The Agency Client Onboarding QA Framework: How to Audit a New Client's Website in the First 24 Hours

Every agency that has run for a few years has had this conversation. Two months into an engagement, organic traffic drops or a form stops working, and the client asks what you changed. You did not change that. You are fairly sure it was broken when you arrived. But you cannot prove it, so you absorb the cost and some of the trust.

A baseline audit on day one is cheap insurance against that conversation. It is also the fastest way to find something impressive to fix in week one, when the client is still deciding whether hiring you was a good idea.

Hour 1–2: access and inventory

Before any technical work, establish what exists and who controls it. Missing access discovered in week three stalls projects; discovered on day one it is a normal onboarding task.

• Domain registrar — who holds it, when does it renew, is auto-renew on. An expired domain is the single most damaging preventable outage.
• DNS provider and current records. Screenshot the zone file.
• Hosting, CDN, SSL provider and certificate expiry dates.
• Google Search Console, Analytics, Ads, Merchant Center, Tag Manager, Business Profile.
• Meta Business Manager, pixel ownership, ad account access.
• CMS admin, and whether anyone else has admin.
• Repository access and where the deploy pipeline runs.
• Who else can push changes — a previous agency, a freelancer, the founder's cousin.

Hour 3–4: the technical baseline

This is the record you will refer back to. Run a full audit across every significant template — home, a category page, a product or service page, the contact page, the checkout or lead form — and archive the output with the date visible.

Capture these specifically, because they are the metrics that will be disputed later:

Save it as a PDF, put it in the shared client folder, and mention it in your kickoff notes. Saying "here is where the site was on the day we started, so we can both measure progress" frames it as accountability rather than defensiveness — which it is, in both directions.

Hour 5–6: the quick-win list

From the audit output, pull everything that takes under an hour and has a visible result. Typically:

• Missing or duplicate title tags and meta descriptions on key pages
• Uncompressed hero images — often the single biggest LCP win available
• Broken links in the footer or navigation
• Missing canonical tags on paginated or parameterised URLs
• No favicon, no og:image, so every shared link looks broken on WhatsApp and LinkedIn
• Form fields with no labels or the wrong input type on mobile
• A noindex left on a page that should rank

Ship three or four of these in the first week and report them plainly. It converts the abstract "we are onboarding" period into visible delivery, which is exactly when clients decide whether the retainer was a good idea.

Hour 7–8: risk register

Separate from the fix list, write down what could go badly wrong and who owns it. Share it. This document has saved more agency relationships than any report.

Being the person who noticed the certificate expiry before it happened is worth more than a quarter of good reporting.

The reusable template

Keep this as a checklist your team copies per client — Notion, a Google Sheet, whatever the team actually opens. The structure that works:

1. Access — one row per system: platform, who holds it, access confirmed (y/n), date, notes
2. Baseline — one row per template URL: audit date, score, CWV, critical findings, PDF link
3. Quick wins — finding, effort, owner, shipped date
4. Scoped work — project, outcome, estimate, status
5. Risks — risk, impact, owner, review date
6. Re-audit schedule — monthly cadence with the date of the next run

The last row is what turns onboarding into a retainer. A monthly re-audit against the day-one baseline produces a chart that moves, and a chart that moves is the easiest renewal conversation in the business. How to build the report around it covers the presentation side.

Make it a standard operating procedure

The framework only works if it runs every time, including for the small client you are sure is fine. The small clients are where undocumented defects live, because nobody has ever looked.

Put the checklist in the contract-signed automation, assign it to whoever owns the account, and treat the baseline PDF as a deliverable with a due date rather than an internal nicety. Two days of work per client, and it eliminates an entire category of argument for the life of the relationship.

If the client is also running paid traffic, add the campaign pre-flight checks to week one — inherited ad accounts routinely have tracking that has been broken for months, and finding that early is both a quick win and a credibility moment.