Readiness checklist
The things a scan cannot see from outside
An external audit reads what your server sends to the public. It cannot tell you whether the backups restore, who still has production access, or which phone rings at three in the morning. Those are the questions this list asks, and a person answers them.
items in the list
sections
settled by the scan
answered by a person
One list, the same one for everybody. The rest are marked inferred: the scan sees a signal that suggests an answer without being able to confirm it, so it proposes and you decide.
Sections
What it covers
Rendered from the list itself, so a section cannot be described here and missing from the product.
Security
Transport, headers, session handling and application hardening.
34 items
Performance
Delivery, payload and Core Web Vitals readiness.
19 items
SEO
Discoverability, indexation and structured metadata.
19 items
Accessibility
WCAG 2.2 AA signals detectable from public rendering.
14 items
Reliability & operations
What keeps the product up and recoverable.
14 items
UX & frontend
Interface completeness and everyday usability.
12 items
Legal & compliance
GDPR posture and published policy coverage.
12 items
Dev & infrastructure
Delivery pipeline and environment hygiene.
12 items
Multi-tenancy & payments
What a scaling SaaS needs before its first enterprise deal.
15 items
A sign-off is a name and a date
Ticking a box proves nothing on its own. When a section is signed off, the workspace keeps who signed it and when - so six months later the question “who said the backups were tested?” has an answer, and a stale sign-off is visible as a stale one rather than as a green tick.
Saved sign-off is available on Starter, Pro, Super, Agency, Enterprise. On Free the list is still yours to work through; what is not kept is the attribution.
Three kinds of answer
Auto - the scan settled it. The evidence is attached and you do not get a vote.
Inferred - a public signal suggests the answer. The item says what was seen and asks you to confirm it.
Manual - nothing outside your infrastructure can know this. The item exists so that it is asked out loud rather than assumed.
Start
The scan fills in its share first
Run an audit and the items the scan can settle come back answered, so the list you work through is the shorter one.