Standard · IMA AI
The Website Review Standard
8 areas. 50+ checks. Every failure comes with a specific fix — including whether AI agents can find and recommend you. Most website audits are vague: a pile of opinions, no priorities, no fixes. This is the opposite — a structured, scored review where every check has a clear pass/fail test and every failure has a concrete fix.
Critical
Actively hurting performance, conversions, or trust.
Fix immediately
Warning
Not breaking, but leaving value on the table.
Fix within 2 weeks
Suggestion
Good practice, lower urgency.
Fix when you have bandwidth
How to use it
- Open your website — and sample properly: home, about, contact, the legal pages, one of every page type, up to ten more from the sitemap.
- Work through Areas 1–8 in order. Skip Area 5 if you don't sell online.
- Mark each check ✅ Pass / ⚠️ Partial / ❌ Fail / N/A. A per-page check fails if any sampled page fails it; partial if only a few do.
- Two kinds of check, never mixed: the mechanical ones (tags, headers, status codes, lengths) are measured by a tool and the evidence is the actual value found; the judgment ones (clarity, copy, trust) are read by a person or a model and every verdict quotes the page. Anything you can't measure is marked manual — never guessed, never scored.
- For every fail, write the specific fix — not a vague recommendation.
- Score it (model at the bottom), fix Critical items first, and re-score within 14 days — a review nobody acts on is just a diagnosis.
v2.1 (September 2026) came from running this standard on imaai.my itself: it scored 75, and every rule we found we had broken went into our own build standard the same day. Clarified in this version: a 404 page must actually return status 404 (a homepage served for every unknown URL is a soft-404); security headers means HSTS + CSP plus nosniff, referrer and permissions policies; a page title does not satisfy the 3-second test — the visitor reads the hero; alt="" on a decorative image is correct, a missing alt attribute is not; contrast is computed after blending transparent text onto its background; the cookie banner must set consent defaults before the tag manager loads; and whether you run ads is a fact from your invoices, not a guess.
Area 1
Technical Foundation
A site that fails these underperforms regardless of content or ad spend.
| Check | How to check | Severity |
|---|---|---|
| HTTPS enabled, no mixed-content warnings | Browser padlock | Critical |
| Loads in under 3 seconds on mobile | Google PageSpeed Insights | Critical |
| Core Web Vitals pass (LCP, CLS, INP) | PageSpeed Insights | Critical |
| Mobile responsive — no horizontal scroll, text readable | Open on a phone | Critical |
| No broken links on key pages | Manual check / broken-link tool | Warning |
| Clean URLs — no .html, no query-string clutter | Check the address bar | Warning |
| Security headers present — HSTS and a basic CSP, plus X-Content-Type-Options, Referrer-Policy, Permissions-Policy | securityheaders.com / response headers | Warning |
| Forms submit over HTTPS; no sensitive data in the URL | Inspect the form | Warning |
| No exposed admin panels, directory listings, or error stack traces | Try /admin, a bad URL | Warning |
| Custom 404 page with a way back to the site — and the response is actually HTTP 404, not the homepage served with 200 | Fetch a garbage URL: check the status code, then the page | Suggestion |
| Favicon set correctly | Check the browser tab | Suggestion |
| Images lazy-loaded and right-sized | PageSpeed "size/defer images" | Suggestion |
Area 2
SEO
Check every key page — home, about, product/service, contact.
| Check | How to check | Severity |
|---|---|---|
| <title> — unique, present, under 60 characters | View page source | Critical |
| Meta description — unique, present, under 160 characters | View source | Critical |
| Canonical tag — present, clean URL | View source | Warning |
| Open Graph tags (og:title, description, image, url, type) | View source | Warning |
| Twitter Card tags | View source | Warning |
| JSON-LD structured data — at minimum Organization schema on homepage | View source, validate at schema.org validator | Warning |
| sitemap.xml exists and submitted to Google Search Console | Visit /sitemap.xml | Warning |
| robots.txt exists and doesn't block key pages | Visit /robots.txt | Warning |
| <meta name="keywords"> present | View page source | Suggestion |
| Google Search Console verified and active | Check GSC | Warning |
| GEO meta tags (geo.region, placename, position) for local business | View source | Suggestion |
Area 3
Analytics & Tracking
No tracking, no data to improve. Verify before any campaign.
| Check | How to check | Severity |
|---|---|---|
| Google Tag Manager (GTM) installed on all pages | View source for GTM container ID | Critical |
| GA4 connected and receiving data | GTM preview or GA4 Realtime report | Critical |
| Meta Pixel installed (if running Meta ads) | Meta Pixel Helper extension | Critical |
| TikTok Pixel installed (if running TikTok ads or livestream) | TikTok Pixel Helper extension | Critical |
| Key conversion events tracked — purchase, lead form, add to cart | GA4 events / Tag Assistant | Warning |
| UTM parameters preserved through checkout (if commerce site) | Test a tagged URL through to confirmation | Suggestion |
Area 4
Brand & Content
A technically perfect site that fails here still won't convert.
| Check | How to check | Severity |
|---|---|---|
| 3-second clarity test — a visitor knows what you do and who it's for within 3 seconds, from the hero alone (the page title doesn't count) | Load the home page, look only at the hero | Critical |
| Primary call-to-action visible above the fold | Load home without scrolling | Critical |
| Brand identity consistent across pages (logo, colours, fonts) | Browse key pages | Warning |
| Copy is clear and direct — no filler ("committed to excellence") | Read home + about | Warning |
| Trust signals present — testimonials, logos, certifications, media | Browse home + about | Warning |
| Real About page — founder, mission, team | Visit /about | Warning |
| Contact info easy to find | Footer + contact page | Warning |
| Images high-quality, relevant, not broken | Browse key pages | Warning |
| Social links present and pointing to active accounts | Footer | Suggestion |
Area 5
Commerce Readiness
Only if you sell products or services directly from the site.
| Check | How to check | Severity |
|---|---|---|
| Each product page has name, description, price, multiple images, clear CTA | Browse products | Critical |
| Add-to-cart / buy flow works end-to-end on mobile and desktop | Test it | Critical |
| Payment methods shown before checkout | Cart / checkout | Critical |
| Return & refund policy visible and linked | Footer / checkout | Warning |
| Shipping info clear — cost and delivery time | Product / checkout | Warning |
| Out-of-stock handled gracefully (no broken buy button) | Check an out-of-stock item | Warning |
| Order confirmation page or email exists | Test purchase | Warning |
| Product images consistent — same ratio, clean background | Browse the grid | Suggestion |
Area 6
Agent Readiness (AEO)
AI assistants increasingly discover and recommend businesses. Sites that AI can read clearly win as this grows. This is the part most checklists miss.
| Check | How to check | Severity |
|---|---|---|
| Content is server-rendered / static — not entirely client-side JavaScript | Disable JS, see if content still appears | Warning |
| Product/service schema (JSON-LD) on relevant pages | View source / schema.org validator | Warning |
| Brand & organisation info consistent everywhere (name, address, contact, logo) | Footer, about, JSON-LD | Warning |
| Key facts (prices, services, contact, hours) in text — not trapped only in images | View source / disable images | Warning |
| No important content behind a login or paywall that blocks crawlers | Browse logged-out | Warning |
| FAQ section or FAQ schema — helps AI extract answers | View source | Suggestion |
| BreadcrumbList schema on inner pages | View source | Suggestion |
| llms.txt at the root — points AI crawlers to your key content | Visit /llms.txt | Suggestion |
| Markdown for Agents — a clean Markdown version served on content negotiation (Accept: text/markdown), so AI parses your page accurately and cheaply | Request with Accept: text/markdown — confirm Markdown, not HTML | Suggestion |
| AI crawler policy is deliberate — answer/citation crawlers (OpenAI, Claude, Google, Bing, Perplexity) allowed so you can be cited; training-only scrapers handled on purpose | /robots.txt + crawler analytics | Warning |
| Content answers real questions directly (clear, extractable statements) | Read a page as if an AI were summarising it | Suggestion |
Area 7
Accessibility
UX, legal exposure, and an SEO/AEO signal at once.
| Check | How to check | Severity |
|---|---|---|
Images have meaningful alt text — alt="" on decorative images is correct; a missing alt attribute is not | View source / accessibility inspector | Warning |
| Text–background contrast meets WCAG AA (4.5:1 body text; 3:1 large text) — blend transparent text colours onto the real background first | Lighthouse / contrast checker | Warning |
| Logical heading order — one <h1>, nested <h2>/<h3> | View source / Lighthouse | Suggestion |
| Keyboard-navigable with visible focus states | Tab through the page | Suggestion |
| Tap targets big enough and not too close on mobile | Lighthouse mobile | Suggestion |
Area 8
Legal & Compliance
For trust and to avoid regulatory risk — especially PDPA (Malaysia & Singapore) and GDPR for EU visitors. Privacy, Terms and Disclaimer should be standalone, footer-linked pages — not modals.
| Check | How to check | Severity |
|---|---|---|
| Privacy policy — standalone footer-linked page disclosing analytics/cookies, processors & data handling | Open it from the footer; confirm a real URL, not a modal | Critical if tracking |
| Cookie consent banner if you set analytics/tracking cookies — with consent defaults (Google Consent Mode v2) set before the tag manager loads | Load the site fresh; view source | Warning |
| Terms of use — standalone footer-linked page (ownership/IP, acceptable use, liability, governing law) | Footer / checkout | Warning · Critical for commerce |
| Disclaimer — informational-only / not-professional-advice notice, footer-linked | Footer | Warning |
| Business identity present — the legal entity behind the site | Footer / about | Warning |
| Legal pages are real pages, not modals — linkable, crawlable, in the sitemap | Open each at its own URL; check sitemap | Warning |
Score it
Each check is worth points by severity. Only count checks you actually verified.
| Severity | Points |
|---|---|
| Critical | 15 |
| Warning | 8 |
| Suggestion | 3 |
Pass = full points · Partial = half · Fail = 0 · Not verified = excluded
Score = (points earned ÷ points possible) × 100
| Score | Rating |
|---|---|
| 85–100 | Excellent — minor improvements only |
| 70–84 | Good — a few gaps to address |
| 50–69 | Needs work — meaningful issues |
| 30–49 | Poor — significant gaps |
| 0–29 | Critical — fundamental issues, act now |
Write it up
Site: [URL]
Review date: [date]
Score: [X / 100] ([rating])
Critical: [count] Warnings: [count] Suggestions: [count]
Review date: [date]
Score: [X / 100] ([rating])
Critical: [count] Warnings: [count] Suggestions: [count]
List Critical items first, then Warnings, then Suggestions. Group fixes that can be done together.
| # | Area | Check | Status | Severity | Specific fix |
|---|---|---|---|---|---|
| 1 | Technical | Core Web Vitals | ❌ Fail | Critical | Compress the hero image from 2.4 MB to under 200 KB (WebP) |
| 2 | SEO | Missing meta description on /products | ❌ Fail | Warning | Add: "Shop [brand] [category] — [key benefit]" |
Need a review done for you?
IMA AI runs website reviews for brands in Malaysia — scored, prioritised, with specific fixes and an implementation plan.
Built by IMA AI — imaai.my. Free to use and share. June 2026.