Find what is broken
before a customer does
Smart-UI audits a live site or web application across six dimensions: security, code, SEO, accessibility, UX and performance. Delivered in 5 to 10 working days as a ranked list of findings with reproduction steps and fixes, not a scanner export. Fixed price, quoted within 48 hours.
Request an auditWhat does a Smart-UI website audit cover?
Smart-UI runs a fixed-scope audit across six dimensions of a live site or web application: security and where credentials live, code and architecture, SEO and indexing, accessibility against WCAG 2.1 AA, UX and conversion, and performance with test coverage.
The deliverable is a ranked list of findings, each with the steps to reproduce it and the fix, rather than a scanner export. Critical security items are reported the day they are found instead of waiting for the report. The audit takes 5 to 10 working days depending on the size of the application.
Every finding is verified against the live site rather than against the source, because a page can report success and serve something else. Smart-UI has audited its own site this way and publishes what it found.
| Engagement models | Fixed scope, fixed price, no retainer |
|---|---|
| Typical duration | 5-10 working days |
| Team shape | Security, front end, QA and SEO specialists |
| Stack | Playwright, Lighthouse, gitleaks, nmap, axe-core, Search Console |
| Markets served | United Kingdom, United States, Australia, European Union |
Six dimensions, six specialists
One generalist with a checklist finds the things a checklist contains. Each dimension below is run by somebody who does that work on production systems every week.
Security and credentials
Where every key lives and what it can do
- Full git history scanned for secrets, not just the working tree
- Production bundle grepped for tokens shipped to the browser
- Port scan from outside, as an attacker sees you
- Staging environments, old admin panels, forgotten subdomains
- Spend and volume alarms on every metered API
- Backups restored once and timed, rather than assumed
Code and architecture
What it costs to change this next quarter
- Dependency vulnerabilities, with a decision recorded for each
- Dead code, duplicated logic and the parts nobody will touch
- Error handling, and what happens when a third party is down
- Build reproducibility and what the deploy actually depends on
- Database queries that get slow before anyone notices
SEO and indexing
Whether search engines see what you think they see
- Every page fetched and compared against its own markup
- Canonicals, redirects, soft 404s and duplicate URL forms
- Structured data checked against the rendered page, not the source
- Search Console coverage read and each exclusion explained
- Internal linking, orphan pages, sitemap accuracy
Accessibility
WCAG 2.1 AA, tested rather than scanned
- Keyboard path through every flow that matters
- Screen reader pass on forms, dialogs and navigation
- Contrast on real components, including hover and disabled states
- Focus order, skip links, and what a zoom to 200 percent does
- Automated axe-core sweep for the machine-checkable half
UX and conversion
Where people stop, and what it costs you
- Every primary task walked through as a first-time user
- Forms: validation, error copy, and what happens on failure
- Empty, loading, partial and error states, which are usually missing
- Mobile behaviour on real devices, not an emulator
- Analytics checked for whether it records what you think it does
Performance and QA
Core Web Vitals on real traffic, and what tests exist
- LCP, CLS and INP measured on field data where available
- Bundle weight, blocking scripts and image formats
- Test coverage over the paths that carry money
- CI: whether a red build actually stops a release
- Load behaviour against a staging environment that matches production
How the audit runs
Fixed scope agreed before it starts, so the price never depends on how much work the findings recommend.
- 01
Brief and access
A short call about what the system does and who uses it. Read access to the repository and a staging environment where possible. A useful audit is still possible with only the public site.
- 02
The pass
Six specialists work in parallel. Anything critical in security is sent the day it is found rather than held for the report, because a leaked key does not wait for a deadline.
- 03
Verification
Every finding is reproduced against the live system before it goes in the report. Anything that cannot be reproduced is dropped. A report padded with maybes is worth less than a short one that is entirely true.
- 04
Handover
A walkthrough of the findings in priority order, with what to fix this week, this quarter, and what to leave. You also get the script that re-runs the checks, so the audit can be repeated without us.
What lands on your desk
The test of an audit is whether somebody can act on it on Monday without asking the author a question.
You get
- Findings ranked by what they cost you, not by tool severity
- Steps to reproduce each one, so your team can confirm it independently
- The fix for each, at the level of detail an engineer can act on
- Critical security items sent the day they are found
- A re-runnable script, so the checks repeat without us
- A walkthrough session with the people who will do the work
You do not get
- A scanner export with 400 rows and no ranking
- Findings nobody reproduced
- A retainer you have to sign to receive the report
- A quote that grows with the number of problems found
Frequently Asked Questions
Six dimensions on one engagement: security and where credentials live, code and architecture, SEO and indexing, accessibility against WCAG 2.1 AA, UX and conversion, and performance with test coverage. Each is run by a specialist in that area rather than by one generalist with a checklist.
Five to ten working days depending on how large the application is and how many user roles it has. The price is fixed before work starts, quoted within 48 hours of seeing the site and a short brief. There is no retainer and no obligation to have us do the fixes.
A ranked list of findings, each with what it breaks, the steps to reproduce it, and the fix. Not a scanner export. Anything critical in security is reported the same day it is found rather than held back for the report. You also get the script that re-runs the checks, so the audit can be repeated without us.
Optionally, quoted separately once the findings are known, so the audit price never depends on how much work it recommends. Many clients take the report and fix it with their own team, which is a fine outcome and the reason the report includes reproduction steps.
Read access to the repository and a staging environment gives the most complete result. A useful audit is still possible with only the public site, covering SEO, accessibility, UX, performance and everything an attacker can see from outside, which is the same view the people scanning you have.
Automated tools report what is machine-checkable and miss what matters most: markup that validates while describing content the page never renders, an endpoint that answers 200 with an error page inside it, a key that is valid and being used by somebody else. Every finding here is verified against what the server actually sends.
From the blog
All articlesWe audited our own site and every page failed
Thirty pages, thirty with at least one fault. What a full audit actually turns up when the site belongs to the people running the audit.
Five million emails on a stolen key
A leaked API key, five million emails, and a $2,000 invoice. What the attack looked like, why nothing alerted anyone, and the audit we now run on every project.