What should an SEO audit checklist cover?

A complete SEO audit checklist covers indexability and crawl control first, then on-page elements, URL structure, content quality, structured data, internal and external links, images, performance, mobile, security headers, accessibility, and E-E-A-T signals. Anything that skips indexability is not an audit, it is a content review.

How often should I run an SEO audit?

Run a full audit quarterly, and a short indexability pass after every deployment that touches routing, rendering, or metadata. Most catastrophic SEO problems are shipped, not grown.

Can I run this checklist automatically?

Yes. IMVASA Audit Tool runs the checks on this page against any public URL for free, with no signup, and returns evidence from your own HTML plus a prioritised fix list.

What is the difference between an SEO audit and a GEO audit?

An SEO audit optimises for ranked links in Google. A GEO audit optimises for being retrieved and cited by AI answer engines like ChatGPT, Perplexity, and Google AI Overviews. They overlap on crawlability and structure but diverge sharply on answer readiness, entity clarity, and evidence.

Do I need paid tools to complete this checklist?

No. Every item here can be verified with free tools: this audit tool, Google Search Console, and Google PageSpeed Insights for lab performance metrics.

SEO audit checklist

The SEO audit checklist behind this tool

An SEO audit checklist is the ordered list of checks that tells you whether a page can be crawled, indexed, understood, and ranked. This is the full list IMVASA Audit Tool runs, grouped into 14 areas and 160 documented items, starting with indexability because everything else is wasted effort if the page cannot be indexed.

Written by Vasa, GEO & AEO specialist · Last updated August 29, 2026

How to work through it

1. Fix indexability first. A noindex tag outranks every other improvement on this page.
2. Then on-page and structure, so the page states what it is about.
3. Then content, links, and schema, which decide how well it competes.
4. Then performance, mobile, security, and accessibility as ongoing hygiene.
5. Re-run the audit after each batch so you can see the score move.

Indexability and crawl control

Nothing else matters if Google cannot fetch and index the page. Start every audit here.

HTTP status is 200: The audited URL returns 200, not a soft 404, 3xx chain or 5xx.
Robots meta tag: No accidental noindex or nofollow on a page you want ranked.
X-Robots-Tag header: Header-level directives are checked separately; they silently override the page.
robots.txt exists and parses: Reachable at the root, valid syntax, no stray BOM or HTML error page.
Googlebot is allowed on this path: The exact URL is evaluated against every matching user-agent group.
Sitemap directive in robots.txt: An absolute Sitemap: line pointing at a live sitemap.
sitemap.xml is reachable and valid: Correct XML, correct namespace, served as XML not HTML.
Page is listed in the sitemap: Orphaned-from-sitemap pages get crawled far less often.
Canonical tag present: Exactly one rel=canonical, absolute, https, self-referencing unless intentional.
Canonical target returns 200: A canonical pointing at a redirect or 404 wastes the signal entirely.
No canonical loop or chain: A canonicalises to B which canonicalises back to A confuses consolidation.
Canonical vs noindex conflict: Canonicalising to a noindexed URL can deindex the whole cluster.
Canonical is not blanket-homepage: Deep pages canonicalising to / is a common CMS misconfiguration.
Link header canonical agrees with the HTML: Conflicting HTTP and HTML canonicals are resolved unpredictably.
Render mode detected: Whether meaningful content exists in server HTML or only after JavaScript runs.
Redirect chain length: Zero or one hop; each extra hop leaks crawl budget and link equity.
Redirect type is correct: Permanent moves use 301/308, not 302, meta refresh or JS location swaps.

Titles, meta and headings

The classic on-page layer, judged on intent match and truncation risk, not just presence.

Title tag present and unique: One title element, in head, non-empty.
Title length and pixel truncation risk: Roughly 30 to 60 characters so it survives the SERP snippet.
Primary keyword in the title: Target term appears early rather than after the brand name.
Meta description present: One description, 70 to 160 characters, written as a click promise.
Meta description is not duplicated: Boilerplate descriptions across a site suppress snippet quality.
Exactly one H1: Zero or multiple H1s weaken the page's topical statement.
H1 matches the title intent: The H1 and title should describe the same job, not two different pages.
Heading hierarchy is sequential: No skipped levels (H2 to H4) and no headings used purely for styling.
Headings cover the target topic: Subheadings name the subtopics a searcher expects to find.
lang attribute on html: Declared and valid, so both search and screen readers know the language.
Charset declared early: UTF-8 declared inside the first kilobyte of the document.
No meta tags stranded in body: Meta and link tags after body opens are ignored by crawlers.
Favicon and apple-touch-icon: Present and reachable; missing icons show up in SERP branding.
Web app manifest and theme colour: Checked for installability and mobile browser chrome.

URL structure

Fourteen checks on the URL itself. Cheap to fix, and it compounds across a whole site.

Slug contains the target keyword: Descriptive words, not IDs or dates alone.
No uppercase characters: Case-sensitive paths create duplicate URLs.
Hyphens, not underscores: Underscores are not reliable word separators for search engines.
No double slashes or spaces: Malformed paths generate duplicate and 404 variants.
No non-ASCII characters: Percent-encoded paths are hard to share and easy to break.
URL length is reasonable: Overlong URLs truncate in results and in shares.
No repeated path segments: /blog/blog/post usually signals a routing bug.
Query parameter hygiene: Parameters that change content should be canonicalised or handled explicitly.
No session IDs in the URL: Session IDs create infinite duplicate crawl space.
No tracking parameters on the canonical URL: utm parameters in canonicals split ranking signals.
Internal search URLs are not indexable: Search result pages are thin and crawl-expensive.
Crawl depth from the homepage: Pages more than three clicks deep receive far less crawl attention.
No stop-word-heavy slugs: Trimmed slugs read better and match queries more tightly.
Trailing-slash consistency: One canonical form; the other should redirect, not duplicate.

Content quality

Measured, not guessed: real counts and readability metrics extracted from your page.

Word count against intent: Thin pages are flagged relative to what the query type needs.
Flesch reading ease: Scored, with the target band explained for your content type.
Average sentence length: Long sentences reduce both readability and AI extractability.
Paragraph structure: Wall-of-text blocks are flagged with the offending paragraph lengths.
Keyword prominence map: Where your top terms actually appear: title, H1, first 100 words, body.
Keyword stuffing detection: Density outliers are reported with exact counts.
Top n-grams: Two- and three-word phrases ranked by frequency and position.
Topic clusters: Which topical clusters the page covers strongly and which are missing.
Text-to-HTML ratio: A very low ratio usually means content is being rendered client-side.
Duplicate content within the page: Repeated blocks and boilerplate-dominant pages.
Content freshness signals: Published and modified dates present, plausible and consistent.

Structured data

JSON-LD and microdata are parsed and validated against Schema.org, with the source line number for every error.

Structured data detected: JSON-LD, microdata and RDFa are all extracted.
JSON-LD parses without errors: Syntax errors are reported with their line in the HTML.
Schema type is appropriate: The declared @type matches what the page actually is.
Required properties present: Missing required fields for the declared type are listed individually.
Recommended properties present: Fields that unlock richer results but are not strictly required.
Schema matches visible content: Markup describing content that is not on the page is a manual-action risk.
No content drift between markup and page: Prices, dates and ratings in schema are compared to the rendered text.
FAQ markup validity: Question and answer pairs exist visibly on the page.
Organization, Person or Author entity present: The entity layer AI engines use for attribution.
BreadcrumbList present on deep pages: Improves both SERP display and internal-structure understanding.

Internal and external links

Eighteen link checks, including a real fetch of external targets rather than a pattern guess.

Internal link count and distribution: Too few links isolates the page; too many dilutes each one.
Broken internal links: Every internal href is resolved and status-checked.
Broken or redirecting external links: Redirects are followed; bot-gated hosts are reported as unverified, not failed.
Anchor text diversity: Repeated 'click here' and exact-match spam are both flagged.
Dead in-page fragments: Anchor links pointing at IDs that do not exist on the page.
Orphan pages (deep audit): Sitemap pages with no internal links pointing at them.
Weak pages by internal authority: A simplified internal PageRank pass over the crawled set.
Excessive links on a single page: Link count against the practical crawl and equity limit.
Internal links to redirects: Links that force an unnecessary hop should point at the final URL.
nofollow and sponsored usage: Correct rel attributes on paid, UGC and untrusted links.
Self-referencing links: Links pointing back at the current URL waste crawl signals.
Contextual vs navigation links: Body-copy links carry more weight than repeated nav links.

Images

Fifteen checks covering both accessibility and delivery.

Alt text present: Every content image has an alt attribute.
Alt text quality: Describes the image rather than repeating the filename or keyword.
Alt text length: Long enough to be useful, short enough to be read aloud.
Decorative images marked correctly: Empty alt for decoration, not a repeated caption.
Width and height attributes: Prevents layout shift and improves CLS.
Modern formats: WebP or AVIF served where legacy formats dominate.
Responsive srcset: Multiple sources so mobile does not download desktop assets.
Oversized images: Intrinsic dimensions far above display size.
Descriptive filenames: IMG_4821.jpg carries no signal; hyphenated descriptive names do.
Broken images: Every src is resolved and status-checked.
Figure captions: figcaption pairing where figures are used.
GIF used instead of video: Animated GIFs are usually an order of magnitude heavier than video.
Inline SVG weight: Very large inline SVGs bloat the HTML payload.
picture element fallbacks: A valid img fallback inside every picture.
CSS background images carrying content: Content in CSS backgrounds is invisible to search and screen readers.

Performance signals

Static, measurable signals from the fetch. For lab metrics the report links straight to PageSpeed Insights.

HTML document size: Payload size against the practical parse budget.
Server response time: Time to first byte from the audit fetch.
Compression enabled: gzip or brotli on the HTML response.
Render-blocking resources: Synchronous CSS and JS in head, counted and listed.
Resource hints: preconnect, dns-prefetch and preload used for critical origins.
Caching headers: Cache-Control present and sane for a static document.

Mobile

Mobile-first indexing means these are ranking checks, not usability nice-to-haves.

Viewport meta present: Exactly one viewport tag with width=device-width.
No user-scalable=no: Blocking zoom is both an accessibility and a mobile-usability failure.
Base font size: Body text large enough to read without zooming.
Touch target size: Interactive elements meeting the minimum tap area.
No horizontal scroll: Fixed-width containers wider than a phone viewport.
No intrusive interstitials: Full-screen overlays on entry, distinguished from normal sticky headers.
Tap-target spacing: Adjacent controls that are easy to mis-tap.

Security and trust headers

Security headers are a trust signal and, for HTTPS and mixed content, a direct ranking factor.

HTTPS enforced: The page is served over TLS and HTTP redirects to it.
Valid certificate chain: Certificate resolves without warnings.
HSTS header: Strict-Transport-Security present with a sensible max-age.
Content-Security-Policy: Present and not trivially permissive.
X-Content-Type-Options: nosniff set on the document response.
X-Frame-Options or frame-ancestors: Clickjacking protection through either mechanism.
Referrer-Policy: Set to a policy that does not leak full URLs cross-origin.
Permissions-Policy: Powerful features restricted by default.
Mixed content: Any http:// subresource on an https page is listed individually.
Cookie flags: Secure, HttpOnly and SameSite on every Set-Cookie.
No secrets exposed in HTML: API keys and tokens accidentally rendered into the markup.

Accessibility

WCAG-aligned static checks. They overlap heavily with what AI parsers need to understand a page.

Landmark regions: header, nav, main, footer present and used once each where appropriate.
Single main landmark: Exactly one main element wrapping the primary content.
Form labels: Every input has a programmatically associated label.
Button and link accessible names: No icon-only controls without text or aria-label.
ARIA role validity: Roles exist, are spelled correctly and are not redundant.
Skip link: A keyboard-reachable skip-to-content link.
Focus visibility: Outline suppression without a replacement indicator is flagged.
Tabindex misuse: Positive tabindex values break natural focus order.
Colour contrast in inline styles: Detectable contrast failures from declared colours.
Table headers: Data tables use th and scope correctly.
Language of parts: Foreign-language passages marked with lang.
Media alternatives: Captions or transcripts referenced for audio and video.

Ten checks so shared links render as a card instead of a bare URL.

og:title and og:description: Present, non-empty and distinct from boilerplate.
og:image present and reachable: Absolute https URL that returns an image.
og:image dimensions and format: Large enough for a summary_large_image card.
og:url matches canonical: Mismatched og:url reattributes the share to another page.
og:type: website, article or product as appropriate.
twitter:card: Declared, with the matching title, description and image.
Social profile links: Profiles linked and mirrored in sameAs markup.
Share affordances: Whether the page offers a share path at all.

E-E-A-T signals

Sixteen checks on the trust layer Google's quality raters and AI engines both lean on.

Named author with a link: A real person or organisation, linked to a profile.
Author entity in structured data: The byline is backed by Person or Organization markup.
Author expertise statement: Credentials or experience stated, not just a name.
About page reachable: Linked from the page or site navigation.
Contact page reachable: A real contact route, not only a form widget.
Privacy policy and terms: Present and linked in the footer.
Editorial policy: How content is produced and reviewed.
Physical address or business identity: Verifiable organisational identity.
Published and modified dates visible: Dates on the page, not only in markup.
External citations: Claims backed by outbound links to primary sources.
Citation quality: Whether cited domains are authoritative or self-referential.
Statistics with sources: Numbers on the page traced to a source.
Affiliate and sponsorship disclosure: Required where monetised links exist.
YMYL handling: Extra trust requirements on money and health topics.

HTML validity and internationalisation

Parser-level problems that quietly break everything downstream.

Doctype present: Missing doctype triggers quirks mode.
Single head and body: Duplicated head sections silently drop metadata.
Single title and description: Duplicates are resolved unpredictably.
noscript in head is valid: Flow content inside head noscript breaks parsing.
Placeholder text left in production: Lorem ipsum, TODO and template defaults.
Document size limit: Very large documents get truncated before the content ends.
hreflang validity: Valid language and region codes on every alternate.
hreflang self-reference: Each page references itself in its own cluster.
hreflang vs noindex conflict: Alternates pointing at noindexed URLs break the cluster.

Run this checklist on your site automatically

Paste a URL and the tool works through every item above, returns the evidence from your own HTML, and ranks the fixes by impact.

Frequently asked questions

What should an SEO audit checklist cover?: A complete SEO audit checklist covers indexability and crawl control first, then on-page elements, URL structure, content quality, structured data, internal and external links, images, performance, mobile, security headers, accessibility, and E-E-A-T signals. Anything that skips indexability is not an audit, it is a content review.
How often should I run an SEO audit?: Run a full audit quarterly, and a short indexability pass after every deployment that touches routing, rendering, or metadata. Most catastrophic SEO problems are shipped, not grown.
Can I run this checklist automatically?: Yes. IMVASA Audit Tool runs the checks on this page against any public URL for free, with no signup, and returns evidence from your own HTML plus a prioritised fix list.
What is the difference between an SEO audit and a GEO audit?: An SEO audit optimises for ranked links in Google. A GEO audit optimises for being retrieved and cited by AI answer engines like ChatGPT, Perplexity, and Google AI Overviews. They overlap on crawlability and structure but diverge sharply on answer readiness, entity clarity, and evidence.
Do I need paid tools to complete this checklist?: No. Every item here can be verified with free tools: this audit tool, Google Search Console, and Google PageSpeed Insights for lab performance metrics.

Keep going

GEO audit checklist

What AI answer engines need before they cite you.

Free GEO audit tool

Score your AI search visibility on any URL.

Free SEO audit tools compared

Honest look at the free tiers, including Semrush alternatives.

Free SEO audit MCP

Run audits from ChatGPT, Claude or Cursor.

Free file generators

robots.txt, sitemap.xml and llms.txt builders.