Skip to content
Passieon

Checklist

SEO audit checklist

59 checks, grouped and ordered so the expensive faults surface first. Indexing before anything else, because a page Google cannot see cannot be fixed by anything further down the list. Nothing to sign up for, and the spreadsheet version at the end is free.

By Hamza Rivera

Short answer: An SEO audit checks indexing first, then crawling, on-page, content, speed, links, local and measurement, in an order that surfaces the expensive faults early. A page Google cannot index cannot be fixed by anything further down the list. This checklist has 59 checks.

59 checks

in 8 sections, in the order that finds the most.

Most audit checklists are a flat list of a hundred things in no particular order, which means the reader starts at the top and gives up somewhere around item thirty, having found nothing. The order below is deliberate. The first two sections contain the faults that silently delete a site from search, and they are the fastest to check.

Work down it. Anything you cannot answer is a finding on its own.

The order an SEO audit runs in Eight bands stacked top to bottom, each narrower than the one above: Indexing with 8 checks, Crawling with 9 checks, On-page with 9 checks, Content with 8 checks, Speed with 7 checks, Links with 6 checks, Local with 7 checks, Measurement with 5 checks. An arrow down the left shows the sequence. A note at the top says that a fault in an upper band makes every check below it meaningless. A fault up here makes everything below it moot 1 Indexing 8 2 Crawling 9 3 On-page 9 4 Content 8 5 Speed 7 6 Links 6 7 Local 7 8 Measurement 5 Fastest to check, most expensive to leave
Each band is narrower than the one above because each one depends on it. Running the list from the bottom is how an audit comes back saying a site is healthy while the whole of it is blocked in robots.txt.

1 Indexing, first, because nothing below matters without it

Every audit starts here. A page that is blocked, noindexed or canonicalised away is invisible no matter how good it is, and this is where the single most expensive faults hide.

  • Fetch robots.txt and read it line by line. A Disallow left in from a staging site is the most common catastrophic fault in SEO.
  • Check no URL that you want indexed is Disallowed. A blocked page cannot be read, so a noindex on it cannot be read either, and it can linger in the index for months.
  • Search for the noindex directive across the whole build, in meta tags and in the X-Robots-Tag header. Both count and only one is usually checked.
  • Compare the page count in the sitemap against the pages actually indexed in Search Console. A wide gap is the audit’s first real finding.
  • Look at every Excluded reason in Search Console coverage, not just the errors. Crawled, currently not indexed usually means a quality problem, not a technical one.
  • Check the canonical on a sample of pages. Self-referencing is normal; a canonical pointing at the home page on every page is a common template bug that deletes a site from search.
  • Confirm the sitemap is listed in robots.txt and submitted, and that it contains only 200-status, indexable, canonical URLs.
  • Check for a second, forgotten sitemap left by an old plugin. They point at URLs that no longer exist and waste crawl budget.

2 Crawling and site structure

What a crawler can reach, how fast it gives up, and whether your most important pages are buried behind five clicks.

  • Crawl the site and list every page more than three clicks from the home page. Those are the pages Google visits least.
  • Find every internal link that returns a 3xx and point it at the destination instead. Redirect chains leak a little every hop.
  • Find every internal link that returns a 4xx. These are pure waste and are usually a handful of typos.
  • Check for redirect chains longer than one hop, and for loops. A loop is invisible to a visitor and fatal to a crawler.
  • Check that both www and non-www, and both http and https, resolve to exactly one canonical version.
  • Check that a URL with a trailing slash and without resolve consistently rather than both serving 200.
  • Look for parameter URLs being indexed: sorting, filtering, session ids, tracking tags. Each is a duplicate of a page you already have.
  • Check orphan pages: pages in the sitemap that nothing on the site links to. They exist and cannot be found.
  • Check pagination is crawlable with real links rather than a JavaScript-only load-more button.

3 On-page, per template rather than per page

Most on-page faults are template faults, which is good news: one fix corrects hundreds of pages. Sample three pages from each template rather than reading all of them.

  • Find every duplicate title tag across the site. Duplicates almost always mean a template writing the same string for many pages.
  • Find every missing or duplicate meta description. Missing is not a ranking fault; duplicated across a whole template usually signals a deeper one.
  • Check every page has exactly one H1 and that it says what the page is about rather than repeating the brand name.
  • Check the heading order runs H1, H2, H3 without skipping. Skipped levels make the page harder to parse for a screen reader and for a machine.
  • Check that the title tag and the H1 are not identical on every page, which is a sign nobody wrote either.
  • Check every image has an alt attribute, and that the alt describes the image rather than repeating the filename or stuffing a keyword.
  • Check internal anchor text says what the destination is. "Click here" and "read more" tell a crawler nothing.
  • Check structured data validates and, more importantly, that everything it declares is visible on the page. Markup describing content a reader cannot see is a manual action waiting to happen.
  • Check the Open Graph and Twitter card tags render something sensible, because this is what gets shared.

4 Content

The part most audits skip because it cannot be automated, and the part that most often explains why a technically perfect site does not rank.

  • List every page and the one search it is meant to answer. Any page you cannot name a search for is a candidate for merging or removing.
  • Find pages competing for the same search. Two pages after one term split the signal and neither wins.
  • Find thin pages: a heading, a paragraph and a form. Merge them into something substantial or remove them.
  • Check every page answers the question in the first two paragraphs rather than warming up for six.
  • Check the content matches the SERP. If the top ten for your target are all guides and your page is a sales page, you are entering the wrong race.
  • Check dates. An article dated three years ago referencing a tool that has been renamed reads as abandoned to a person and to a model.
  • Check any page making a claim can support it. Invented counts, made-up reviews and borrowed case studies are the fastest way to lose trust.
  • Check the FAQ content on the page matches the FAQ in the structured data exactly, in both directions.

5 Speed and Core Web Vitals

Measured on real pages on a real phone, not on the home page on a desktop, because that is where the visitors are.

  • Check Largest Contentful Paint on a mobile connection, on a template page rather than the home page.
  • Check Cumulative Layout Shift, and look specifically for images and ads without declared dimensions.
  • Check Interaction to Next Paint, which replaced First Input Delay and catches heavy JavaScript that older checks missed.
  • List every render-blocking script and stylesheet in the head and ask whether each has to be there.
  • Check images are served in a modern format, sized for the slot they occupy, and lazy-loaded below the fold but not above it.
  • Check fonts are self-hosted or preconnected, with a font-display that does not leave the text invisible while they load.
  • Check caching headers on static assets. A visitor returning after a week should not be downloading the fonts again.

6 Links

Both directions. Internal links are the half you control completely and the half most audits ignore.

  • Check the pages you most want to rank have the most internal links pointing at them. Usually they do not.
  • Check every important page is linked from somewhere other than the navigation and the sitemap.
  • Review the backlink profile for links from networks, directories bought in bulk, or sites in an unrelated language. Those are the ones worth disavowing, and almost nothing else is.
  • Find your broken backlinks: pages that earned links and now 404. Redirecting them recovers value already paid for and is the cheapest win in any audit.
  • Check outbound links still resolve. A citation to a page that has gone reflects on you, not on them.
  • Check anchor text on inbound links is not overwhelmingly exact-match commercial, which is what a manual link campaign looks like.

7 Local, if the business has a location or a service area

For a business that serves an area, this section usually outweighs everything above it.

  • Check the Google Business Profile is claimed, verified and has a primary category that matches what the business actually does.
  • Check the name, address and phone number are identical on the profile, on the site and in every directory listing.
  • Check the profile links to the relevant page rather than the home page.
  • Check opening hours, including holiday hours, and whether the business is findable with the open-now filter applied.
  • Check review volume and, more importantly, recency. Reviews stopping a year ago reads as a business that stopped.
  • Check every review has a reply, and that no reply discloses anything it should not.
  • Check LocalBusiness structured data exists and carries the same address and hours as everything else.

8 Measurement, which decides whether any of this can be proved

Last in the order and first in importance, because an audit you cannot measure the effect of is an opinion.

  • Check Search Console is verified, on the correct property type, and that you own it rather than an agency.
  • Check Analytics is installed once and only once. Two tags double everything and nobody notices for months.
  • Check conversions are actually tracked: calls, forms, bookings. Traffic without conversions cannot tell you whether the work paid.
  • Check internal traffic is excluded, or the smallest site looks busiest.
  • Record where things stand today, before any changes. An audit with no baseline cannot prove anything later.

Protecting what you build

Getting the visibility is the half everybody sells. Keeping it is the half that decides whether businesses still have customers arriving from Google in three years, and almost nobody writes it down, so here it is.

What actually breaks a business in search

Not usually an algorithm update, whatever the industry press implies. Core updates move positions; these remove you.

A redesign or a platform move

By a distance the most common cause of a real collapse. URLs change and nothing redirects, or the new site ships with the staging robots.txt still in it. Both are entirely preventable and both are usually discovered weeks later.

A plugin or a setting nobody audited

One checkbox marked "discourage search engines", one SEO plugin defaulting to noindex on a template, one caching layer serving a stale page. Small change, total effect.

Losing control of an account

The Business Profile owned by a former agency, Search Console verified to somebody who has left, the domain registered to a developer. None of this hurts until the relationship ends, and then all of it does at once.

A suspended Google Business Profile

For a business that serves an area this is worse than any algorithm update, because it removes you from the map entirely and on the same day.

Letting the work stop

Nothing dramatic happens. Reviews stop, hours drift, a competitor keeps going, and a year later the position has quietly gone. This is the most common ending and the least noticed.

What to refuse, however it is sold to you

Every one of these still gets sold, usually by email, usually cheaply, and usually to somebody who does not know it is being done in their name. All of them work for a while.

  • Bought links, in any packaging

    Guest post networks, paid directories that exist only to sell links, anything offered by email with a price per link. These are the clearest thing Google acts on manually, the action can arrive years later, and recovery means removing what you paid for and then waiting.

  • Reviews you did not earn

    Bought, incentivised, written by staff, or traded with another business. Google removes them, and where the pattern is obvious it suspends the listing rather than the reviews. It is also the one that damages you with customers if it is ever visible.

  • Keywords stuffed into the business name

    It moves the map pack for a while, which is exactly why it keeps being sold. It is also the single most common cause of a suspension, and the suspension takes the whole listing rather than the extra words.

  • Pages written to have pages

    A page per town you have never worked in, a page per service you do not offer, content generated to fill a content calendar. It does not rank and it drags down what would have.

  • Anybody who guarantees a position

    Nobody controls Google’s results. A guarantee means either the terms are meaningless or the method is one of the four above.

The monthly discipline

Twenty minutes a month, and it is the difference between noticing a problem in week one and noticing it in month six.

  • Check Search Console coverage once a month and look at the Excluded reasons, not just the errors.
  • Watch impressions rather than clicks. Impressions fall first, usually weeks before anybody notices the phone is quieter.
  • Open the Business Profile and look for edits the public has suggested and Google has accepted without telling you.
  • Reply to every review that arrived since last month, and keep asking, steadily rather than in bursts.
  • Before any site change, write down what the URLs are now. After it, check they still resolve.
  • Keep one note of what changed and when. Almost every traffic mystery is solved by a change nobody wrote down.
  • Re-run the audit checklist once a year, and the first two sections after any redesign, host move or new plugin.

Own your own accounts

The domain, the hosting, the Google Business Profile, Search Console and Analytics should all be registered in the business’s name with the business’s own email, and anybody working on them should have access granted rather than ownership transferred. It costs nothing to set up that way and it is close to impossible to unwind afterwards. If any of those are currently in somebody else’s name, that is worth fixing this week whether or not anything is wrong.

How often should you do an SEO audit?

A full one once a year, and a short one each quarter covering indexing, crawl errors and Search Console coverage. That rhythm catches drift, which is what accumulates when nobody is doing anything wrong in particular.

The audits that actually save money are the unscheduled ones. Run the first two sections immediately after any of these, without waiting for the quarter to end: a redesign, a move to a new platform, a change of hosting or CDN, a new plugin with access to robots.txt or the head of the page, a certificate change, or any sudden fall in impressions in Search Console. Every one of those can put a noindex or a Disallow in front of a site that was working the day before, and the damage compounds quietly until somebody looks. If the file itself needs writing, the robots.txt generator writes it with the AI crawlers named one by one and refuses the line that empties a site.

The SEO audit template, as a spreadsheet

The checklist above as a file you can fill in: one row per check, a result column that only takes pass, fail or not applicable, a column for the evidence (the address, the figure or the screenshot name, which is the one people leave out and the one that matters, because a finding with no URL cannot be verified or handed to anybody else), and beside every check where to look and what a fail costs.

Download the audit template (Excel)

It opens in Google Sheets as well. Eleven tabs. The first is a read-me and the second is the summary the client reads. Then the checks, in the order a fail costs enquiries: the enquiry path first, which no crawler can run because no crawler fills in a form, then indexing, on-page for the money pages, technical, content, local and links. Every fail is copied to a Findings tab with the page, the evidence, what it costs and the fix, and the Findings tab becomes the plan for the next thirty days, which becomes the first monthly report.

The five stages of the audit template, in the order a fail costs enquiriesFive numbered rows: enquiry path, highlighted; indexing; on-page; technical; content, local and links. Beside each, what a fail at that stage costs: every enquiry from the page, every click a missing page would have had, the click that was already there, a share of the clicks a slow page gets, and the harder searches a linked page would win. A line under the rows: every fail becomes a Findings row with the page, the evidence, what it costs and the fix.THE CHECKS, IN THE ORDER A FAIL COSTS ENQUIRIES1Enquiry pathA form that does not send costs every enquiry fromthat page, and no crawler fills in a form2IndexingA page Google has not indexed costs every click itwould have had3On-pageA title that names nothing costs the click that wasalready there4TechnicalA slow page costs a share of the clicks it alreadygets5Content, local and linksWeak signals cost the harder searches, the ones alinked page would winevery fail becomes a Findings row: the page, the evidence, what it costs, the fix
The enquiry path is checked first because a form that does not send costs every enquiry from that page, and it is the one stage no crawling tool reports on.

Keep the completed sheet. The second audit is far more useful than the first, because the difference between them is the only real evidence that anything changed. It is free, it is not gated behind an email address, and you can change anything in it.

If you would rather we ran it

Same list, done for you, with the findings ranked by what they cost rather than by how easy they were to find. You get the sheet and the evidence whether or not you go on to have the work done.

Questions about SEO audits

How often should you do an SEO audit?

A full audit once a year for most sites, and a short one every quarter. Then an unscheduled one whenever something changes that could break indexing: a redesign, a platform migration, a change of hosting, a new plugin that writes to robots.txt, or a sudden fall in impressions in Search Console. The annual audit finds drift; the unscheduled one finds damage, and damage is more expensive.

How long does an SEO audit take?

Working through this list on a small site takes a day or two. On a large one the crawl alone takes longer, and the content section is the part that expands, because it cannot be automated and it is where the real answers usually are.

Can I do an SEO audit myself?

Yes, and the first two sections are worth doing whoever you hire afterwards. Indexing and crawl faults are objective, they are findable with free tools, and they are where the largest single losses tend to hide.

What tools do I need?

Search Console, which is free and non-negotiable, a crawler, and a page speed tool. Everything in the indexing, crawling and measurement sections can be done with those three. The content section needs judgement rather than a tool.

What is the difference between an SEO audit and a technical SEO audit?

A technical audit covers the first two sections here plus speed: what a crawler can reach and read. A full SEO audit adds content, links, local and measurement, which is where most of the reasons a site does not rank actually live.

Book a call with us

A 30-minute call in your working hours. Tell us what you sell and where, and we will tell you what we would do first and what it involves. Prefer email? Send your website through the form and the Passieon Team will reply within two working days.

Message us

Message us

Ask anything about your site or where your enquiries are going. It goes straight to a person, not a bot. Leave an email and you get a reply.