SEO Audit Guide 2026:
How to Audit Your Website (Step-by-Step)

Open yoursite.com/robots.txt and read every Disallow rule line by line. Ask yourself: is this intentional? In my audit portfolio, 38% of sites had at least one unintentional Disallow rule — usually a wildcard pattern left over from a staging environment, or a CMS plugin that added a blanket block nobody noticed. Verify using GSC's robots.txt tester, then test Bingbot separately in Bing Webmaster Tools' Robots.txt Tester — the two crawlers interpret wildcard rules differently and what passes for Googlebot doesn't always pass for Bingbot. [4]

In Google Search Console, go to Indexing → Pages. Compare the "Indexed" count against your sitemap URL count. A gap of more than 10% usually means one of two things: pages that shouldn't be in the sitemap (paginated URLs, filter variants, tag archives), or pages Google has decided to exclude because of canonical conflicts, thin content signals, or crawl budget deprioritisation. Export the "Not indexed" list and triage each exclusion reason — they're not equal in severity or urgency.

Run Screaming Frog across the full site. In the Response Codes tab, filter for 3xx and 4xx. Redirect chains longer than one hop waste crawl budget and dilute link equity — collapse every intermediate hop to a direct 301. For internal 404s (your own pages linking to a broken URL), these are high-priority fixes: they're broken user journeys and a signal of poor site maintenance. External links pointing to your 404s are covered in Step 7 as a backlink recovery opportunity.

In Screaming Frog, filter the Directives tab for pages returning a noindex meta tag. Accidental noindex tags are one of the most common findings on sites that have recently migrated CMS platforms or gone through a redesign — staging noindex directives that were never removed before launch. Cross-check the GSC Coverage report's "Excluded by noindex tag" bucket against your intended noindex pages (privacy policy, thank-you pages, internal search results) to catch anything that shouldn't be there.

Every indexable page should have a self-referencing canonical pointing to its exact preferred URL — correct protocol, consistent trailing slash, no session IDs or tracking parameters. In Screaming Frog, filter the Canonicals tab for "Non-canonical pages" and "Canonical mismatch" — both mean Google's index version may differ from what you intended. Canonical mismatches are among the most common technical findings and among the easiest to fix at template level, which makes them a good early win.

Run your five highest-priority pages through the Google Rich Results Test. Focus on: Articles, FAQPages, Product pages, How-To pages, and Local Business listings. Invalid or missing schema turns up on 88% of sites I audit — most commonly because schema was set up correctly at launch, then quietly broke after a CMS update changed the template ID the schema plugin was referencing. [4] In 2026 this matters beyond rich results — structured data is one of the primary signals AI citation engines use to identify extract-ready content.

In Chrome DevTools, disable JavaScript (Settings → Debugger → Disable JavaScript) and reload your key content pages. Anything that disappears — nav, article body, product descriptions — is JS-dependent and may not be indexed by Bingbot, which renders JavaScript far less reliably than Googlebot. Then run Bing Webmaster Tools URL Inspection on the same pages and click "View Rendered Page." If key content is missing from Bing's rendered view, it's missing from Bing's index — which means it's invisible to ChatGPT Search, regardless of how well it performs in Google. [3]

In Screaming Frog, export all crawled URLs and cross-reference with your sitemap. Pages in the sitemap that have zero internal links pointing to them are orphan pages — Google's ability to re-discover and re-crawl them relies entirely on the sitemap schedule, and they accumulate almost no PageRank without internal link signals. Orphan pages tend to be older blog posts, migrated content, and paid campaign landing pages that were created and then never linked from anywhere on the main site.

In Screaming Frog, filter the Content tab for pages under 300 words. Export the list and classify each one: pages that are intentionally short — privacy policy, contact page, thank-you pages — are fine. What you're looking for is content pages below 300 words that are trying to rank for informational queries. Google's Search Quality Evaluator Guidelines flag "thin content with little or no added value" as a quality issue that suppresses not just those individual pages but domain-level quality signals. [6] Your options: expand with something genuinely useful, consolidate with a stronger related page, or remove and redirect.

In Google Search Console, export search query and landing page data for the past 12 months. Filter for your target keywords and check: are multiple pages showing up for the same primary query? If they are, you have cannibalization — Google has to pick one on every search, often picks the wrong one, and neither page builds as much signal as it would if the authority were concentrated. The fix depends on intent: if both pages serve the same purpose, consolidate the weaker into the stronger. If they genuinely serve different angles of the same keyword, make those differences a lot clearer in the title and content focus.

In GSC Performance, filter by page and set the date range to the past 12 months with monthly comparison. Pages showing steadily declining impressions — without an algorithm update to explain it — are getting outranked by fresher competitor content. These are your best refresh targets: the page already has backlinks, internal links, and ranking history. It just needs the content brought up to date. Semrush's State of Content Marketing 2025 found that properly refreshed pages return to their previous peak rankings within 60–90 days on average. [7]

Use Ahrefs Webmaster Tools' competitor intersection feature, or manually compare your content inventory against your top two organic competitors. For each topic cluster in your niche, ask which subtopics your competitors rank for that you don't cover. These gaps cost you more than just the missing traffic — they tell Google you only partially own the topic. A site that covers 90% of a cluster consistently outranks one covering 50%, even when the individual pages are comparable in quality. [5]

Open Bing Webmaster Tools and go to Reports & Data → Index Explorer. Check your 10–20 highest-priority content pages individually. In my audit portfolio, an average of 23% of target pages are missing from Bing's index despite being fully indexed by Google — which means complete ChatGPT Search invisibility for those pages, no matter how good the content is. [4] The most common culprits: Bingbot blocked by robots.txt, JavaScript content Bingbot can't process, and canonical configurations Bing interprets differently from Google.

OpenAI runs two separate crawlers: GPTBot (training data) and OAI-SearchBot (real-time ChatGPT Search retrieval). Blocking GPTBot is a legitimate choice if you want to opt out of model training — but some sites have blocked both with a single robots.txt rule, which also kills real-time ChatGPT Search retrieval as a side effect. These are distinct user agents that need separate entries. If you're intentionally blocking training but want ChatGPT Search visibility, make sure OAI-SearchBot has its own explicit Allow rule. [8]

Manually go through your 10 highest-priority pages and read the first paragraph under each H2. Does it directly answer what the heading is asking, in 40–70 words, as a standalone unit someone could read without the surrounding context? Pages that open sections with "In this section we will explore…" or any other preamble are invisible to AI extraction even when the right answer is buried a few paragraphs later. Rewrite those openers to front-load the answer — it's the same change that wins Featured Snippets, so one edit serves multiple channels.

Open ChatGPT (with Search enabled), Perplexity, and Google AI Mode. Run your five most important target queries. Is your site getting cited? If yes — which pages, for which queries? If no — use the Bing URL Inspection and content structure checks above to track down why. This takes 20 minutes and tells you something no automated tool currently can: not whether you're theoretically eligible for AI citations, but whether you're actually getting them right now. [9]

Ahrefs Webmaster Tools' free plan gives you a full backlink profile for verified domains — referring domains, domain rating distribution, anchor text breakdown, and new vs. lost link trends over time. Look at the unique referring domain count over the past 12 months: a steady decline is a leading indicator of ranking pressure ahead, because domain diversity is the primary link authority signal, not raw link count. Export your top 100 referring domains and manually review the top 20 for relevance and quality.

In Ahrefs Webmaster Tools, filter the Backlinks report for "Broken" — links from external sites hitting pages on your domain that now return 404. For any broken URL with a decent referring domain behind it, create a 301 redirect to the most relevant live page. This is one of the best returns you'll get from any link work — you're recovering equity you already earned rather than going out and building new relationships from scratch.

In Ahrefs, pull up your anchor text breakdown. A natural backlink profile is dominated by branded, URL, and generic anchors ("click here," "this post") — with exact-match keyword anchors as a minority. If exact-match keyword anchors are above 15–20% of your total, that's an over-optimisation pattern Google's Penguin algorithm (now part of core) can act on. The fix isn't to remove links — it's to earn more editorial coverage from authoritative publications, which naturally produces varied anchor text. [10]

In GSC, go to Security & Manual Actions → Manual Actions. A manual action from Google's web spam team — most often for unnatural inbound links, thin content, or cloaking — is the most severe finding in any SEO audit and takes precedence over everything else. If one is present, stop all other optimisation work until it's resolved via a reconsideration request. Manual actions are uncommon, and clean sites typically see "No issues detected" — but it takes 30 seconds to check and the consequences of missing one are serious.

Open GA4 DebugView (Admin → DebugView) and walk through the main page types on your site: homepage, category pages, blog posts, landing pages, and conversion pages. Confirm a page_view event fires on each one. Common failures: pages where GTM wasn't added to a new template, SPA routes that don't fire page_view on navigation, and thank-you pages that send a conversion event but skip the page_view. HubSpot's 2025 State of Marketing report found 23% of marketing teams cite inaccurate attribution data as their top analytics challenge — most of those problems start with gaps in basic page tracking. [12]

In GA4, go to Admin → Channel Groups → Create channel group. Set up a channel called "AI Search" with rules that capture: Session source contains "chatgpt.com" OR "openai.com" OR "perplexity.ai" OR "gemini.google.com." Without this, AI referral traffic gets scattered across "Referral" and "Direct" — invisible in standard acquisition reports. Note that since June 2025, OpenAI has been adding utm_source=chatgpt.com to citation links on desktop, which helps attribution accuracy. Mobile app sessions can still show as Direct, so don't assume your chatgpt.com referral count represents total ChatGPT-driven traffic. [13]

In GA4, go to Admin → Events and check the list of events marked as conversions. Make sure every intended action — form submission, demo request, purchase, PDF download — actually has a conversion event. Then check the other direction: scroll depth, video plays, and page views should not be marked as conversions, because that inflates your conversion rate and makes channel comparisons meaningless. Finally, check for duplication — one form submission should fire exactly one conversion, not two or three from a redirect chain.