The 2026 Website Health Check

Your website is the hardest-working salesperson in your business. It works 24 hours a day, never takes a sickie, and is usually the first impression a customer gets.

So when did you last give it a proper check-up?

Here's the 2026 health check we run on every site we audit. Twelve points, three categories. Walk through it yourself or send it to your dev team.

Performance (will Google and humans actually wait for it?)

  1. Largest Contentful Paint (LCP) under 2.5 seconds on mobile 4G. Google ranks on this. Customers leave at 3 seconds.
  2. Interaction to Next Paint (INP) under 200ms. Replaced FID in early 2024. Tap-to-response delay is what people feel.
  3. Cumulative Layout Shift (CLS) under 0.1. No more buttons jumping around as ads load.
  4. Images served as AVIF or WebP, lazy-loaded below the fold, with explicit width/height.

If any of these are red, you're losing both rankings and revenue. PageSpeed Insights is free and ruthless.

Security & maintenance (boring but career-ending if you skip it)

  1. HTTPS everywhere, with a valid certificate auto-renewing. No mixed content warnings.
  2. WordPress core, themes, and plugins all on the current major version. Updated weekly with regression testing, not "set and forget."
  3. Daily off-site backups that you've actually tested by restoring once. Untested backups don't count.
  4. A Web Application Firewall (Cloudflare, Wordfence Premium, or similar). Brute-force and SQL injection attempts are constant.
  5. Two-factor authentication on every admin account. No exceptions, ever.

AI-readiness (the new bit)

The category that didn't exist on our 2019 checklist.

  1. Valid structured data (Article, FAQPage, LocalBusiness, Product), test it in Google's Rich Results tool.
  2. An llms.txt file at your domain root, declaring what AI crawlers can read and how to attribute you.
  3. Author bios with real photos and credentials on every article. LLMs weight E-E-A-T heavily when choosing what to cite.

What a "passing" site actually looks like

  • All three Core Web Vitals green on mobile.
  • Zero critical security warnings in Wordfence / Sucuri.
  • Backups verified within the last 30 days.
  • Rich Results test passes for every key page type.
  • Cited at least once by ChatGPT or Perplexity for a brand-relevant query.

If you can't be bothered

That's literally what our WordPress Care Packages exist for, $99/month and we run this check (plus the fixes) so you don't have to. But even if you go DIY, run the 12 points above quarterly. Your future self will thank you.