Technical SEO Audit Checklist 2026: 200+ Items to Fix

Crawlability

Crawlability is the foundation of technical SEO. If Googlebot and AI crawlers like GPTBot and PerplexityBot cannot reach your content, nothing else matters. Understanding how search engines work in 2026 starts with confirming crawl paths. Start every audit here.

1. robots.txt present and valid: File exists at root, returns 200, contains no syntax errors that block entire user-agents unintentionally.
2. No accidental Disallow: /: Confirm the production robots.txt does not still carry a staging-era global disallow.
3. AI crawler policy declared: Explicit rules for GPTBot, ClaudeBot, PerplexityBot, CCBot, Google-Extended — allow or block by strategy.
4. XML sitemap reachable: Linked from robots.txt, returns 200, under 50MB uncompressed and under 50,000 URLs per file.
5. Sitemap index used at scale: For large sites, an index file referencing child sitemaps by section (posts, products, categories).
6. Sitemap freshness: lastmod reflects actual content changes; not every URL rewritten on every deploy.
7. Only canonical URLs in sitemap: No redirected, noindexed, 404, or parameterized duplicate URLs.
8. Internal linking reaches all target URLs: Run a crawl and compare sitemap URLs against internally linked URLs — orphaned pages flagged.
9. Crawl depth under 4 clicks: Critical landing pages reachable within 3-4 clicks from the homepage.
10. No crawl traps: Faceted navigation, calendar widgets, and session IDs do not generate infinite URL variations.
11. Server returns stable response codes: No intermittent 5xx under Googlebot load; check GSC Crawl Stats for anomalies.
12. Crawl budget monitored: Pages crawled per day tracked in GSC; spikes investigated for duplicate or parameter explosion.
13. HTTPS with valid certificate: No mixed-content warnings, HSTS header present, certificate auto-renewal configured.
14. www vs non-www resolved: One canonical host, the other 301-redirects permanently.
15. Trailing-slash consistency: Either always or never — redirects handle the inverse.
16. Redirect chains under 2 hops: Chains of 3+ waste crawl budget and can lose PageRank signal.
17. 404 rate trending flat or down: Sudden 404 spikes indicate broken internal links or removed pages without redirects.
18. Googlebot verified via reverse DNS: Confirm high-volume Googlebot hits actually originate from Google's IP ranges, not spoofed traffic.

Indexation

Crawled does not equal indexed. Indexation hygiene determines what actually appears in search results and what Google spends its crawl budget reconsidering. This is where most mid-size sites leak the majority of their organic potential in 2026.

1. Indexed URLs count reconciles with sitemap: GSC indexed count should roughly match canonical URL count — a gap of 30%+ demands investigation.
2. No noindex on revenue pages:Audit every <meta name="robots"> and X-Robots-Tag header on key templates.
3. Canonical tags self-referential by default: Every page points to itself as canonical unless intentionally consolidated.
4. No conflicting canonical signals: rel=canonical, hreflang, sitemap, and internal links all agree on the preferred URL.
5. Thin content deindexed or improved: Tag pages, author archives, and empty category pages either upgraded or noindexed.
6. Duplicate content consolidated: Printer-friendly pages, AMP variants, and parameter duplicates all canonicalized to primary URLs.
7. Parameter handling deliberate: Faceted and filter URLs either indexed strategically or handled with noindex and rel=canonical.
8. Soft 404 monitoring: GSC flags soft 404s; thin pages returning 200 should return 404 or 410 when genuinely gone.
9. 410 for permanently removed: Gone content returns 410, not 404, so Google deindexes faster.
10. Pagination handled cleanly: rel=next/prev no longer used; each paginated page is self-canonical and indexable if useful.
11. Staging and dev environments password-protected: No accidental indexing of preview domains; confirm via site: search.
12. GSC "Crawled - currently not indexed" reviewed: Large counts here signal low-quality or duplicate content Google refuses to index.
13. GSC "Discovered - currently not indexed" monitored: Indicates Google sees the URL but deprioritizes crawl — usually a quality or crawl-budget issue.
14. Manual actions checked monthly:Security & Manual Actions tab in GSC — zero penalties confirmed.

Rendering

Rendering is where JavaScript-heavy sites win or lose in 2026. Googlebot renders, but with a second-wave delay; AI crawlers like ChatGPT Search and Perplexity vary widely in JS execution. Server-rendered or hybrid-rendered critical content wins every time.

1. Initial HTML contains primary content: View-source and confirm headings, body copy, and links are present before JS executes.
2. Mobile-friendly rendering verified in GSC URL Inspection: Live test shows the DOM Google actually sees after rendering.
3. Framework SSR enabled for SEO templates: Next.js, Nuxt, Remix, Astro configured for server or static rendering on indexable routes.
4. Critical navigation in static HTML: Primary nav and footer links crawlable without JS execution.
5. No content hidden behind onClick: Tabs, accordions, and "read more" toggles must render content in the DOM, not inject on click.
6. Lazy-loaded images use native loading="lazy": Above-the-fold images eager-loaded, below lazy-loaded via native attribute.
7. Images include alt text: Descriptive alt attributes on all content images; decorative images get empty alt="".
8. Infinite scroll has paginated fallback: Each "page" reachable via crawlable URL; Googlebot does not scroll.
9. Client-side routing emits proper status codes: SPAs route to 404 pages that actually return a 404 HTTP status, not 200.
10. Hydration does not strip SEO content: Compare server HTML vs post-hydration DOM — no critical content removed by client code.
11. Third-party scripts deferred: Analytics, chat widgets, and tag managers load async or defer to protect main-thread rendering.
12. JavaScript errors do not block rendering: Console errors caught in synthetic monitoring; silent failures on low-end mobile flagged.
13. Web Components and Shadow DOM tested: Content inside shadow roots may not be indexed; render to light DOM for SEO-critical fragments.
14. AI crawler rendering tested: Fetch URLs as GPTBot, PerplexityBot, OAI-SearchBot user-agents and confirm content parity.
15. CSP headers do not block critical resources: Content-Security-Policy allows Google's rendering services to load fonts, scripts, and CSS.

Core Web Vitals

Core Web Vitals are a confirmed ranking signal. INP replaced FID in 2024 and in 2026 sits alongside LCP and CLS as the performance trifecta. See our page speed revenue impact analysis for the commercial case behind these thresholds.

1. LCP under 2.5s on 75th percentile mobile: Largest Contentful Paint measured via CrUX and field data, not just lab tests.
2. INP under 200ms on 75th percentile: Interaction to Next Paint across all user interactions, not just first input.
3. CLS under 0.1 on 75th percentile: Cumulative Layout Shift measured through full session lifetime post-March 2024 update.
4. TTFB under 800ms: Time to First Byte — server response time foundation for every other metric.
5. LCP element identified and optimized: Usually a hero image or h1 — preloaded, correctly sized, prioritized.
6. Hero image uses fetchpriority="high": Browser hint to load LCP candidate ahead of other resources.
7. Modern image formats: AVIF or WebP served via picture element or next/image with JPG/PNG fallback.
8. Responsive images with correct sizes attribute: srcset + sizes prevents oversized downloads on mobile viewports.
9. Fonts preloaded and font-display: swap: No FOIT; critical fonts preloaded to avoid late text rendering.
10. Main-thread work minimized: Long tasks over 50ms profiled and split; heavy JS offloaded to Web Workers where possible.
11. JavaScript code-split by route: Ship only the JS needed for the current page; defer the rest.
12. Unused CSS purged: Tailwind JIT, PurgeCSS, or native tree-shaking eliminates unshipped styles.
13. Ads and embeds reserved space: width/height attributes on iframes and images prevent CLS shifts.
14. CrUX data reviewed monthly: PageSpeed Insights field data and GSC Core Web Vitals report cross-checked.
15. Real-user monitoring (RUM) deployed: web-vitals.js or commercial RUM to catch regressions synthetic tests miss.

Structured Data

Schema markup has evolved from rich-result candy to core AI-citation infrastructure. In 2026, structured data signals help AI Overviews, ChatGPT Search, and Perplexity decide what to quote. Valid, specific schema wins.

1. JSON-LD preferred over Microdata: Google's recommended format; cleaner maintenance and separation from presentation HTML.
2. Validated in Schema.org validator and Google Rich Results Test: Both tools run clean — zero errors, warnings reviewed.
3. Article or BlogPosting on editorial content: With headline, datePublished, dateModified, author, and image properties.
4. Product schema on commerce pages: Offer, price, priceCurrency, availability, review aggregates where permitted.
5. Organization schema on homepage: Name, logo, URL, sameAs social profiles, contact point.
6. BreadcrumbList on hierarchical pages: Improves SERP display and helps Google understand site structure.
7. WebSite with SearchAction: Enables sitelinks search box in SERP for brand queries.
8. Event, Recipe, VideoObject where applicable: Rich-result eligible types matched to actual content.
9. Author entity with sameAs: Link author schema to authoritative profiles (LinkedIn, academic, Wikipedia) for E-E-A-T.
10. Schema matches visible content: No markup for content not rendered to users — policy violation.
11. Do not use forbidden schemas: FAQPage, HowTo, Review, QAPage no longer eligible for most sites post-2024 deprecation.
12. Image URLs are absolute and indexable: Schema image properties use full URLs, not relative paths.
13. Dates in ISO 8601 format: datePublished and dateModified use full ISO with timezone offset.

Mobile SEO

Google indexes the mobile version. In 2026 the gap between mobile and desktop experience remains the single most common cause of unexplained ranking drops after migrations or redesigns.

1. Viewport meta tag present:<meta name="viewport" content="width=device-width, initial-scale=1"> on every page.
2. Responsive design confirmed in GSC Mobile Usability: Historical report in some regions; test via URL Inspection screenshot comparison.
3. Tap targets at least 48x48px with 8px spacing: Fingers need landing area; cramped nav is a recurring mobile fail.
4. Font size minimum 16px body: Prevents iOS auto-zoom on input focus, improves readability.
5. No horizontal scrolling: Content fits viewport at all common mobile breakpoints (360, 390, 412px wide).
6. Mobile Core Web Vitals tracked separately: Mobile LCP and INP typically 30-50% worse than desktop — optimize for mobile first.
7. Content parity with desktop: Mobile version contains all primary content; no hidden tabs with critical text.
8. Mobile-friendly forms: Correct input types (email, tel, number) trigger appropriate keyboards; autocomplete attributes set.
9. No intrusive interstitials on landing: Large above-the-fold pop-ups are a confirmed ranking demotion signal.
10. Mobile navigation crawlable: Hamburger menu links present in HTML, not only rendered after click.
11. Touch gestures have accessible fallbacks: Swipe-only carousels need buttons; hover-only interactions need tap equivalents.
12. Mobile redirects not broken: No separate m. subdomain still in use; if it is, each redirect is 1:1 to equivalent desktop URL.

International SEO

International SEO is unforgiving. One wrong hreflang pair can collapse an entire market. For any site serving more than one language or region in 2026, these checks are non-negotiable.

1. hreflang annotations present: Every alternate language/region declared via link rel=alternate hreflang in head or via sitemap.
2. Bidirectional hreflang confirmed: Every page references its alternates AND those alternates reference back.
3. Self-referential hreflang: Each page includes hreflang pointing to itself with its own locale.
4. x-default defined: Fallback locale for visitors whose locale matches none of the alternates.
5. Language codes in ISO 639-1: Two-letter codes (en, de, fr) — not three-letter variants.
6. Region codes in ISO 3166-1 Alpha 2: Uppercase two-letter (US, GB, DE) paired with language via hyphen.
7. URL structure consistent: Either subfolders (/en/, /de/) or subdomains (en., de.) — one strategy, not mixed.
8. Geotargeting set in GSC for ccTLDs only when intentional: gTLDs benefit from country targeting in GSC International Targeting.
9. Currency and locale-specific content on right pages: en-GB shows GBP; en-US shows USD; not mixed within a locale.
10. No auto-redirect by IP alone: Give users the option to choose locale; IP redirects frustrate both users and crawlers.
11. Translated metadata: Title and description translated per locale, not English across all variants.
12. Duplicate content across locales handled: Similar content in same language (en-US vs en-GB) canonicalized or distinguished by locale content.

Site Architecture

Architecture decisions compound. Poor URL hierarchy or internal linking takes years to untangle. Strong architecture makes crawl, index, and topical authority propagate effortlessly — and it's one of the cheapest SEO optimization levers when caught early.

1. URLs short, readable, hyphen-separated: /services/seo-optimization beats /s?id=847&type=service.
2. URL hierarchy reflects topic groupings: /blog/topic/post-slug or /services/category/service — signals topical clustering.
3. No deep nesting beyond 3-4 segments: /a/b/c/post OK, /a/b/c/d/e/post is crawl-unfriendly.
4. Hub-and-spoke internal linking: Pillar pages link to cluster posts; cluster posts link back and to siblings.
5. Internal anchor text descriptive: "technical SEO audit" not "click here" — signals relevance to both users and crawlers.
6. Primary nav stable across site: Same taxonomy everywhere; inconsistency dilutes topical signals.
7. Footer links used strategically: Only high-priority evergreen links; not a dumping ground for 200 low-value URLs.
8. Breadcrumbs rendered and marked up: Visible breadcrumbs with BreadcrumbList schema on deep pages.
9. 404 page returns 404: Custom design is fine; HTTP status code must actually be 404.
10. No orphan pages: Every indexable URL receives at least one internal link from another indexable page.
11. Link equity not diluted by excessive links: Pages with 500+ internal links dilute PageRank per link; consolidate where possible.
12. Related-content modules pull relevance, not recency alone: Algorithmic relatedness beats "latest posts" for SEO value.
13. Topic clusters mapped: Spreadsheet of pillar → clusters → internal links audited quarterly for gaps.

Log File Analysis

Log file analysis separates senior audits from junior ones. Sitemaps tell Google what exists; server logs tell you what Googlebot actually does. For enterprise sites the ROI on log analysis is higher than any other checklist section.

1. Access logs retained 90+ days: CDN and origin logs captured and stored with IP, user-agent, URL, status code, timestamp.
2. Log analyzer configured: Screaming Frog Log File Analyser, Botify, OnCrawl, or a custom pipeline (BigQuery, ClickHouse).
3. Googlebot requests verified: Reverse DNS lookup confirms actual Googlebot, not spoofed user-agent.
4. Crawl distribution by template: Which templates (product, category, blog, filter) get what share of Googlebot hits?
5. Crawl frequency on priority pages: High-revenue URLs crawled weekly minimum; if not, investigate signals.
6. 404 and 5xx in log output: Trend weekly; sudden spikes indicate infrastructure or link regressions.
7. Redirect crawling monitored: Googlebot repeatedly hitting a chain burns budget — collapse chains.
8. Parameter URL waste: If Googlebot spends 30%+ of crawls on parameter variants, tighten parameter handling.
9. Uncrawled canonical URLs surfaced: Canonical URLs in sitemap that Googlebot has not visited in 30+ days — often orphaned or low-internal-link pages.
10. AI crawler share tracked: GPTBot, PerplexityBot, ClaudeBot as a % of total bot traffic — growing in 2026.
11. Bot vs human traffic separation: Audit bandwidth and compute costs — bots can represent 30-60% of traffic on unoptimized sites.
12. Log-derived internal link gaps: Pages Googlebot reaches only via sitemap, not internal links, flagged for linking work.

Tools & Automation

Tools do not replace judgment, but they scale it. A tight toolchain cuts audit time in half and keeps regressions from slipping between quarterly reviews. Cross-reference findings against the Google algorithm update timeline and our 300-term SEO glossary when interpreting anomalies.

1. Google Search Console connected and verified: Property-level verification, not URL-prefix where domain property is available.
2. Bing Webmaster Tools connected: Bing powers ChatGPT Search — its index quality affects AI search visibility in 2026.
3. Screaming Frog or Sitebulb crawl scheduled: Monthly crawl minimum; comparison reports flag new issues automatically.
4. Ahrefs or Semrush tracking keyword set: Core 200-500 keywords tracked weekly with historical rank data.
5. PageSpeed Insights API integrated: Automated Core Web Vitals check against top landing pages weekly.
6. CrUX dataset queried via BigQuery: For sites with enough traffic, CrUX provides ground-truth performance data.
7. Looker Studio or Metabase dashboards: GSC + GA4 + rank tracking in a single dashboard for weekly review.
8. Uptime and status-code monitoring: Synthetic checks on top URLs every 5 minutes; alerts on non-2xx responses.
9. CI/CD SEO checks: Pre-deploy lint for broken internal links, missing meta tags, oversized images, invalid schema.
10. Change log of SEO-impacting deploys: Any release touching templates, routing, or content tagged for audit review.
11. Alerting on GSC anomalies: Sudden impression or click drops trigger automated alerts via API polling.
12. Backlink monitoring: Ahrefs or Semrush alerts on new referring domains, lost links, and spam link attacks.
13. Log analyzer output piped to BI: Weekly summaries of bot crawl patterns rather than ad-hoc investigation only during audits.
14. AI-search citation tracking: Monitor which of your URLs are cited by ChatGPT Search, Perplexity, Google AI Mode — increasingly a tracked KPI.

Conclusion

A technical SEO audit in 2026 balances foundational hygiene (crawl, index, render) with emerging concerns (INP, AI search citation, structured data depth). Use this 200-item checklist as a quarterly cadence, prioritize ruthlessly by traffic impact, and you will catch regressions before they cost rankings.

Frequently Asked Questions