- Audit in pipeline order, not tool order. Crawl and index first, then content, then authority. A fix downstream is worthless while an upstream gate is closed.
- Crawlers detect. They do not prioritize. A page with a broken title tag that nobody visits is not a finding, it is a distraction from the one that is deindexed.
- The whole 12-point pass runs on free tools: Search Console, Analytics, PageSpeed Insights, the Rich Results Test, and a free crawler tier.
- Google added a Generative AI performance report to Search Console on June 3, 2026. AI Overviews and AI Mode impressions can now be isolated from ordinary Search data, so the AI layer of an audit is measurable rather than theoretical.
- Pew Research Center found users click a traditional result on 8% of visits when an AI summary appears, versus 15% without, and click a source cited inside the summary on just 1%. Flat rankings with falling clicks is a category of problem, not a mystery.
- Run the full pass quarterly, check indexing and traffic monthly, and re-audit immediately after any redesign or replatform.
You ran a free SEO checker, it gave your site a score of 62 out of 100 and a list of 217 issues, and you have no idea which line on that list is the reason nobody finds you. That is the normal experience of auditing a website, and it is a prioritization problem dressed up as a detection problem.
An SEO audit is a structured review of everything that decides whether search engines can find, understand, and recommend your site: crawling and indexing, content quality, page speed, structured data, backlinks, and now AI answer visibility. The output that matters is not a score. It is a ranked list of fixes, hardest-hitting first.
What is an SEO audit, and do I actually need one?
An SEO audit is a diagnostic pass over your site that answers three questions in sequence: can search engines reach your pages, do they understand what those pages are about, and do they have any reason to prefer you over the alternatives. Everything on any audit checklist is a sub-question of one of those three.
You need one when something is wrong and you cannot name it. Traffic slid and nobody changed anything. You publish steadily and nothing ranks. You migrated platforms three months ago and never quite recovered. In each case the useful move is not to publish more, it is to find the blocker, because effort applied above a closed gate produces nothing at all.
You also need one on a schedule, even when nothing looks wrong. Sites break quietly. A staging robots.txt gets pushed to production, a redesign moves body copy into JavaScript, a plugin update starts emitting noindex on an entire template. None of those announce themselves. They show up as a slow bleed you notice a quarter late.
My rankings did not move but my traffic did. Will an audit catch that?
Only if the audit looks above your listing as well as at it. Holding position while losing clicks is now its own diagnosis, and it has nothing to do with the issues a crawler reports. What changed is that the answer often appears before the link does.
Pew Research Center tracked the real browsing behaviour of 900 US adults and found that when an AI summary appeared, users clicked a traditional search result on 8% of visits, against 15% of visits with no summary. They clicked a source cited inside the summary itself on 1% of visits. Semrush separately reports AI Overviews on commercial searches growing 71% over six months, which is vendor data and directional, but it points the same way.
So a 2026 audit has to answer a question the 2019 version never asked: are you present in the answer, or only in the list beneath it. That is why checks 11 and 12 below exist, and why an audit that stops at rankings now describes a shrinking share of your visibility. We break the mechanics down separately in how to rank in Google AI Overviews, and the vocabulary in GEO vs SEO, AEO and LLMO.
What do I need before I start?
Less than the tool vendors suggest. The complete 12-point pass below runs on free software, and the paid crawlers mostly buy you speed and reporting rather than findings you could not otherwise reach.
- Google Search Console. The only source that tells you what Google actually did with your site, as opposed to what a third party estimates. If it is not set up, start there: what Search Console is and how to use it.
- Google Analytics 4. Behaviour and conversions, so you can tell a traffic problem from a traffic-that-does-not-convert problem. See how to check website traffic.
- A crawler. Screaming Frog crawls 500 URLs free, which covers most small business sites in one pass.
- PageSpeed Insights for Core Web Vitals, and Google's Rich Results Test for structured data.
- A browser with JavaScript disabled. Free, and it catches a failure mode nothing else surfaces.
One discipline before you open any of them: decide what you are trying to fix. An audit run without a question produces a list. An audit run against "why did organic traffic fall 30% since May" produces an answer.
The 12-point SEO audit checklist
Work these in order. The sequence is not arbitrary: each check sits upstream of the ones below it, so a failure at step 1 makes steps 4 through 10 unmeasurable. Resist the urge to start with the interesting content work.
Is Google actually indexing my pages?
Open the Page indexing report in Search Console and compare the number of indexed pages against the number you expect. Then read the "Not indexed" reasons, because they are diagnoses, not warnings. "Excluded by noindex tag" on a money page is an emergency. "Crawled, currently not indexed" across a template usually means quality or duplication, not a technical fault. If nothing is indexed at all, stop the audit and work through why your website is not showing up on Google first.
Is more than one version of my site live?
Type all four variants into a browser: with and without www, on http and https. Exactly one should load, and the other three should redirect to it with a 301. If two versions both serve a 200, you have split every ranking signal your site has ever earned across duplicates. Then check that each page declares a self-referencing canonical tag pointing at the version you kept. This is a fifteen-minute check that occasionally explains everything.
Which pages lost traffic, and when exactly?
In the Search Console Performance report, compare the last three months against the previous three, sort by click difference, and look at the losers. The shape of the loss names the cause. A cliff on one date points at an algorithm update or something you shipped that day. A slow slide points at decay or a competitor. Losses concentrated on one template point at a technical fault in that template. Cross-check with how to check your website ranking so you separate a position loss from a click loss.
Are my titles and descriptions earning the click?
Filter the Performance report to pages ranking in positions 3 to 10 and sort by impressions. High impressions with a click-through rate well under 2% usually means the title is not answering the query the searcher typed. Then run the crawler for missing, duplicated, or truncated titles. Fix the high-impression pages first: rewriting the title on a page with 40 impressions a month is busywork, and rewriting it on one with 12,000 is a same-week win.
Is my content thin, stale, or competing with itself?
Two failures live here. Thin pages have nothing to rank: tag archives, near-empty service pages, product pages with the manufacturer's description. Cannibalization is subtler, and it happens when several of your own pages target the same query, so Google keeps swapping which one it shows and none of them consolidate. To find it, search site:yourdomain.com "your keyword" and see how many of your own pages compete. The fix is usually to merge them into one strong page and 301 the rest. Our pillar on building an SEO-optimized website covers the structure that prevents this.
Do my pages load fast enough to keep?
Run PageSpeed Insights on your homepage, your top landing page, and one product or service page, and read the field data rather than the lab score. Three thresholds matter: Largest Contentful Paint under 2.5 seconds, Interaction to Next Paint under 200 milliseconds, and Cumulative Layout Shift under 0.1. Core Web Vitals are a modest ranking factor and a large conversion factor, so treat a failure as a revenue problem that happens to also be an SEO problem. The playbook chapter on rendering and speed goes deeper.
Are any of my pages orphaned?
An orphan page has no internal links pointing at it, so it gets discovered late, crawled rarely, and inherits no authority from the rest of the site. Compare your crawler's list of found URLs against your sitemap: anything in the sitemap that the crawl never reached by following links is an orphan. While you are in there, check that your most important pages are reachable within three clicks of the homepage, and that your internal anchor text describes the destination instead of saying "click here".
Am I leaking authority through broken pages and redirect chains?
Pull every 404 and every 3xx from the crawl. Internal links pointing at 404s waste crawl budget and strand users, and they are trivially fixable by updating the link. Redirect chains, where A points to B points to C, dilute signal and slow the page, so repoint the first hop straight at the final destination. Pay particular attention to old URLs that still have backlinks, since a 404 there is inbound authority you already earned and are throwing away.
Does my structured data actually validate?
Run your key templates through Google's Rich Results Test and confirm two things: that the schema is present in the server-rendered HTML, and that it parses without errors. Schema injected by a tag manager frequently fails the first condition, because the crawlers that matter most for AI answers do not run JavaScript. Match the type to the page's job, so Article on posts, Product on products, FAQPage on genuine question blocks. The schema chapter in our playbook covers which types are worth the effort.
Is my backlink profile an asset or a liability?
Open the Links report in Search Console and look at three things: how many distinct domains link to you, whether the anchor text reads naturally or is stuffed with your target keyword, and whether the linking sites are ones a human would recognise. Sudden spikes of unrelated foreign-language domains are the classic negative signal. Work through running a backlink audit for the disavow decision, four free ways to check your backlinks for the data pull, and what domain authority means before you read too much into any single score. Our free backlink finder suggests niche-matched places to earn the next ones.
Do AI engines show up in my Search Console at all?
This check became possible on June 3, 2026, when Google launched a Generative AI performance report in Search Console. It isolates impressions from AI Overviews and AI Mode, broken out by page, country, device, and date. Until then that visibility was blended into your general Search numbers with no way to separate it. Read it for presence and pattern: which of your pages surface in generative features at all, and whether that set overlaps with the pages you actually care about. Note the limits before you build a strategy on it. The report currently shows impressions only, with no clicks, no click-through rate, no queries, and no average position, and Google rolled it out to a subset of site owners first, so an empty report may mean you are not in the test group rather than absent from AI answers.
Am I getting cited in AI answers, or just crawled?
Impressions tell you a link appeared somewhere. They do not tell you whether an engine recommends you when a buyer asks a real question. For that, write down the ten questions your customers actually ask before buying, run them through ChatGPT, Perplexity, and Google AI Mode, and record three things per answer: are you cited, are you mentioned without a link, and who gets named instead of you. Our free prompt scanner automates the sweep, and the measurement pillar explains why this has to be done per engine, since citation sets barely overlap between them. The per-engine mechanics are in ChatGPT SEO.
One prerequisite sits underneath checks 11 and 12, and it fails more often than either. If an AI search crawler cannot fetch your pages, no amount of content work registers anywhere. Confirm your robots.txt and your edge rules are not blocking the search bots, which are a different set of user agents from the training bots: which AI crawlers to block and which to allow, and the crawler access chapter for the full verification. Getting this wrong is the most expensive silent failure in the whole audit, and it is why technical GEO exists as a discipline.
My tool found 200 issues. Which ones actually matter?
Almost none of them, which is the honest answer no audit tool will give you. Crawlers are detectors, and detection is cheap. They flag every missing alt attribute with the same urgency as a deindexed category page, because they cannot tell which page earns your revenue. Prioritization is the entire value of an audit, and it is the part software still cannot do for you.
Sort every finding on two axes: how badly it breaks things, and how much traffic sits behind the affected page. A broken thing on a page nobody visits is not a priority. Here is the triage we use.
| Finding | Does it actually matter? | Fix by |
|---|---|---|
| Noindex or robots block on a money page | Yes. The page cannot rank at all, whatever else you do | Today |
| Two versions of the site both serving 200 | Yes. Every signal you own is split in half | Today |
| Body content only present after JavaScript | Yes. Most AI crawlers read an empty page | This week |
| AI search crawler blocked at the CDN or WAF | Yes. Removes you from that engine's answers entirely | This week |
| LCP over 4 seconds on top landing pages | Yes, mostly for conversion rather than ranking | This month |
| Missing or duplicate titles on ranking pages | Yes, where impressions are high and CTR is low | This month |
| Internal links pointing at 404s | Moderately. Cheap to fix, so just fix them | This month |
| Several of your pages targeting one keyword | Yes, and it is invisible until you look for it | This quarter |
| Orphan pages with no internal links | Moderately, if the page was meant to earn traffic | This quarter |
| Schema errors on key templates | Moderately. Costs rich results and AI parseability | This quarter |
| Missing alt text on decorative images | Not for rankings. Do it for accessibility | Backlog |
| A tool's overall "SEO score" | No. It is a marketing device, not a diagnosis | Ignore |
The pattern in that table is that the top rows are binary and the bottom rows are gradients. Binary failures delete you from a surface completely and are usually one setting. Gradient failures move you a little. Fix every binary blocker before you spend a single hour on a gradient, and you will get more from a two-day audit than most teams get from a two-week one. The GEO audit chapter in our playbook lays out the same layered ordering in full.
Is the AI visibility part real, or is that just a sales pitch?
It is fair to be suspicious, because plenty of agencies rebranded the same audit and raised the price. The reason it survives scrutiny is that the measurement stopped being speculative this summer. Google shipping a dedicated Generative AI report inside its own webmaster tool is an admission that generative impressions are a distinct visibility surface, and Google does not build reporting for surfaces that do not matter.
Be precise about what that does and does not prove. It confirms the surface exists and is now partially measurable. It does not tell you that AI traffic outweighs organic traffic for your business, and for most sites in most industries it does not yet. The honest framing is that you now have two scoreboards where you used to have one, and an audit that reads only the older one is incomplete rather than useless.
What it changes practically is the order of your content work. Answer-first passages, self-contained sections, visible dates, original numbers, and clean semantic markup serve both scoreboards at once, which is the rare case where the AI-era advice and the classic advice point the same direction. The technical GEO pillar covers the access and parseability gates that sit upstream of all of it, and a full GEO audit scores citation rate and competitor share rather than rankings. If you are unsure whether engines can even resolve your brand as an entity, our entity checker is a two-minute test.
How often should I be doing this?
Quarterly for the full pass, monthly for the checks that regress silently, and immediately after anything structural. Annual audits are how sites discover in March that they broke something in June.
- Monthly: indexed page count, the Performance report against last month, and Core Web Vitals on your top templates. Fifteen minutes.
- Quarterly: the full 12 checks, ending in a re-ranked backlog rather than a document.
- After any redesign, replatform, migration, or CDN change: re-run checks 1, 2, 6, and the crawler-access prerequisite before you do anything else. These are exactly the events that flip a binary gate closed.
Write the findings somewhere you will actually work from, with an owner and a date per item. An audit whose output is a PDF nobody opens has cost you two days and returned nothing. The measure of a good audit is not how many issues it found, it is how many of the top five got shipped.
Frequently Asked Questions
Work in pipeline order rather than tool order. Confirm Google can crawl and index the site, check that only one version of it is live, then find which pages lost traffic and why. Only then review titles, content, speed, links, and schema. Finish with the two AI checks: whether generative engines show in Search Console, and whether they quote you.
A focused audit of a small business site takes one to two days: a few hours of crawling and data pulls, then the analysis. Large ecommerce or multi-template sites run one to three weeks. The crawl itself is fast. What takes time is separating the findings that cost you traffic from the several hundred that do not.
Google Search Console and Google Analytics cover most of it, plus PageSpeed Insights for Core Web Vitals and the Rich Results Test for schema. Add a free crawler tier such as Screaming Frog, which crawls up to 500 URLs at no cost. That stack is enough to complete all 12 checks on a normal site.
Run the full 12-point pass quarterly. Check indexing and traffic monthly, since those regress silently. Re-audit immediately after any redesign, replatform, migration, or CDN change, because those are what break crawling and rendering. A yearly audit finds problems roughly nine months after they started costing you money.
A technical audit covers whether search engines can reach, render, and understand your site: crawling, indexing, speed, structured data, and site architecture. A full SEO audit includes that plus content quality, keyword targeting, and your backlink profile. Technical is a subset, and it is the subset you check first, because content work cannot pay off on pages that cannot be crawled.
Yes, and it is now measurable rather than theoretical. Google added a Generative AI performance report to Search Console on June 3, 2026, so AI Overviews and AI Mode impressions can be isolated from ordinary Search data for the first time. An audit that reports only rankings and clicks now describes part of your visibility.
Agency audits typically run from around $1,500 for a small site to $10,000 or more for enterprise ecommerce, and the deliverable varies wildly. What you are paying for is prioritization, not detection: any crawler finds issues, while judgment about which 10 of 200 findings actually move traffic is the part worth money.
Usually because an answer now sits above your link. Pew Research Center found that when an AI summary appears, users click a traditional search result on 8% of visits versus 15% without one. Holding position while losing clicks is the signature of that shift, not of a ranking problem an ordinary audit would catch.
The Bottom Line
An SEO audit is worth exactly as much as the ordering it produces. The checklist is the easy half, and it has been broadly the same for a decade: crawl, index, content, speed, links, schema. What separates an audit that changes your traffic from one that generates a report is the discipline of fixing binary blockers before gradients, and high-traffic pages before tidy ones.
The genuinely new part is checks 11 and 12. Since June 3, 2026 you can see your generative impressions in Google's own tooling, and you can sit down with ten buyer questions and find out in an hour whether the engines recommend you or a competitor. That takes AI visibility out of the realm of opinion. If you want the whole system in order, from crawler access through citation tracking, work through the GEO Playbook.