SEO Audit Checklist: 18 points, run it yourself
An SEO audit is not a thirty-page report. It is a list of questions asked in the same order every time, with the answers written down somewhere. You can run it yourself in an hour or two, with three free tools, knowing nothing at the start.
This page gives you the method. The checklist tool does the rest: it keeps your answers, calculates your score, and lets you start over as often as you like.
Why run it yourself
An outsourced audit hands you a document. An audit you run yourself hands you something more useful: you now know where to look.
The second time will take twenty minutes. And the day a salesperson tells you on the phone that your site has "a big technical problem", you will be in a position to ask which one — the best protection there is against that particular pitch.
An audit has an order, and the order matters
This is the part most guides skip. The questions are not equal.
While a single line on the first floor is red, working on speed or copy achieves nothing: nobody will read it. A site whose robots.txt shuts Google out can have the best content in its county and still be unfindable.
Hence the rule: go down the list in order, and only move up a floor when the one below is clean.
What a technical audit covers — and what it does not
What people call a "technical SEO audit" looks at the machinery of the site: Google's access, speed, phone display, security. Eighteen points is enough for a small-business site.
What it says nothing about, and what comes next:
- your keywords — the phrases your customers actually type, which are almost never the ones you use in your trade;
- your copy — what your pages say, and to whom;
- your inbound links — the other sites that mention you, the slowest signal to build and the most decisive.
Put another way: this audit checks that the car starts, not that it is pointed the right way. Both matter, in that order.
What you need
Three tools, free, nothing to install:
- PageSpeed Insights — it answers eight of the eighteen points on its own;
- Google Search Console — what Google really knows about your site (connect it once, if you have not);
- your own phone — for the three points only a human eye can judge.
Add somewhere to write your answers. A notebook works, but you lose the comparison from one run to the next: that is exactly what the checklist tool does, keeping the history in your browser.
How to mark each point
Three possible answers, never more. Shades of grey cost time and change nothing about what needs fixing.
And a fourth possibility that matters: leave the point empty. A point you have not looked at yet is not a point you failed; it should not weigh on your score.
Floor 1 — can Google see your site?
Six points, the most important in the whole audit.
Redirects. Type each of http://yoursite.com, http://www.yoursite.com, https://yoursite.com and https://www.yoursite.com. Three should jump to the fourth. If two different addresses show your site without ever meeting, Google sees two competing sites and splits your credit between them.
Robots.txt. Open yoursite.com/robots.txt. If you read Disallow: / under User-agent: *, your entire site is closed to search engines. It is one line, and it costs years of visibility. What yours should look like.
SSL certificate. The padlock in the address bar. Check its expiry date too: an expired certificate breaks a site overnight, usually on a Sunday.
Indexed pages. Search Google for site:yoursite.com and compare the number of results with the number of pages you have published. This is the most important number in the audit. A 40-page site showing 3 has a problem; a 12-page site showing 11 is fine. If nothing shows up at all, start by checking what is blocking you — nine times out of ten it is a "discourage search engines" setting left ticked after a launch.
Sitemap.xml. Open yoursite.com/sitemap.xml. You should see a list of addresses, raw and ugly — that is normal, this file is not made for people. Check your recent pages are in it.
404 errors. Click every link in your menu and your footer. The ones that lead nowhere lose the visitor and waste Google's visit.
Floor 2 — is the site usable?
Ten points, eight of which come out of the same report. Run PageSpeed Insights on your home page and on an inner page: they are almost never alike.
The thresholds worth remembering, and nothing else:
| What you read | Good | Needs work | Bad |
|---|---|---|---|
| Mobile score | 50 and above | 35 to 50 | below 35 |
| Main content shown (LCP) | under 2.5 s | 2.5 to 4 s | over 4 s |
| Layout stability (CLS) | under 0.1 | 0.1 to 0.25 | over 0.25 |
| Server response | under 0.8 s | 0.8 to 1.8 s | over 1.8 s |
Three notes that save pointless work:
- mobile comes before desktop. Google ranks sites on their mobile version, including for searches made at a desk. A 40-point gap between the two scores is normal;
- if the server response is over 1.8 seconds, hosting is the first job. Changing theme or adding a cache plugin will not fix a slow server — it is the floor under every other measurement;
- images are the biggest cause of slowness on a small-business site, by a wide margin. A photo straight off a phone weighs 4 to 8 MB; the same photo prepared for the web weighs 150 KB and looks identical. PageSpeed lists which ones to shrink and how much you gain.
The last two points on this floor are not measured, they are looked at: open your site on your own phone and do what a customer would do — find the phone number, the address, the hours, send a message. Then on a wide screen, to check the page is not a narrow column in the middle of empty space.
Floor 3 — security
Two points, often missing from an SEO audit even though they decide trust.
HTTP headers. Security instructions your server sends before the page. A free test grades you A to F and lists what is missing; the two to get first are Strict-Transport-Security and Content-Security-Policy. If someone else runs your hosting, send them the report — it says exactly what to add.
Code injection (XSS). You do not have to run the attack. Three checks are enough: your site and its plugins are up to date, your forms go through a maintained plugin rather than a homemade script, and no security warning shows up in Search Console. A site that has not been updated in two years fails this one without discussion.
A filled-in example
Here is the audit of a real bakery site, trimmed to the lines that moved. Score: 58%, red verdict — because of a single line.
| Point | Result | What was found |
|---|---|---|
| Redirects | Pass | www jumps to the short address |
| Robots.txt | Pass | WordPress virtual file, nothing blocked |
| SSL certificate | Pass | valid for another 8 months |
| Indexed pages | Fail | 2 pages known to Google out of 14 published |
| Sitemap.xml | Needs work | present, but lists 3 deleted addresses |
| 404 errors | Pass | no broken links in the menu |
| Server response | Needs work | 1.4 s — busy shared hosting |
| Mobile score | Fail | 31 |
| Main content shown (LCP) | Fail | 5.8 s — banner photo at 4.2 MB |
| Layout stability (CLS) | Pass | 0.02 |
| Images | Fail | 11 photos over 2 MB, no alt text |
| HTTP headers | Needs work | grade D, no HSTS |
What this audit says, and what could not be read before running it: the problem is not speed, it is that Google only knows 2 pages out of 14. Until that is fixed, shrinking photos will not win a single visitor — the bakery would be speeding up pages nobody can find.
That is also why the checklist marks four lines as critical: as soon as one of them fails, the verdict turns red whatever the score. An audit at 91% with a broken SSL certificate is not a healthy site.
What to fix, in order
Once the checklist is filled in, the work sorts itself:
- anything stopping Google from reaching the site — a setting to untick, a line to remove, a certificate to renew. Effect within days, usually free;
- oversized images — the biggest speed gain for the least effort;
- server response — if it is over 1.8 s, changing host beats every cache plugin combined;
- comfort on a phone — buttons too small, text running off the edge;
- security headers — a request to your host, no risk involved.
None of this improves your position on competitive searches: it makes you eligible. Ranking, after that, is decided by copy and links.
How often to run it
Twice a year for a site that does not change much. And always after a redesign, a host migration, adding a shop, or installing a batch of plugins: those are precisely the moments a site loses its visibility all at once, with nobody noticing for months.
That is where history matters. Two audits of the same site, six months apart, tell you what no single score can: whether you are moving forward.
Three mistakes that waste time
- Auditing the home page only. It is usually the best-kept page on the site. Always test an inner page — a product page, a post, the contact page.
- Chasing 100/100. Going from 31 to 60 changes your visitors' experience. Going from 85 to 95 changes nothing for anyone, and costs ten times more.
- Believing a technical audit will lift the site. It removes the brakes. That is necessary, and it is not sufficient: a healthy site nobody talks about is still a site without visitors.
Run yours now
The eighteen points, their instructions and the thresholds are gathered in the SEO audit checklist: you answer, it scores, and your answers stay in your browser. Free, no account, as many audits as you like.
Prefer to let your assistant do the legwork? The same checklist exists as a skill for Claude and ChatGPT: it collects what can be measured, asks you for the rest, and hands back a report to open.