---
title: "Technical SEO Audit Checklist"
description: "A technical SEO audit checklist covering crawlability, indexation, site architecture, Core Web Vitals, structured data, and mobile usability."
tldr: "A technical SEO audit works through the crawl-render-index pipeline in order: confirm crawlers can access the site, confirm the right pages are indexed, then audit performance, structured data, and architecture. High-impact findings are often crawl blocks on pages that should be indexed, noindex tags left on after development, canonical tags pointing the wrong way, and redirect chains eating crawl budget. Check crawler access at the CDN as well as in robots.txt: a bot-management rule can block a crawler your robots.txt allows, and nothing in the file will show it. Run a full crawl with Screaming Frog or Sitebulb before starting: the crawl data underpins most checks."
publishDate: 2026-04-27
updatedDate: 2026-07-14
author: "Liam Hayward"
---
Run this checklist against an existing live site to identify technical SEO issues. For a new site or redesign going live, use the [Go-Live Checklist](/resources/go-live-checklist/) instead. For the full audit reasoning and process behind each section, see the [SEO Audit Guide](/resources/seo-audit-guide/).

**Before starting:** crawl the site with Screaming Frog, Sitebulb, or a similar tool. Export the crawl data: most checks below reference it. Also open Google Search Console; you will need the Page Indexing, Core Web Vitals, and URL Inspection reports.

---

## 1. Crawlability

- [ ] robots.txt is accessible at `/robots.txt` and returns a 200 status code
- [ ] robots.txt does not block any pages that should be indexed (check key page types: homepage, category pages, key landing pages)
- [ ] robots.txt does not block CSS or JavaScript files Googlebot needs to render pages
- [ ] No accidental `Disallow: /` in production robots.txt
- [ ] Crawl budget is not wasted on low-value URLs: parameterised URLs, faceted navigation, session IDs, internal search results
- [ ] Orphan pages (pages with no internal links) are either removed or linked internally
- [ ] Crawl depth: key pages are reachable within 3-4 clicks from the homepage
- [ ] No crawler traps: infinite pagination, calendar archives generating unlimited URLs, or session-based URL parameters creating unique URLs per visit
- [ ] XML sitemap is declared in robots.txt via `Sitemap:` directive
- [ ] AI crawler access is intentional: check whether GPTBot, OAI-SearchBot, ClaudeBot, and PerplexityBot are allowed or blocked in robots.txt and confirm this reflects a deliberate decision rather than an inherited default. Sort them by what they do, not by company: **training** crawlers (GPTBot, ClaudeBot), **search** crawlers that index for citation (OAI-SearchBot, PerplexityBot) and **agent** fetchers acting for a user in real time (ChatGPT-User, Perplexity-User). Blocking one category does not block the others
- [ ] Crawler access at the network layer matches robots.txt. A CDN or bot-management rule can block a crawler that robots.txt allows, and the site owner often never sees it. If the site is on Cloudflare, check the AI crawler settings: since 15 September 2026 a newly onboarded domain that carries ads is offered a preset with Training set to Disallow AI Training and Agent blocked on ad-displaying pages, with Search left allowed.[^2][^3] If the site has Training set to Block, confirm that was intended, because Block applies to crawlers that fetch for both search and training and so also blocks Googlebot, Applebot and Bingbot; Disallow AI Training is the setting that keeps them[^3]
- [ ] No Googlebot IP ranges blocked by geo-restriction, firewall or WAF rules. Review hosting and CDN configuration if the site uses IP-based access controls

For more, see [Crawlability and robots.txt](/technical-seo/crawlability-and-robots-txt/), the [Robots.txt reference](/resources/robots-txt-reference/), and [Crawl budget](/technical-seo/crawl-budget/).

---

## 2. Indexation

- [ ] Google Search Console Page Indexing report reviewed: note the "Not indexed" reasons and any pages indexed with warnings
- [ ] Key pages are indexed. Spot-check with URL Inspection in Search Console
- [ ] No important pages in "Crawled - currently not indexed" state. This indicates a quality or duplication issue
- [ ] No important pages in "Discovered - currently not indexed" state. This may indicate crawl budget or internal linking issues
- [ ] No important pages with noindex tag (check crawl export for noindex on pages that should rank)
- [ ] No important pages blocked by robots.txt but still appearing in the index. URLs appear without description in SERPs if this occurs
- [ ] Paginated pages handled correctly: paginated content is either indexable with self-canonicals, or noindexed on deep pages
- [ ] Faceted navigation / filter URLs are either blocked, canonicalised, or have noindex as appropriate
- [ ] No soft 404s: pages returning 200 with "not found" or empty content (check the "Soft 404" reason in the Search Console Page Indexing report)
- [ ] Index count is plausible relative to actual page count (`site:example.com` estimate as a rough check)

For more, see [Indexing](/technical-seo/indexing/), [When to use noindex](/resources/when-to-use-noindex/), and [Why isn't my page indexed?](/resources/why-isnt-my-page-indexed/).

---

## 3. Canonical tags

- [ ] All key pages have a self-referencing canonical tag
- [ ] Canonical tags use absolute URLs (not relative paths)
- [ ] No canonical tags pointing to redirecting URLs
- [ ] No canonical tags pointing to non-200 pages
- [ ] Canonical tags are consistent with hreflang tags (hreflang must reference canonical URLs)
- [ ] Paginated pages: page 2+ self-canonical. Google advises against a canonical pointing back to page 1; use noindex on deep pages instead
- [ ] www vs. non-www is consistent: one resolves to the other via 301, and canonicals reflect the chosen version
- [ ] HTTPS vs. HTTP is consistent: all canonicals use HTTPS

For more, see [Canonical tags](/technical-seo/canonical-tags/) and [Duplicate content](/technical-seo/duplicate-content/).

---

## 4. Redirects

- [ ] No redirect chains longer than 2 hops (A → B → C should be resolved to A → C)
- [ ] No redirect loops (A → B → A)
- [ ] All redirects are 301 (permanent) unless intentionally temporary (in which case use 302)
- [ ] 302s are reviewed. Confirm each is temporary, not a permanent move misconfigured as temporary
- [ ] Internal links point directly to final destination URLs, not through intermediate redirects
- [ ] Old URLs from previous migrations are still redirecting correctly
- [ ] No broken redirect destinations. Redirects should not point to 404 pages

For more, see [Redirects](/technical-seo/redirects/) and [HTTP status codes](/resources/http-status-codes/).

---

## 5. Status codes

- [ ] No important pages returning 4xx. Check crawl export, filter by 4xx
- [ ] No important pages returning 5xx
- [ ] 404 pages return a true 404 status code. Soft 404s returning 200 must be avoided
- [ ] No important resources (CSS, JS, images) returning 4xx. Check by filtering crawl by resource type
- [ ] Search Console: the "Not found (404)" reason in the Page Indexing report reviewed and resolved or accepted

---

## 6. Site architecture and internal linking

- [ ] Navigation links to all top-level sections
- [ ] Important pages receive internal links from relevant, high-authority pages on the site
- [ ] No key pages are orphaned. All key pages should have at least one internal link pointing to them
- [ ] Breadcrumbs are present and correctly structured
- [ ] Anchor text in internal links is descriptive and varied. Avoid "click here" or exact-match keyword repetition
- [ ] No broken internal links. Filter crawl export by 4xx on internal links
- [ ] Pagination: multi-page sections are linked sequentially
- [ ] Site hierarchy is logical: category pages link to subcategories, subcategories link to content

For more, see [Site architecture](/technical-seo/site-architecture/).

---

## 7. HTTPS and security

- [ ] SSL certificate is valid (not expired, not self-signed)
- [ ] HTTP redirects to HTTPS via 301, not 302
- [ ] www and non-www both redirect to the canonical version
- [ ] No mixed content (HTTP resources loaded on HTTPS pages). Check browser console on key pages
- [ ] HSTS header is set (`Strict-Transport-Security`)
- [ ] No security warnings in Chrome for the domain

For more, see [HTTPS and security](/technical-seo/https-and-security/).

---

## 8. Core Web Vitals

- [ ] Search Console Core Web Vitals report reviewed. Note which URL groups fail on mobile and desktop
- [ ] LCP is under 2.5 seconds (check PageSpeed Insights field data for key templates)
- [ ] INP is under 200ms
- [ ] CLS is under 0.1
- [ ] No render-blocking resources identified in Lighthouse that have not been addressed
- [ ] LCP image (if applicable) has `fetchpriority="high"`. It should not be lazy-loaded
- [ ] Images have explicit `width` and `height` attributes set
- [ ] Web fonts are preloaded, with `font-display: optional`, or `font-display: swap` paired with matched fallback metrics (`size-adjust`, `ascent-override`) so the swap does not shift layout

For more, see [Core Web Vitals](/technical-seo/core-web-vitals/) and the [Core Web Vitals Optimisation Guide](/resources/core-web-vitals-optimisation/).

---

## 9. Mobile

- [ ] Key page templates checked on mobile. Google's standalone Mobile-Friendly Test was retired in December 2023 and Search Console's Mobile Usability report went with it, which leaves no dedicated mobile-usability tool. **Lighthouse does not fill the gap:** version 12.0.0 replaced the `tap-targets` audit with `target-size` under accessibility, and version 13 removed the `font-size` audit outright, on the grounds that "there are no signals that this remains an SEO concern today".[^1] A clean Lighthouse **SEO** score says nothing about whether the page is usable on a phone
- [ ] Viewport meta tag is present on all pages (Lighthouse reports this as the `viewport-insight` audit from version 13[^1])
- [ ] Content is the same on mobile and desktop. Mobile-first indexing means Google indexes the mobile version
- [ ] No content hidden behind expandable elements inaccessible to Googlebot
- [ ] No intrusive interstitials (full-screen popups on page load)
- [ ] Tap targets are appropriately sized (Lighthouse: accessibility, `target-size`)
- [ ] Text is readable without zooming: no font sizes below 12px for body text. Lighthouse no longer audits this, so check it manually in DevTools device emulation

For more, see [Mobile SEO](/technical-seo/mobile-seo/).

---

## 10. Structured data

- [ ] Structured data is present on appropriate page types: articles, products, local business, breadcrumbs. Note: FAQPage schema no longer produces rich results in Google Search; no platform documents any other use, so it is harmless rather than useful. Sitelinks Search Box (SearchAction on WebSite) has been deprecated and no longer produces a visual result
- [ ] No structured data errors in Search Console (Rich Results report)
- [ ] Structured data validated with Google's Rich Results Test for key templates
- [ ] No structured data present for content not visible to users. Hidden structured data violates Google's guidelines
- [ ] Organisation schema on homepage with correct `name`, `url`, `logo`, and `sameAs` social profiles
- [ ] BreadcrumbList schema matches visible breadcrumb navigation
- [ ] Article schema includes `datePublished` and `dateModified`

For more, see [Structured data](/technical-seo/structured-data-schema-markup/).

---

## 11. Page speed and performance

- [ ] Server response time (TTFB) is under 800ms for key pages
- [ ] Images are compressed and served in WebP or AVIF format
- [ ] Images are correctly sized for their display dimensions. Avoid serving 2000px images in a 400px slot
- [ ] Images have descriptive alt text. Empty alt on informational images removes the primary relevance signal for image search and fails accessibility requirements
- [ ] Lazy loading is applied to below-the-fold images (`loading="lazy"`)
- [ ] JavaScript is deferred or asynced where appropriate
- [ ] Third-party scripts (analytics, chat, ads) are loaded asynchronously. They should not block rendering
- [ ] A CDN is in use. It reduces latency for geographically distributed users
- [ ] Browser caching headers are set appropriately. Static assets should be cached per your TTL strategy

---

## 12. International (if applicable)

- [ ] hreflang tags are implemented on all language/region variants
- [ ] All hreflang tags are reciprocated across all versions in the cluster
- [ ] hreflang tags use correct ISO 639-1 language codes and ISO 3166-1 alpha-2 region codes
- [ ] hreflang URLs resolve to 200 responses (not redirects or 404s)
- [ ] x-default hreflang is set
- [ ] Geo-targeting signals are consistent (hreflang, on-page localisation, currency, address). There is no country-targeting setting to configure: Search Console's International Targeting report was removed in 2022, and Google now infers the target country from the signals on the site
- [ ] Content is localised. Machine-translated content must be reviewed before publishing

For more, see [Hreflang and international SEO](/international-seo/hreflang-and-international-seo/) and [geotargeting](/international-seo/geotargeting/).

---

## 13. JavaScript rendering

- [ ] Key content (headings, body text, links) is present in the HTML source. JavaScript should not be the only source of content
- [ ] Compare `View Source` against rendered DOM in DevTools. Content visible in browser should appear in source or be present after rendering
- [ ] Navigation links are crawlable `<a href>` elements. Avoid JavaScript `onClick` handlers without href
- [ ] Google's rendered version of key pages shows the correct content. Use URL Inspection > View crawled page in Search Console. Google's cached pages and the `cache:` operator were both removed in 2024, so there is no longer a cache to check
- [ ] Internal links in JavaScript-rendered content use standard `<a>` tags

For more, see [JavaScript SEO](/technical-seo/javascript-seo/).

---

## 14. Log file analysis (if access available)

- [ ] Googlebot is crawling key pages. Confirm in server logs filtered by Googlebot user agent
- [ ] Googlebot is not crawling large volumes of low-value URLs. Parameterised, session-based, and internal search URLs should be blocked
- [ ] Crawl frequency on key pages aligns with update frequency. High-priority pages should be crawled regularly
- [ ] 5xx errors visible in logs but not in crawl tools. Some errors are transient but worth monitoring
- [ ] No suspicious non-Google bots consuming significant crawl bandwidth

For more, see [Log file analysis](/technical-seo/log-file-analysis/).

---

## Prioritising findings

Not all technical issues are equal. Prioritise by impact:

**Critical (fix immediately):**
- Crawl blocks on pages that should be indexed
- noindex on pages that should rank
- 5xx errors on key pages
- Redirect loops

**High (fix in current sprint):**
- Redirect chains of 3+ hops
- Broken internal links to important pages
- Canonical tags pointing to wrong URLs
- Core Web Vitals failures on high-traffic templates

**Medium (schedule):**
- Orphan pages with some value
- Missing structured data on eligible page types
- Mixed content warnings
- Large image files not yet converted to WebP

**Low (backlog):**
- Minor crawl inefficiencies on low-traffic sections
- Structured data enhancements (not errors)
- Crawl depth improvements beyond 4 clicks

[^1]: [Lighthouse changelog, v12.0.0 — GoogleChrome/lighthouse](https://github.com/GoogleChrome/lighthouse/blob/main/changelog.md) and [What's new in Lighthouse 13 — Chrome for Developers](https://developer.chrome.com/blog/lighthouse-13-0)

[^2]: [Your site, your rules: new AI traffic options for all customers — Cloudflare](https://blog.cloudflare.com/content-independence-day-ai-options/)

[^3]: [Have it both ways: stay discoverable in search while disallowing AI training — Cloudflare Blog](https://blog.cloudflare.com/accountable-mixed-use-ai-crawlers/), 15 September 2026