THE AUDIT GATE · 2026-11-06.1

“Done” is a checklist, not an opinion.

Every build is checked against the twelve items below before it is delivered. The list is public, numbered and versioned. It can be run by someone who did not build the site, which is the only reason it can settle an argument.

IF A CHECK FAILS

The builder fixes it and the audit runs again. It costs the client nothing, and it is not capped — a build that fails four times is fixed four times.

IF IT PASSES

The delivery obligation is met. Payout is not withheld for anything that was not in the agreed scope. Anything new is a change order, priced in writing.

The twelve checks

Each audit check, what a pass proves, and what it does not prove.
ID	THE CHECK	A PASS PROVES	IT DOES NOT PROVE
routes-200	Every URL in the sitemap is requested as an anonymous visitor and must return 200.	There is no published page that is dead, gated by accident, or behind a login.	That each page is worth reading, or that a search engine will index it.
no-redirect-chains	No sitemap URL answers with a redirect, and no redirect chain is longer than one hop.	A crawler reaches the page it was promised without walking a maze.	That the destination is the page the visitor wanted.
https-and-certificate	The site answers on HTTPS, the certificate chain validates from outside, and the expiry is at least 14 days away.	The browser will not warn a customer away, today or at the next renewal.	That the certificate will renew — that is a job somebody has to keep doing.
no-mixed-content	No page loads a script, stylesheet, font or image over plain HTTP.	The padlock is not cosmetic.	That every third-party script is trustworthy.
one-h1	Every page has exactly one h1, and every page has a title that is unique across the site.	The page states its subject once, in a way a crawler and an assistant can read.	That the heading is any good, or that the title is the one a buyer would search.
structured-data	Every JSON-LD block parses as JSON and its @type values are from schema.org.	The machine-readable claims are readable, rather than silently broken markup.	That the claims inside them are true — that is the content's job, not the parser's.
contrast	Body text meets 4.5:1 against its background and large text meets 3:1, measured on the rendered page.	The text is legible to a person reading outdoors on a phone.	That the page is usable with a screen reader — that needs a manual pass, every time.
keyboard-reachable	Every interactive control is reachable by Tab and shows a visible focus ring.	A keyboard user is not locked out of the enquiry path.	That the focus order makes sense for the task.
form-delivers	The primary form is submitted once against a reserved test destination, and the submission arrives with the fields it claims to send.	The one thing the site exists to do actually reaches a person.	That anybody will answer it, or that it will not be caught by a spam filter later.
mobile-render	Every template renders at 390×844 with no horizontal document scroll and no element wider than the viewport.	The site is usable on the phone most visitors are holding.	That it is fast on their network, or correct on a device nobody tested.
no-js-errors	Loading each template produces no uncaught console errors.	The page is not half-broken in a way that only shows up in a console nobody opens.	That every interaction completes — that is what the form check is for.
claims-match	Every factual claim on the site — a price, a licence number, an address, a count — resolves to the record it came from.	The site is not inventing anything, which is the failure that cannot be undone by a fix.	That the record itself is right. It proves the site is faithful to it.

routes-200
Every URL in the sitemap is requested as an anonymous visitor and must return 200.
PROVESThere is no published page that is dead, gated by accident, or behind a login.
NOTThat each page is worth reading, or that a search engine will index it.
no-redirect-chains
No sitemap URL answers with a redirect, and no redirect chain is longer than one hop.
PROVESA crawler reaches the page it was promised without walking a maze.
NOTThat the destination is the page the visitor wanted.
https-and-certificate
The site answers on HTTPS, the certificate chain validates from outside, and the expiry is at least 14 days away.
PROVESThe browser will not warn a customer away, today or at the next renewal.
NOTThat the certificate will renew — that is a job somebody has to keep doing.
no-mixed-content
No page loads a script, stylesheet, font or image over plain HTTP.
PROVESThe padlock is not cosmetic.
NOTThat every third-party script is trustworthy.
one-h1
Every page has exactly one h1, and every page has a title that is unique across the site.
PROVESThe page states its subject once, in a way a crawler and an assistant can read.
NOTThat the heading is any good, or that the title is the one a buyer would search.
structured-data
Every JSON-LD block parses as JSON and its @type values are from schema.org.
PROVESThe machine-readable claims are readable, rather than silently broken markup.
NOTThat the claims inside them are true — that is the content's job, not the parser's.
contrast
Body text meets 4.5:1 against its background and large text meets 3:1, measured on the rendered page.
PROVESThe text is legible to a person reading outdoors on a phone.
NOTThat the page is usable with a screen reader — that needs a manual pass, every time.
keyboard-reachable
Every interactive control is reachable by Tab and shows a visible focus ring.
PROVESA keyboard user is not locked out of the enquiry path.
NOTThat the focus order makes sense for the task.
form-delivers
The primary form is submitted once against a reserved test destination, and the submission arrives with the fields it claims to send.
PROVESThe one thing the site exists to do actually reaches a person.
NOTThat anybody will answer it, or that it will not be caught by a spam filter later.
mobile-render
Every template renders at 390×844 with no horizontal document scroll and no element wider than the viewport.
PROVESThe site is usable on the phone most visitors are holding.
NOTThat it is fast on their network, or correct on a device nobody tested.
no-js-errors
Loading each template produces no uncaught console errors.
PROVESThe page is not half-broken in a way that only shows up in a console nobody opens.
NOTThat every interaction completes — that is what the form check is for.
claims-match
Every factual claim on the site — a price, a licence number, an address, a count — resolves to the record it came from.
PROVESThe site is not inventing anything, which is the failure that cannot be undone by a fix.
NOTThat the record itself is right. It proves the site is faithful to it.

The protocol, in order

BEFORE THE BUILD STARTS: The scope is written down, priced, and agreed. That document — the Contracted Baseline — is frozen at the moment it is sent. Its hash is recorded, so the words under the signature cannot change afterwards.
AT DELIVERY: The audit runs against the delivered site, against this version of this list. The result is written down with the date and the build it applies to.
IF A CHECK FAILS: The builder fixes it and the audit is re-run. This costs the client nothing, and it is not capped: a build that fails four times is fixed four times.
IF THE AUDIT PASSES: The builder's delivery obligation is met. Payout is not withheld for anything that was not in the Contracted Baseline.
IF THE CLIENT WANTS SOMETHING NEW: That is a change order: priced in writing, approved in writing, and paid. It is not a review of the delivery, and it cannot be used to withhold the delivery payout.

What the audit is not.

These checks prove the site is not broken in the ways listed. They do not prove it is good, persuasive, fast on every device, or right for the business. The audit is the floor, not the ceiling, and it is evidence in a disagreement rather than a substitute for one.

It is presumptive, not final. A client who disagrees with a pass is not told the matter is closed; they are shown the report and, if they still disagree, the disagreement is about the scope — which is a change order, and priced.

The build side of this →What you get →Start with the brief →