Five checks catch most website decay: real-phone speed in PageSpeed Insights, every form and button tested end to end, Search Console alerts and trends, software and certificate dates, and what AI assistants say about your business. All five use free tools.
A 30-minute quarterly audit should check five things: how fast your key pages load for real phone users, whether every form, call button and WhatsApp link still reaches a person, what Search Console has flagged, whether your software and security certificate are close to expiry, and whether AI assistants describe your business correctly. Each check uses a free tool, and together they catch most of the quiet failures that cost enquiries.
Websites decay without telling anyone. A plugin update breaks a form, a redirect starts looping, a new script slows every page, and nobody notices until the phone goes quiet. Half an hour, four times a year, is enough to catch most of it while the fix is still small.
- of real-user data behind PageSpeed Insights field results
- 28 days
- of real-user data behind PageSpeed Insights field results
- the 'good' limit for Interaction to Next Paint, a Core Web Vital
- 200 ms
- the 'good' limit for Interaction to Next Paint, a Core Web Vital
- the end of security support for PHP 8.1
- 31 Dec 2025
- the end of security support for PHP 8.1
- the day Let's Encrypt stopped sending certificate expiry emails
- 4 Jun 2025
- the day Let's Encrypt stopped sending certificate expiry emails
01
Speed on a real phone (5 minutes)
Run your three most important pages, usually the home page, your main service page and your contact page, through PageSpeed Insights and read the mobile results first. The top section is field data from real Chrome users over the previous 28 days. The score below it comes from a lab test on a simulated mid-range phone. Field data is what your customers actually felt.
Look at the three Core Web Vitals, which are judged at the 75th percentile of page loads. Good means Largest Contentful Paint within 2.5 seconds, Interaction to Next Paint within 200 milliseconds and Cumulative Layout Shift of 0.1 or less. If a page has too little traffic for its own field data, the tool falls back to figures for your whole site, and if there is not enough even for that, you only get the lab test.
Write the numbers down. One quarter's result tells you little; four in a row tell you whether a new plugin, chat widget or tracking script is slowly costing you.
02
Every form, button and link, tested for real (10 minutes)
This check matters most and gets skipped most. From your own phone, on mobile data, submit every form on the site with a realistic enquiry. Then confirm the notification arrived in an inbox a person reads daily, not a spam folder or the address of someone who left last year.
Next, tap the click-to-call number and the WhatsApp button on the pages people use most. Check that the number is current, that WhatsApp opens the right chat with a sensible pre-filled message, and that any booking or payment link still loads. A broken form sends you no error message. You simply stop hearing from people.
03
Search Console: alerts and trends (5 minutes)
Search Console emails you when Google finds new issues on your site, so first make sure those emails reach someone who reads them. Then work through these reports.
- Page indexing (some Google pages still call it Index coverage): pages Google could not index or chose to leave out. Some exclusions are expected, such as duplicates or pages marked noindex, so first confirm your home page and main service pages are indexed. Entries under 'Not found (404)' usually mean a deleted page or a link to a missing address. Google says that is fine for a page you removed on purpose, but a page that has moved needs a 301 redirect.
- Security issues and Manual actions: both should be empty. Anything listed here is urgent.
- Core Web Vitals: the site-wide version of your speed check, based on real-world usage.
- Performance: compare the last three months with the same three months a year ago, and note which queries and pages are growing or shrinking.
Google's troubleshooting guide suggests the 16-month view for spotting seasonal patterns, which matters for businesses with exam, wedding or festival seasons. It also offers a useful rule: if impressions hold steady but clicks fall, look at your page titles and snippets, and at whether other sites now show a more appealing rich result.
04
Software, certificate and domain dates (5 minutes)
Expiry dates are the cheapest problems to prevent and the most embarrassing to suffer. Check these each quarter.
| What | Where to look | Watch for |
|---|---|---|
| PHP version | Your hosting control panel (hPanel, cPanel or Plesk) | 8.0 and older get no fixes; 8.1 loses security support on 31 December 2025, so plan a move to 8.3 or 8.4 |
| WordPress core, plugins and theme | Dashboard, then Updates | Pending updates, and plugins nobody has updated in a long time |
| Security certificate (HTTPS) | Your host's SSL page, or a free certificate monitor | An expiry date in the next month, or auto-renewal switched off |
| Domain name | Your registrar account | Expiry date, auto-renew status, and a working card and email on file |
Two changes this year make the certificate check matter more. Let's Encrypt, a free, automated certificate authority, stopped sending expiry reminder emails on 4 June 2025, so anyone relying on those emails no longer gets a warning. It pointed users to third-party monitors instead, such as Red Sift Certificates Lite, which it described as free for up to 250 certificates. And under a ballot the CA/Browser Forum approved in April 2025, the maximum lifetime of publicly trusted TLS certificates shrinks in stages from 398 days today: to 200 days from 15 March 2026, 100 days from 15 March 2027 and 47 days from 15 March 2029. Automatic renewal is becoming the only practical option, so confirm your host does it.
On WordPress, plugin and theme auto-updates have been available since version 5.5. They run twice a day by default and email you after each attempt. If you switch them on, take a backup you know you can restore first, as WordPress's own documentation advises.
05
Ask the assistants about yourself (5 minutes)
Open ChatGPT, Gemini and Google's AI Mode and ask the questions a customer would: what your business does, where it is, when it is open and who it suits. Then ask a category question, for example the best physiotherapy clinic in Kakkanad, and see whether you appear at all.
Google added Malayalam to AI Mode in October 2025, along with six other Indian languages, so if your customers search in Malayalam, ask in Malayalam too.
When an answer is wrong, do not argue with the chatbot. Fix the source: your website's contact and service pages, your Google Business Profile and the directories that list you. Then ask the same questions next quarter and see whether the answers have caught up.
06
Make it a habit
Put four dates in the calendar, one per quarter, and keep the results in a single sheet so the trend is visible. The routine:
- Speed: mobile PageSpeed Insights for your top three pages, with the three Core Web Vitals noted.
- Forms and buttons: every form submitted from a phone, plus call, WhatsApp and booking links tapped.
- Search Console: alert emails reaching the right person, then Page indexing, Security issues, Manual actions, Core Web Vitals and a year-on-year Performance comparison.
- Dates: PHP version, pending updates, certificate expiry and domain renewal.
- AI check: four questions about your business and one category question, in English and Malayalam.
- Fix list: anything that failed, with a name and a deadline next to it.
The businesses that run this dull loop every quarter rarely have the emergencies the others do. If you would rather someone ran it with you the first time, start with our free audit.
Sources
Facts current as of 31 October 2025.