A regional distributor has had the link to a PDF of a surgical technique guide saved on their computer for years. Every so often they copy it and send it to a surgical technologist over WhatsApp. That link isn't in any menu, doesn't appear in the admin's page list, and nobody on the Marketing team knows it exists. But it gets visits every week, and if an audit moves that folder, the next message leads to an error.
What circulates outside the site is also part of it
A manufacturer's website has URLs that live outside it: catalogs distributors downloaded, QR codes printed on labels, links in congress presentations, PDFs attached to a tender. A crawl follows what's linked from within the site, and these URLs are beyond its reach.
Finding them means cross-checking sources. Search Console shows which URLs Google picks up, even when nobody links to them. The existing redirects keep a record of the previous site's paths. And the server folders contain files someone uploaded by hand, outside WordPress, that the content management system doesn't list: surgical technique guides, IFUs, or product line catalogs that have been circulating for years. Before touching a path, it's worth knowing what it delivers today and who reaches it.
Admins see a different version of the site
On most hosting setups with caching, someone logged in as an administrator gets pages generated on the fly, without the cache visitors see. A caching error stays invisible from the dashboard. A search can be slow in the editor and fast for the public, or the other way around. On a bilingual site there's another difference: being logged in can change the language of the results.
That's why every test is done logged out, in a browser nobody from the company has logged into, on a phone and on a computer, in Spanish and in the other language. In a medical catalog, the test uses a real code, a trade name, and an anatomical region, combines filters, and opens a product page's document. A screenshot of the dashboard shows how something is configured. Opening the PDF in a private browser window shows what the physician gets.
What we found on a newly launched site
At SAI, the technical audit was done in August 2026, with the new site already live, receiving traffic, and with no maintenance window. Everything was verified logged out: the hosting provider's two cache layers didn't apply to logged-in users.
The crawl found references to three external origins that were still live: the previous site's WordPress installation, still sitting in a folder; a staging server on another host; and the company's old domain. Images coming from those sources loaded only as long as those servers responded. Thirty-six of them, the ones on the staging server, were already broken and visible to any visitor.
- External origins with live references30
http://references to the site's own domain1,065across 302 pages0- Redirects that ended in an error60
Once those dependencies were removed, all 712 URLs in the crawl responded without errors. The previous site's 511 redirects were followed one by one to their final destination, and none was broken when the review closed. That's when something a list didn't show came up: two redirect systems were active at the same time, and for some URLs each one sent visitors to a different destination.
The figures are kept separate because they're different problems. The http:// references were inside published pages; the redirects protected people arriving from outside with an old URL. Added up into a single number of “errors fixed,” there would be no way to tell where each one was.
One change at a time, with a way back
An audit of a live site turns up dozens of findings that carry very different weight. Sorting them into three levels helps: what keeps someone from reaching a product or a document, what works, but poorly, and what can wait. A broken path to an IFU comes before the spacing on a card.
Each fix is applied on its own, in a small batch, with a known way to undo it. For each one, we note which URLs it touches and how we'll check that it worked. If two documents use different names for the same product, the discrepancy is logged and the relevant team decides on it before the product page is changed.
Each batch ends with the same test from the outside: an implant product page, its surgical technique guide, and a link saved before the migration, all opened while logged out. If any of the three fails, the batch is rolled back.
Services covered in this article
