SEO Audit Checklist: What to Check and How to Run It for Free
Short answer: An SEO audit checklist is a fixed list of checks that you work through in order of impact: first whatever can make pages invisible (blocked crawling, noindex, wrong status codes), then speed, on-page basics, content, technical hygiene, links and images, languages and structured data, and last readiness for AI crawlers. Below you find eight groups with a "what good looks like" for every check. You can check most of it for free with SEOgrinder, without an account. No audit can guarantee rankings; it finds the errors that stand in your way.
What is an SEO audit checklist?
An SEO audit is a systematic check of a website against a list of known requirements. The list is the checklist. It answers three plain questions: can search engines reach and index your pages, can people use them without frustration, and can a search engine tell what each page is about?
What an audit is not: it is not keyword research, it is not a ranking report, and it is not a promise. It finds errors and gaps in the technical and on-page foundation. Whether a page you have fixed then ranks higher depends on many things outside the checklist, and nobody can guarantee a position. What the checklist does give you is a way to rule out the avoidable problems, so that a weak result is not caused by a blocked file or a broken redirect.
In which order should you work through an SEO audit checklist?
Order by impact, not by how easy a check is. A site with a perfect title on every page gains nothing if the pages are blocked in robots.txt. A sensible order:
- Can the page be found and indexed at all? Crawling, noindex, status codes, sitemap. If this fails, nothing else matters.
- Is the page usable? Speed and stability, measured on phones as well as on desktop.
- Does the page say clearly what it is? Title, description, canonical, headings, language.
- Is the content worth indexing? Enough substance, no duplicates, signs of who wrote it and when.
- Is the foundation sound? HTTPS, compression, caching, security headers.
- Do links and images work? Broken links, missing alt texts, share images.
- Do multilingual setups and structured data hold up? hreflang, JSON-LD.
- Can AI systems reach and read the page? Rules for AI crawlers, HTML that works without JavaScript.
The report of SEOgrinder follows the same idea: its task list is sorted by effect, so the first entries are the ones to fix first.
The SEO audit checklist in eight groups
Every table has two columns: the check, and what good looks like. Numbers appear only where a published source gives them.
1. Crawling and indexing
| Check | What good looks like |
|---|---|
| robots.txt | Answers at /robots.txt with status 200 and blocks only what you really want blocked. The most specific matching rule wins; if Allow and Disallow are equally specific, Allow wins (RFC 9309). It is no access protection: it only asks well-behaved bots to stay away. |
| noindex | Set only on pages that should stay out of the index. No important page carries a robots directive that says noindex. |
| Sitemap | Lists the pages you want indexed and is announced in robots.txt with a Sitemap: line and the full URL. At most 50,000 URLs and 50 MB per file, uncompressed (sitemaps.org). |
| Status codes | Live pages answer 200. A moved page answers 301 and points to the equivalent new page. A page that is gone answers 404 or 410. |
| Redirect chains | A redirect leads to the final address in one step. Google follows up to 10 steps by default, but every extra step is wasted time. A 301 or 308 is a strong signal, a 302 or 307 a weak one (Google). |
| Soft 404 | A page that says "not found" also sends the status 404. A page that answers 200 but shows an error or an empty page is reported as a soft 404 in Search Console. Details in our article on soft 404 errors. |
2. Speed
| Check | What good looks like |
|---|---|
| LCP (Largest Contentful Paint) | At most 2.5 seconds |
| INP (Interaction to Next Paint) | At most 200 milliseconds. INP replaced FID as a Core Web Vital in March 2024. |
| CLS (Cumulative Layout Shift) | At most 0.1 |
| How it is judged | At the 75th percentile of page loads, separately for phones and desktop (web.dev) |
| Lab and field data | Look at both: a lab run (Lighthouse in PageSpeed Insights) shows what a test sees, real-visitor data (CrUX) shows what people experienced. |
3. Page on Google
| Check | What good looks like |
|---|---|
| Title | Every page has its own title that describes that page. |
| Meta description | Every page has its own short summary, written for people. |
| Canonical | Each page names the one address under which it should be indexed. |
| H1 | One H1 per page is the usual practice; it names the topic. |
| Heading order | H2 under H1, H3 under H2. Headings structure the text; they are not for font sizes. |
| lang attribute | <html lang="en"> matches the language of the page. It helps browsers and assistive technology. Google does not use it to detect the language. |
| URL quality | Readable, stable addresses without needless parameters. |
4. Content
| Check | What good looks like |
|---|---|
| Word count | Enough to answer the question the page is about. No fixed minimum is proven, so do not pad. |
| Focus keyword | The topic is clear from title, H1 and first paragraph. Repeating the keyword more often does not help; write for readers. |
| Duplicates | No two pages share the same title, description or H1, and near-identical pages are merged. |
| Thin pages | Pages with almost no content are expanded, merged into a better page, or removed with the right status code. |
| Readability | Short paragraphs, plain words, clear structure. |
| Author and date | Articles show who wrote them and when. Trust pages (about, contact, imprint, privacy) exist and are linked. |
5. Technology and security
| Check | What good looks like |
|---|---|
| HTTPS | The whole site is served over HTTPS with a valid TLS certificate. |
| One address per page | The variants http and https, with and without www, all lead to a single version. |
| Mixed content | No http resources (images, scripts) on https pages. |
| HTTP/2 | The server offers HTTP/2. |
| Compression | Text files such as HTML, CSS and JavaScript are sent compressed. |
| Caching | Static files carry cache headers; you decide deliberately how long the HTML may be cached. |
| Security headers | Set according to the documentation of your server or platform. |
6. Links and images
| Check | What good looks like |
|---|---|
| Internal links | No link points to a missing page (4xx or 5xx), and links do not go through redirects: point them at the final address. |
| Findability | Every important page can be reached through internal links. A page without any internal link is an orphan, and a page buried many clicks deep is hard to find. Google lists internal links among the basics for making content discoverable (AI features). |
| Images | All image files load. |
| Alt texts | Meaningful images have a short, factual alt text. Purely decorative ones have an empty alt attribute. |
| Share image | og:image is an absolute https address; Facebook recommends at least 1200 × 630 px and a ratio of about 1.91 : 1, with a file of at most 8 MB (Facebook). See our article on Open Graph tags. |
7. Languages and structured data
| Check | What good looks like |
|---|---|
| hreflang | Every language version names itself and all the others, with complete addresses including https://. Return links are mandatory, or the information can be ignored. x-default points to a fallback page for all other languages. One method is enough: HTML head, HTTP header or sitemap; using several brings no benefit in Search (Google). |
| Language codes | Valid codes: ISO 639-1 language, optionally with an ISO 3166-1 Alpha-2 region. |
| Text language | The language of the text matches what you declare. |
| Structured data | JSON-LD or Microdata is readable, the types are the intended ones, and no required field is missing. |
8. AI readiness
| Check | What good looks like |
|---|---|
| Rules for AI crawlers | A deliberate decision per bot in robots.txt. OpenAI and Anthropic each document separate bots for training, search and user requests. See our article on robots.txt for AI crawlers. |
| HTML without JavaScript | The main text and the links are in the HTML the server sends. Google renders JavaScript, but a 2024 analysis by Vercel and MERJ found that none of the large AI crawlers executed it (source). That is the 2024 state and has not been re-verified since. |
| llms.txt | Optional. A benefit is not proven. See What is llms.txt?. |
| Google AI features | Google states that AI Overviews and AI Mode have no additional requirements beyond the normal SEO foundations: the page must be indexed and eligible to show with a snippet. |
How to run this SEO audit checklist in one short session with SEOgrinder
SEOgrinder is free, needs no account and checks most of the points above in one run. The scan itself takes a short while; how long the fixes take depends on what it finds.
- Enter the address. Open SEOgrinder, type the address of a public page and start the analysis.
- Read the grade and the task list. The report gives a grade and a list of tasks sorted by effect. It is split into six areas: Speed, Page on Google, Accessibility, Technology & security, AI readiness and Website.
- Start at the top of the Tasks tab. Fix the first entries first, then go down the list. For site-wide findings such as duplicate titles, near-identical pages or orphan pages, the report crawls your site and lists what it found.
- Keep what you need. Use Share the report as PDF; in your browser's print dialog, choose "Save as PDF". Then you can hand the report to a client, a colleague or your developer.
- Check again after fixing. Reports are cached for 24 hours. Check again forces a fresh run, so you see whether a fix worked. The button can be limited to protect the checked website from too many requests; the report tells you when.
- Optional: hand it to a coding assistant. Hand over to AI turns the report into a work order in Markdown. Each task has a "Done when" condition that can be checked.
If you use Google Search Console, SEOgrinder can also evaluate a Search Console export (the direct API connection is only available when you run SEOgrinder on your own computer). That adds how real searchers find and click your pages in Google.
One limit, stated openly: SEOgrinder checks the technical foundation. It does not track rankings and does not measure whether ChatGPT, Gemini or Perplexity name your brand. Services for that exist; it is a different job.
How often should you run an SEO audit?
There is no proven ideal interval. A rule of thumb that works in practice:
- A full pass after a launch, a redesign, a migration or a change of CMS or hosting.
- A short pass whenever you change templates, robots.txt, redirects or the sitemap.
- A regular look at Search Console, which shows problems that appear over time.
Common mistakes
- Trying to fix everything at once. A list with fifty entries is not a plan. Take the top three, fix them, check again, repeat.
- Putting effort before effect. Changing a hundred meta descriptions is easy, but a blocked directory is worth more attention.
- Looking only at the overall grade. A grade summarises; the tasks tell you what to do. Two sites with the same grade can have very different problems.
- Skipping the recheck. A fix that was never verified is a guess. Run the check again.
- Treating the checklist as a ranking promise. It removes obstacles. It does not create demand, authority or good content.
- Auditing only the homepage. Templates repeat: one broken template breaks hundreds of pages.
- Blocking things by accident. A robots.txt copied over from a staging site that blocks everything is a typical way to make a whole site invisible.
FAQ
Is an SEO audit checklist enough to rank higher?
No. It finds avoidable errors. Rankings depend on content, competition and many other factors, and nobody can guarantee a position.
How long does an SEO audit take?
Most of the time goes into working through the tasks, not into the scan. How long it takes depends on what the scan finds and on the size of the site.
Do I need paid tools?
Not for the checks on this page. SEOgrinder is free and needs no account. Search Console and PageSpeed Insights complement it.
Which checks matter most?
Group 1, crawling and indexing. If search engines cannot reach or index a page, nothing else on the list helps.
Does the checklist cover AI search?
It covers the technical basis: can AI systems reach and read your page. It does not tell you whether an assistant mentions you. Google says it needs no extra steps for AI Overviews beyond the usual SEO foundations.
Your next step
Run the free scan on your site with SEOgrinder, take the three tasks at the top of the list, fix them, and press Check again. Then repeat with the next three.