Digital AuditsModule 2: Website and search reviewLesson 4 of 12
Course progress25%
19 min lesson · Updated August 2026
How do you audit performance, maintenance and security basics?
Audit website performance, maintenance and security basics by combining field experience, repeatable lab diagnosis, infrastructure and software checks, and verified operational controls—without treating a single score as speed or security proof.
What you will learn
By the end, you will understand:
Separate field and lab performance evidence
Review maintenance, backups, updates and access controls
Report security observations without claiming a penetration test
Visual explainer
See the idea clearly.
123
A website is reviewed through user-experience field data, repeatable lab tests, network and asset layers, software maintenance, access control, backups, monitoring and recovery verification.
Field and lab data answer different questions
Field data
Aggregated experiences from eligible real users over a period; useful for population experience but affected by devices, networks, geography and sample eligibility.
Lab data
A controlled synthetic run useful for diagnosis and repeatability; it does not represent every visitor or guarantee field outcomes.
Document the performance test
Exact URL/template
Device/emulation
Network/CPU conditions
Tool/version
Location
Signed-in/out state
Cache state
Cookie/consent state
Third-party scripts
Date/time
Repeat runs
Field-data availability
Trace the loading path
01
DNS/TLS/server response
02
HTML and critical resources
03
CSS/fonts
04
Main content image
05
JavaScript execution
06
Layout stability
07
Interaction readiness
08
Third-party activity
09
Long-lived cache/repeat visit
Core Web Vitals are important—not complete
Largest Contentful Paint, Interaction to Next Paint and Cumulative Layout Shift describe key aspects of loading, responsiveness and visual stability. They do not cover content clarity, accessibility, transaction success or every performance problem.
Diagnose by page type and distribution, not only an average. Avoid optimizing a lab number in ways that harm real functionality.
Maintenance and security baseline
Area
Check
Software
Supported core/theme/plugin/runtime versions, update ownership and staging/rollback.
Access
Named accounts, least privilege, MFA where supported, no shared admin credentials.
Backups
Automated schedule, off-site/isolated copy, retention and tested restoration.
Availability, logs, integrity/change awareness and actionable alert ownership.
Recovery
Incident contacts, containment steps, clean restore source and verification.
A Site Health score is not a security certificate
WordPress Site Health can expose configuration and software recommendations. It cannot prove absence of vulnerable custom code, compromised credentials, malicious files or weak hosting controls.
A standard audit should describe its security depth. Do not call passive configuration review a penetration test or promise a site is secure.
Test safely
Avoid load, exploit or destructive testing on production without explicit authorization, method and rollback. Sanitize reports and never include credentials, tokens or sensitive personal data.
Escalate suspected compromise through an incident process; do not casually modify evidence.
Real-world example
Example: one score hides two different issues
Example
A product page receives a poor mobile lab score. Field data also shows slow LCP, supporting a broad image-delivery issue, while the lab trace reveals a consented chat script blocking interaction only after acceptance. The audit separates the two findings, owners and verification methods.
Try this
Create a performance evidence pack
Test one representative URL three times in the same lab conditions, record the median and trace, then compare available field data. List which conclusions are supported by both and which remain lab-only hypotheses.
Common questions
Questions beginners ask.
Is PageSpeed Insights the same as Lighthouse?
PageSpeed Insights can show field data and Lighthouse lab analysis; the two datasets have different scopes and should not be confused.
What are Core Web Vitals?
Google’s current user-experience measures for loading, interaction responsiveness and visual stability: LCP, INP and CLS.
Why do performance scores change?
Network, device, server, page state, third parties, tool versions and natural run variation affect lab results.
Does a score of 100 mean the site is fast for everyone?
No. It is one lab result under defined conditions and does not represent all real users or tasks.
Does WordPress Site Health prove security?
No. It is a useful configuration/maintenance diagnostic, not a security guarantee.
What makes a backup trustworthy?
A protected backup with suitable retention that has been restored and verified, not merely a success notification.
Should every plugin be updated immediately on production?
Security fixes matter, but important changes need compatibility checks, backups and rollback according to risk.
Can a normal audit claim no vulnerabilities exist?
No. State tested scope and method; absence of observed issues is not proof of absence.
