An annual website audit: does the site still do its job?

Before you start

Pick a fixed date, such as the anniversary of launch or the start of your financial year, so it actually happens. Have to hand: the site on a phone and a laptop, the Anticode dashboard, your domain registrar's login details (kept by you, not shared in chat), and a document for findings with three columns: what, fix, who.

The seven parts

1. Is everything on it still true?

Read every page as a new customer. Check prices, opening hours, services you no longer offer, team members who have left, photos of premises that have changed, and every phone number and address. Run the release checklist, which runs every publish check without publishing. The design gate stops empty links (an empty address, "#" or javascript:), but it doesn't check that outside addresses still work, so click those yourself.

2. Is it still bringing people in?

Open the site's analytics and compare this year with last: total views per site, and the split by source (search, AI assistants, social, other sites, direct). A fall in search with no change in the business often means competitors' pages improved or yours went stale. The Intelligence page summarises visits since publish and answers from cited figures only. Remember analytics is per site, not per page.

3. Do the forms and connectors still work?

1. Send a real test through every form: contact, booking, newsletter and any custom form.
2. Check each arrives where it should: the account's email, Slack or Telegram, the sheet or CRM.
3. Check the people receiving them are still the right people. Connectors belong to the account or Team workspace and receive every site's forms, so one stale webhook affects all of them.
4. Glance at the submissions access log, which records the last 200 reads, exports and deletes of form data, for anything you don't recognise.

4. Are the legal pages right?

Anticode writes each site's Privacy Policy and Terms from what the site actually does, such as its forms and where submissions go. They're a starting point, not legal advice. If you added a connector, started taking payments through a payment link or changed what you collect, read them again and have someone qualified check anything you rely on.

5. Is the domain safe?

At your registrar, check the expiry date, that auto-renew is on, that the payment card is current, and that the contact email reaches someone. Anticode connects your own domain on paid plans and issues its certificate, but registration and renewal happen at the registrar. A lapsed domain is the most avoidable outage there is.

6. Is the plan still the right fit?

Look at what you used: builds against the daily and weekly allowance, sites, seats in a Team workspace, and whether you still need a custom domain or the badge removed. Compare with the plans on /pricing. While you're in the account, check who has access: remove people who've left (owners and admins can), and confirm two-factor sign-in is on for everyone who can read form data.

7. Does the design still fit the business?

If the business has moved upmarket, changed audience or simply looks dated next to competitors, try a different direction (one of the seven design systems), action colour or theme in the visual editor, preview it, and keep or discard it. Version history means trying costs nothing. A full redesign is a separate project; see the website redesign process.

Also worth a look: security and backups

Every published site serves a security report at /.well-known/anticode-security, worked out from the published pages each time it is requested. Read it once a year, and after any change that added a form. Anticode keeps the last ten published versions as backups, which its regular file-hash scan uses to put back anything changed on the server; your own way back to an earlier site is version history. Do keep your own copy of photos and copy you would hate to rewrite.

Turning findings into fixes

What goes wrong

• The review never happens. Put it in the shared calendar with a named owner, like a boiler service.
• The list is too long to act on. Fix anything that is wrong or risky now; schedule the nice-to-haves.
• Nobody knows the registrar login. Write down where the domain is registered and who holds access, and keep it with your other business records.

How you know it's done

Every page is accurate, every form reached its destination in a test, the domain renews automatically with a current card, access is limited to current people with two-factor sign-in, and the findings list has an owner and a date on every line. Next year's review starts from this year's list.

Limits

Anticode won't remind you to do the review, check facts on your pages, renew your domain, or give legal advice on the generated policies. Analytics count views per site with no per-page breakdown, heatmaps or A/B tests. See the website maintenance checklist, the domain renewal checklist and removing employee website access.

Questions people ask

How long does an annual website audit take?

An afternoon for a small business site, plus whatever the fixes take. The review itself is mostly reading and testing.

Do I need to update my privacy policy every year?

Only when something changes, but the yearly review is a good moment to check. Anticode writes it from what the site does; it isn't legal advice.

Can Anticode renew my domain?

No. Renewal happens where the domain is registered. Anticode connects the domain to your site and issues the certificate.