The SEO Audit Checklist I Actually Use: 41 Checks, Ordered by What Moves Traffic

An SEO audit is a diagnosis, and most published checklists are not diagnoses. They are inventories: two hundred items, every one weighted the same, alt text sitting beside a sitewide noindex as though the two were comparable problems. The output is a colour-coded spreadsheet that makes a client feel audited without telling them what to do on Monday.

This is the sequence I actually run, 41 checks in six passes. The order is the argument. Everything in Pass A can single-handedly remove a site from search, so it runs first and nothing else matters until it is clean. Everything in Pass F is where I find the problems that cost clients their traffic in the first place, which is why it is on the list at all when most checklists omit it entirely.

What actually moves traffic

Before the list, the triage. I have run this on enough recovery jobs to have a view, and the view is not evenly distributed.

The unpopular opinion in that table is Pass E. Core Web Vitals are assessed on field data at the 75th percentile over a rolling 28-day window, and a group reads as good only when all three metrics pass together. They are worth fixing because slow pages lose conversions. They are not where a stalled site’s traffic problem usually lives, and I have watched agencies spend a quarter on a 0.02 CLS improvement while a thousand thin pages sat in the index.

Pass A: indexability, 9 checks

Every one of these can take a site out of search on its own. If anything here fails, stop and fix it before you look at anything else.

1. robots.txt is reachable, returns 200, and does not disallow anything you need crawled.
2. No sitewide noindex, and in particular no staging noindex that survived the launch.
3. Canonical tags are self-referencing on indexable pages, and do not all point at the homepage.
4. No nosnippet or restrictive max-snippet directives, which also remove the page from AI features.
5. HTTPS resolves, the certificate is valid, and HTTP redirects to it once rather than in a chain.
6. One canonical hostname. www and non-www do not both serve 200.
7. Search Console shows no manual actions and no security issues.
8. The Page Indexing report has no large or growing category of excluded URLs that should be indexed.
9. A live URL Inspection on your top ten pages renders the content you expect.

Pass B: crawl and architecture, 8 checks

Google is explicit that most sites should not think about crawl budget at all: its own guidance says you do not need to read it if your site does not have a large number of pages that change rapidly, or if your pages are crawled the same day they are published. It targets sites above roughly a million pages changing weekly, sites above ten thousand pages changing daily, and sites with many URLs sitting in Discovered, currently not indexed.

1. XML sitemaps list only canonical, indexable URLs and carry accurate lastmod values.
2. Redirect chains are short. Google supports up to ten hops but advises staying under three.
3. Permanently removed pages return 404 or 410 rather than soft 404s.
4. Faceted navigation and query strings are not generating an unbounded URL space.
5. Unwanted URLs are blocked in robots.txt rather than noindexed, which is what Google recommends for crawl control.
6. Pagination resolves to real, crawlable URLs.
7. Orphan pages are identified. Anything valuable with no internal links pointing at it is a finding.
8. Crawl stats show no server errors or response-time spikes coinciding with a traffic change.

Pass C: content and intent, 8 checks

1. One intent per URL. Pages competing for the same query are consolidated, not both optimised.
2. The page answers its query in the opening, before the reader has to scroll.
3. The content contains something a general-purpose model could not produce without this business: data, testing, client outcomes, local knowledge.
4. Titles are descriptive rather than exaggerated, and the og:title is set deliberately, since Google uses it as a title link source.
5. Meta descriptions are written as a click asset. They are not a ranking factor and the snippet usually comes from the page body.
6. Headings reflect the document’s real structure rather than keyword placement.
7. Publication and modification dates are accurate, and dateModified reflects substantive change rather than a cosmetic bump.
8. Thin and duplicate pages are counted. A number, not an impression.

Pass D: links, 6 checks

1. Internal links point at the pages that matter, with descriptive anchors. This is the cheapest lever on most sites and the most neglected.
2. Money pages are within three clicks of the homepage.
3. The referring domain profile has no sudden unexplained spikes.
4. Paid or sponsored links carry rel="sponsored", and user-generated links carry rel="ugc".
5. No live disavow file that nobody can justify. A disavow left running unexamined costs sites real authority.
6. Broken internal and outbound links are catalogued.

On item five: the disavow file is the single most misused tool in this discipline, and I set out when it helps and when it actively hurts in the disavow file, explained. If you are auditing a site you did not build, check whether one exists before you conclude anything about its link profile.

Pass E: experience, 5 checks

1. Largest Contentful Paint under 2.5 seconds at the 75th percentile of field data.
2. Interaction to Next Paint under 200 milliseconds.
3. Cumulative Layout Shift under 0.1, with explicit width and height on every image, video, iframe and ad slot.
4. The page is usable on a real phone, not only in a resized desktop window.
5. No intrusive interstitial on entry from search.

Pass F: risk, 5 checks

This pass is missing from almost every checklist you can download, and it is where the expensive problems are. Every item here is a spam policy exposure that will not show up in a crawler report.

1. No third-party content published on the domain mainly to borrow its ranking signals. Editorial oversight is not a defence, and I set out why in parasite SEO and site reputation abuse.
2. No conditional logic serving crawlers different content. The twenty-minute test is in cloaking in SEO.
3. No mass-generated pages built per query variant, which is scaled content abuse by Google’s own definition.
4. No inherited private network still pointing at the site, and no historic link buying that has not been dealt with.
5. Authorship is real and findable. A byline that leads nowhere is a trust problem on any page a reader would act on.

How to read the result

An audit that produces 41 findings has told you nothing. An audit that produces four findings and says which one to fix first has done the job. My rule is that a finding earns its place in the report only if I can state the mechanism by which fixing it changes traffic. If I cannot, it goes in an appendix, and the appendix is explicitly labelled as housekeeping.

If you are running this because traffic has already fallen rather than as routine maintenance, the shape of the fall narrows the search before you start. Google’s own guidance on debugging traffic drops separates algorithmic updates, technical faults, security issues, spam violations, seasonality and market shifts, and recommends extending the Performance report to 16 months so a seasonal pattern is visible as a seasonal pattern. Report average position and impressions alongside clicks, because stable positions with falling clicks is a different diagnosis requiring a different remedy.

That diagnostic order, and the question of whether you are looking at a penalty at all, is the subject of my pillar on Google penalty recovery. If the audit turns up something in Pass F, start there rather than working through the rest of the list, and if you need to tell a manual action from an algorithmic demotion first, that is covered in manual action penalty or algorithmic demotion.

Royking Niba is an SEO and GEO consultant specialising in penalty and spam-update recovery, with more than 8 million organic visits recovered for clients. Google’s crawl budget, traffic-drop and Core Web Vitals guidance cited here was checked against its published documentation on 22 September 2026.