Skip to content
steelabs

Example

Sample site audit report

A permanent, fictional excerpt showing how an automated finding becomes a fix and a verification step. Available even when temporary live reports expire.

Download editable Markdown

How to use this

Useful for: Website owners comparing automated findings with the work needed to resolve them.

  1. Read expected and observed behaviour together. The result of a rule describes that rule on the checked response; it does not establish the security, accessibility or speed of the entire site.

  2. Group repeated findings by their cause before estimating work. One missing shared configuration may affect several pages, while an apparently similar page issue may need an individual content change.

  3. Assign a fix and verification step to each actionable item. Save the original run settings so a follow-up check compares like with like rather than claiming improvement from changed scope.

  4. Use a fresh audit for a current website. This example never expires because it is a teaching document, not a stored audit run or a snapshot of an actual customer system.

Scope and limitations: Fictional, abbreviated example. No requests were made to a real site to produce these findings. The live tool has a wider rule set; this excerpt is not its full report or a certification.

Document preview

# Sample site audit report — fictional excerpt

## Scope
Site: example.invalid (fictional; no live scan).
Pages represented: home, services and contact.
Mode: desktop response checks; selected illustrative rules only.
No performance benchmark, security certification or client outcome is implied.

## Selected findings
| Area | Expected | Observed in example | Result |
| --- | --- | --- | --- |
| Security | A Content-Security-Policy header | Header absent | Needs attention |
| SEO | One descriptive H1 per page | Contact page has no H1 | Needs attention |
| SEO | Canonical URL for the page | All three point to themselves | Passed rule |
| Links | Internal destinations respond successfully | Services links to a removed route | Needs attention |
| Accessibility | Meaningful images have text alternatives | One content image has no alternative text | Needs review |
| Performance | Content images declare dimensions | Dimensions absent on hero image | Needs attention |

## Fix first: shared security configuration
Observation: the sample responses omit a Content-Security-Policy header.
Action: inventory the required script, image, font and connection origins; configure a policy compatible with the framework and third-party services.
Verification: check the deployed response header, exercise interactive flows and inspect browser violations. Merely adding a header does not establish that the policy prevents inline script execution.

## Fix next: page-specific content and navigation
Give the contact page a descriptive primary heading. Replace or remove the broken services link. Add an appropriate alternative description to the meaningful image; decorative images should use an empty alternative. Declare image dimensions and check the layout at narrow and wide viewports.
Verification: repeat the same checks, use the actual page destinations and review keyboard operation. Automated alternative-text detection cannot decide whether the description is useful.

## Handover record
Owner: assign one owner per fix.
Evidence: attach the original response, affected route and follow-up result to the private work item.
Remaining work: authentication, business workflows, interactive accessibility, load testing and specialist security assessment are outside this excerpt.

A real report reflects a particular run, configuration and point in time. The release decision needs additional evidence for areas an automated response check cannot exercise.

Read alongside this worksheet

Get help applying itAll resources