A technical SEO audit is the annual health check of your site. You don't run it because something is visibly broken, but to catch what is broken without showing it. With AI Overviews on the results page and core updates several times a year, ignoring the technical side is like building a castle on sand.
This guide gives you an actionable checklist in 7 major steps, concrete tools and the specific points to fix first.
Prerequisites before starting
Make sure you have access to Google Search Console (GSC), Google Analytics 4, and ideally a crawler like Screaming Frog (free up to 500 URLs) or Sitebulb. These tools are indispensable for the following steps.
1. Crawl the Site: The Complete Mapping
The first step is to simulate what Googlebot does: traverse all URLs on your site to build an exhaustive inventory.
What to analyze:
- 4xx error pages: Internal links pointing to pages that no longer exist frustrate visitors and waste crawling. Fix the links first. Redirect a 404 with a 301 only when a relevant replacement page exists; a page you removed on purpose can stay a 404 or 410.
- 5xx errors: A sign that your server is overloaded or misconfigured. A Googlebot encountering server errors spaces out its visits, which slows down indexing.
- Redirect chains: Cascading redirects (A → B → C → D) slow down visitors. Google advises "redirecting to the final destination directly" and, if not possible, keeping chains "ideally no more than 3" (Google).
- Orphan pages: Pages with no internal links. Google finds them with difficulty and considers them less important. Link them from relevant pages.
2. Indexing Analysis
Being crawled doesn't guarantee being indexed. Go to GSC > Indexing > Pages to examine each status.
Critical statuses to monitor
- "Crawled - currently not indexed": Google crawled the page but did not index it. On important pages, it often points to content that is too thin or too similar to other pages. Solution: improve the content or merge it with a similar page.
- "Discovered - currently not indexed": Google found the URL but has not crawled it yet. Typically, crawling "was expected to overload the site" and was rescheduled (Google). Check your server capacity and response times.
- "Excluded by noindex tag": Check that you haven't accidentally tagged important pages as noindex (SEO plugins often have settings that noindex tag, category or author archives: check them).
- "Duplicate URL, Google chose a different canonical": Sign of duplicate content. Google has chosen a canonical URL different from the one you intended.
3. Robots.txt and Sitemap Analysis
These two files are your "visit plan" for Googlebot. An error here can block entire sections of your site.
robots.txt: common mistakes
- Blocking the
/wp-content/folder in WordPress: this prevents Google from accessing your images and CSS/JS files, so Google can't render your pages the way visitors see them. - Forgetting to update robots.txt after a migration. Entire directories can remain blocked in production.
sitemap.xml: good practices
- Only include canonical URLs set to
index, follow. Exclude noindex pages, pagination pages, e-commerce filter pages. - Verify that all sitemap URLs return an HTTP 200 status code. A 301 URL in your sitemap is a signal of poor SEO hygiene.
- Submit the sitemap in GSC and check the "Sitemap" report to identify non-indexed URLs.
4. Performance and Core Web Vitals
Google says good Core Web Vitals (LCP, INP, CLS) align with "what our core ranking systems seek to reward" (Google). They rarely outweigh relevance and content quality, but a slow site frustrates visitors. INP replaced FID as a Core Web Vital on March 12, 2024.
Priority technical levers:
- LCP (Largest Contentful Paint): Optimize your hero image (WebP or AVIF format, preload, explicit dimensions). Target under 2.5 seconds.
- INP (Interaction to Next Paint): Reduce JavaScript blocking the main thread. Use
deferandasync, avoid heavy third-party scripts at initial load. - CLS (Cumulative Layout Shift): Always declare the dimensions of your images and iframes. Ads that load after content are the number one culprit.
Recommended tool: PageSpeed Insights for real-world data (CrUX), complemented by WebPageTest for filmstrip diagnostics and load waterfalls.
5. HTTPS, Security and Trust Signals
Google has used HTTPS as a ranking signal since 2014. Beyond the certificate, HTTP security headers protect your visitors. Google does not present them as ranking signals, but they are part of a well-run, trustworthy site.
Essential security headers checklist
Strict-Transport-Security(HSTS): Forces HTTPS on all visitors' browsers.X-Content-Type-Options: nosniff: Prevents browsers from interpreting files differently from their declared MIME type.X-Frame-Options: SAMEORIGIN: Protects against clickjacking.Referrer-Policy: strict-origin-when-cross-origin: Controls information shared during cross-origin navigation.Content-Security-Policy(CSP): The most powerful but also the most complex. Start with "report-only" mode to audit without breaking things.
Test your headers: securityheaders.com gives you an instant score and identifies gaps.
6. Structured Data and Rich Snippets
Schema.org structured data allows Google to understand the meaning of your content, not just its words. They can make your pages eligible for rich results. They are not required for AI Overviews: Google says there is "no special schema.org structured data that you need to add" (Google), but your markup must match the visible content.
Priority schemas by site type:
- Blog / Media:
BlogPosting(orArticle),BreadcrumbList - E-commerce:
Product,Review,Offer - SaaS / Software:
SoftwareApplication,Organization - Local:
LocalBusiness,OpeningHoursSpecification
Note: since 2023, FAQ rich results are only shown for "well-known, authoritative government and health websites", and HowTo rich results are deprecated (Google). Don't count on them for visibility.
Verification: Use the Schema.org validator and Google's rich results test for each page type.
7. Internal Linking and Site Architecture
Information architecture is often overlooked in technical audits. A clear structure, where pillar pages receive links from the pages that go into detail, directs attention to your most important content.
Principles of a healthy architecture:
- Click depth: Keep strategic pages within a few clicks of the homepage (3 is a common rule of thumb). Deeply buried pages are harder for visitors and crawlers to find.
- Descriptive anchors: Avoid "click here." Use anchors that precisely describe the target page. This helps Google understand the topic of the linked page.
- Internal / external link ratio: Each article should contain at least 3-5 internal links to deeper pages on your site.
- Internal PageRank: Check in Screaming Frog which pages receive the most internal links. They are the pages your own structure presents as most important. Make sure these are indeed your most strategically important pages.
The Technical SEO Audit Checklist
Sources and Recommended Tools
- Google Search Console: search.google.com/search-console: the essential starting point for any audit.
- Screaming Frog SEO Spider: screamingfrog.co.uk: the reference crawler for technical audits.
- PageSpeed Insights: pagespeed.web.dev: real CrUX data on your Core Web Vitals.
- Security Headers: securityheaders.com: instant audit of your HTTP security headers.
Once the technical side is clean
A technically perfect page can still give readers wrong information. If your traffic dropped and this audit found nothing, read how to tell if outdated content is the cause, then how to find outdated content.
Your feedback matters