points)
- The homepage says where you work (4 points)
- Every page has one clear heading, with the rest in order (2 points)
- Your pages link to each other (2 points)
AI assistant visibility
4 checks
Whether the assistants people now ask for recommendations can read who you are, what you do, and where you do it.
- Your business details are in the page code (6 points)
- The site answers questions directly (5 points)
- AI crawlers can read your site (4 points)
- Assistants name your business for your own services (3 points)
The security report: 12 checks
The same scan also runs 12 security checks, sold as their own report. They carry no points
and do not move the score: each one is a yes or a no about the site, with the header or
setting it is about. They are what a scanner can see from outside: the encryption and the
headers that enforce it, the protections the server switches on, what answers at a handful
of well-known paths, and the software the pages announce. The report says plainly that it
is not a penetration test, and that backups, logins and the hosting account need a person.
Encryption
4 checks
Whether everything between the visitor and the site travels encrypted: the site on HTTPS, the unencrypted address sending people to it, the browser told to always use it, and nothing on the page loaded in the clear.
The site is served over HTTPS
HTTPS
Critical when it fails
What good looks like. Ask your host to switch on an SSL certificate (most include one free) and set the site to load over https. Until then, anything a visitor types on the site, including a contact form, travels where it can be read.
The unencrypted address sends visitors to the secure one
HTTP redirect
Important when it fails
What good looks like. Add a redirect so that http:// goes straight to https://. On most hosting it is one switch in the control panel or three lines in the .htaccess file. Without it, anyone who types the address without https gets the unencrypted site.
The browser is told to always use HTTPS
HSTS header
Important when it fails
What good looks like. Send the Strict-Transport-Security header, so that once a visitor has been to the site their browser refuses to load it unencrypted, even from an old link. One header on the server, or one switch in the hosting control panel.
Everything on the page loads encrypted
Mixed content
Critical when it fails
What good looks like. Change every http:// address in the page's scripts, stylesheets, pictures and frames to https://. Browsers block some of these outright and mark the padlock as broken for the rest.
Server settings
4 checks
The protections a server switches on with a line of configuration: whether the site can be framed by another, whether the browser can be tricked about file types, what the server says about itself, and how its cookies are marked.
The site cannot be framed inside another site
X-Frame-Options
Important when it fails
What good looks like. Send the X-Frame-Options header with the value SAMEORIGIN, or a Content-Security-Policy with frame-ancestors. It stops another site from showing your pages inside its own and tricking visitors into clicking.
The browser is told not to guess file types
X-Content-Type-Options
Quick win when it fails
What good looks like. Send the X-Content-Type-Options header with the value nosniff. It stops a browser from running a file as a script because it guessed wrong about what it was. One line of server configuration.
The server keeps its software version to itself
Server header
Quick win when it fails
What good looks like. Turn off the version number in the Server and X-Powered-By headers. On Apache it is ServerTokens Prod; on PHP it is expose_php = Off. A version number tells an attacker exactly which known holes to try.
Every cookie is marked Secure
Cookie flags
Important when it fails
What good looks like. Mark every cookie the site sets as Secure, so the browser only ever sends it over an encrypted connection. For cookies that scripts on the page do not need to read, add HttpOnly as well.
What is exposed
4 checks
What the server answers that it never should: configuration files, backups and folder listings, the software versions it announces, and forms that send what people type without encryption.
No configuration or backup files are readable
Exposed files
Critical when it fails
What good looks like. Delete the file from the web folder or move it outside it, and set the server to refuse requests for dot-files and backups. Then change every password and key the file contained: assume it has been read.
Folders do not list their contents
Directory listing
Important when it fails
What good looks like. Switch off directory listing on the server (Options -Indexes in .htaccess on Apache, or the equivalent setting in the hosting control panel). A listed folder hands out every file in it, including the ones nothing links to.
The site's software is current and not announced
Software versions
Critical when it fails
What good looks like. Update the library or platform named to a supported version, and remove the generator tag that prints the version into every page. An announced version is an invitation; an old one is an open door.
Every form sends what people type encrypted
Form transport
Critical when it fails
What good looks like. Point every form at an https:// address and serve the page it sits on over https. A form that posts in the clear sends names, phone numbers and messages where anyone on the same network can read them.
The compliance report: 14 checks
The same scan also runs 14 accessibility and privacy checks, sold as their own report. They
carry no points and do not move the score: each one is a yes or a no about the site, with the
rule it belongs to. The accessibility checks follow WCAG 2.2 level AA where a scanner can
measure it. The privacy checks are the basics a small business website owes the people who fill
in its forms. The report says plainly that it is what a scanner can measure and
not a legal opinion.
Accessibility
9 checks
Whether people who read with a screen reader, move through pages with a keyboard, or need larger text can use the site: the basics of WCAG 2.2 level AA that a scanner can see.
Every picture has a description
WCAG 1.1.1
Critical when it fails
What good looks like. In your site editor, open each picture and fill in the description field with what it shows, in one short sentence. Purely decorative pictures get an empty description so screen readers skip them.
Headings run in order on every page
WCAG 1.3.1
Quick win when it fails
What good looks like. Give every page one main heading that states what the page is, then use the next heading level down for its sections and the one below that for their parts, without skipping a level. A screen reader reads the headings as an outline, and a skipped level breaks it.
Body text is large enough to read
Good practice
Important when it fails
What good looks like. Set body text to at least 16 pixels. One line in the stylesheet, and the single cheapest improvement most sites can make.
Every form field has a label
WCAG 3.3.2
Critical when it fails
What good looks like. Give each field a visible label above it (Your name, Phone, Best time to call) and connect the label to the field. Keep the placeholder as an example if you like, but never as the only name for the field: it disappears the moment someone starts typing, and a screen reader never reads it.
Keyboard focus is visible
WCAG 2.4.7
Important when it fails
What good looks like. Remove the stylesheet rule that hides the focus outline and let the browser draw it, or replace it with a clear two-pixel outline in the site's own colour. Someone moving through the page with the Tab key has to be able to see where they are.
Every link says where it goes
WCAG 2.4.4
Quick win when it fails
What good looks like. Change link text like “click here” and “read more” to say what is on the other side: “See our teeth whitening prices”. Screen reader users often jump from link to link, hearing only the link text.
Every page names its language
WCAG 3.1.1
Quick win when it fails
What good looks like. Add lang="en" to the opening html tag of every page. Without it a screen reader may pronounce English in another language's voice.
Video has captions, and nothing flashes
WCAG 1.2.2
Important when it fails
What good looks like. Add captions to every video (YouTube and Vimeo both do this for you), and remove anything that scrolls or blinks on its own.
Phones can zoom in
WCAG 1.4.4
Quick win when it fails
What good looks like. Remove user-scalable=no and any maximum-scale below 2 from the viewport tag. People with low vision pinch to zoom, and the tag is stopping them.
Privacy
5 checks
What a small business website owes the people who fill in its forms: a policy that exists, says what is collected, gives a way to ask, names the tracking that runs, and never signs anyone up without asking.
A privacy policy is published
Privacy
Important when it fails
What good looks like. Publish a privacy policy and link it from the footer of every page. Any site with a contact form needs one, and advertising platforms ask for it.
The privacy policy says what is collected
Privacy
Important when it fails
What good looks like. Add a short section that names what each form collects (name, phone, email, the message), what it is used for, and how long it is kept. Four sentences in plain words is enough.
The privacy policy says who to ask
Privacy
Important when it fails
What good looks like. Add one line with an email address for privacy questions, and say that anyone can ask to see or delete what you hold about them.
The tracking that runs is named in the policy
Privacy
Important when it fails
What good looks like. Name every analytics and advertising tool the site runs in the privacy policy, in plain words, and what each one records. If a tool is not earning its place, remove it instead.
No form adds anyone to a list without asking
Privacy
Important when it fails
What good looks like. Untick the newsletter or offers box by default. Anyone who wants your emails will tick it, and the list you build that way is the one that opens them.
Score your website
34 checks, about two minutes. No card and no account.