Before you spend a dollar improving your website — or conclude you need to — run this audit. Fifteen checks, roughly forty minutes, zero tools to buy. It's the same sequence we run (with deeper instruments) on every Singapore site that comes to us, published because an owner who knows their site's real condition makes better decisions with every vendor, including us.

Part one: can customers even reach you? (Checks 1–5)

1. The mobile-data test. Open your site on your phone, Wi-Fi off. Count seconds until it's readable. Past three, you're losing the MRT-scroll customer before your first word renders. 2. The form test. Submit a real enquiry through your own contact form. Did it arrive? Silent form death is this industry's most expensive failure — we've seen Singapore forms dead for months while campaigns poured traffic in. 3. The WhatsApp tap. If you have a WhatsApp button, tap it on mobile: correct number, sensible pre-filled text (or at least none that embarrasses)? 4. The padlock sweep. Check the SSL padlock on every page type — homepage, inner pages, any checkout. Browser warnings on one page poison trust on all. 5. The number-and-hours check. Is your current phone number, address and opening pattern actually correct? Post-move and post-rebrand fossils are everywhere, and they cost real walk-ins.

Part two: does Google still respect you? (Checks 6–10)

6. The brand-name search. Google your business name: does your site rank first, does the result text read well, and does your Business Profile panel show current info? 7. The money-search sample. Search your top three services the way customers would ("aircon servicing tampines", not your internal jargon) — where are you, and who's above you? Write the answers down; they're your baseline. 8. The indexation spot-check. Search site:yourdomain.sg — do your important pages appear, or has Google quietly dropped half your site? 9. The review pulse. Count your Google reviews and check the newest one's date — Singapore buyers read recency as a proxy for whether you're still good, and a review stream that died in 2024 says something you didn't intend. 10. The copyright-year tell. Look at your own footer. A stale year is how visitors carbon-date your neglect in one glance — trivial to fix, brutal to leave.

Part three: is the asset decaying underneath? (Checks 11–15)

11. The login check. Can you, personally, log in to your website's admin right now? If credentials live only with a vendor — or a vendor who's stopped replying — you've found your most urgent finding; the escalation path is in our orphaned-site rescue guide. 12. The backup question. Where is your most recent backup, and have you ever seen proof one restores? "I assume the host does it" scores as a fail. 13. The domain-expiry lookup. Check your domain's renewal date and which card pays it — expired-card-on-forgotten-autorenew kills more SG sites than hackers do. 14. The update backlog. If you can log in: how many plugin/core updates are pending? A long queue is decay you can currently see for free. 15. The measurement void. Do you have any number for what the site produced last month — visits, enquiries, anything? If the answer is no, every website decision you make is a guess, which is the quiet finding underneath all the others.

Scoring, honestly

0–2 fails: genuinely healthy — maintain the habit (quarterly rerun of this list) and spend your energy on growth. 3–6 fails: typical, and fixable in a focused week — most items above are small individually; their compound is what hurts. Prioritise Part One first (leaking enquiries today), then Part Three (protecting the asset). 7+ fails, or any fail on checks 2, 11 or 12: the site needs a decision, not a patch — sometimes rescue-and-maintain, sometimes the rebuild math is honestly better, and the deciding numbers are in that guide. Whatever you found: the audit's value is that you now hold the findings — take them to any vendor and watch how their recommendations map to your actual failures rather than their favourite products. That's the entire trick to buying web services well in Singapore, and it cost you S$0 and one evening. If you'd like the deeper instrumented version — speed scores, security posture, indexation detail — the free health check runs it and reports in plain language, whether or not you ever hire us for the fixes.

The 15-point audit protocol (as we run it during discovery calls)

Before quoting any Singaporean SME rebuild or redesign, we run a 15-point audit that surfaces the specific issues driving underperformance. Sharing the checklist publicly serves buyers whether they hire us or not; the discipline of doing this audit on your own site produces improvement recommendations you can act on regardless of vendor choice.

Check 1: Mobile experience above the fold. Open your site on an actual phone (not just Chrome DevTools mobile emulation). Within 3 seconds of loading, is it clear what your business does and why the visitor should care? Are the primary CTAs tap-reachable with one thumb? Is text readable without pinch-zooming? Failure here loses the majority of your traffic before anything else matters.

Check 2: Page speed (Core Web Vitals). Run your homepage through Google's PageSpeed Insights on the mobile test. LCP should be under 2.5s, INP under 200ms, CLS under 0.1. Passing all three consistently is table stakes for competitive search visibility. Most sites we audit fail at least one; some fail all three.

Check 3: Trust density above the fold. Are there at least 3 trust signals visible before the visitor needs to scroll? Reviews, certifications, UEN visible for verification, recognisable client logos, professional accreditations — signals that reduce the "is this business real" hesitation. Sites without visible trust signals underperform on conversion regardless of everything else.

Check 4: Primary CTA specificity. What does your main CTA button say? "Learn more" is theatre; "Get a quote in 24 hours" is specific. Buttons that describe what actually happens when clicked outperform generic CTAs measurably. Every CTA on your site should pass the specificity test.

Check 5: WhatsApp integration. Is WhatsApp available as a contact channel, pre-filled with context appropriate to the specific page (not just "hi")? Singaporean and Malaysian buyers overwhelmingly prefer WhatsApp for initial contact; sites without it lose enquiries from buyers who don't want to fill out forms or send emails.

Check 6: Contact information verifiability. Are your business name (matching UEN registration), address, phone number, and email visible somewhere on the site? Buyers verify these; sites hiding them behind contact forms signal untrustworthiness whether or not the intent was such.

Check 7: Pricing transparency where applicable. Does your industry allow published pricing? Most do. Sites that publish prices — even ranges rather than exact figures — build trust faster than sites requiring "contact for quote" for every enquiry. Yes, this filters some buyers; the ones it filters weren't ready to buy anyway.

Check 8: Real portfolio or case studies. Are your past projects verifiable — live links where allowed, real client names where allowed, real project specifics? Or are they anonymised "S., successful business owner" style that reads as inauthentic? Real specifics build trust; vague testimonials erode it.

Check 9: SEO title and meta descriptions. Do your key pages have handwritten title tags and meta descriptions that would earn a click if shown in search results? Or are they auto-generated fallbacks that read as filler? Meta content directly affects both rankings and click-through-rate.

Check 10: Schema markup. Do your pages have structured data (JSON-LD) telling Google exactly what they are? Organization, LocalBusiness, Service, Product, Article, FAQPage, BreadcrumbList as applicable. Well-marked pages get richer SERP presentations that lift CTR meaningfully.

Check 11: PDPA compliance. Do you have a privacy policy that reflects what you actually do with customer data? Cookie consent handled properly? Explicit consent captured at enquiry forms? Not just legal documents anyone can copy — actual implementation matching your actual data practices. Non-compliance is a legal risk and increasingly an SEO risk.

Check 12: HTTPS everywhere. Is HTTPS enforced on every page including admin, and does the SSL certificate chain validate correctly? Sites with mixed content, expired SSL, or HTTP fallback are penalised in search and distrusted by browsers directly.

Check 13: Broken links audit. Are there dead internal links or broken external links on your site? Sites accumulate these over time as content evolves; a quarterly link audit catches them before they degrade user experience and SEO signals. Free tools like Screaming Frog (up to 500 URLs free) can run this audit in minutes.

Check 14: Analytics conversion tracking. Is Google Analytics 4 set up with conversion events matching your business's actual actions — form submissions, WhatsApp taps, phone clicks, purchases? Not just page views. If you can't tell which pages produce enquiries, you can't optimise.

Check 15: Google Business Profile completeness. Is your GBP claimed, verified, and comprehensively populated — category, services, products, hours, photos, Q&A, posts? For most SMEs, GBP is more important to local visibility than the website itself; leaving it minimally configured is leaving revenue on the table.

Priority order for addressing findings

If your audit surfaces multiple issues, tackle them in this priority order for maximum ROI. First priority: broken fundamentals. Mobile above-fold clarity (Check 1), page speed (Check 2), broken links (Check 13), and HTTPS (Check 12). These are baseline health; fix before optimising anything else. Second priority: trust and conversion. Trust density (Check 3), CTA specificity (Check 4), WhatsApp integration (Check 5), verifiable contact info (Check 6). These produce visible conversion lifts within weeks. Third priority: SEO fundamentals. Meta content (Check 9), schema markup (Check 10), GBP (Check 15), analytics tracking (Check 14). These take longer to show results but compound over months and years. Fourth priority: content and compliance. Pricing transparency where applicable (Check 7), real portfolio (Check 8), PDPA compliance (Check 11). Important but less immediately impactful than the earlier categories.

How Singaporean SMEs typically score on this audit

Across the audits we've conducted for Singaporean SMEs during discovery calls, the aggregate pattern is specific. Checks most sites pass: HTTPS (largely universal now), contact information visibility (most sites include address and phone somewhere), and basic mobile responsiveness (though "responsive" varies enormously in quality). Checks most sites fail: Core Web Vitals (majority fail at least one metric), CTA specificity (most sites default to "learn more" or "contact us"), trust density above the fold (most sites bury trust signals below the scroll line), schema markup (most sites have none or minimal), and analytics conversion tracking (most sites track page views without conversion events). Checks with wide variation: pricing transparency (industry-dependent but even within industries, execution varies), WhatsApp integration (some businesses embrace it, others avoid it based on cultural or operational preferences), and PDPA compliance (varies from thorough to superficial).

The pattern isn't that Singaporean SMEs neglect their websites — most invest meaningful effort and money. The pattern is that the effort and money go into specific dimensions (design polish, content volume) while other dimensions (technical fundamentals, conversion architecture, measurement discipline) get less attention. Rebalancing that investment mix produces material improvement often at modest additional cost.

Beyond the 15 checks (what else matters that isn't captured here)

The 15-point audit covers most high-impact dimensions but omits several worth noting. Content strategy alignment. Does your content actually target the searches your buyers make? Or does it target industry-general topics that don't produce enquiries? Content strategy audit is a separate discipline from technical audit; both matter. Conversion funnel integrity. Even sites that pass the 15 checks can leak conversion at specific funnel steps. Session recordings, heatmaps, and funnel analysis surface these issues beyond what a static audit sees. Competitor positioning. How does your site compare to competitors on the same searches? Sometimes the fix isn't your site's absolute state but its relative state versus competitors buyers are also considering. Brand and design consistency. Whether your visual identity, tone, and messaging cohere across pages affects trust in ways audits partially miss. Post-launch iteration discipline. Sites that get audited and fixed once, then neglected, degrade back toward the state they were in. Ongoing discipline matters more than one-time fixes.

Our SEO retainers include ongoing audit and iteration; sites without ongoing discipline usually benefit from annual audit-and-fix cycles at minimum. The one-time-fix approach produces some improvement but leaves substantial value on the table.

How Singapore-specific compliance shapes the audit

PDPA specifically affects several audit checks in ways worth explaining. Privacy policy check — must reflect actual data handling, not template language. Should specify what data is collected, how it's used, how long retained, how individuals exercise access rights. Templates copied from other sites often reference practices that don't match the specific business. Cookie consent implementation — must respect the notification and consent requirements without being aggressive. Cookie walls that block content until consent are problematic; discreet consent notices that respect user choice are appropriate. Enquiry form consent — explicit consent at data collection with clear purpose. Not: "by submitting you agree to marketing" hidden in fine print. Data handling documentation — internal records of what data is collected, where it's stored, who has access. Not visible to users but required for PDPA compliance and useful when subject access requests arrive.

Non-compliance is a legal risk and increasingly a search ranking risk as Google's E-E-A-T frameworks incorporate regulatory compliance signals for sites in regulated jurisdictions. Proper PDPA implementation isn't compliance theatre; it's baseline operational discipline for Singaporean SMEs.

What the audit produces as deliverable

When we run this audit for a prospective client during discovery, the specific deliverable format. Executive summary: one page identifying the top 3-5 issues that would produce biggest business impact if addressed. Detailed findings: each of the 15 checks with pass/partial/fail status and specific evidence. Recommended remediation priorities: what to fix first, second, third based on impact/effort matrix. Estimated remediation scope: what would be included in a rebuild or optimisation engagement with us. Alternative paths: if you'd prefer to fix the issues without engaging us, what you could tackle yourself and what would benefit from professional work.

The written deliverable becomes valuable regardless of whether you hire us. Some prospects use it as internal planning documentation. Some use it as leverage with their current vendor. Some use it to prioritise DIY improvements. Very few dispute the specific findings; the audit surfaces issues that are objectively verifiable rather than opinions.

Case-based audit findings we've documented

Anonymised patterns from specific audits. The tuition centre with excellent content but no conversion tracking. Site had substantial teacher profiles, curriculum breakdowns, and testimonials — genuinely quality content. But GA4 was set up without conversion events, so nobody knew which pages actually drove enquiries. Adding conversion events revealed most enquiries came from a specific teacher's profile page, which had been under-invested visually. Reallocating design polish to that page and similar teacher profiles produced measurable enquiry increase. The renovation contractor with fast desktop performance and slow mobile. Desktop LCP was 1.8s; mobile LCP was 6.2s. The gap came from images sized for desktop but not properly responsive, plus JavaScript that ran heavily on mobile without deferring. Fixing produced substantial mobile ranking improvement and mobile conversion improvement together — the traffic that had been arriving but bouncing suddenly converted. The professional services firm with excellent trust signals in wrong places. Site had impressive credentials, real client logos, honest case studies — but all buried three clicks deep in the About section. Moving these signals to service pages and near CTAs produced measurable improvement in enquiry rates without changing any actual content. Repositioning existing assets can be as valuable as producing new ones.