How to Run a Technical SEO Audit: A Step-by-Step Checklist
Crawl, render, index, then speed: the checks that block traffic come first, and every step ends with a way to confirm the fix landed.
Run Screaming Frog on almost any site and it’ll hand you a few hundred “issues” within minutes. Missing alt text, long titles, low word counts. Most of them won’t cost you a single visit.
The short version: an audit answers four questions in order. Can Google crawl the page, render it and index it, and does it pick the URL you wanted?
Speed and structured data come after those.
Each check below says what to do, why, and how to confirm it worked. A fix nobody retested is a guess.
Not sure a technical audit is the one you need? This comparison of a marketing audit, an SEO audit and a website audit shows what each one checks and what it ignores.
The 11 checks at a glance
Here they are in the order I’d run them. A small site gets through the list in an afternoon.
| # | Check | Where you do it | About |
|---|---|---|---|
| 1 | List the pages that matter and take a baseline | Search Console | 20 min |
| 2 | Crawl the site | Screaming Frog or another crawler | 30 min |
| 3 | Read your robots.txt | yoursite.com/robots.txt, Search Console | 10 min |
| 4 | Fix broken pages and handle deleted ones | Crawler, Page indexing report | 30 min |
| 5 | One version of every URL, on HTTPS | Browser, crawler | 15 min |
| 6 | Find what’s kept out of the index | Page indexing, URL Inspection | 30 min |
| 7 | Canonicals and the URLs nobody meant to publish | Crawler, URL Inspection | 30 min |
| 8 | Sitemap and internal links | Sitemaps report, crawler | 20 min |
| 9 | What Google sees after rendering, on mobile | URL Inspection live test | 20 min |
| 10 | Core Web Vitals on real visits | Core Web Vitals report, PageSpeed Insights | 20 min |
| 11 | Structured data that matches the page | Rich Results Test | 15 min |
Before you crawl
1. List the pages that matter and take a baseline
Write down the pages that earn you traffic or money, then the templates behind them: home, category, article, product.
Why templates? On most sites a problem lives in one and repeats across hundreds of URLs.
Then take a snapshot. Export the Performance report by page and note today’s indexed count in the Page indexing report.
Check it: you have one sheet with your top pages, the template each one uses, its clicks and today’s indexed count.
Crawl
2. Crawl the site
A crawler follows your links the way Googlebot does and lists every URL with its status code, title and canonical.
Screaming Frog crawls 500 URLs for free, enough for most small sites. Ahrefs Webmaster Tools and Bing’s Site Scan are free too, for sites you’ve verified.
Set the user agent to Googlebot smartphone. Do your pages build their content with JavaScript? Then switch on JavaScript rendering in the crawler’s settings.
Check it: pick two or three URLs from each template on your list and find them in the crawl. Anything missing, or anything unexpected that turns up in big numbers, is your first lead.
Don’t expect the crawl to match your sitemap count. The sitemap lists what you want in Google, while the crawler finds everything you link to.
3. Read your robots.txt
Open yoursite.com/robots.txt in a browser and read every line. The classic disaster is a Disallow: / left over from the staging site, which tells every crawler to stay out of everything.
Then look for rules that block the CSS and JavaScript Google needs to render your pages. The 500 KiB size limit only bites on huge files.
Remember what robots.txt can’t do. It controls crawling, and Google says it’s “not a mechanism for keeping a web page out of Google”. That job belongs to noindex (check 6).
Check it: the robots.txt report in Search Console should show your file fetched without errors. Then run your top pages through URL Inspection and confirm crawling is allowed.
While you’re in the file, decide on AI crawlers on purpose. GPTBot and its peers are separate from Googlebot.
Google-Extended controls Gemini training, and Google says it doesn’t affect inclusion in Google Search. Google also plans to back one shared rule for AI training opt-outs.
4. Fix broken pages and handle deleted ones
Filter the crawl by status code. Every link inside your own site should land on a 200 page, so fix or remove links to 404s and chase any 5xx errors with your host.
Then check the pages you’ve deleted or moved, especially ones that used to get traffic or links:
- moved, with a close replacement: redirect it to that page
- gone for good: let it return 404 or 410
- gone, but redirected to the homepage: Google’s own help calls that a soft 404, so pick one of the two options above
A soft 404 also happens when a page says “not found” but returns 200. The Page indexing report lists them.
Check it: a fresh crawl filtered to 4xx and 5xx shows no internal links pointing at them.
5. One version of every URL, on HTTPS
Your site should answer on one address only. Type these into a private window and every one should end on the same URL in a single redirect:
http://yoursite.comhttp://www.yoursite.comhttps://www.yoursite.com(or the bare version, whichever you don’t use)- a page with and without its trailing slash
Use permanent redirects, 301 or 308. A 302 says the move is temporary, which is a weaker signal about which URL to keep.
Then look for chains, where A redirects to B and B to C. Point internal links straight at the final URL.
On the HTTPS side, watch for mixed content: images or scripts still loading over http.
Check it: your crawler’s redirect chains report is empty, and the browser shows no mixed-content warning on your main templates.
Index
6. Find what’s kept out of the index
Open the Page indexing report in Search Console and read the reasons pages aren’t indexed. Ignore the total. Look only for URLs from your list in check 1.
The ones to act on:
- Excluded by ‘noindex’ tag on a page that should rank. Check the meta robots tag and the
X-Robots-Tagheader. - Blocked by robots.txt on a page you want indexed.
- Crawled, currently not indexed across a whole template, which usually means Google doesn’t think those pages are worth keeping.
Mind one trap. Google has to crawl a page to see its noindex, so a page blocked in robots.txt can’t be noindexed.
And search Google for site:staging.yoursite.com. A staging copy in the index competes with the real one, so password-protect it.
Check it: URL Inspection on each money page says the URL is on Google. That’s the indexed version; click Test live URL to see today’s page.
Google’s late-October documentation update gives the same advice for sites where users publish pages: noindex what’s meant for people with the link, and watch Page indexing for sudden jumps.
7. Canonicals and the URLs nobody meant to publish
Every page should point its canonical tag at itself, or at the one version you want indexed. It’s a hint, though: Google says it “may choose a different page as canonical than you do”.
Duplicates mostly come from URLs you never planned. On a WordPress site, look for:
- tag, author and date archives that repeat the same posts
- internal search results (
?s=) that got linked somewhere - attachment pages, one per image (new installs since WordPress 6.4 redirect them to the file; older sites keep them unless you change it)
- filter and sort parameters on shop and category pages
For each group, first decide whether it deserves to be in Google at all. If it doesn’t, noindex it or stop linking to it. Don’t just block it in robots.txt.
Check it: in URL Inspection, compare the user-declared canonical with the Google-selected one on your top pages. Where they differ, find out why before you change anything; sometimes Google’s choice is the right one.
8. Sitemap and internal links
Your XML sitemap should list only pages that return 200, are indexable and are their own canonical. Each file holds 50,000 URLs or 50 MB at most.
Submit it in Search Console and add a Sitemap: line to robots.txt.
Then compare the sitemap with the crawl. A URL in the sitemap that the crawler never reached is an orphan: no page on your site links to it, so Google has little reason to think it matters.
Important pages should sit a few clicks from the homepage, behind ordinary <a href> links. Menus that only work on a JavaScript click can hide whole sections.
Check it: open the sitemap file itself and spot-check 20 URLs in the crawl: all 200, indexable and self-canonical. The Sitemaps report should show a successful read.
Render and experience
9. What Google sees after rendering, on mobile
Google indexes the mobile version of your pages, crawled with its smartphone agent. If your mobile layout hides text, links or structured data that desktop has, Google may never count them.
The same goes for content that appears only after JavaScript runs. If the script fails, Google gets a blank page.
That matters most for the main text, internal links, title and canonical.
Check it: run URL Inspection, click Test live URL, then View tested page. Read the HTML tab for your main content and links, not just the screenshot.
10. Core Web Vitals on real visits
Google’s three Core Web Vitals and its targets, measured at the 75th percentile of real visits:
| Metric | What it measures | Good |
|---|---|---|
| LCP | Loading: when the main content appears | 2.5 seconds or less |
| INP | Responsiveness: how fast the page reacts to taps and clicks | under 200 milliseconds |
| CLS | Visual stability: how much the layout jumps | under 0.1 |
INP replaced First Input Delay on March 12, 2024. Still see FID in a checklist? It’s out of date.
Work from field data: the Core Web Vitals report in Search Console and the top half of PageSpeed Insights.
And don’t chase perfect. Good scores don’t guarantee top rankings, Google says, so fix the pages that are poor, move on to the rest of the list, and come back when the report changes.
Check it: the Core Web Vitals report groups URLs by template. A fix counts when that group moves to Good on mobile, which takes weeks of new data.
11. Structured data that matches the page
Structured data helps Google read what a page is (an article, a product, a recipe) and makes it eligible for rich results. Use JSON-LD, and only mark up what visitors can see on the page.
Keep your expectations straight. Google “does not guarantee” rich results even for valid markup.
And types disappear: FAQ rich results are no longer shown in Google Search.
Check it: run your main templates through the Rich Results Test, then watch the matching enhancement reports in Search Console for errors.
If your site runs in more than one language, add a hreflang pass here: each version lists itself and every other version, and the links go both ways, or Google ignores them.
If you have more time
Two checks are worth it on bigger or busier sites:
- Crawl stats in Search Console shows how often Googlebot visits and which responses it gets. A jump in 403 or 5xx often means a firewall is turning Google away.
- Server logs show which URLs bots actually request. Search Console doesn’t give you a per-URL crawl history, so logs are the only way to see it.
Logs full of “Googlebot” hits? Check they’re real with Google’s reverse DNS test. Gary Illyes says fake Googlebots are getting more common.
How to prioritise what you find
An audit is only as good as its order. Here’s how I’d rank whatever turns up:
| Priority | What it looks like | When |
|---|---|---|
| 1. Blocks money pages | robots.txt block, stray noindex, 5xx errors, wrong canonical, staging copy indexed | Today |
| 2. Wastes crawling at scale | Redirect chains, internal 404s, thousands of parameter or archive URLs, orphan pages | This month |
| 3. Hurts visitors | Poor Core Web Vitals, mixed content, broken mobile layout | Next sprint |
| 4. Tool warnings | Title length, missing alt text on decorative images, “low word count” | When you’re there anyway |
For each finding, write down what’s wrong, the evidence, which template it affects, the fix, and how you’ll retest it. Whoever fixes it then knows what done looks like.
What’s overrated
These show up in plenty of audits and do little or nothing:
- the meta keywords tag, which Google says “has no effect on indexing and ranking at all”
rel="next"andrel="prev", which Google stopped usingcrawl-delayaimed at Google: its robots.txt parser ignores the line (Bing reads it)- the Mobile-Friendly Test, gone since December 2023 along with the Mobile Usability report
- chasing a perfect PageSpeed score or a tool’s “health score”
- an llms.txt file for Google, which says these files “aren’t needed for Google Search” and won’t move your rankings either way
How often to audit
Run the full list once or twice a year, and before and after any redesign, migration or platform change. That’s when robots.txt rules, noindex tags and redirects break.
In between, 15 minutes a month in Search Console catches most problems early: Page indexing, Crawl stats and Core Web Vitals.
On WordPress, run the WordPress security checklist alongside it. A hacked site fails every check here.
Why it matters
Most sites don’t need a 90-page audit. They have three or four template-level problems, and a crawler’s long list hides them under hundreds of warnings.
So treat the audit as a short list of fixes, ranked by what each one blocks. A noindex tag on your category template costs more than every missing alt text combined.
Got one hour? I’d do checks 3, 5 and 6. They’re free, and they’re where the expensive mistakes hide.
Common Questions
How long does a technical SEO audit take for a small website?
An afternoon. For a site under 500 pages, the 11 checks take three to five hours with Search Console and the free version of Screaming Frog. Fixing what you find, and waiting for Google to recrawl, takes longer.
Can I do a technical SEO audit for free?
Yes. Google Search Console, PageSpeed Insights, the Rich Results Test and Screaming Frog’s free version, which crawls 500 URLs, cover every check in this list for a small site. A paid crawler licence mostly matters once the site passes 500 URLs.
What’s the difference between a technical SEO audit and a full SEO audit?
Scope. A technical SEO audit checks whether search engines can crawl, render and index your pages. A full SEO audit adds content quality, keyword targeting and backlinks on top of those technical checks.
