Technical SEO Checklist 2026: 50+ Items to Audit Your Site

Technical SEO is the foundation every other SEO discipline rests on. You can publish the best content in your niche, earn world-class backlinks, and target the right keywords, but if Googlebot cannot crawl your pages, render your JavaScript, or trust your canonical signals, none of it converts into rankings. This checklist walks through the 50+ items we audit on every site, organized into seven buckets — crawlability, indexability, site architecture, performance, structured data, internationalization, and security. Each item includes the severity, how to detect the problem, and how to fix it.

Use the list top to bottom for new audits, or jump to the section that matches the symptom you are debugging. Items marked Critical can block indexing or rankings entirely; items marked High measurably impact performance or crawl efficiency; items marked Medium are best-practice refinements.

1. Crawlability Audit

Crawlability is the first gate. If search engines cannot reach a URL, nothing else matters. The most common crawlability problems are not 404s — they are misconfigured robots.txt files, accidentally blocked subdirectories, and overly aggressive server-level rate limiting that throttles Googlebot.

robots.txt configuration (Critical)

Open https://yourdomain.com/robots.txt in a browser. Confirm it returns HTTP 200, is under 500 KB, and does not contain a global Disallow: / outside of staging environments. Use Google Search Console's robots.txt Tester to verify that important sections (your blog, product pages, category pages) are not accidentally disallowed. Common mistakes include blocking /wp-content/ (which prevents CSS and JS from rendering correctly) and leaving development-era rules like Disallow: / in place after launch.

XML sitemap submission (High)

Every site needs at least one XML sitemap submitted through Google Search Console and Bing Webmaster Tools. Confirm that the sitemap returns 200, contains only canonical URLs, includes accurate lastmod dates, and is referenced from your robots.txt with a Sitemap: directive. Large sites should split sitemaps into multiple files of up to 50,000 URLs each and use a sitemap index file. Stale lastmod values that always say "yesterday" train Google to ignore the field — only update it when content actually changes.

Crawl errors in Search Console (High)

Inside Google Search Console, the Pages report categorizes URLs as Indexed, Not Indexed, or Excluded with reasons attached. Pay special attention to Soft 404, Crawled — currently not indexed, and Discovered — currently not indexed. Soft 404s often indicate empty category pages or thin product pages that need consolidation. "Crawled — currently not indexed" is Google's polite way of saying the content was not worth indexing; address quality, uniqueness, and internal linking signals.

Server response codes (Critical)

Run a full-site crawl with Screaming Frog, Sitebulb, or any Lighthouse-based crawler. Every URL in your sitemap should return HTTP 200. Redirect chains (302 → 301 → 200) waste crawl budget and dilute signals — flatten all chains so each redirect goes directly to its final destination. Audit 404s and 410s: a small number is normal, but if you have hundreds of broken internal links, fix them at the source rather than masking with redirects.

Crawl budget for large sites (Medium)

If your site has more than 100,000 URLs, crawl budget becomes a real constraint. Pull server logs and filter to Googlebot user agents. Look for wasted crawls on faceted-navigation URLs, search results pages, calendar pages, or session-ID URLs. Block these patterns in robots.txt, mark them noindex, follow, or use canonical tags to consolidate. Faster server response times also directly increase the number of pages Googlebot will fetch per session.

2. Indexability Audit

Once Google can crawl a URL, it decides whether to index it. The indexability layer is where most "I published this and it never showed up in Google" problems live.

Meta robots and X-Robots-Tag (Critical)

For every important page, view the page source and confirm there is no <meta name="robots" content="noindex"> tag and no X-Robots-Tag: noindex HTTP header. The most damaging technical SEO mistake we see is a noindex tag left over from staging that quietly suppresses thousands of pages. Spot-check after every deploy. The noindex directive overrides any positive signal — sitemaps, links, content — so its presence is always intentional or a bug.

Canonical tags (Critical)

Every indexable page should declare a single, self-referencing canonical tag pointing to the preferred version of the URL. Cross-domain canonicals are legitimate but rarely used. Common canonical mistakes: pointing every page to the homepage (devastating), missing canonicals on paginated archives, canonical tags that include tracking parameters, and conflicting canonical signals from HTTP headers vs. HTML. Use the URL Inspection Tool in Search Console to see which canonical Google chose — it does not always honor yours.

Duplicate content (High)

Duplicate content rarely causes a penalty, but it splits ranking signals across multiple URLs and confuses Google about which version to serve. Common sources: www vs. non-www, HTTP vs. HTTPS, trailing slashes, URL parameter combinations, mobile-vs-desktop separate domains, and printer-friendly versions. Force a single canonical form via 301 redirects and confirm in the URL Inspection Tool.

Soft 404 detection (Medium)

A soft 404 is a page that returns HTTP 200 but tells the user (and Googlebot) that nothing was found — "No products match your search," "This category is empty," "User has been deleted." These pages waste crawl budget and damage quality signals. Either return a proper 404 status, redirect to a relevant alternative, or rebuild the page with meaningful content.

Indexed vs. submitted ratio (Medium)

In Search Console, compare the number of URLs submitted via sitemap to the number actually indexed. A healthy ratio is 90%+ for high-quality sites. Below 80% suggests quality, duplication, or thin-content issues. A sudden drop usually signals an algorithm update, a noindex deployment bug, or a robots.txt regression.

3. Site Architecture & URL Structure

Architecture is how Google understands your site's hierarchy. A clean, shallow structure with descriptive URLs and consistent navigation distributes link equity efficiently and reinforces topical authority.

URL structure (High)

Use lowercase URLs with hyphens (not underscores or spaces). Keep URLs short and descriptive — under 75 characters where possible. Avoid stop words, dates that will become stale, and IDs that mean nothing to users. Once a URL is published and earning links, change it only when absolutely necessary and always with a 301 redirect.

Click depth (High)

Important pages should be reachable from the homepage in three clicks or fewer. Click depth correlates with crawl frequency and indexation quality — pages buried at depth 6 or 7 get crawled rarely and tend to drop out of the index. Use breadcrumbs, hub pages, and contextual internal links to shorten paths to revenue-critical content.

Breadcrumb navigation (Medium)

Implement breadcrumbs on every page that is not the homepage, mark them up with BreadcrumbList schema, and ensure the visible breadcrumbs match the structured-data version. Breadcrumbs appear in Google search results, improve perceived navigation, and provide context to ranking algorithms.

Pagination handling (Medium)

Google deprecated rel="next" and rel="prev" as ranking signals in 2019, but pagination still needs careful handling. Each paginated page should have a self-referencing canonical, not point to page one. Make sure paginated content is reachable from internal links rather than only via JavaScript "Load More" buttons that Googlebot may not execute.

Faceted navigation (High)

Faceted navigation (color, size, brand filters on category pages) generates exponential URL combinations and is the single biggest source of crawl-budget waste on ecommerce sites. Decide per-facet whether the combination has search demand worth indexing. Index category + one valuable facet like "blue running shoes." Block or noindex the rest, and use nofollow on facet links you do not want crawled at all.

4. Performance & Core Web Vitals

Core Web Vitals are Google's user-experience signals: Largest Contentful Paint (LCP), Interaction to Next Paint (INP, which replaced FID in 2024), and Cumulative Layout Shift (CLS). Each has a "Good," "Needs Improvement," and "Poor" threshold. Aim for all three to be in the Good range on at least 75% of page views.

Largest Contentful Paint < 2.5s (Critical)

LCP measures how quickly the largest visible element renders. The most common LCP problems are unoptimized hero images, late-loading web fonts, and render-blocking JavaScript. Fixes: preload the LCP image with <link rel="preload">, serve modern formats (AVIF, WebP), use responsive srcset, defer non-critical CSS and JS, and self-host fonts with font-display: swap.

Interaction to Next Paint < 200ms (Critical)

INP measures responsiveness — the delay between user interaction and visual feedback. Poor INP usually means heavy JavaScript on the main thread. Audit with the Chrome DevTools Performance panel and the web-vitals JavaScript library. Break up long tasks with setTimeout, scheduler.yield(), or web workers. Ship less JavaScript: code-split aggressively and lazy-load third-party scripts.

Cumulative Layout Shift < 0.1 (Critical)

CLS measures unexpected layout movement during page load. Always declare explicit width and height attributes on images and iframes. Reserve space for ads, embeds, and dynamically inserted content with min-height containers. Avoid injecting content above existing content after first paint.

HTTP/2 or HTTP/3 (High)

Use curl -I --http3 https://yourdomain.com or your CDN's diagnostics to confirm HTTP/2 or HTTP/3 is active. Both protocols multiplex requests over a single connection, eliminating the head-of-line blocking that hurt HTTP/1.1. Most CDNs (Cloudflare, Fastly, Cloudfront) enable HTTP/3 with a single toggle.

Image optimization (High)

Images are the largest payload on most pages. Convert to AVIF (best compression) or WebP (broader support) with JPEG fallbacks. Use responsive images with srcset and sizes. Apply lazy loading via loading="lazy" for below-the-fold images — but never on the LCP image. Compress before upload using lossy compression at quality 75–85 for photos.

Font loading (Medium)

Web fonts are a frequent LCP and CLS culprit. Self-host fonts rather than loading from Google Fonts. Use font-display: swap to show fallback text immediately. Preload the one or two fonts above the fold. Subset fonts to only the characters you use, and consider variable fonts to consolidate multiple weights into one file.

Resource hints (Medium)

Use preconnect for critical third-party origins (analytics, fonts, CDN). Use preload for the LCP image and critical fonts. Avoid prefetch for things the user is unlikely to need — it wastes bandwidth and competes with critical resources.

5. JavaScript SEO & Rendering

Google renders JavaScript, but rendering is expensive and happens in a delayed second pass. JavaScript SEO is about minimizing the gap between what users see and what the initial HTML response contains.

Server-side rendering or static generation (High)

For content-critical pages — landing pages, product pages, blog posts — render HTML on the server (SSR) or at build time (SSG). Frameworks like Next.js, Nuxt, Remix, Astro, and SvelteKit all support these patterns. Pure client-side rendering (CSR) works for SEO but adds risk, delays indexing, and requires careful crawl-budget management.

Hydration mismatches (Medium)

When the server-rendered HTML differs from what the client renders, React, Vue, and Svelte all log hydration warnings. These mismatches can cause Googlebot to see a different page than the user — sometimes wildly different. Fix mismatches at the source rather than ignoring the console warning.

Test rendered HTML (High)

Use the URL Inspection Tool in Search Console to see the actual HTML Googlebot rendered. Compare it to "View Page Source" (the initial HTML). If your primary content, headings, or internal links only appear in the rendered version, your initial HTML is too thin. For dynamic rendering questions, the Mobile-Friendly Test and Rich Results Test also show rendered HTML.

Avoid blocking JavaScript and CSS (Critical)

Never disallow .js or .css files in robots.txt. Googlebot needs them to render the page correctly and evaluate mobile-friendliness. Blocking CSS can cause Google to see your site as broken or non-mobile-friendly, which can damage rankings significantly.

Lazy loading and infinite scroll (Medium)

Implement infinite scroll with proper pagination URLs underneath — each "page" of content should be reachable via a distinct URL with a 200 status. Use the Intersection Observer API for lazy loading, and ensure crucial content is not lazy-loaded behind interactions Googlebot will not perform.

6. Structured Data & Schema

Structured data does not directly boost rankings, but it earns rich results in SERPs — star ratings, sitelinks, FAQ accordions, image carousels — that dramatically improve click-through rates and visibility.

Use JSON-LD format (High)

Google recommends JSON-LD over Microdata or RDFa. JSON-LD lives in a single <script type="application/ld+json"> block in the head or body, decoupled from your HTML markup. This makes it easy to template, maintain, and update without touching the rendered content.

Schema types to implement (High)

At minimum, every site should have Organization or LocalBusiness on the homepage, WebSite with a Sitelinks search box, and BreadcrumbList on every page. Article-type pages need Article, NewsArticle, or BlogPosting. Product pages need Product with Offer and AggregateRating. FAQ pages need FAQPage. How-to content needs HowTo.

Validate every schema block (High)

Use the Schema Markup Validator (schema.org) for spec compliance, and Google's Rich Results Test for eligibility for specific rich result types. Errors block rich result eligibility entirely; warnings are best-practice misses. Re-validate after every schema change.

Avoid schema spam (Critical)

Schema must match the visible content. Marking up content that is not actually on the page (fake reviews, fabricated FAQ, hidden ratings) triggers manual actions and demotions. Google explicitly enforces this — schema spam is one of the few schema-related signals that can hurt you directly.

7. Internationalization (hreflang)

If your site serves multiple languages or countries, hreflang tells Google which version to show in which market. Misconfigured hreflang is a top-10 source of international SEO problems.

hreflang annotations (High for multilingual sites)

Implement hreflang tags in the HTML <head>, HTTP headers, or sitemap. Every alternate version must reference every other version, including itself (the return-link rule). Use ISO 639-1 for language and ISO 3166-1 Alpha 2 for region: en-US, en-GB, es-MX, fr-CA. Include an x-default for users whose language or location does not match any specific version.

Language and region selection (Medium)

Decide on a URL strategy: ccTLDs (example.de), subdomains (de.example.com), or subdirectories (example.com/de/). Subdirectories are easiest to manage and consolidate authority on a single domain. Avoid auto-redirecting users based on IP — let them choose, and remember the choice. Google explicitly warns against IP-based redirects that block crawlers from seeing all language versions.

8. HTTPS & Security

HTTPS has been a confirmed ranking signal since 2014 and is now table stakes. Beyond the small ranking lift, modern browsers actively flag HTTP sites as "Not Secure," which devastates user trust and conversion rates.

Force HTTPS site-wide (Critical)

Redirect every HTTP URL to its HTTPS equivalent with a 301. Add the Strict-Transport-Security (HSTS) header with a long max-age (at least 31536000 — one year) to force browsers to use HTTPS automatically. Submit your domain to the HSTS preload list once HSTS is stable for safer enforcement.

Valid certificate (Critical)

Use a certificate from a recognized authority — Let's Encrypt is free and trusted, and most managed hosts auto-renew. Confirm there are no certificate chain issues, mismatched hostnames, or expired intermediate certificates. Run https://www.ssllabs.com/ssltest/ against your domain and target a grade of A or A+.

Mixed content (High)

Every resource loaded on an HTTPS page must also be HTTPS — no HTTP images, scripts, stylesheets, or iframes. Modern browsers block most mixed content by default, breaking pages. Audit with the browser DevTools console and a crawler that flags mixed content.

Security headers (Medium)

Set Content-Security-Policy, X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin, and Permissions-Policy appropriately. None of these are direct ranking factors, but they protect users, prevent injection-driven SEO attacks, and signal a well-maintained site.

9. Mobile-First Indexing

Google has used mobile-first indexing for all sites since late 2023. The mobile version of your site is the version Google indexes and ranks. If your mobile site is a stripped-down version of desktop, you have a problem.

Content parity (Critical)

The mobile version must contain the same primary content, headings, images, links, and structured data as the desktop version. Hidden-by-default mobile content (accordions, tabs) is fine — Google treats it the same — but content omitted entirely from mobile is invisible to the index.

Responsive design (High)

Use a single responsive codebase rather than a separate m. subdomain. Responsive eliminates duplicate-content concerns, simplifies maintenance, and ensures Googlebot sees the same content as both mobile and desktop users.

Viewport meta tag (High)

Include <meta name="viewport" content="width=device-width, initial-scale=1"> on every page. Missing or misconfigured viewport tags trigger "Not Mobile-Friendly" warnings in Search Console and demote rankings on mobile queries.

Tap target size and font size (Medium)

Tap targets should be at least 48×48 pixels with adequate spacing. Body text should be at least 16px. The Mobile Usability report in Search Console flags violations across your site.

10. Monitoring & Tooling

A one-time audit catches today's problems; continuous monitoring catches tomorrow's. The minimum monitoring stack:

• Google Search Console for indexation, performance, Core Web Vitals, and manual actions. Free, indispensable.
• Bing Webmaster Tools for Bing-specific signals and the 7–10% of queries Bing handles. Often catches issues earlier than GSC because of its faster crawl reporting.
• A site crawler — Screaming Frog (free up to 500 URLs), Sitebulb, or JetOctopus for log file analysis on enterprise sites.
• A real-user monitoring (RUM) tool — Google's CrUX, SpeedCurve, or your own web-vitals JavaScript implementation. Lab data lies; field data is what Google uses for ranking signals.
• Log file analysis for sites with crawl-budget concerns. Logflare, Splunk, or a periodic export of access logs into a notebook is enough to start.

Prioritizing the Checklist

You will never have time to address every item at once. Triage in this order:

1. Indexability bugs first. A misplaced noindex or robots.txt block is a five-minute fix that can recover thousands of indexed pages.
2. Critical Core Web Vitals next. Pages stuck in "Poor" LCP or INP affect rankings on every query.
3. Site architecture and internal linking. Investments here compound — every new page benefits from a cleaner structure.
4. Structured data for top revenue pages. Rich results boost CTR more reliably than ranking-position changes for many queries.
5. JavaScript rendering improvements. Higher effort, but unblocks long-term performance.
6. Refinements — security headers, hreflang polish, faceted-nav tuning, schema expansion.

Document every finding in a shared tracker, assign owners, and re-audit on a fixed cadence. Technical SEO is never "done"; it is a baseline you maintain so that content and links can do their job.