A basic site audit covers performance and security together, and the fastest way to start is with a checklist you can run after every major change. This post gives you that checklist: what to check for images, what to check for security, and how to prioritize fixes. You do not need special tools for most of it, and you can fix the highest-impact items first without overhauling everything at once.

Image Audit

Images are often the heaviest part of a page, so small improvements here can cut load times noticeably. Run through these checks for every image on your site.

Serve Correctly Sized Files

Do not serve a very wide image when the browser will display it at a much smaller size. Resize images to match the largest display size you use. A thumbnail should be a separate, smaller file, not the full image scaled down with CSS.

Compress JPGs

JPEG compression reduces file size with little visible loss. Use a tool like jpegoptim.com to strip metadata and find a quality setting that balances size and appearance. Even a modest compression can cut file size by half.

Use Modern Formats Where Supported

Formats like WebP and AVIF can be smaller than JPEG at the same quality. Serve them to browsers that support them (using <picture> elements or srcset), and fall back to compressed JPEGs for the rest. Check your content delivery system to see if it handles format negotiation automatically.

Lazy-Load Images Below the Fold

Images that are not visible when the page first loads should not load until the user scrolls near them. Add loading="lazy" to your <img> tags. This keeps the initial page load fast and saves bandwidth for visitors who never scroll all the way down.

Security Headers Audit

HTTP security headers tell browsers how to handle your site's content. Missing or weak headers leave visitors open to common attacks. Check these headers on every page.

  • Content-Security-Policy (CSP): Restricts which scripts, styles, and other resources can load. A tight CSP blocks XSS attacks and data injection. Start with a restrictive policy and widen it only as needed.
  • HTTP Strict Transport Security (HSTS): Forces browsers to use HTTPS for all future requests. Set a reasonable max-age and include includeSubDomains if you control all subdomains.
  • X-Frame-Options: Prevents your site from being embedded in an iframe on another domain, stopping clickjacking. Use DENY or SAMEORIGIN.
  • X-Content-Type-Options: Stops browsers from guessing a file's MIME type. Set it to nosniff to prevent script injection via incorrectly typed files.

After you adjust these headers, test them with a free security scanner that checks each header and explains what is missing or misconfigured. No account is needed for the free scans.

TLS Configuration and Certificate Expiry

Transport Layer Security encrypts data between your server and visitors. A weak TLS setup or an expired certificate breaks that encryption and scares away users.

Check Certificate Expiry

Set a calendar reminder for at least a few weeks before your certificate expires. Automated renewal with tools like Let's Encrypt is common, but verify that the renewal actually runs. An expired certificate shows a browser warning that most visitors will not bypass.

Test TLS Configuration

Ensure your server supports the latest version of TLS and a modern version. Disable older versions, which are deprecated. Check that your cipher suite uses modern, secure ciphers and that older, weak ones (like RC4 or 3DES) are removed. A passive scanner can list your enabled protocols and ciphers without making any connection to your server.

Outdated JavaScript Libraries

JavaScript libraries with known vulnerabilities are one of the most common entry points for attackers. Even if your own code is clean, a single outdated jQuery or TinyMCE version can compromise the whole site.

  1. Identify every library your site loads. Check your HTML source, JavaScript files, and any content management system plugins. Write down the library name and version number.
  2. Compare against CVE databases. For each library and version, look up whether any Common Vulnerabilities and Exposures (CVEs) have been published. A JavaScript library check tool can automate this comparison for you.
  3. Update or replace vulnerable libraries. The safest fix is to update to the latest stable version. If an update is not possible (for example, a legacy dependency), consider replacing the library with an alternative or wrapping it in a way that limits the risk.

Run this check after every major change to your site, because a new plugin or theme update can reintroduce an old, vulnerable library.

Run Checks After Every Major Change

A single update can undo weeks of careful work. A new plugin can turn off your HSTS header. A theme update can replace your compressed images with uncompressed originals. A content management system upgrade can reset your CSP to the default. Make it a habit to run your full audit checklist after any significant change: new theme, new plugin, major content overhaul, or server migration. The checks take a few minutes, and they catch regressions before they reach your visitors.

Fix the Highest-Impact Items First

You do not need to fix everything at once. Prioritize changes that protect visitors or save the most bandwidth. A missing HSTS header or an expired certificate is a higher priority than a slightly too large JPEG. A known CVE in a widely used library is higher than one in an obscure script nobody uses. Fix the items that affect the most users or pose the most risk, then work down the list. The goal is steady improvement, not perfection on day one.