A free website audit that turns visitors into leads

The challenge

504 Sites builds and hosts websites for small businesses on a simple monthly plan. The hardest part of that sale is showing an owner that their current site is costing them customers. Telling them is a sales pitch. Showing them, with their own numbers, is proof.

An earlier version of the audit looked the part but didn’t really test anything. We rebuilt it so every score comes from a real check of the visitor’s own website.

What we built

A free audit at 504sites.com/audit that any business owner can run in under a minute:

• Google’s speed test, on a phone. The audit runs Google’s PageSpeed Insights on a simulated mobile connection, the way most local customers visit, for real speed, accessibility, best-practice and search scores.
• Eight checks of the homepage itself: a secure connection, a phone-friendly layout, a tap-to-call link, a contact form or booking link, business details Google can read, and a good page title, search description and main heading.
• A plain-English report. An overall score out of 100, broken into four areas (speed on phones, mobile-friendly and secure, found on Google, and turns visitors into customers), the top three things to fix in order of importance, and what’s already working.
• A copy in their inbox. The full report is emailed to the business owner.
• A lead for the sales team. Every audit is saved to the 504 Sites CRM with its scores and problems, and the team gets an alert. If the owner then clicks a plan from their report, the lead moves to the next stage and the team is alerted again, so hot leads get a fast follow-up.

Under the hood

The page is built with Astro. Google’s speed test runs in the visitor’s browser, because it can take longer than a server function is allowed to run. Its scores are then sent to a Netlify Function, which fetches and checks the homepage, builds the report, saves the lead in Supabase and sends both emails through Resend.

All the private keys stay on the server, and the audit is built to resist abuse:

• Rate limits on how often one visitor can run audits, and on how many emails one address can receive in a day, so the form can’t be used to spam people.
• Protection against probing private networks: the audit refuses to fetch addresses on internal networks, checking again at every redirect.
• A signed token so only the person who ran an audit can mark their own lead as interested.
• A hidden honeypot field that quietly turns away most spam bots.

Why it matters

The audit turns a cold pitch into a free, useful service. Every report gives the owner something concrete to fix, whether or not they buy, and every lead reaches the sales team with its problems already identified, so the first conversation starts from the owner’s own results instead of a generic script.