Fix now
Items 01 to 05These are either visible to your customers right now, or they mean work is not reaching you.
01
The contact form sends to an address that no longer exists
Functional
The contact form sends to an address that no longer exists
FunctionalEnquiries are delivered to an address on a domain that lapsed two years ago. Every one of them bounces and is discarded. The visitor still sees a "thanks, we'll be in touch" message, so neither side knows.
We sent a test enquiry on the day of this audit and it did not arrive anywhere.
Delivery changed to your current inbox, and a test enquiry forwarded to you as proof it lands.
Move off the server's built-in mail function to a delivery service such as Resend or Postmark, so bounces surface instead of vanishing. Return a real success or failure state to the page rather than redirecting blind.
02
Your phone number cannot be tapped on a mobile
Functional
Your phone number cannot be tapped on a mobile
FunctionalThe number in your header is part of an image rather than text, so tapping it on a phone does nothing. Most people looking for a plumber are on a phone and expect to tap and call.
It also means search engines cannot read your number, so it will not show beside your listing.
The number set as real text and linked as a tap-to-call link on every page.
Replace the graphic with text inside a tel: link and reproduce the styling in CSS. Keeps it tappable, readable by search engines and selectable as text.
03
The admin login page is open to the world with no limit on attempts
Security
The admin login page is open to the world with no limit on attempts
SecurityYour site's login page can be reached by anyone who guesses the address, and it allows unlimited password attempts. The contact form plugin is also three years out of date and has a publicly listed vulnerability.
Sites like yours are not targeted personally. They are found automatically by software that tries thousands of addresses a day looking for exactly this.
Login attempts limited, two-factor login switched on, and every plugin updated. Then ask how updates will be kept up in future.
Rate-limit the login route and enforce two-factor for every admin account. Update the vulnerable plugin first, then the rest. Put the site behind a proxy that filters known bot traffic before it reaches the server.
04
"Content coming soon" is still on the services page
Content
"Content coming soon" is still on the services page
ContentTwo of your six services, bathroom installation and underfloor heating, still carry placeholder text from when the site was built. Both are jobs worth thousands, and the page currently tells people you have not got round to describing them.
Both sections written properly, or removed until they are.
Copy, not code. Around 150 words per service, naming the towns covered and what a typical job involves. If it will not be written this month, delete the sections rather than leave them showing.
05
You collect personal details with no privacy policy
Legal
You collect personal details with no privacy policy
LegalThe contact form asks for a name, address, phone number and job description, and the site has no privacy policy at all. Under UK GDPR you are required to tell people what happens to their information.
Your Gas Safe registration number is also missing. The site says "Gas Safe registered" three times but never gives the number, and customers are advised to check the register before letting anyone touch a boiler.
A privacy policy written and linked beside the form, and your registration number shown in the footer of every page.
A privacy page naming the business as data controller, what is collected, how long it is kept and who processes it. Link it next to the submit button. Put the registration number in the shared footer template so it appears everywhere at once.
Fix soon
Items 06 to 10Nothing here is broken, but each one is quietly costing you work by making the site slower, harder to find or harder to trust.
06
The homepage takes 11 seconds to load on mobile data
Performance
The homepage takes 11 seconds to load on mobile data
PerformanceThe page pulls down 8.4MB, almost all of it photographs uploaded straight from a camera at full size and then shrunk by the browser. One boiler installation photo is 3.1MB on its own.
Half of visitors abandon a page that takes more than three seconds. On a job that starts with someone standing over a leak, it will be worse than that.
Every image resized and compressed, with smaller versions served to phones. This alone should bring the page under two seconds.
Resize to a sensible maximum, convert to WebP or AVIF, and serve responsive sizes so phones get a small file. Lazy-load anything below the fold, and set width and height on every image so the page stops jumping as it loads.
07
Every page has the same title in search results
SEO
Every page has the same title in search results
SEOAll seven pages carry the title Home | Northgate Plumbing. Google shows the title as the
clickable headline, so your boiler page, bathroom page and emergency callout page are indistinguishable
in results.
A distinct title and description written for every page, naming the service and the area it covers.
Drive the title and description from per-page fields in the template rather than a single hard-coded value. Roughly 60 characters for the title, 155 for the description, service and town in both.
08
No address and no service area anywhere on the site
Local search
No address and no service area anywhere on the site
Local searchThe site never says which towns you cover or where you are based. Someone searching "plumber near me" is shown businesses that have told Google where they work. Yours has not.
Your address and the towns you cover written on the site, plus LocalBusiness structured data so search engines can read it.
A name, address and phone block in the footer, matching the Google Business Profile exactly. Add LocalBusiness JSON-LD with an areaServed list for the towns covered. Claim the Business Profile if it is not already.
09
Three spelling mistakes, two of them in headings
Typos & copy
Three spelling mistakes, two of them in headings
Typos & copyThe services page heading reads "Bathroom Instalation", the homepage banner reads "24 Hour Emergancy Call Outs", and the contact page says "we will recieve your message shortly".
Small on their own, but a spelling mistake in a heading is the first thing a certain kind of customer notices, and it is the cheapest thing on this list to put right.
All three corrected, and the rest of the site read through properly while they are in there.
Correct the three strings. Worth running the whole site through a spellchecker at the same time, since headings are usually images or hard-coded template text and get missed.
10
Your reviews are not on your own website
Trust signals
Your reviews are not on your own website
Trust signalsYou have 47 reviews on Facebook averaging 4.9, and not one appears on the site. A visitor deciding between you and two other quotes has nothing on this page telling them you are the safe choice.
Your best reviews shown on the homepage and on each service page, with a link through to the full list.
Facebook has no reliable public embed for reviews, so either move review collection to a Google Business Profile and embed from there, or place the quotes by hand with a link to the source. Do not add review structured data for self-published quotes, as Google does not allow it.
Worth doing
Items 11 to 15Quality, accessibility and housekeeping. Less urgent, but all of it is standard practice and should have been included.
11
The mobile menu will not close
UX & UI
The mobile menu will not close
UX & UITapping the menu icon opens the navigation, but tapping it again does nothing. The only way out is to pick a link or reload the page. It has been that way since launch.
The menu button fixed so it closes as well as opens, and closes when you tap outside it.
The button binds an open handler rather than a toggle. Switch it to toggle the class, keep aria-expanded in step, and close on outside click and on Escape.
12
White text on the pale blue banner is hard to read
UX & UI
White text on the pale blue banner is hard to read
UX & UIThe main banner sets white text over a light blue background. Measured contrast is 1.9 to 1, against an accepted minimum of 4.5 to 1. In daylight on a phone it is close to invisible.
A darker blue behind that text, keeping the same brand colour family.
Darken the banner blue until it measures 4.5 to 1 against white, or lay a semi-transparent dark panel behind the text block. Check it against the brand colour rather than replacing it.
13
None of your photographs have descriptions
Accessibility
None of your photographs have descriptions
AccessibilityAll 34 images are missing alt text. That matters for anyone using a screen reader, and it also means Google cannot tell what your work photos show, so they never appear in image results.
A short description written for every image, saying what the job actually was.
Alt text on all 34, describing the job rather than repeating the business name. Purely decorative images take an empty alt="" so screen readers skip them instead of announcing a filename.
14
Three links lead to a price list that was deleted
Functional
Three links lead to a price list that was deleted
FunctionalThe homepage, the services page and the footer all link to a PDF price list that has been removed. All three produce an error page, and that error page has no way back to the site.
The links removed or pointed at a current price list, and a proper error page put in place with a way back.
Remove or repoint the three links. Add a branded 404 page carrying the site's own header and navigation, and redirect the old PDF path if the file is being replaced rather than dropped.
15
The contact form has no spam protection
Security
The contact form has no spam protection
SecurityThere is nothing stopping automated submissions. Sites like this usually start receiving dozens of junk enquiries a day sooner or later, at which point real ones get missed among them.
Spam protection added. Cloudflare Turnstile is free and invisible to genuine visitors.
Add Turnstile and verify the token on the server before the message is sent. The widget on its own does nothing without that server-side check, which is the step most often skipped.
One thing to check yourself
Item 16This one needs your judgement rather than a developer's, because only you can find out the answer.
16
Find out who owns your domain and hosting
Ownership
Find out who owns your domain and hosting
OwnershipYour domain is registered to your developer's account rather than to you, and it renews in March. That is common and usually harmless, but it means you cannot move the site, change host or renew the name without them. If you ever fall out, or they stop trading, it becomes a serious problem.
The domain transferred into an account in your own name, and the login details for your hosting. Both are yours by right.
Open an account at any registrar in the business owner's name, request the transfer code from the current holder, and move it across. Ask for hosting and DNS logins at the same time, and change the passwords once you have them.