How to do an SEO audit (2026): a step-by-step guide

Traffic has slipped for three months, the developer says nothing changed, and the content team has published twenty articles that nobody found. An SEO audit is how you find out which of those facts are connected. This guide walks through a complete SEO audit in six steps, names the free tool for each step, shows how to prioritise the findings, and ends with a report template and a worked sample you can copy.

What is an SEO audit, and what is it not?

An SEO audit is a structured review of everything that stops a site from being crawled, indexed, understood and chosen by search engines and AI answer engines. Its output is a prioritised list of fixes, each with an owner. It is not a ranking report, a keyword strategy, or a dump of every warning a crawler can print.

That distinction is where most audits fail. A crawler will list 4,000 images without alt text on a site whose real problem is that category pages return a 302 to a login wall. The audit’s job is judgement: which findings explain the missing traffic, and which are noise.

A useful audit is scoped (one page, one template, one section or the whole site, decided up front), evidenced (every finding points at a URL, header or report row someone else can reproduce), prioritised (ranked by impact against effort, not by the order a tool printed them) and owned (developer, editorial and marketing fixes go to different people). Our view: if the deliverable does not change what somebody does next week, it was a report, not an audit.

What data do you need before you start?

You need four sources: a search engine’s own view of your site, a crawler’s view, a page-level scorer, and a baseline. All are free.

Source	What it gives you	Limits to know
Google Search Console	Page indexing reasons, performance by query and page, field Core Web Vitals, links, the generative AI performance report	Tables cap at 1,000 rows
Bing Webmaster Tools	Bing’s index status (which also feeds Copilot), backlinks, a comparison against two other sites	Link data is a representative sample
A desktop crawler	Every URL, status, title, canonical, hreflang and internal link, exportable	Screaming Frog’s free tier stops at 500 URLs per crawl (vendor claim)
A page scorer	75+ checks on one URL across technical, on-page, content, performance, security and AI visibility, each with a fix and an owner	One page at a time; the free audit on this site takes about a minute
Server or CDN logs	Which crawlers fetch which URLs, how often, with what status	Needs hosting or CDN access

Before touching anything, export a baseline: 16 months of Search Console performance by page and query, the Page indexing totals, and a crawl export, so that in three months you can show the audit worked.

Step 1: Check indexing and crawlability

Nothing else matters for a page that is not in the index, so start here: can crawlers reach the page, are they allowed to, and did Google keep it?

Open the Page indexing report and read the “not indexed” reasons. Google documents each one; these drive most audits.

Reason in Search Console	What it usually means	What to check
Discovered, currently not indexed	Google knows the URL but has not crawled it	Internal links to the page, sitemap accuracy, whether the page is worth indexing
Crawled, currently not indexed	Google fetched the page and chose not to keep it	Thin or duplicate content, templates with no unique value
URL blocked by robots.txt	A Disallow rule matches	Whether it is intentional; Google says it may still index a blocked URL without a snippet
Excluded by noindex tag	A robots meta tag or X-Robots-Tag header says noindex	A staging setting that leaked into production
Duplicate, Google chose different canonical than user	Your canonical says one thing, Google disagrees	Parameter variants; http and https or www and non-www both serving content

Then test the two files that govern crawling. For robots.txt, Google says a 4xx response (except 429) is treated as if no file existed, while a 5xx stops crawling for the first 12 hours and then relies on a cached copy for up to 30 days (Google’s robots.txt documentation), so a file that returns 500 during a deploy can pause crawling for a day. Check that it returns 200 as plain text, allows CSS and JavaScript, and references your sitemap; our audit checks this, and the robots.txt tester tests URLs against Googlebot and the AI crawlers. For the XML sitemap, Google says a file is limited to 50,000 URLs or 50 MB uncompressed, that it uses lastmod when consistently accurate, and that it ignores priority and changefreq. List only canonical, indexable, 200-status URLs; the sitemap checker validates the XML, counts URLs and flags entries that redirect or error.

Crawl budget is a step-1 topic only at scale: Google’s guidance is aimed at sites with over a million pages changing weekly or over 10,000 changing daily. The fixes that help crawling are worth doing on any site, but not because of budget.

Step 1 output: URLs that should be indexed and are not, with the reason for each; and URLs that are indexed and should not be.

Step 2: Run the technical checks

The technical layer is where audits find the fixes with the largest effect per developer hour. Work through five areas, then hand the long tail to the technical SEO checklist.

Redirects and status codes

Every important URL should return 200 directly. For URLs that moved, Google says a 301 or 308 is a canonicalisation signal that makes the target the indexed URL, while 302, 303 and 307 are treated as temporary and tend to keep the source URL in results; it also says Googlebot “generally follows 10 redirect hops”, so a short chain is not fatal, but each hop adds latency and dilutes link signals. Trace the home page, top landing pages, the http and www variants and legacy URLs that still earn links. The redirect checker prints every hop; our audit flags chains of two or more hops and temporary redirects on permanent moves, and the post on redirect chains covers the usual causes.

Canonical tags

Every indexable page should carry one self-referencing canonical with an absolute URL. Google says its canonicalisation signals stack: redirects strongest, then rel="canonical", then sitemap inclusion, internal links and hreflang clusters. Audit for canonicals that point at a redirecting URL, canonicals that differ between HTML and HTTP header, and filtered pages canonicalised to page 1 despite unique content. The canonical checker tells you whether the tag points where it should; the canonical tag entry has the rules.

hreflang

If the site has language or country versions, Google says each version must list itself and every alternate, that unreciprocated links are ignored, and that codes must be ISO 639-1 languages with optional ISO 3166-1 Alpha 2 regions, so “uk” for the United Kingdom is invalid. Audit one template per market. The hreflang checker validates return links and x-default.

Core Web Vitals

Google says Core Web Vitals are used by its ranking systems and that the targets apply at the 75th percentile of real page loads: LCP of 2.5 seconds or less, INP of 200 milliseconds or less and CLS of 0.1 or less (web.dev on Core Web Vitals). Use the Search Console Core Web Vitals report for field data grouped by URL pattern, then Lighthouse for lab diagnostics on the worst group; lab scores do not rank you, field data does. The Core Web Vitals checker shows both; the Core Web Vitals entry defines each metric.

JavaScript rendering

Google says it crawls, then queues a page for rendering in a headless evergreen Chromium “once Google’s resources allow”, and that server-side rendering or pre-rendering is faster for users and crawlers “and not all bots can run JavaScript” (Google’s JavaScript SEO basics). Compare the raw HTML with the rendered page: if the main text, links or canonical only exist after JavaScript runs, Google may index it late and most AI crawlers never see it. Our audit’s “Text in the HTML” check counts the words in the raw response and warns below 200; the JavaScript rendering entry explains the pipeline.

Step 2 output: per template: status, redirect chain, canonical, hreflang, field Core Web Vitals, and whether the content is in the raw HTML.

Step 3: Review on-page elements

On-page problems are cheap to fix and easy to find, which is why bad audits pad themselves with them. Audit by template, sample the long tail, and separate “missing” from “not optimal”.

Element	Google’s position	Our audit flags when
Title	No length limit, but title links are truncated to fit the device; Google may rewrite half-empty, boilerplate, inaccurate or obsolete titles	Missing; outside 30 to 60 characters
Meta description	Snippets come primarily from page content; the description is used when it fits better; identical descriptions are not helpful	Missing; over 160 characters
H1	Google can handle several	None, or more than one
Heading order	No ranking rule	Skipped levels, such as H2 to H4
Image alt text	Needed for image search and accessibility	Missing on more than 20 percent of images
Internal links and anchors	Anchor text should be descriptive, not “click here”	Fewer than three internal links; more than three generic anchors
Open Graph tags	No ranking effect; controls how shares render	Missing og:title, og:description or og:image

Run the meta tag checker on each template and your top 20 pages by clicks. Use the keyword density checker only to catch stuffing; there is no target ratio, and Google’s AI optimisation guide says its systems need no special phrasing to understand a page. The title tag entry lists the rewrite triggers.

Step 3 output: missing or duplicated elements per template, and per page for the pages that earn the most clicks.

Step 4: Assess content quality and cannibalisation

This is the step tools cannot do for you. Read the pages. For each page that should rank, ask whether it answers the query it ranks for (compare Search Console queries with the opening section), whether it is unique on the site and against competitors, whether it is current and attributed (a visible updated date and a byline cost nothing; our audit checks both), and whether it shows experience. Google says its systems favour unique, non-commodity content, that there is no ideal page length, and that there is no need to “chunk” content for AI systems (Google’s AI optimisation guide). Our audit warns below 300 words of extractable text; treat that as a prompt, not a rule, because a 120-word page that fully answers “what are your opening hours” is not thin.

Keyword cannibalisation is the case where two of your pages compete for the same query. Find it in Search Console: filter the Performance report to a query, open the Pages tab, and look for two URLs that alternate over time as Google switches its preference. Fix it by consolidating the weaker page into the stronger one with a 301, or by rewriting one for a clearly different intent. A crawl export sorted by title finds the obvious duplicates; the website audit crawls 10 pages free and lists duplicate titles and descriptions.

Step 4 output: pages to improve, merge, redirect or remove, each with the query evidence that justifies the decision.

Step 5: Analyse links

Audit links in two directions. Internal links decide which pages crawlers reach and which look important: from the crawl export, list orphan pages, pages more than three clicks from the home page, and important pages linked only from the footer. Google says every page you care about should be linked from at least one other page, with descriptive anchor text.

External links are a reputation signal you only partly control. Start with the Search Console Links report, which Google describes as a sample, then add Bing Webmaster Tools for a second index and its two-site comparison. Interpret with care: referring domains matter more than raw backlink counts; anchor text dominated by exact-match commercial phrases is a manual-action risk, not a strength; and Domain Authority, Domain Rating and Authority Score are third-party estimates that Google’s John Mueller has said repeatedly Google does not use. On cleanup, Google says most sites do not need the disavow tool, that it can harm your site if used incorrectly, and that it is for sites with a manual action or a considerable number of spammy links likely to cause one (Google’s disavow documentation).

The backlink checker shows referring domains, authority and top links for any domain, and the backlink analysis guide covers competitor link gaps and the disavow decision in depth.

Step 5 output: an internal linking fix list, a short list of link opportunities, and a documented decision on disavow (usually: no).

Step 6: Check AI-search readiness

AI Overviews, AI Mode, ChatGPT search, Claude, Perplexity and Copilot all retrieve pages before they answer, and each has rules you can audit.

Crawler access

Blocking the wrong user agent removes you from an answer engine silently. From the operators’ own documentation: OpenAI says sites that opt out of OAI-SearchBot “will not be shown in ChatGPT search answers”, while disallowing GPTBot only signals that content should not be used for training, and the two settings are independent. Anthropic says Claude-SearchBot indexes for search, Claude-User fetches on request and ClaudeBot collects training data, and all three honour robots.txt. Perplexity says PerplexityBot is its search crawler and that Perplexity-User “generally ignores robots.txt rules” because a person requested the fetch. Google says AI Overviews and AI Mode use normal Googlebot, that a page must be indexed and snippet-eligible to appear in them, and that Google-Extended is a control token, not a crawler, which governs Gemini training and grounding and “does not impact a site’s inclusion in Google Search”. Copilot answers from Bing’s index, so bingbot is the control.

Test your robots.txt against each agent with the robots.txt tester, then check that your CDN or firewall is not blocking the same bots by user agent; our audit sends requests as several AI crawlers and reports which are refused while a normal request succeeds (a heuristic, since real crawlers are verified by IP). The AI crawlers guide has the full table and copy-paste policies.

Snippet controls and extractability

Google says nosnippet and max-snippet:0 prevent content being used as a direct input for AI Overviews and AI Mode, and noindex keeps a page out of them entirely. Audit for these on pages you want cited; they are commonly left over from a legal review. Then confirm the content is in the raw HTML, because most AI crawlers do not execute JavaScript.

Measurement and structure

Google says to track AI features with the generative AI performance report in Search Console, and that no special files, markup or Markdown are needed because Google Search does not use them. That includes llms.txt: Research shows (Ahrefs, 137,210 domains, May 2026) that 97 percent of published llms.txt files received no requests at all; read the llms.txt guide before expecting anything from one. What does seem to help is the structure that helps featured snippets: question-led headings with a 40 to 60 word direct answer, specific numbers with linked sources, named authors and visible dates, and Organization or Person markup with sameAs links. Our audit’s AI visibility category scores these items; the AI visibility checker and the AI visibility guide go deeper.

Step 6 output: a robots.txt and firewall decision per crawler, pages with snippet controls to review, and a shortlist of pages to restructure for direct answers.

Audit variants: local, ecommerce, WordPress and Shopify

The six steps hold for every site, but the findings cluster by type. Local businesses depend on the Google Business Profile, NAP consistency and LocalBusiness markup, so a profile review replaces most of step 3 (local SEO audit checklist). Ecommerce sites generate most problems in steps 1 and 2: faceted navigation, out-of-stock pages returning 200, pagination canonicalised to page 1 (ecommerce SEO audit checklist). WordPress sites usually fail on plugin weight, indexed tag and date archives, and a noindex left on by a plugin (WordPress SEO audit). Shopify stores have fixed URL structures, collection-path product duplicates to verify, and app scripts that hurt INP (Shopify SEO audit).

How do you prioritise what to fix?

Rank every finding by expected impact against effort, and give each one an owner. Impact is high when a fix affects indexing, crawler access or a template used by many pages; effort is low when one person can do it in a day without a release. Do high-impact, low-effort items first, schedule high-impact, high-effort items, batch the rest, and drop what will not move anything.

	Low effort (S)	Medium effort (M)	High effort (L)
High impact	Remove a leaked noindex; unblock OAI-SearchBot; fix a canonical pointing at a redirect (developer, this week)	Fix LCP on the main template; consolidate cannibalising pages (developer plus content, this month)	Move to server-side rendering; replatform faceted navigation (developer, this quarter)
Medium impact	Add missing titles on top pages; add sameAs to Organization markup (content, developer)	Rewrite thin category copy; fix hreflang return links (content, developer)	Rebuild internal linking for a large section (content plus developer)
Low impact	Add a favicon and lang; set X-Content-Type-Options (developer, batch)	Add Open Graph images across templates (developer)	Alt text on an archive of 40,000 images (content, as capacity allows)

Two rules keep the grid honest: a finding on one page is medium impact at best unless that page earns a large share of traffic, and “we might as well” never moves low-impact work ahead of a high-impact item that is merely inconvenient.

What should an SEO audit report contain?

A good SEO audit report leads with a one-page summary a non-specialist can act on, then gives the evidence for each finding, then a schedule. It should be shorter than the data behind it, name an owner for every fix, and let a reader reproduce any finding from the URLs and reports cited.

Use this template; sections 1 to 3 fit on one page.

1. Summary. Three to five sentences: what is wrong, what it costs, what to do first.
2. Scores and baseline. Tool scores, Search Console totals and the date, so the next audit has a comparison.
3. Top five issues. A table with evidence, impact, effort, owner and the first action.
4. Findings by step. Each step’s findings with evidence and fix instructions.
5. 30, 60 and 90 day plan. Who does what, in what order, and how you will measure it.
6. Appendix. Crawl exports, log samples, the full issue list.

A worked mini sample

The summary and top-issues table for a fictional 2,400-product store, written the way a report should read.

Summary. Organic sessions fell 31 percent year on year while impressions rose, which points to a click-through or SERP-feature problem rather than lost rankings. The audit found three causes: 1,900 filtered URLs are indexed and competing with category pages; the product template renders its description client-side, so AI crawlers and Google’s first pass see no text; and the firewall returns 403 to OAI-SearchBot and PerplexityBot by user agent. Fixing those three items is one developer sprint.

#	Issue	Evidence	Impact	Effort	Owner	First action
1	Filtered URLs indexed and cannibalising categories	Page indexing: 1,900 indexed ?color= and ?size= URLs not in the sitemap; Performance report shows categories swapping with filtered URLs for 14 head terms	High	S	Developer	Add noindex to filtered URLs this week; add a robots.txt rule once de-indexed
2	Product descriptions not in raw HTML	Raw response: 38 words; rendered: 620 words; audit check “Text in the HTML” returns an error	High	L	Developer	Server-render the description block
3	AI search crawlers blocked by firewall	Fetch as OAI-SearchBot and PerplexityBot returns 403; a normal request returns 200	High	S	Developer	Add user-agent exceptions and verify against the operators’ published IP ranges
4	LCP 3.9 s at p75 on the product template	Search Console Core Web Vitals report, mobile, 2,100 URLs “needs improvement”	Medium	M	Developer	Preload the hero image and serve it in AVIF at the displayed size
5	212 products with duplicate titles	Crawl export, title column	Medium	S	Content	Add the variant attribute to the title template

Every row names a report, a count and a next action; that is what separates an audit from a list of warnings.

What to do next

Run the free audit on your home page and your most important landing page; it covers the step 1, 2, 3 and 6 checks in about a minute and tags each finding with an owner and effort. Then set up Search Console and Bing Webmaster Tools, export the baseline, and work through the six steps. For the Search Console side, the Google Search Console SEO audit goes report by report; if you are deciding whether to hire the work out, what SEO audit services include explains a good proposal, and what a good SEO score means explains why tool scores do not compare.

Frequently asked questions

How much does an SEO audit cost?

Running one yourself with Search Console, Bing Webmaster Tools and free checkers costs time rather than money. Professional audits are quoted per project and scale with the number of pages, the number of templates and how deep the deliverable goes. Before paying, run a free scan so you know whether the problems are obvious or subtle.

How long does an SEO audit take?

Our view: a single page can be scored in about a minute, a small brochure site takes a working day to audit properly, and a large ecommerce or publishing site takes one to three weeks because crawling, log review and content sampling all take time. Writing the report usually takes as long as the analysis.

How often should you do an SEO audit?

A full audit once a year, plus one after any migration, redesign, platform change or sustained traffic drop. Between full audits, review the Search Console Page indexing, Core Web Vitals and Performance reports monthly and run a quick page scan after every significant release.

Can I do an SEO audit myself?

Yes. The data sources in this guide are free, and the six steps work for any site. Hire help when the site is large, when the fixes need a developer you do not have, or when a penalty, migration or international setup is involved.

What is the difference between an SEO audit and a technical SEO audit?

A technical SEO audit covers only the machine-facing layer: crawling, indexing, rendering, status codes, performance, structured data and security. A full SEO audit adds on-page elements, content quality, links and, in 2026, AI-search readiness. Steps 1 and 2 of this guide are the technical audit.

What is a good SEO audit score?

Scores are tool-specific and not comparable between tools. A score tells you how many of that tool's checks you pass, weighted by its own opinion of importance. Treat anything below the tool's green band as a prompt to read the individual findings, not as a verdict on your rankings.