KIX
Talk to us
Website soft audit

What is your website
really doing?

Your website works for you while you're not looking. It may also be tracking visitors without asking, showing an out-of-date page, or quietly turning customers away. Our soft audit checks it the way your customers see it, and tells you in plain English what's fine, what isn't, and what to do about it.

01 — Why it matters

We checked the websites of 51 businesses that advertised in one local magazine in 2026.

88%

had at least one problem worth fixing

41%

started tracking visitors before asking permission

49%

had no privacy policy linked from their homepage

14%

still showed a copyright date of 2024 or earlier

Checked in October 2026, using only what any visitor's browser receives. We never name the businesses.

02 — What “soft” means

Soft means we only look.

We see your website exactly as a customer's browser does, on a computer and on a phone. We never log in, never try passwords, never test for weaknesses and never touch your systems. Nothing we do can break anything, and you don't need to give us access to anything.

03 — What we check
  • 01

    Security

    Is the padlock there, is the certificate in date, does every address end up on the secure version, and are the browser's standard protections switched on?

  • 02

    Privacy and cookies

    Does your site track visitors before they agree? Can they say no? Which other companies can see who visits?

  • 03

    The paperwork

    Privacy policy, cookie policy, terms, notices on your forms, and, for a limited company, the details the law says your website must show.

  • 04

    Phones

    How your site looks and works on a real phone, where most of your customers will see it first.

  • 05

    Upkeep

    Out-of-date software, old copyright dates, and old technology that browsers have moved on from.

  • 06

    Email

    Whether someone could send an email that looks like it came from you.

04

How it works

  1. 01

    Order

    Tell us your website address and pay online.

  2. 02

    We check

    We go through your site as a customer would, on a computer and on a phone.

  3. 03

    Two reports

    Within 5 working days: a functional report for you, and a technical report for whoever looks after your site.

  4. 04

    We talk it through

    A 30-minute call to go through what we found and answer your questions.

  5. 05

    You decide

    Fix it yourself, hand it to your web designer, or ask us. There's no obligation to use us.

05

What you get

Two reports, written for two different readers. These samples are for a made-up business, Example Bakery Ltd. Yours will be about your own website.

Samplea made-up business

Functional report · For you. Plain English, what's working first, then what to fix, most important first.

Website soft audit · Functional reportSample

A friendly look at www.examplebakery.example

Prepared for Example Bakery Ltd (a made-up business), by KIX Labs · October 2026

How we checked

We looked at your website the way your customers' browsers do, on a computer and on an iPhone. We didn't log in, send any forms or test for weaknesses. Every point below has evidence behind it, and the technical report has the details for whoever looks after your site.

At a glance

3 things you're doing well · 1 high · 4 medium · 2 low

First, what you're doing well

  1. Customers can find what they need. Your opening hours, address and phone number are on the home page, and on a phone the number is one tap to call.

  2. It works on phones. On an iPhone, every page fits the screen with no sideways scrolling, and the menu is easy to use.

  3. The padlock is there. The site is served securely, the certificate is in date, and the plain address takes visitors straight to the secure one.

What we found, most important first

1HighPrivacyLaw
Visitors are tracked before they're asked
What it means.
Google Analytics and a Facebook advertising tool start the moment someone arrives, before they have seen or answered your cookie banner. UK law says you must ask first for anything that isn't essential to run the site.
What we saw.
Four tracking cookies were set within two seconds of the home page loading, with no click on the banner.
A gentle fix.
Set things up so these tools only start after a visitor clicks Accept. Most banner tools have a setting for this. It's usually less than a day's work.
2MediumTrustLaw
The order form doesn't say what happens to people's details
What it means.
Your cake order form asks for a name, phone number and email, but doesn't say how they'll be used. People fill in forms more readily when they can see that, and the law expects you to tell them.
What we saw.
No link to a privacy notice on or near the form at /order.
A gentle fix.
Add one line under the form, linking to your privacy policy.
3MediumLaw
Your privacy policy is out of date
What it means.
It refers to the Data Protection Act 1998, which was replaced in 2018. It also doesn't mention the cookies your site sets.
What we saw.
The 1998 Act is named twice in your privacy policy, and no cookies are listed.
A gentle fix.
Update it to today's law and list the tools that set cookies. Half a day for whoever writes it.
4MediumLaw
Your company details aren't on the website
What it means.
As a limited company, your website must show your full company name, company number, where you're registered and your registered office. It's a small line, and its absence can make a careful customer hesitate.
What we saw.
The footer says "Example Bakery" with no company number or registered office.
A gentle fix.
Add one line to the footer. Fifteen minutes.
5MediumEmail
Someone could send email pretending to be you
What it means.
Your email is missing a setting that tells other mail services what to do with fake emails using your name. Without it, a scam email "from" Example Bakery is more likely to reach your customers.
What we saw.
No DMARC record for your domain.
A gentle fix.
Whoever manages your domain adds one short record, starting gently and tightening after a few weeks.
6LowUpkeep
Some of the site's building blocks are old
What it means.
Your site uses a version of a common building block from 2016 that has had security fixes since.
What we saw.
jQuery 1.12.4 on every page.
A gentle fix.
Ask your web designer to update it next time they're working on the site, and to check everything still works afterwards.
7LowTrust
The footer still says © 2023
What it means.
It's small, but an old date makes a site look abandoned to anyone who notices.
What we saw.
"© 2023 Example Bakery" on every page.
A gentle fix.
Update it, or set it to update itself each year. Five minutes.

What next

Most of this is routine upkeep, and several items take minutes rather than days. Hand the technical report to whoever looks after your website, and they'll have everything they need. If you'd like us to do it, we'll quote first. There's no obligation.

Technical report · For your web designer. The evidence, and exactly what to change.

Website soft audit · Technical reportSample

www.examplebakery.example: technical notes

For whoever looks after the website of Example Bakery Ltd (a made-up business). Prepared by KIX Labs, October 2026.

How we checked

Only what any visitor's browser receives: the home page and the pages it links to, response headers, the TLS certificate and public DNS. Fresh headless Chrome, desktop and iPhone 13, no clicks, 15-second wait. No forms submitted, no logins, no hidden or admin paths requested.

The order to do things in

#FixRough effort
1Gate analytics and the Meta pixel behind consentHalf a day
2Publish DMARC15 minutes, then a few weeks of monitoring
3Privacy notice, and a notice on the order formHalf a day
4Company disclosures in the footer15 minutes
5Security headers, and stop announcing server versionsAbout an hour
6jQuery upgrade1 to 2 hours, plus testing
7Copyright year5 minutes

1. Tracking before consent

What we found

  • Cookies set before any interaction:
    • _ga (400 days) and _ga_EXAMPLE123 (400 days)
    • _fbp (90 days)
    • _gcl_au (90 days)
  • Requests before any interaction, at about 1.1 seconds:
    • POST region1.google-analytics.com/g/collect?v=2&tid=G-EXAMPLE123
    • GET connect.facebook.net/en_US/fbevents.js
  • The consent banner script loads, but the GA4 and Meta tags are hard-coded in <head> and do not wait for it. Google Consent Mode is not configured.

The fix

  1. Load both tags through the consent tool, or set Consent Mode v2 defaults to denied before gtag('config', …).
  2. Fire the Meta pixel only after consent is granted.
  3. Make sure the banner offers Reject as plainly as Accept.
  4. Check in a fresh browser profile: no _ga, _fbp or _gcl_au until Accept is clicked.

2. Email authentication

What we found

  • examplebakery.example TXT "v=spf1 include:_spf.google.com ~all"
  • _dmarc.examplebakery.example: no record.

The fix

  1. Publish v=DMARC1; p=none; rua=mailto:[email protected].
  2. Read the reports for 2 to 4 weeks, and make sure every service that sends as you is listed in SPF.
  3. Move to p=quarantine, then p=reject. Tighten SPF from ~all to -all once the senders are confirmed.

3. Privacy notice and the order form

What we found

  • /privacy cites the "Data Protection Act 1998" twice and lists no cookies.
  • /order collects name, email and phone, with no privacy notice on or near the form.

The fix

  1. Rewrite the notice for UK GDPR and the Data Protection Act 2018: who you are, what you collect, why, how long you keep it, who processes it (Google, Meta), and people's rights.
  2. List each cookie with its purpose and lifetime.
  3. Add one line under the order form linking to the notice.

4. Company disclosures

What we found

  • Footer: © 2023 Example Bakery. No company number, place of registration or registered office.

The fix

  1. Add: Example Bakery Ltd, registered in England and Wales, company number 00000000. Registered office: 1 Example Street, Exampletown. The trading-disclosure rules require these on a company's website.

5. Headers and version disclosure

What we found

  • Response headers on / include none of:
    • Strict-Transport-Security
    • Content-Security-Policy
    • X-Content-Type-Options
    • Referrer-Policy
    • Permissions-Policy
  • Server: Apache/2.4.41 (Ubuntu) and X-Powered-By: PHP/7.4.3. PHP 7.4 stopped receiving security fixes in November 2022.

The fix

  1. Add the headers above. Start CSP in Report-Only mode while the consent work lands.
  2. Set ServerTokens Prod and expose_php = Off.
  3. Plan the move to a supported PHP version with the hosting provider.

6. jQuery

What we found

  • jquery-1.12.4.min.js on every page (released 2016). The cross-site scripting fixes from jQuery 3.5.0 are missing.

The fix

  1. Upgrade to the current 3.x release with jquery-migrate loaded during testing. Check the menu and the order form, then remove migrate.

7. Copyright year

  • © 2023 in the footer. Print the year from the server or the template, so it stays current.

What's already right

  • Valid certificate. http:// and www. both reach https://www.examplebakery.example/ in one 301.
  • No mixed content.
  • Viewport set. No horizontal overflow at 390 px.
  • SPF published.

Website soft audit

£175

No VAT to add.

  • A functional report for you
  • A technical report for your web designer
  • Both within 5 working days
  • A 30-minute call to talk it through

One website. No access needed. No obligation to use us for the fixes.

06 — Questions
Do you need access to my website?
No. We only look at what any visitor can see.
Can the audit break anything?
No. We don't log in, send forms or test for weaknesses, so there is nothing to break.
I already have a web designer.
Good. Give them the technical report. It's written for them.
What if everything is fine?
Then the report says so, and tells you what you're doing well.
What happens after I order?
You get a receipt by email straight away. We'll email you to book your 30-minute call, and your reports arrive within 5 working days.
Can you fix what you find?
If you'd like us to, we'll quote first. There's no obligation.

Find out what your website is really doing.

Talk to us