Every website owner I know has run an automated scan at some point. The report comes back with a score, a list of missing alt attributes, a few performance warnings — and a general feeling that things are probably fine.
Scanners are genuinely good at what they check. The problem is what they can't check: anything stateful, anything visual in context, anything that requires actually completing a task like a customer. I've spent 10+ years as a QA engineer / SDET, and the bugs that cost businesses money are almost never in the scanner's report. They're in this list.
1. The form that says "sent" and sends nothing
The contact form validates. The success message appears. The scanner sees a working form.
What nobody checked: whether the message arrives. A misconfigured mail route, a spam filter eating submissions, a CRM webhook that silently started failing two deploys ago. From the visitor's side, everything worked. From your side, the lead doesn't exist.
Check it yourself: submit your own form, then verify the message landed in the inbox or CRM it is supposed to reach. Not "the success text showed" — the actual arrival, end to end.
2. The cookie banner sitting on your Buy button
On desktop, your layout is clean. On a real phone — the device most of your visitors actually use — the cookie consent bar covers the checkout button, the chat widget overlaps the menu, or the sticky header eats half the screen.
Scanners resize a browser window. They don't hold a phone with a consent banner up, a software keyboard open, and a thumb in the way.
Check it yourself: open your site on your own phone, in a private window (so the banner shows), and complete your main conversion action without dismissing anything first.
3. Validation that rejects valid customers
A postcode with a space in it: rejected. An apostrophe in a surname: the form dies. A phone number in an international format: "invalid."
Scanners don't fill in forms with realistic, messy human data. They especially don't try the valid but unusual inputs — which are exactly the ones your real customers type.
Check it yourself: complete your signup/checkout flow using the messiest realistic details you can think of — long names, special characters, addresses with apartment numbers, non-local phone formats.
4. The browser you don't test on
It works in Chrome. It works in your CI, which is also Chrome. Meanwhile the payment step quietly fails in Safari, because Safari is where a large share of your mobile buyers live and it handles some things (date inputs, popup blockers, third-party cookies) differently.
Check it yourself: run your critical flow once in Safari (ideally a real iPhone) and once in Firefox. Not the homepage — the flow that makes money.
5. Flows that break between pages
Every page passes its individual checks. The journey doesn't: the discount code that empties the cart, the login wall that loses the item you were mid-purchase on, the confirmation page that never fires after a redirect.
Page-level testing — human or automated — misses these by construction. Only walking the full journey catches them.
Check it yourself: do one complete end-to-end run as a first-time visitor: land, browse, add, check out, confirm, then check the confirmation email arrived.
6. Error states nobody designed
What does your site do when the session expires mid-checkout? When the API is slow? When someone double-clicks Pay? Scanners test the happy path at machine speed. Humans are slow, impatient, and click things twice.
None of these need special tooling to find. They need a person, a phone, and the deliberate attempt to use the site like a customer who is in a hurry and barely paying attention. That's what a manual audit is: structured, adversarial use.
If you run your own site, the checks above are a solid afternoon's work and they're free. I'd rather you did them than not.
Disclosure / the soft part: I do this professionally. After a decade of QA work I launched SiteFix Audit — a fixed-price manual audit service ($49–$249) that runs exactly these checks and delivers a prioritised PDF report with repro steps, severity, and fixes. If you'd rather hand the afternoon to someone else, that's the link. Either way, check your contact form first. That one surprises everybody.
Video: the SF-002 demo walkthrough shows a sample audit run-through:
DEV requires disclosing AI assistance in content creation — before publishing, add a line such as: "Drafted with AI assistance; the checks and opinions are mine." — and only publish if that statement is true at posting time.
Top comments (0)