How to Do a Free Website SEO Audit: 65+ Point Checklist (2026)

An SEO audit sounds like a job for an agency, but most of the problems that hold a website back are simple and visible: a missing title, a page blocked from Google, a slow server, an expired certificate. You can find them yourself in about ten minutes.

This checklist walks through a complete website SEO audit in the order that matters most, explains what each check means, and tells you how to fix what you find. You can run every check by hand, or let our free Website SEO Audit tool run all of them at once.

What an SEO audit actually checks

A useful audit answers four questions:

1. Can search engines find and index the page? If not, nothing else matters.
2. Do they understand what it's about? Titles, headings, content and structured data.
3. Is it fast, secure and usable? Speed, HTTPS, mobile and accessibility.
4. Will people and AI tools trust and cite it? Trust pages, brand markup and clear answers.

Work through them in that order. A beautiful page that Google can't index earns nothing.

The quick way: run a free audit

1. Open the Website SEO Audit.
2. Enter your home page, or any important page. "example.com" works too.
3. Keep Core Web Vitals ticked to include Google's speed test.
4. Read Fix these first: the failed and high-impact checks, already sorted by importance.

You get a free preview with no signup, and a free account unlocks one full report. After that, Pro adds unlimited audits and a branded PDF report you can send to a client or developer. The rest of this guide explains each part of the report.

1. Indexing: can Google see the page?

• HTTP status. The page must return 200. A 404 or 500 means it won't be indexed.
• noindex. A robots meta tag or X-Robots-Tag header with "noindex" tells Google to drop the page. It is often left on by accident after a site launch.
• robots.txt. A Disallow rule can block the page, or block the CSS and JavaScript Google needs to render it. Check both.
• Canonical URL. Each page should have one canonical tag pointing to its preferred address. If it points somewhere else, Google indexes that page instead, and if the target is broken Google may ignore it.
• XML sitemap. List your important pages in sitemap.xml, link it in robots.txt and submit it in Google Search Console. Accurate lastmod dates help Google recrawl what changed.
• Redirects. Every extra redirect hop slows the page and leaks link value. Link straight to the final URL.

2. Meta tags and content

• Title tag. One per page, 30 to 60 characters, with the main topic near the start.
• Meta description. 70 to 160 characters written to earn the click. Google often rewrites it, but a good one still helps.
• One H1, then H2s and H3s in order. A clear outline helps readers, Google and AI answers.
• Enough useful content. Pages under about 300 words rarely rank unless the intent is very simple. Write to answer the visitor's question fully.
• Readability. Short sentences and plain words. A Flesch score above 50 suits most audiences.
• Image alt text. Describe meaningful images; use alt="" for decorative ones.
• No placeholder text. "Lorem ipsum" on a live page is more common than you'd think.

3. Links and URLs

• Internal links. Every important page should link to related pages with descriptive anchor text, not "click here". Our guide on checking internal and external links covers this in detail.
• Broken links. Fix or remove links that return 404. The free Link Checker tests every link on a page.
• Don't nofollow your own pages. It stops link value flowing through your site.
• One version of the site. http:// and https://, and www and non-www, should all 301-redirect to one address.
• A real 404 page. Pages that don't exist must return a 404 status, not 200. A "soft 404" wastes crawl budget.
• Clean URLs. Short, lowercase, with hyphens between words.

4. Speed and Core Web Vitals

Google measures real page experience with three Core Web Vitals:

The fixes that help most sites:

• Server response. Aim for under 600 ms. Use caching, a CDN or faster hosting.
• Compression. Turn on gzip or Brotli; it often cuts HTML size by about 70%.
• Images. Compress large files, use WebP or AVIF, set width and height, and lazy-load images below the fold. Never lazy-load the main hero image: it delays LCP.
• Scripts. Add defer or async, and remove third-party tags you no longer use.

5. Security

• HTTPS everywhere, with http:// redirecting to https://.
• A valid SSL certificate for both www and non-www, renewed automatically before it expires.
• No mixed content. Every image, script and stylesheet must load over https://.
• Security headers. HSTS, X-Content-Type-Options, Content-Security-Policy, Referrer-Policy and clickjacking protection.
• No exposed files. Check that /.git/ and /.env are not downloadable. If they are, block them and rotate every password and API key immediately. This one check can save a business.

6. Social previews and structured data

• Open Graph tags (og:title, og:description, og:image) control how your link looks on WhatsApp, LinkedIn and Facebook. Make sure the image actually loads; 1200×630 px works best.
• Structured data. JSON-LD for Organization, Article, Product or FAQ makes a page eligible for rich results. Each type has required fields, such as an Article's headline, image, datePublished and author. Missing fields mean no rich result.

7. Accessibility

Accessible pages are easier for everyone to use, and the same structure helps search engines:

• Allow pinch-zoom (no user-scalable=no in the viewport).
• Give every form field a label and every icon button an aria-label.
• Use unique element IDs and give iframes a title.
• Declare the page language with lang on the html tag.

8. AI search readiness

ChatGPT search, Perplexity, Claude and Google's AI Overviews increasingly answer questions directly. To be cited:

• Don't block AI search crawlers such as OAI-SearchBot, PerplexityBot and Claude-SearchBot in robots.txt. Blocking training bots like GPTBot is a separate choice and doesn't affect Google.
• Put your content in the HTML. Most AI crawlers don't run JavaScript, so content that only loads in the browser is invisible to them.
• Use Organization markup with your name, logo and social profiles, so AI systems recognise your brand.
• Write answer-friendly sections: question-style headings, short direct answers, lists and tables.
• llms.txt is an optional summary file for AI tools. It's a proposal, not a confirmed ranking signal.

What to fix first

Don't try to fix everything at once. Work in this order:

1. Anything that stops indexing: errors, noindex, robots.txt blocks, broken canonicals.
2. Security emergencies: exposed /.git or .env files, expired certificates.
3. Missing titles, descriptions and H1s on your most important pages.
4. Speed problems on mobile, starting with the server and the largest images.
5. Everything else, from structured data to accessibility.

Audit again after each round of fixes to confirm the score improves. Then build authority: compare linking sites with the DA PA Checker, and create discovery links with the backlink generator.

Key takeaways

• Check indexing first: status code, noindex, robots.txt, canonical and sitemap.
• Fix security emergencies immediately, especially exposed .git and .env files.
• Titles, one clear H1 and useful content still do most of the on-page work.
• Core Web Vitals, accessibility and AI search readiness now belong in every audit.
• The free Website SEO Audit runs 65+ of these checks at once and tells you how to fix each one.