WordPress offers a unit testing checklist and import files along with instructions for theme testing in general.

Usability

Interface, visual content, and legibility

• Homepage appearance
• Consistent headers
• Element alignment
• Timing of dynamic content
• Favicon
• Subpage appearance (each template)
• Spelling/Grammar
• Extraneous text orphans/rivers/hyphens/etc.

Flexibility

Responsiveness at various users’ browser settings.

• Various viewport sizes
• Various text sizes
• Various browser zoom levels
• Drag resizable forms/elements

Social

Check to see how different pages will show up when shared via social networks.

• Sharing ability within the site
• Manual sharing on Facebook, Twitter, Google+, LinkedIn to test thumbnail and description
• Facebook Linter
• Twitter Card Tester

Metadata

Check metadata to see how crawlers (including search and social) will see the site.

• Google Structured Data Testing Tool
• Google Search Rich Results Testing Tool
• KnowEm Metrics
• Verify metagraphics are updated

SEO

Make sure search crawlers can properly index the website and its content. Many other checks in this list can also affect SEO!

• Install/activate Yoast SEO plugin
• Use of semantic tags
• Initialize and verify Google Search Console and link it to Google Analytics
• Run a test through Screaming Frog SEO Spider
• Check for broken links
• Check for alt tags
• Avoid duplicate titles, descriptions, H1 tags, and content in general

Functionality

Valid code and proper target URLs without orphan pages or broken essential functions.

• No broken links
• target="_blank" on external links
• Page Titles
• Search
• Logo links home
• Forms accept alternate character sets (and symbols like quotes)
• Not affected by third-party ad blocking apps
• Verify Universal Google Analytics are instated
  • Verify Google Analytics event tracking is working properly
  • Verify Google AdWords integration is working properly (if needed)
  • Add referrer spambot protection to Google Analytics (using an alternate View)

Validity

Run the pages through various validators to see if there are any glaring mistakes. The linters will be very strict, and HTML5 can not technically be W3 validated, so while we will always strive for syntactically perfect code, it is not always conceivable.

• HTML W3C Validated
• CSS W3C Validated
  • W3 CSS Validator
  • CSS Lint
• JS Validated
  • JS Lint
  • JS Hint
  • Add 'use strict'; to the top of the your JS files and test functionality again.

Performance

Run the pages through various speed tests to see how optimized the site is. Clients’ servers may hinder goal progress, but frontend improvements should be noted. These are not requirements, but are methods of testing where a site stacks up. For a true baseline speed test, enable browser caching in .htaccess before running tests.

• WebPageTest
• Google Page Speed
• Pingdom
• GT Metrix (Also provides YSlow results)
• SEO SiteCheckup
• MobileOK
• Check Google Rich Snippets
• Optimized HTTP headers
• Optimized images
  • ImageOptim (Mac Only)
• Enabled gzip
• W3C Semantics

Accessibility

Graceful degradation and progressive optimization for usability across all types of users’ disabilities. For more information, read about Section 508 compliance, Web Content Accessibility Guidelines (WCAG), and the Accessible Canada Act (as an example of modern legislation).

• Deque axe DevTools
• Internationalization
• Specified language
• Readable by target demographic (and above)
• Alt attributes (only on images that have information; not simply decorative)
• Links are descriptive not simply “click here” (SEO benefits too)
• Heading tag usage
• Check readability without certain resources
  • Disable javascript
  • Disable images
  • Disable CSS
• Sufficient color contrast (especially for header/navigation)
• Print style
• Text selection (Not blocked, coherent order)
• Sitemap (Preferably XML)
• Friendly (“Pretty”) URLs
• Limited (or no) use of mailto links. Contact form alternatives used.
• Keyboard accessible (including tab order and dropdown menus)
• Test in a screen reader (if possible)

Security

Prevent users from knowingly or unwittingly using the site in a way not intended, and other defensive design checks.

• Prevent directory traversal (Options All -Indexes)
• Remove or redirect “www” subdomain
• Submit empty form fields (required fields and not)
• Search submissions do not execute JS (search for: “<script>alert(‘Test’);</script>”)
• Custom 404 page
• No sensitive information in browser-side source code (comments, console logs, etc.)
• Pages/files behind secured pages inaccessible from outside areas
• Disable Wordpress Pingbacks
• Deny access to .htaccess file from visitors