A lot of our work starts with checking a website: one somebody else built, one a business has outgrown, or one that has simply drifted over years of plugins, uploads and changes of hands. Before we change anything, we look.
After looking after 200+ websites, we find the same handful of problems again and again. None of them is dramatic. All of them cost the owner something: speed, security, search visibility, or the ability to trust their own figures. Here are the ones we find most, with real examples from sites we’ve checked, names left out.
1. The live site still depends on the test site
Most sites are built on a test copy first, then moved to the real address. The move often leaves stragglers: images, fonts and links that still point at the test copy. Everything looks fine, so nobody notices.
In one week this autumn, all three shops we checked had it. One had over a thousand references to its old test address, and eight of its live pages were loading images from it. The day that test copy is switched off, those images and fonts vanish from the real site.
2. Photos saved in the wrong format, at the wrong size
Banner photos exported as PNG files, or uploaded straight from a camera at 5,000 pixels wide, are the single most common reason a site is slow. On one shop, five banner photos made up 6.9 MB of a 9.5 MB home page. The full story is here.
3. Add-ons nobody remembers installing
Page builders and their add-on packs are useful, but each one brings its own scripts, styles and fonts, loaded on every page whether the page needs them or not. We regularly find an icon set of nearly 900 icons loaded for a dozen, sliders nobody has used since launch, and two plugins doing the same job.
4. Layouts that only work on the designer’s screen
A section built to a fixed width of 1,512 pixels looks perfect on a big monitor. On an ordinary laptop, it pushes the whole page sideways. We see it constantly, because sites get signed off on the screen they were designed on. Always check a new site on a laptop, a tablet and a phone.
5. Tracking that doesn’t track
One site had been loading a Google Analytics tag on every page for six months that Google itself no longer recognised. It recorded nothing, and nobody knew, because the reports still showed the other tags working. Others have the same tag added three different ways by three different people. We cover this properly in Is your analytics lying to you?
6. Doors left open
Much of what we find is security housekeeping that nobody got round to:
- Backup copies of files (the
.bakand.oldcopies people make before editing) left where anyone could download them, source code included. - Old WordPress features switched on that almost nobody uses but attackers love, like the one that lets a bot try hundreds of passwords in a single request.
- The exact software version on show, which is a signpost for anyone looking for sites running something out of date. 20 of 38 WordPress sites in our Dundee benchmark showed theirs.
- No security headers at all: half the WordPress sites in the benchmark sent none of the five common ones.
7. Scheduled jobs that run on your visitors’ time
WordPress runs its scheduled jobs (publishing, clean-ups, emails) by piggybacking on visitors’ page loads. On a busy site that means pages occasionally slowing while it does housework; on a quiet one it means scheduled jobs not happening at all. On sites we host, they run on a proper timer instead.
8. Nobody can say who has access
Old admin accounts for developers who left years ago, shared passwords, a hosting login nobody can find. It’s the least technical problem on this list and one of the most important. A business should always be able to list exactly who can get into its own website.
What to do about your own site
- Load your home page on your phone, on mobile data. If it takes more than a few seconds, something is heavy.
- Look at your site on a laptop and a tablet, not just the screen it was built on.
- Check your analytics is recording visits right now, using its real-time view while you browse your own site.
- List everyone with an admin login, and remove anyone who shouldn’t have one.
- Ask your developer or host whether your site still loads anything from a test or old copy.
Or let us look. Taking over a site starts with exactly this kind of health check, and it’s part of our hosting and support. We’ll tell you what we find in plain English, what matters, and what doesn’t. Get in touch.
Got a problem like this? Good. We like those.
Tell us what you’re dealing with and we’ll tell you honestly what we’d do.
