Technical SEO audit checklist

Use this checklist for every new client, every quarterly review, and any time rankings drop unexpectedly. Ordered by typical impact.

Indexability

• [ ] robots.txt accessible at /robots.txt
• [ ] robots.txt not accidentally blocking important sections
• [ ] No sitewide noindex (check a few template pages)
• [ ] Canonical tags present and self-referential on most pages
• [ ] No conflicting canonical + noindex on same page
• [ ] GSC Coverage report reviewed; errors resolved

Crawlability

• [ ] XML sitemap accessible + submitted to GSC
• [ ] Sitemap URLs all 200 OK, indexable (no noindexed or redirected URLs)
• [ ] Homepage → every category ≤1 click
• [ ] Category → every page ≤2 clicks
• [ ] No orphan pages (pages with 0 internal inbound links)
• [ ] Navigation uses <a href>, not JS-only onclicks

HTTPS + security

• [ ] HTTPS on every URL
• [ ] No HTTP→HTTPS internal link mixes
• [ ] No mixed content warnings
• [ ] SSL certificate not expiring soon
• [ ] HSTS header configured
• [ ] www vs non-www decision made and enforced by 301

Site speed + Core Web Vitals

• [ ] LCP <2.5s on mobile (field data)
• [ ] INP <200ms on mobile
• [ ] CLS <0.1 on mobile
• [ ] Images compressed + served in modern formats (WebP/AVIF)
• [ ] Render-blocking JS deferred
• [ ] Render-blocking CSS minified + critical inline
• [ ] Web fonts using font-display: swap
• [ ] CDN in front of origin for static assets

Mobile

• [ ] Mobile Usability report shows no errors
• [ ] Same content on mobile + desktop (mobile-first parity)
• [ ] Responsive design; no separate m.* subdomain
• [ ] Tap targets ≥44px
• [ ] Body text ≥16px
• [ ] No intrusive interstitials on entry

Response codes

• [ ] 404 rate <1% of Googlebot requests (from logs)
• [ ] No 5xx errors on regular crawl
• [ ] Redirect chains cleaned up (>1 hop → fix)
• [ ] Major 301s from old URL structures still in place (don't remove during migrations)
• [ ] Deleted pages return 410 or 404, not redirect-to-homepage

URL structure

• [ ] URLs short, descriptive, hyphenated, lowercase
• [ ] No IDs, session params, or PHP query strings in URLs for key pages
• [ ] Consistent trailing-slash behavior (either always or never)
• [ ] Case consistency (lowercase preferred)
• [ ] Parameterized filters (?sort=, ?filter=) handled (noindex, canonical, or robots.txt)

Duplicate content

• [ ] No cannibalization (multiple pages ranking for same keyword)
• [ ] Product variations canonicalized to parent
• [ ] Pagination handled (rel=next/prev or noindex on deep pages)
• [ ] Tag archives noindexed if they duplicate categories
• [ ] www + non-www + HTTP + HTTPS all consolidated to one version

International (if applicable)

• [ ] Hreflang tags present and reciprocal
• [ ] x-default fallback defined
• [ ] Country-targeting in GSC (or ccTLD in use)
• [ ] No conflicting canonical across language versions

Structured data

• [ ] Organization schema on homepage
• [ ] Article schema on blog posts
• [ ] Product schema on product pages
• [ ] BreadcrumbList on deep URLs
• [ ] All pass Rich Results Test
• [ ] GSC → Enhancements shows no errors

JavaScript (if JS-heavy)

• [ ] Content visible in initial HTML (SSR/SSG) or in Googlebot's rendered HTML
• [ ] Internal links as real <a href>
• [ ] Meta tags (title, description) set server-side
• [ ] Lazy-loaded content still reachable by Googlebot

Monitoring

• [ ] GSC property verified + set up
• [ ] Sitemap submitted
• [ ] Analytics tracking on every page
• [ ] Uptime monitor configured
• [ ] Core Web Vitals tracked over time
• [ ] Rank tracking in place for target keywords

Fix order

If time is limited, address in this order:

1. Crawl blockers (robots.txt, noindex, canonical issues)
2. HTTPS + duplicate URL consolidation
3. Core Web Vitals on top pages
4. Redirect chains + 4xx/5xx rates
5. Mobile usability
6. Structured data on priority pages