Find what’s broken before you spend on what’s not.

Real-device load times across your most important templates — homepage, primary service or category page, blog post, product or contact page — measured against the 3G mid-range-phone reality your visitors actually experience, not the gigabit fibre you tested on. We profile time to first byte, time to interactive, total blocking time, and total page weight, then identify the heaviest assets, the render-blocking scripts, and the third-party tags that are quietly costing you a second or two on every visit. Where a tag adds more weight than it justifies, we flag it.

Largest Contentful Paint, Interaction to Next Paint, and Cumulative Layout Shift — Google’s three field metrics, measured against the 75th-percentile thresholds the algorithm actually uses for ranking. We read your Chrome User Experience Report data alongside lab measurements from Lighthouse, identify which of the three is failing and on which templates, and trace each failure back to its cause: late-loading hero images, unsized embeds, hydration-blocking JavaScript, font-display strategy, layout shift from injected ads or banners. Field data is the verdict; lab data is the debugger.

Automated scanning catches roughly thirty per cent of accessibility issues. The other seventy per cent require human review. We run an axe-core sweep across the templates, then walk the site by hand with a screen reader and a keyboard — colour contrast, focus order, form labelling, heading hierarchy, alt-text quality, semantic landmarks, motion-reduction preferences, ARIA misuse. The deliverable is the WCAG 2.2 AA conformance gap, scored by severity and effort. Accessibility is now a legal exposure in most jurisdictions and a ranking signal in all of them. The audit makes the gap visible before it becomes either.

A read on whether the host itself is the bottleneck. Server response times across the day, caching configuration at server, application, and CDN layers, PHP or runtime version, database query latency on the heaviest pages, asset delivery via CDN versus origin. We check whether the host’s marketing copy matches the actual performance you’re getting, and whether the plan you’re paying for is sized correctly for your traffic. The most common single finding on this pass is a host that costs the same as a faster one — and switching is the highest-leverage fix on the page.

More than half of your traffic arrives on a phone, and on most sites the phone version is a desktop layout that learned to shrink. We test on real devices across iOS and Android, audit touch-target sizes, tap-delay behaviour, scroll performance, font legibility at 320 px wide, the way menus and forms behave on a thumb, and the parity between what the desktop visitor sees and what the mobile visitor gets. Anything missing on mobile is effectively missing from your site as far as Google is concerned, and we surface those gaps explicitly.

A heuristic walkthrough of the paths that turn a visitor into a customer — homepage to service page to enquiry, category to product to checkout, landing page to lead form. We map the friction: ambiguous calls to action, forms that ask for more than they need, trust signals that are missing where the decision is being made, social proof in the wrong place, copy that hedges where it should commit. The output is not abstract conversion-rate-optimisation theory; it’s a list of specific, page-level changes ordered by expected impact on the actual business outcome you’re chasing.

A baseline review of the security posture exposed at the HTTP layer — Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, Referrer-Policy, Permissions-Policy, CORS configuration — and at the application layer for WordPress and other CMS sites. SSL configuration, cipher suite, login hardening, file permissions, plugin and theme inventory, and the obvious exposed paths that automated bots probe within hours of going live. We grade the site against a clear standard, document the gaps, and flag the ones that are exploitable today versus the ones that are merely best-practice debt.

Whether the data you rely on to make decisions is actually correct. We verify that GA4 is firing on every meaningful event, that conversion goals are configured against real form submissions and not pageviews of a thank-you URL, that bot traffic is being filtered, that referrer attribution is intact across the conversion path, and that tag-manager triggers are not silently double-counting or dropping events. Most sites we audit are running on a measurement layer that disagrees with reality somewhere; this pass is how that gets surfaced before another quarter of decisions is made on the wrong numbers.