Website Audit Checklist: 40 Checks for SEO, Speed and Security

A complete website audit checks 40 things across six areas: indexing and crawling, on-page content, technical speed, security, AI search readiness and tracking. Each check below states what to look at and the tool or method that verifies it. Work through it in order, because a problem in an early section (a page Google cannot index) makes every later fix on that page worthless.

Why this audit covers SEO, speed and security together

Most published audit checklists cover SEO only. That leaves out two areas that directly change rankings: performance and security. The three interact in ways a single-discipline review misses. Three common examples show how:

• A security plugin or firewall rule blocks Googlebot, and pages drop out of the index while the SEO report shows nothing wrong.
• A hacked site generates thousands of spam pages, and the first symptom is a traffic drop, not a security alert.
• A caching or "speed" plugin breaks structured data or serves the wrong canonical tag, and rankings fall after a performance fix.

I have done security research since 2011, written production code since 2016 and worked in SEO since 2020, so this checklist reflects where those three areas overlap. Use it as a self-check, a brief for a developer, or a way to judge what an SEO consultant is actually reviewing.

Indexing and crawling

Indexing comes first because a page Google has not indexed cannot rank, however good it is. These 8 checks confirm that search engines can find, crawl and store your pages:

• Your important pages are indexed: open Search Console > Pages and compare the indexed count with the number of pages you expect.
• Robots.txt does not block key sections: read yourdomain.com/robots.txt and test URLs with the Search Console URL Inspection tool.
• No important page carries a noindex tag: crawl the site with Screaming Frog and filter the Indexability column for "Non-Indexable".
• An XML sitemap exists, lists only indexable 200-status URLs and is submitted: check Search Console > Sitemaps.
• Every page resolves to one canonical version (https, one of www or non-www, consistent trailing slash): type all four variants into the browser and confirm each redirects to the same URL.
• Canonical tags point to the correct URL: check the Canonical column in a Screaming Frog crawl.
• No broken internal links or redirect chains longer than one hop: filter the crawl for 4xx responses and redirect chains.
• Staging, test and admin URLs are not indexed: search Google for site:yourdomain.com plus words such as "staging" or "test".

Google's own documentation is direct on one common mistake: robots.txt "is not a mechanism for keeping a web page out of Google", and a noindex tag or password protection does that job (Google Search Central, robots.txt introduction). Pages that pass these checks but still do not appear in results have a different cause, covered in why a website is not showing on Google.

On-page and content

On-page checks confirm that each indexed page clearly matches one search intent. These 7 checks apply to every page you want to rank:

• Each page has a unique title tag under about 60 characters that contains its main query: export titles from a Screaming Frog crawl and sort for duplicates.
• Each page has a unique meta description of 140-160 characters: check the Meta Description tab in the same crawl.
• Each page has exactly one H1 and a logical H2/H3 structure: check the H1 tab for missing or duplicate headings.
• No two pages target the same query: search Search Console > Performance for your main queries and confirm one URL receives the impressions.
• Thin pages with no unique value are merged, expanded or removed: sort the crawl by word count and review the shortest pages.
• Images have descriptive alt text: filter the crawl's Images tab for "Missing Alt Text".
• Every important page receives internal links from related pages: check inlinks per URL in Screaming Frog or Ahrefs Site Audit.

Technical and speed

Speed checks measure what real visitors experience, using Google's Core Web Vitals. Google defines a good experience as Largest Contentful Paint (LCP) within 2.5 seconds, Interaction to Next Paint (INP) of 200 milliseconds or less and Cumulative Layout Shift (CLS) of 0.1 or less, measured at the 75th percentile of page loads (web.dev, Web Vitals, updated 2024). These 8 checks cover performance and the technical foundations around it:

• LCP is 2.5 seconds or less on mobile: read the field data at the top of PageSpeed Insights.
• INP is 200 milliseconds or less: check the same field data, or Search Console > Core Web Vitals.
• CLS is 0.1 or less: check PageSpeed Insights field data and watch the page load for content that jumps.
• Server response time (TTFB) is 0.8 seconds or less: read the TTFB value in PageSpeed Insights, which web.dev uses as its "good" threshold.
• Images are compressed, correctly sized and served as WebP or AVIF: check the "Improve image delivery" items in the PageSpeed Insights diagnostics.
• Pages are cached and static files are served through a CDN: inspect response headers in Chrome DevTools > Network for cache-control and a CDN header.
• Every template works on mobile without horizontal scrolling or tiny tap targets: load key pages on a real phone and in Chrome DevTools device mode.
• Structured data is valid: test key templates with Google's Rich Results Test.

The full explanation of how load time affects rankings and conversions, with fixes for each cause, is in does a slow website hurt SEO.

Security

Security belongs in an SEO audit because a hacked or flagged site loses rankings and visitor trust at the same time. Google shows browser warnings on sites flagged for malware, and injected spam pages compete with your real content. These 8 checks cover the basics:

• HTTPS works on every page with a valid certificate and no mixed content: check the padlock and the Chrome DevTools Console for mixed-content warnings.
• The CMS core, theme and plugins run current versions: open the WordPress (or other CMS) updates screen and list anything outdated.
• Unused plugins, themes and admin accounts are removed: review the plugin list and the users list for anything nobody recognises.
• Admin logins use strong unique passwords and two-factor authentication: log in as each admin and confirm 2FA is enforced.
• Off-site backups run automatically and a restore has been tested: confirm the backup location, the schedule and the date of the last successful restore.
• Security headers are set (Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options): scan the homepage at securityheaders.com.
• No malware or injected spam is present: check Search Console > Security Issues and Google Safe Browsing site status, then search site:yourdomain.com for pages you did not create.
• Your firewall or security plugin does not block search engine crawlers: run URL Inspection > Test Live URL and confirm the fetch succeeds.

Treat a failed malware check as urgent and follow the steps in what to do when your website is hacked before continuing the rest of the audit.

AI search readiness

AI search readiness checks whether ChatGPT, Gemini, Perplexity and Google's AI features can read and cite your pages. Google states that a page needs to be indexed and eligible for a snippet to appear as a supporting link in AI Overviews or AI Mode, with "no additional technical requirements" (Google Search Central, AI features and your website, 2025). Other assistants run their own crawlers, so these 5 checks matter:

• AI search crawlers are allowed: confirm robots.txt and your CDN or firewall bot settings do not block OAI-SearchBot or PerplexityBot. OpenAI states that sites which opt out of OAI-SearchBot "will not be shown in ChatGPT search answers" (OpenAI, Overview of OpenAI crawlers).
• Main content is in the HTML, not loaded only by JavaScript: view the page source (Ctrl+U) and confirm the key text is present.
• Key pages answer their question in the first 2-3 sentences: read the opening of each service and guide page.
• Organization and author schema state who you are, where you operate and what you offer: test with the Schema Markup Validator.
• Your business name, address and description match across your site, Google Business Profile and directories: compare them side by side.

Being visible to AI crawlers is the technical half of the job. The content half is explained in how to get your business mentioned in ChatGPT.

Tracking and analytics

Tracking checks confirm that you measure the results of every other fix. These 4 checks prevent decisions based on broken data:

• GA4 fires once per page on every template: check Tag Manager Preview mode or the GA4 DebugView.
• Key conversions (form submits, calls, purchases) are recorded as key events: submit a test form and confirm it appears in GA4.
• Search Console is verified for the correct domain property and linked to GA4: check Search Console settings and GA4 > Admin > Product links.
• Consent banners and tag rules do not block analytics for consenting visitors: accept cookies in a private window and confirm the GA4 request in DevTools > Network.

What a professional audit adds

A professional audit adds three things this checklist cannot do on its own. Pricing and deliverables are covered in how much an SEO audit costs.

1. Prioritisation. A 40-item list treats every failure as equal. A professional review ranks the failures by impact on traffic and revenue, so the first week of work goes to the 3 or 4 issues that matter most.
2. Root causes across code, SEO and security. A slow LCP, a deindexed page and a spam injection often share one cause, such as an outdated plugin. Finding it requires reading the code and the server configuration, not only the reports.
3. Fixing, not listing. Most audit reports end with a spreadsheet. The value is in the fixes, tested and confirmed in Search Console and PageSpeed Insights afterwards.

I run audits this way because I work across all three areas: Python, PHP, JavaScript, Next.js, Laravel and WordPress on the code side, Ahrefs, Search Console, GA4 and Screaming Frog on the SEO side, and security research acknowledged by Google, BlackBerry and TeamViewer. Read how much an SEO consultant costs to compare audit options before you hire.

Frequently asked questions

What does an SEO audit include?

An SEO audit includes checks on indexing and crawling, on-page content, technical performance and structured data. A complete website audit also covers security and analytics, because hacked pages and broken tracking both distort SEO results.

How often should I audit my website?

Run a full website audit once a year and a short health check every quarter. Run an extra audit after a redesign, a CMS migration or a sudden traffic drop.

Can I do a website audit myself?

Yes, a site owner can complete most of these 40 checks with free tools such as Google Search Console, PageSpeed Insights and the free version of Screaming Frog, which crawls up to 500 URLs. A professional is most useful for prioritising the failures and fixing issues in code, server configuration or security.

What is the difference between a technical SEO audit and a website security audit?

A technical SEO audit checks whether search engines can crawl, index and render your pages quickly. A website security audit checks whether attackers can get in, through outdated software, weak admin access, missing backups or injected malware. The two overlap whenever a security problem, such as spam injection or a blocking firewall, damages rankings.

Why does a website audit need to include security?

A website audit needs security checks because hacked sites lose rankings and traffic before owners notice the breach. Injected spam pages, malware warnings and firewalls that block Googlebot all appear as SEO problems, so an SEO-only audit misdiagnoses them.