Website Audit Checklist: 47 Checks for 2026

This is a website audit checklist built from what Google actually measures, not what audit tools like to report. Most site audits still flag things Google stopped caring about a decade ago, which is how you end up with a 40 page report and no idea what to fix first.

Every item below is something Google Search Console, Lighthouse or PageSpeed Insights genuinely evaluates. They are grouped into four categories and ordered by how much fixing them is worth.

Working through it end to end takes a few hours. If you would rather see where you stand first, the free website audit tool runs the automated portion of this list in about a minute.

Quick Answer

A website audit checklist is the list of things you check to find out why a site is not ranking or converting. The useful version has four parts, worked in this order: can Google crawl and index the pages, is the content worth ranking, does the site load fast on a phone, and does Google have reason to trust the domain. The 47 checks below are grouped that way and ordered by how much fixing each one is worth. Crawlability problems are first because a page Google cannot reach cannot be fixed by anything else on the list.

Working through the whole thing by hand takes a few hours. The free website audit tool runs the automated portion in about a minute if you want a baseline before you start.

Why Most Website Audits Are Useless

Buy a cheap audit and you will get a 40 page PDF full of scores that do not matter. It is common to see a report flag "missing meta keywords", which Google has ignored since 2009, while missing a noindex tag that is quietly blocking the entire site.

Real audits are technical, specific, and prioritized by impact. This checklist is organized by the four categories Google actually evaluates:

1. Crawlability & Indexing (Can Google find your pages?)
2. Content Quality (Does your content deserve to rank?)
3. Technical Performance (Does your site load fast and work everywhere?)
4. Authority Signals (Does Google trust you?)

Part 1: Crawlability & Indexing (Checks 1-12)

These are the foundation. If Google cannot crawl your site, nothing else matters.

1. robots.txt Configuration

Check: Does your robots.txt accidentally block important pages? Common mistake:

This blocks everything, and it reaches production more often than you would expect.

Correct approach:

How to verify: Search yoursite.com/robots.txt and review. Use the DevelopersMatrix Website Audit Tool to test automatically.

2. XML Sitemap

Check: Does your sitemap exist, is it submitted to Google Search Console, and does it only include indexable URLs? The three sitemap problems that show up most often:

• No sitemap at all
• A sitemap listing URLs that return 404
• A sitemap listing pages that are set to noindex, which sends Google two contradictory instructions

Best practice: Submit via Google Search Console → Sitemaps. Keep under 50,000 URLs. Update automatically when content changes.

3. Canonical Tags

Check: Does every page have a canonical that points to itself? Are parameters (UTM, pagination) handled? Example of what breaks:

Fix: One canonical per product. Prefer clean URLs. The DevelopersMatrix Website Audit Tool checks canonical consistency across your entire site.

4. Noindex vs. Index Status

Check: Are important pages accidentally noindex? Are thin pages (search results, tags, archives) properly noindexed? The pattern that causes most of the damage:

• Blog tag pages indexed (thin content penalty risk)
• Search result pages indexed (even worse)
• Product pages noindexed by a CMS default setting

5. 404 Errors and Broken Links

Check: Google Search Console → Coverage → Excluded. Look for "Soft 404" and "Not found". Where to draw the line: fix any 404 that has external links pointing to it. Use a 301 redirect for content that moved. Return a proper 410 for content that is gone for good, because a 410 tells Google to stop coming back and a 404 does not.

6. Redirect Chains

Check: Are there redirect chains longer than 2 hops? Bad: A → 301 → B → 301 → C (Google may stop following) Good: A → 301 → C

7. HTTPS / SSL Certificate

Check: Is your entire site HTTPS? Mixed content (HTTP resources on HTTPS pages) triggers browser warnings and ranking penalties. Quick test: Open your site in Chrome DevTools → Security tab.

8. URL Structure

Check: Are URLs descriptive, lowercase, and separated by hyphens? Bad: /p?id=123&ref=affiliate Good: /products/handmade-leather-wallet

9. Breadcrumb Markup

Check: Does your site have breadcrumb structured data? Google uses this for rich snippets. Implementation:

10. Internal Linking

Check: Does every important page have at least 3 to 5 internal links pointing to it? How to find them: use Screaming Frog or the DevelopersMatrix Website Audit Tool to list orphan pages, meaning pages with zero internal links. These are effectively invisible to Google.

11. Pagination

Check: If you have paginated content (blog archives, product lists), are rel="next" and rel="prev" used correctly? Or does pagination use proper parameter handling?

12. JavaScript Rendering

Check: Does Google render your JavaScript content? Test with the URL Inspection tool in Search Console. Red flag: Content loaded via fetch() after page load may not be indexed. Use server side rendering or static generation for critical content.

Part 2: Content Quality (Checks 13-25)

13. Title Tag Optimization

Check: Are title tags unique, under 60 characters, and leading with the keyword? Bad: "Home | My Website" Good: "Handmade Leather Wallets | Free Shipping | CraftCo" Tool: DevelopersMatrix Website Audit Tool flags duplicate or missing titles.

14. Meta Descriptions

Check: Unique descriptions, 150 to 160 characters, with a call to action. What usually goes wrong here: duplicate descriptions repeated across templated pages, and descriptions long enough that Google truncates them in the results.

15. Header Tag Hierarchy

Check: One H1 per page. H2s for sections. H3s for subsections. No skipping levels. Common mistake: Using H1 for logo on every page. This dilutes page relevance.

16. Content Uniqueness

Check: Is your content duplicated across pages? Even navigation text repeated on 1000 pages can trigger thin content flags. Tool: Siteliner.com finds internal duplicate content.

17. Keyword Cannibalization

Check: Are multiple pages targeting the same keyword? This splits your ranking potential. Example: Having /blog/seo-guide and /guides/seo-guide both targeting "SEO guide". Fix: Consolidate or differentiate intent.

18. E-E-A-T Signals

Check: Does your content demonstrate Experience, Expertise, Authoritativeness, and Trustworthiness? What this means practically:

• Author bios with credentials
• Published dates updated
• External citations to authoritative sources
• "About Us" page with real information
• Contact information visible

19. Thin Content Pages

Check: Pages with under 300 words of unique content.

The usual offenders are tag pages, one line product descriptions, and anything generated in bulk. Either improve them or set them to noindex. Leaving them indexed drags the whole domain.

20. Image Optimization

Check:

• Descriptive alt text (not "image1.jpg")
• WebP format where possible
• Properly sized (do not serve 4000px images for 800px display)
• Lazy loading for below the fold images

21. Structured Data / Schema Markup

Check: Do you have relevant schema? Article, Product, FAQ, HowTo, Organization. Tool: Google's Rich Results Test validates your markup.

22. Content Freshness

Check: When was your last content update? Google prefers recently updated content for many queries.

Update your top twenty pages quarterly and show a genuine last updated date. Changing the date without changing the content is worse than leaving it alone.

23. Mobile Content Parity

Check: Does your mobile version have the same content as desktop? Google uses mobile first indexing. Common issue: Accordions on mobile hide content that is visible on desktop. If the content is not in the DOM on mobile, Google may not see it.

24. Outbound Link Quality

Check: Do you link to authoritative, relevant sources? Outbound links to .edu, .gov, and established publications strengthen your page's context.

25. Readability

Check: Is your content readable? Aim for 8th to 10th grade level for general audiences. Tool: Hemingway Editor. The DevelopersMatrix Website Audit Tool includes readability scoring.

Part 3: Technical Performance (Checks 26-37)

26. Core Web Vitals (LCP)

Check: Largest Contentful Paint under 2.5 seconds. LCP is typically:

• Hero image
• Video poster
• Large text block

Fix: Preload LCP image, use responsive images, consider a CDN.

27. Core Web Vitals (INP)

Check: Interaction to Next Paint under 200ms. Common culprits:

• Heavy JavaScript execution on click
• Third-party scripts blocking main thread
• Unoptimized event handlers

28. Core Web Vitals (CLS)

Check: Cumulative Layout Shift under 0.1. What causes CLS:

• Images without width/height attributes
• Ads or embeds that load late
• Web fonts causing FOIT/FOUT

29. Server Response Time (TTFB)

Check: Time to First Byte under 600ms. Where this usually goes wrong: cheap shared hosting. If your TTFB is over a second and the server is the only thing between the request and the response, the host is the problem and no amount of front end work fixes it.

30. Render-Blocking Resources

Check: Are CSS and JS files blocking first paint? Fix: Inline critical CSS, defer non-critical JS, use async for third party scripts.

31. Image Format Optimization

Check: Are you serving WebP? AVIF is even better but has limited support. Impact: Converting PNG to WebP typically reduces size by 25 to 35 percent.

32. JavaScript Bundle Size

Check: What is your total JS payload? Google recommends under 500KB uncompressed for mobile. A real example. This site was shipping roughly 1.9 MB of JavaScript on its homepage because one component in the header imported the entire blog corpus. Moving that to a lazy import and passing summaries as props took it to 823 KB, a cut of 57 percent, with no change to what the page does. Check what your header and footer components import. A single data import in a shared component lands on every page on the site.

33. Third Party Scripts

Check: How many third party scripts load? Each adds latency and privacy risk. Common offenders:

• Analytics (Google Analytics, Mixpanel)
• Chat widgets (Intercom, Drift)
• Ads (AdSense, programmatic)
• Social embeds (Facebook, Twitter)

A reasonable rule: if a script is not business critical, load it after the first interaction or remove it. Chat widgets and ad overlays are the two that most often cost more than they earn.

34. Font Loading

Check: Are web fonts causing layout shifts or invisible text? Fix: Use font-display: swap. Preload critical fonts.

35. Database Query Performance

Check: If you run a dynamic site, are database queries optimized? Common issue: N+1 queries, missing indexes, unoptimized JOINs.

36. CDN Usage

Check: Are static assets served from a CDN? Impact: A global CDN can reduce load times by 50 to 70 percent for international users.

37. Caching Strategy

Check: Proper cache headers for static assets. Service Worker for PWA features. Recommended:

• HTML: no-cache (always fresh)
• CSS/JS: 1 year with hash in filename
• Images: 1 year

Part 4: Authority & Trust (Checks 38-47)

38. Backlink Profile

Check: Do you have quality backlinks? Quantity matters less than relevance and authority.

One link from a publication people have heard of is worth more than a thousand from blogs built to sell links. If you have bought links in the past, disavowing them matters more than earning new ones.

39. Brand Search Volume

Check: Do people search for your brand name? This signals authority to Google.

Brand searches are hard to fake and Google knows it. Getting mentioned somewhere real, even once, moves this more than any on page change.

40. Social Signals

Check: Active social profiles linked from your site. Not a direct ranking factor, but correlates with legitimate businesses.

41. Review Signals

Check: For local businesses, Google Business Profile reviews. For products, review schema markup.

42. Site Security

Check: Beyond HTTPS, do you have security headers? Recommended headers:

• Content-Security-Policy
• X-Frame-Options
• X-Content-Type-Options

43. Privacy Policy & Legal

Check: Required for ads, analytics, and compliance. Linked from footer.

44. Contact Information

Check: Physical address, phone, email. Especially important for YMYL (Your Money Your Life) sites.

45. About Page Quality

Check: Real people, real photos, real story. Not a generic template.

46. Content Accuracy

Check: Facts cited, claims supported, outdated information removed. YMYL sites are held to higher standards.

47. User Engagement Metrics

Check: Bounce rate, time on page, pages per session. Google uses Chrome user data as a quality signal. Improve by: Better internal linking, related content recommendations, table of contents for long articles.

How to Work Through This Checklist

Step 1: Run the free website audit tool for an automated baseline. It covers the checks a machine can answer, which is most of Parts 1 and 3. Step 2: Open Google Search Console. Check Manual Actions first, then Pages for coverage problems, then Core Web Vitals. Manual Actions comes first because if you have one, nothing else on this list matters until it is lifted. Step 3: Run Lighthouse in Chrome DevTools on mobile, then desktop. Mobile first, because that is the version Google indexes. Step 4: Crawl the site with Screaming Frog to catch the structural problems a single page test cannot see: orphan pages, redirect chains, duplicate titles across templates. Step 5: Fix in this order. Crawlability, then performance, then content, then authority. Resist the urge to start with the easy wins at the bottom.

Which Tools You Actually Need

You do not need an expensive stack to audit a website. Most of what matters is free.

Prices change, so treat those as a rough guide rather than a quote.

Start free. Search Console plus PageSpeed Insights plus one automated audit tool covers what most sites need. Paid crawlers earn their money when you are managing several sites or working past a few thousand URLs, and not really before that.

How Often to Audit

Also audit straight after a redesign, a platform migration, or a confirmed Google update. Those are the three moments when something breaks quietly.

Five Mistakes That Waste an Audit

Auditing once and forgetting. Sites change. Content gets published, plugins update, links rot. An audit from six months ago describes a site that no longer exists. Treating it as a technical exercise. A site can pass every technical check and still get no traffic, because the content is thin or aimed at the wrong intent. Audit what the page says with the same rigour you audit how it loads. Checking mobile in a desktop browser. "It looks fine on my laptop" is the most expensive sentence in SEO. Open the site on a real phone. Device emulators miss font rendering, touch target size, and overlay ads landing on your content. Not acting on the findings. A report in a folder changes nothing. Turn the findings into a list with owners and dates, and work the top of the list. Using too many tools. Ten tools produce ten conflicting scores and no decision. Pick two or three, learn them properly, and ignore the rest.

Frequently Asked Questions

The full set of questions people ask about audits, costs and timing is answered at the end of this page.

References

• Google Search Central Documentation. https://developers.google.com/search
• PageSpeed Insights methodology. https://developers.google.com/speed/docs/insights/v5/about
• Core Web Vitals overview. https://web.dev/vitals
• HTTP Archive, State of the Web. https://httparchive.org

Related Guides

• Website code audit guide for reviewing the underlying HTML, CSS and JavaScript rather than the SEO layer
• Free website audit tool to run the automated part of this list in about a minute
• Website audit services and pricing if you would rather have someone run it and hand you a prioritised plan