August 17, 2026 · by David Gilbert · 3 min read · Web & E-Commerce
Whenever I take on an existing website — for a redesign, a fix, or an ongoing maintenance arrangement — I run the same audit before touching a single line of code, regardless of how small the requested job sounds. It's saved me, and the client, from more unpleasant surprises than I can count, and it takes less time than people expect.
What's Actually Live Right Now, Not What I'm Told Is Live
First, I check what's genuinely running — software versions, plugins, hosting environment — rather than trusting whatever documentation or memory the client has of their own setup. It's extremely common for the actual live environment to have drifted from what anyone remembers or wrote down, usually through small updates and changes nobody specifically tracked along the way.
What's Actually Bringing in Traffic and Enquiries
Before changing anything, I want to know which specific pages are actually doing real work for the business — generating enquiries, ranking in search results, getting genuine repeat traffic — so I protect those deliberately rather than risk accidentally breaking something quietly valuable in the course of making everything else better.
Where the Security Gaps Actually Are
Outdated software, weak admin credentials, and missing basic security headers are depressingly common on sites that have otherwise been left alone and working fine for years. A working site isn't necessarily a secure one, and "it's been fine for years" isn't reassurance — for plenty of slow-building security gaps, it's just bad luck not yet running out.
How It Actually Performs on a Real, Average Connection
Not on my own fast office connection — on a genuinely average mobile connection, because that's closer to what most of a typical small business's actual customers are using. A site that feels perfectly fast to its own owner can be a frustratingly slow, abandoned tab to an actual visitor on an average mobile connection in a different location.
What's Actually Backed Up, Properly
Before I change anything, I confirm there's a genuinely current, genuinely restorable backup — not an assumption that one probably exists somewhere. This is the single step I'm least willing to skip, on principle, no matter how small or routine the requested change initially sounds.
Why I Run This Every Time, Even for "Quick" Jobs
The jobs that have gone sideways on me, historically, are almost always the ones I assumed were too small or too routine to need a proper check first. A five-minute audit, done consistently and without exception, is dramatically cheaper than an unexpected outage or security incident caused by a change I made without fully understanding what I was actually changing it on top of.
What Clients Usually Don't Expect
Most clients are mildly surprised that a "simple text change" comes with any audit step at all, and I understand the instinct — it sounds like a quick, trivial job from the outside. But I've genuinely seen small, innocent-looking changes break things that had nothing obviously to do with them, purely because of some interaction nobody could have anticipated without first understanding the actual current state properly.
The Honest Value Proposition
This audit doesn't make me faster on any single job. It makes me dramatically less likely to cause an expensive, avoidable surprise on any given job, which over the span of a career adds up to a lot of avoided bad days, for both me and every client who's never had to experience one.