The 30-Minute Healthcare Website Audit You Can Run Yourself

You can audit your own clinic website in 30 minutes if you split the time 3 ways. Spend 10 minutes reading your pages against section 133 of the National Law, which sets the health ad rules. Spend 10 minutes reading Google's Core Web Vitals report, which grades your site speed on 28 days of real visits. Then spend 10 minutes asking your strongest page the trust questions Google has published. Ahpra, the body behind the health ad rules, assessed 775 ad complaints in 2024/25. Of the practitioners it contacted about a problem ad, 74% fixed it early, before any further action. That is the whole case for checking your own site. You can fix most breaches yourself once someone shows you where to look, and this post shows you.

What can a 30-minute healthcare website audit actually find?

It can find 3 kinds of problem, and each one has a different judge.

The regulator judges your words. Google judges your speed, using other people's visits. Google also judges trust, using a list of questions it has published. You cannot check all 3 with one tool, even though most "audit checklists" pretend you can. So this audit is built as 3 passes of 10 minutes, one for each judge.

Here is one honest note before you start the clock. A 30-minute audit finds the faults you can see. It will miss the faults Google measures over a month. It will also miss anything about your clinic that lives off your website. We come back to that in section 5. It matters, because a clean 30-minute check does not prove your whole site is clean.

Minutes 0 to 10: does any page break section 133?

Start with the regulator, because this is the only one of the 3 that can fine you.

Section 133(1) of the National Law lists 5 things your health service ads must never do. You can search your own site for each one, using your browser's find box. Here they are, with the phrases that usually break them.

Keep 2 things in mind while you search.

First, the defence in subsection (2) does not protect you. It says a person does not commit an offence "merely because the person, as part of the person's business, prints or publishes an advertisement for another person". That protects your web developer and your agency. Your practice gets no matching defence when its own service is advertised. If the words are on your site, they count as your words, whoever typed them. We went through that in what Google actually penalises about AI content.

Second, the numbers show this check is worth your time. In its 2024/25 annual report, Ahpra says its ad compliance team assessed 775 complaints about ads. Of the practitioners it contacted about a problem ad, 74% fixed it early, "such that further intervention was not required". The report then counts what happened to those who did not.

Look at the shape of that chart. Out of 86 practitioners, 11 ended up with action from the regulator. Every one of them had been told twice where the problem was. The audit you are running now is that first warning, done by you, for free.

If the search turns something up, what gets a healthcare website flagged has a safe rewrite for each of the common phrases.

Minutes 10 to 20: what does Google's speed report say?

This check works differently. You read a report Google has already written about you, so there is no tool to run. The report has a time lag, and most clinic owners have never been told about it.

Open Google Search Console, the free tool Google gives site owners, and find the Core Web Vitals report. Google describes it as showing "how your pages perform, based on real world usage data (sometimes called field data)". The report sorts your pages into Poor, Needs improvement and Good, across 3 measures.

Google publishes the 3 measures and their passing marks on web.dev. Largest Contentful Paint "should occur within 2.5 seconds of when the page first starts loading". Interaction to Next Paint should be "200 milliseconds or less". Cumulative Layout Shift should be "0.1 or less".

Now for the time lag. The report grades the slower end of your visits, at the 75th percentile, rather than your average visitor. Google's words on the LCP column: "75% of page requests took this amount of time or less to reach largest contentful paint in the last 28 days." The same wording applies to the other two. So a quarter of your visits can be slower than the number you see. And the number covers the last 28 days, so it does not show today.

This has 2 results for you, and both change what these 10 minutes are for.

First, if you fix something today, the report will not show it today. Google's own fix-tracking in the report starts "a 28-day monitoring session", and the issue "is considered fixed" only if it does not appear during that window. Nobody gets a same-day result on speed. If someone promises you one, they are selling you a test score, and Google does not grade you on that.

Second, many small clinic sites will open the report and see "No data available". Google says that means "either that your property is new in Search Console, or that there is not enough data available in the CrUX report to provide meaningful information". A suburban practice with a few hundred visits a month can stay like that for a long time. You have not failed. You simply have no grade yet, which means Google is not using speed to rank you either way.

Write down 3 things and stop. Note the status of your busiest group of pages, the measure it fails on (if any) and the date. You will need the date, because the 28 days will have moved on by the next time you look.

Minutes 20 to 30: would your strongest page pass Google's own questions?

The third judge has no report and no tool. It has a list of questions, written by Google, on a page called "Creating helpful, reliable, people-first content". Most clinic owners have never read it, and it is the cheapest audit on the internet.

Pick one page. Choose your busiest service page, rather than your home page. Then ask it the questions Google asks. These are quoted straight from Google's page.

• "Does the content provide original information, reporting, research, or analysis?"
• "Does the content provide insightful analysis or interesting information that is beyond the obvious?"
• "Does your content clearly demonstrate first-hand expertise and a depth of knowledge (for example, expertise that comes from having actually used a product or service, or visiting a place)?"
• "Are you mainly summarizing what others have to say without adding much value?"
• "Is the content mass-produced by or outsourced to a large number of creators, or spread across a large network of sites, so that individual pages or sites don't get as much attention or care?"

Google also builds the whole page around 3 words: who created the content, how and why. On the who, it lists what a reader looks for when deciding if they can rely on a page: "clear sourcing, evidence of the expertise involved, background about the author or the site that publishes it, such as through links to an author page or a site's About page". On the why, it says the answer should be that "you're creating content primarily to help people".

For your clinic, that turns into a 5-line check you can do by eye.

• Is a registered practitioner named on the page, with the qualification and a link to a bio? If no one is named, the who is missing.
• Does the page say something a competitor's page for the same service does not? If you could swap the clinic name and nothing would change, you fail the question about original information.
• Is any clinical statement sourced, with a date? A claim with no source risks breaking section 133(a), and it costs you trust at the same time.
• Does the page tell the reader what the appointment does not cover? Google's questions reward pages that cover everything. So does the "unreasonable expectation" ground.
• Would the page exist if Google did not? If its only job is to rank for a suburb name, Google's own question about content "primarily made to attract visits from search engines" answers itself.

Notice the overlap. Four of those 5 lines are the same work as the section 133 check. That is the most useful fact in this whole post. In healthcare, the regulator and Google want nearly the same thing. They want a named person saying something specific and true, with the evidence attached. Few other industries are this lucky.

If you want the schema side of the who checked as well, schema markup for healthcare websites has its own 10-minute check for that.

What does a 30-minute audit miss?

It misses 4 things, and you should know them before you tell anyone your site passed.

It misses the month. The speed grade covers 28 days of other people's visits. You read it today, but it was not measured today. Anything you changed this week is not in it yet.

It misses everything that is not on your site. Section 133 applies to any ad for a health service, and it does not say "on a website". Social posts, Google Business Profile descriptions, directory listings and ad copy all count as ads. The 775 complaints Ahpra assessed covered more than websites. This audit only reads your site.

It misses the pages you did not open. Ten minutes covers one search across a handful of pages. A site with 40 service pages and a blog has far more than a handful. Google warns about sites with many pages that differ by only a word. That is exactly what you miss when you open just 3 of them.

It misses what the regulator is doing now. Ahpra's report says its team can "scan social media and websites for advertising breaches". So Ahpra no longer waits for complaints, as we covered in what 775 advertising complaints led to. Your self-audit is a snapshot, while their scan keeps running.

What do you do with the result?

There are 3 possible results, and each one has a different next step.

The section 133 search found something. Fix it this week, before anything else. The regulator is the only one of the 3 judges that sends letters. The fix is almost always a rewritten sentence, so you rarely need to rebuild a page. The 74% figure above shows practices doing exactly that after being asked. You get to do it before anyone asks.

The speed report says Poor on a group of pages you care about. Note the measure. Then give whoever built your site the measure's name and the web.dev passing mark, and ask for a date. Wait 28 days before you judge the result, because the report will wait that long too.

Your strongest page failed Google's questions. This one costs the most to fix, and it gives you the most back. Put a named practitioner on it. Add the one thing about your approach that a competitor's page does not say. Source every clinical line. That page now does what the regulator wants and what Google wants at once.

If the audit was clean on all 3, put a date in your calendar 28 days out and run it again. By then the speed data will have moved on, and so will the regulator's scan. Your site will stay the same unless you change it.