Website Audit: A Western Sydney Kitchen Renovation Business

The audit at a glance

• Client: A kitchen and joinery renovation business in Western Sydney (name withheld for privacy)
• Service: Website and digital marketing audit
• Scope: Security, performance, technical SEO, on-page SEO and content, local SEO, user experience and conversion, accessibility and analytics
• Method: A passive, read-only review of the public website, the same way any visitor or search engine sees it. No logins, no form submissions and no intrusive scanning.
• Delivered: A plain-English report with 41 prioritised issues, a fix for each one and a step-by-step action plan

The headline finding: hidden malware on every page

From the outside, the website looked fine. It had a modern design, a working enquiry form, click-to-call buttons and more than 20 suburb pages. The owner had no idea anything was wrong.

Reading the page source told a different story. Every page was running an injected script disguised as a “performance optimiser”. It quietly downloaded and ran code from domains that public malware sandboxes classify as malicious, linked to fake “verify you are human” scams that trick visitors into running commands that steal passwords.

Left alone, this can expose customers to scams, get the site flagged with a “Deceptive site ahead” warning in Google and Chrome, and get Google Ads accounts suspended. That is why our first recommendation was to stop all SEO work and clean the site immediately, then lock it down so it cannot happen again: update outdated plugins, hide the admin username, disable unused login routes, add security headers and rotate every password.

Scorecard

Area	Score	Main reasons
Security	2 / 10	Active malware, outdated plugins, exposed admin account
Performance	4 / 10	11 MB homepage, slow main image, duplicated fonts and styles
Technical SEO	4 / 10	8 broken menu links, messy sitemap, no business schema
On-page SEO and content	5 / 10	No dedicated service pages, inconsistent suburb pages
Local SEO	5 / 10	Address mismatch on Google, licence number not shown
UX and conversion	6 / 10	Good calls to action, but widgets cover buttons and no privacy policy
Accessibility	5 / 10	Missing alt text, unlabelled icon links, empty headings
Overall	4 / 10	Fix security first. The SEO upside afterwards is substantial.

In total we found 3 critical, 14 high, 18 medium and 6 low priority issues.

What else we found

Previously ranking pages had disappeared

Eight links in the main “Locations” menu, on every page of the site, led to “page not found” errors. Google was still showing some of these pages in search results, including the page for the business’s home suburb. Pages that used to bring in enquiries had been deleted, and visitors who clicked them hit a dead end. We recommended restoring them from backup, or redirecting each one to the closest live page.

An 11 MB homepage

The homepage downloaded about 11 MB across 98 requests. Five AI-generated images alone made up roughly 7.8 MB: each was around 1,500 pixels wide but displayed at about 340 pixels. The main image took about 3.5 seconds to appear even on a fast connection, so mobile visitors on 4G would wait much longer. Resizing and converting the images to modern formats, removing duplicate icon libraries and loading scripts only where they are needed should cut the homepage by around 80%.

Search engines were getting mixed signals

• The homepage title targeted bathrooms while the main heading and brand were about kitchens, so the page was splitting its main keyword.
• The sitemap listed a default “Hello world” post and an internal template, but left out real location pages.
• The thank-you page after the enquiry form could be found in Google, which distorts conversion data.
• There was no structured data telling Google this is a local building business, with its address, phone, hours and service area.

The most valuable services had no pages of their own

Kitchens, bathrooms, wardrobes, laundries and outdoor kitchens were all short paragraphs on a single services page. These are the searches with the highest buying intent, such as “kitchen renovations Sydney” and “custom wardrobes Sydney”. Each one deserves its own detailed page with the process, materials, a price guide, FAQs, real project photos and reviews.

Local SEO and trust gaps

• The address and postcode on the Google Business Profile did not match the website, and the map pin sat in the wrong suburb.
• The contractor licence number and ABN were not shown. NSW Fair Trading generally expects licensed contractors to show their licence number when advertising residential building work.
• Stock photos and AI-generated images were used where buyers expect to see real completed projects.
• There was no privacy policy, even though the enquiry form collects names, emails, phone numbers and suburbs.

Small things that cost enquiries

A floating Google rating badge covered the “Enquire Now” button on mobile and desktop, the services carousel cut off its own titles on smaller screens, and there was no tracking for calls, WhatsApp clicks or form submissions. The business could not tell which marketing was actually producing enquiries.

What was already working well

• HTTPS, clean web addresses and correct canonical tags on every live page
• Unique page titles and meta descriptions throughout
• Clear contact details, click-to-call, email and WhatsApp buttons, and an enquiry form near the top of the page
• Five recently rebuilt suburb pages with strong length and structure, a good template for the rest
• No layout shift while pages load, and a fast server response when the hosting was not overloaded

A good audit should tell you what to keep as well as what to fix. These foundations meant most of the fixes could be made without a full rebuild.

The action plan we delivered

1. Now (24 to 48 hours): Remove the malware, update or replace outdated plugins, rotate every password and restore or redirect the 8 broken location pages.
2. Weeks 1 to 2: Compress and convert images, clean up the sitemap, fix the homepage title, add local business schema, correct the Google Business Profile address, show the licence number and ABN, publish a privacy policy, move the floating widgets and add security headers.
3. Months 1 to 2: Build dedicated service pages, rewrite the older suburb pages, turn real jobs into project case studies, add alt text, set up a sticky call button on mobile and track enquiries in Google Analytics.
4. Ongoing: Helpful articles each month, a simple review-request process, directory listings and monthly updates and security checks.

What this means for your business

This business was not doing anything unusual. Its website looked professional and it had invested in suburb pages and reviews. The problems were invisible from the front end: malicious code in the background, deleted pages that used to rank, and images ten times larger than they needed to be.

That is the point of an audit. You cannot fix what you cannot see, and the most damaging problems are usually the ones nobody notices until Google flags the site or the enquiries dry up.