SEO Audit Checklist: 25 Things to Check Before You Hire Anyone

If you are about to pay an agency for SEO, spend one afternoon on your own site first. Not because agencies are untrustworthy, but because a site owner who knows their problems negotiates from strength. An agency proposal means something very different when you can read it against facts instead of guesses.

Google's September 2026 spam update finished rolling out on Oct 8. If your traffic moved after Sep 24, this checklist doubles as a diagnostic: work through the crawl, content, and link sections before you blame the update. Most traffic drops are not algorithm updates, a point this post returns to below.

All 25 checks use free tools. You need no paid subscription, no developer, and no agency to complete them. What you cannot do alone is the follow-through: a professional audit turns findings into a prioritized plan, which is exactly where Rank Rays' audit service picks up.

Why check before you hire

An agency walks into your business cold. It will spend its first billable hours discovering the things you could have found yourself: the noindexed pages, the 404s on the pricing page, the mobile layout that buries the phone number. Finding them first does not replace an audit. It makes the audit better, because the agency starts from your findings instead of a blank screen.

It also protects you from the oldest trick in the pitch deck: a "free audit" that discovers urgent, expensive problems which happen to be exactly what the agency sells. When you already know what is actually wrong, a pitch is easy to judge.

Crawl and index: 5 checks

If Google cannot reach your pages, nothing else matters. Start here.

1. HTTPS is valid, with no mixed content

Click the padlock next to your URL on a few key pages. If the site loads over plain HTTP, or the padlock warns about insecure elements, you have a mixed-content problem: secure page, insecure images, scripts, or fonts loaded inside it. Mixed content quietly erodes trust signals and can block features in browsers. Fix it before you spend a rupee or pound on anything else, because every other check assumes it.

2. robots.txt is not blocking anything it should not

Open yoursite.com/robots.txt. This small file tells crawlers where they may not go. One misplaced Disallow: / blocks the entire site, and it happens more often than developers admit: staging rules get copied to the live site, a plugin update rewrites the file, a well-meaning freelancer "cleans up" crawler access. Your robots.txt should block admin and checkout internals, nothing that earns traffic. This check takes 30 seconds and saves embarrassments.

3. The XML sitemap is submitted and clean

In Google Search Console, open the Sitemaps report. A healthy sitemap lists only pages that return a 200 status: real, indexable pages. Red flags are sitemaps full of redirects, 404s, or URLs that carry a noindex tag. A sitemap is a list of your pages you hand to Google personally. If the list itself is sloppy, the crawling that follows will be too.

4. No noindex on money pages

Search Console's Pages report shows what Google excluded and why. Look for important pages under "Excluded by 'noindex' tag." Pages get noindexed by template bugs, CMS migrations, plugin toggles flipped during a redesign, or developers protecting staging and forgetting to flip it back. Every noindexed page is invisible in search, and it never emails you to say so. Check this after any site change, every time.

5. Canonicals are consistent

View the source of a few pages and find the canonical tag. Each page should declare itself as the canonical version, and no page should point its canonical at a page that is itself noindexed, redirected, or missing. Conflicting signals, two URLs claiming to be the real one, or a canonical chain that ends at a 404, leave Google guessing which page to rank. Guessing usually means ranking neither.

Speed and experience: 4 checks

Google grades real-user experience, not your developer's laptop.

6. Core Web Vitals pass on mobile

Run your top pages through PageSpeed Insights and look at the mobile numbers, not desktop. The 2026 thresholds are unchanged: LCP (largest contentful paint) at 2.5 seconds or less, INP (interaction to next paint) at 200 milliseconds or less, and CLS (cumulative layout shift) at 0.1 or less, all measured at the 75th percentile of real Chrome user data. Note the letter: INP replaced FID in March 2024. Any tool or article still grading FID is giving you 2023 advice. INP is the vital most sites fail, so a passing score here puts you ahead of the 40%+ of sites that still fail it.

7. The mobile layout is genuinely usable

Open your site on a phone, not a desktop browser shrunk down. Read a paragraph without pinching to zoom. Tap every button in the main navigation and the quote form with your thumb. If text is tiny, buttons crowd each other, or anything scrolls sideways, you are failing the test your visitors take first. Google's mobile-first indexing means this layout is the version Google evaluates.

8. No scripts trap the back button

This one is a policy check, not a preference. Google announced a spam policy on back-button hijacking in April 2026, with enforcement starting June 15, 2026: exit-intent scripts or pop-ups that block or intercept the browser's back button are now policy violations. If your site fires a pop-up the moment a visitor tries to leave, you are not doing clever conversion work. You are holding a door shut, and Google now treats it as spam.

9. Key pages return no 404s or 500s

Crawl your main pages, or pull the Pages report in Search Console and look for 404 and server-error exclusions. A 404 on a blog post from 2019 is housekeeping. A 404 on the page your ads point to, or a 500 on the checkout page, is lost revenue. Errors on pages that earn traffic or links go to the top of every fix list.

On-page: 5 checks

These are the oldest checks in SEO and still the most commonly failed.

10. Every important page has a unique title near 60 characters

Open each key page and read its title tag, the text in the browser tab. Each page gets its own title, with the main keyword near the front, around 60 characters. Duplicate titles across pages tell Google the pages are interchangeable. Titles stuffed with every keyword variation tell it you write for crawlers. One page, one clear promise, in the words a searcher would use.

11. Meta descriptions stay within 150 to 160 characters

The meta description is your ad copy in the search results: one or two sentences that earn the click. Keep each page's description between 150 and 160 characters and make it a real hook, not a keyword tail like "SEO services | best SEO | SEO company." Google may rewrite descriptions, but a well-written one still wins clicks when it shows.

12. One H1 per page, matching the searcher's intent

Each page should have exactly one H1, and it should answer the question the searcher asked. A page targeting "emergency plumber Lahore" should not headline itself "Welcome to our website." The H1 sets the contract with the reader: this page is about the thing you searched for. Anything else is a broken promise before the first paragraph.

13. Alt text describes the image, and a human reviewed it

Check the alt attributes on your images. Good alt text says what the picture shows: "technician inspecting a boiler," not "image1" and not a paragraph of keywords. Google's October 1, 2026 guidance on AI-assisted content extended the human-review requirement explicitly to titles, meta descriptions, structured data, and image alt text. Machine-generated alt text without a human reading it is now a documented miss.

14. No two pages fight over the same keyword

Search your site for the same target phrase appearing as the focus of two or more pages, or check Search Console's queries report for one query splitting clicks across several URLs. When two of your pages compete for the same query, they split each other's authority and Google picks the winner at random, sometimes the weaker page. This is keyword cannibalization, and the fix is to merge, differentiate, or redirect, never to write a third page on the same topic.

Content: 3 checks

Google's September 2026 spam update made this section urgent reading.

15. No scaled thin content with no unique value

The September 2026 spam update (Sep 24 to Oct 8) was not an "AI content penalty," whatever the hot takes said. Google named no specific target: it improved automated spam detection against its existing policies, across all languages. What it tightened was the scaled-content-abuse definition: generating many pages with AI, or stitching content together from other pages, without adding unique value. Ask of every page: would this page exist if search engines did not? If the honest answer is no, it is the kind of page the update was built to catch, however it was written.

16. Each page matches the intent of what actually ranks

Open an incognito window, search your target query, and read the top 3 results. Are they guides, product pages, or local listings? If Google ranks how-to articles and your page is a sales pitch, you are not losing to better SEO. You are answering the wrong question. Intent mismatch is the most common reason good-looking pages never rank, and no amount of link building fixes a page that does not belong in the results.

17. Money pages are fresh

Read your service and product pages with a stranger's eyes. Old prices, discontinued offers, staff who left years ago, screenshots of a design you replaced, "copyright 2022" in the footer. Stale pages leak trust twice: visitors hesitate, and Google sees content nobody maintains. Freshness does not mean rewriting everything monthly. It means the pages that make you money show a business that is awake.

Links: 3 checks

Links remain the authority signal. These 3 checks tell you whether yours help or hurt.

18. Spammy links are identified and handled

Look at your backlink profile in Search Console's Links report or a free backlink checker. Watch for obvious junk: links from hacked sites, foreign-language directories with no connection to your business, sitewide footer links from unrelated domains, and exact-match anchor text from pages that exist only to host links. The disavow tool is a last resort, not a routine, but knowing which links point at you is the difference between a clean profile and a surprise.

19. Anchor text is not over-optimized

Scan the anchor text of your inbound links. A natural profile is a mix: brand names, naked URLs, generic phrases like "this guide," and the occasional exact-match keyword. If most of your links use keyword-rich commercial anchors, the pattern is visible to Google and to anyone reviewing your profile. Editorial links earned from real outreach almost never read like a keyword list, which is why manual link building produces the safest anchor mix.

20. Lost referring domains are on your radar

Compare your backlink profile against 6 or 12 months ago. Domains disappear: sites shut down, pages get deleted, webmasters remove links during redesigns. A slow leak of referring domains is a slow leak of authority. Some losses you reclaim by fixing broken target pages on your own site, so the link points somewhere live again. Some need a polite email. None of them fix themselves.

Local: 2 checks

If you serve a place, these 2 checks carry outsized weight.

21. The Google Business Profile is claimed and complete

Search your business name. Your Google Business Profile should appear, claimed, with the right category, accurate hours, your services, real photos, and a description that reads like a human wrote it. An unclaimed profile, wrong hours, or a profile with 2 blurry photos from 2019 loses you to the competitor who treats it as a storefront. For service businesses, this panel often outranks the website itself.

22. NAP is consistent across directories

NAP, name, address, phone, must read identically everywhere it appears: your site footer, Google Business Profile, and the directories that list you. "Street" vs "St." is noise. "Old phone number on 3 directories" is a signal problem. Google cross-references listings to confirm you are who you claim to be, and every mismatch weakens that confirmation.

AI-readiness: 3 checks

Search changed in 2026. These checks cover the parts no 2024 checklist mentions.

23. Key pages appear in AI Overviews and AI Mode

In October, Google announced that cited links now appear higher and more often in AI Overviews and AI Mode, with the link carousel expanding worldwide and preferred sources prioritized. Open Search Console's Generative AI report, launched June 3, 2026: it shows impressions in AI Overviews and AI Mode, separate from the classic Performance report. The report shows impressions only, no clicks, CTR, positions, or queries, but it answers the basic question: are your pages even in the room where AI answers are built?

24. Content is answer-structured and fact-checked

AI systems extract from pages that state things clearly. Give each section a direct answer early, define terms plainly, and state facts in sentences that stand alone. Then do what Google's October 1, 2026 guidance requires: fact-check by hand before publishing. This is also where structured data earns its place: it powers rich results, not AI visibility. Pages that are vague, hedged, or unverified do not get cited. Pages that answer do.

25. No effort is wasted on llms.txt theater

You may have seen advice to add an llms.txt file, chop content into AI-friendly chunks, or rewrite pages for chatbots. Google's word on this is plain: llms.txt files neither help nor harm Google rankings, and splitting content into chunks or rewriting it for AI systems is unnecessary. Those files can be useful for ChatGPT and Claude. They are not an SEO audit item. Spend the hour on item 24 instead.

The audit-day table: check, tool, pass, red flag

Run the table first on audit day. It orders the checks above by the tools you already have.

Your traffic moved after Sep 24? Diagnose it the honest way

Before you blame the September 2026 spam update, run the sequence professionals use:

1. Rule out the boring causes first. Most traffic drops are not algorithm updates: seasonality, broken tracking, a site migration, or lost backlinks explain most of them.
2. Line up the drop date with the Search Status Dashboard. If the drop started Sep 24 or later, the update is a candidate. If it started Sep 10, it is something else.
3. Wait at least 1 week after the update finished, so after Oct 8, before judging anything. Rankings settle.
4. Compare equal periods before and after in Search Console. Look at queries, not just clicks.
5. Watch the pattern: keeping brand queries while losing generic ones is a common core-update shape, and it points at relevance and authority, not a technical bug.

If the drop lines up with the update and survives steps 1 to 4, you likely have a content-quality or spam-policy problem, and items 15 through 20 are your starting point.

FAQs

Should I really run all 25 checks before hiring an agency?

You do not have to, but the afternoon pays for itself. You will brief the agency better, read its proposal with working knowledge, and spot the difference between findings that matter and padding. The agency's job is the part you cannot do yourself: turning 25 findings into a sequenced plan.

How long does a professional SEO audit take?

It scales with the site. A small business site can be audited in hours. A large site with thousands of pages, multiple templates, and a messy history takes days to weeks. What separates a real audit from a checklist like this one is the output: a prioritized action plan ranked by impact and effort, findings a non-technical owner can understand, and a realistic implementation roadmap.

Did the September 2026 spam update penalize AI-written content?

No. Google did not introduce a penalty for AI-written content and named no specific target. The update improved automated spam detection against existing policies, and what it tightened was scaled content abuse: many pages generated without adding unique value, however they were created. Human-written content with no value fails the same test.

Is it worth adding an llms.txt file?

For ChatGPT and Claude, possibly. For Google rankings, no. Google states that llms.txt files neither help nor harm rankings, and that splitting content into chunks or rewriting it for AI systems is unnecessary. If your audit budget is limited, spend it on clear, fact-checked content instead.

What is the single biggest red flag on this list?

A site Google cannot reach or will not show: noindex on money pages, a robots.txt blocking everything, or HTTPS broken site-wide. Visibility bugs are binary, the page is either in the index or it is not, which makes them the highest-impact fixes per minute of work.

Can I hire someone to run these checks for me?

That is what an audit service is. Rank Rays' audits cover the technical ground in this post, redirects, 404s, meta titles and descriptions, schema, alt attributes, canonical tags, Search Console issues and indexing, plus a review of foundational and content backlinks. The work is 100% white-hat, and the report covers website metrics: rankings, traffic, links, and organic enquiries and form fills. No invented numbers, no borrowed case studies.

The bottom line

25 checks, 7 sections, free tools. If your site passes all of them, you do not have an audit problem, you have a strategy problem, and that is a different conversation. If it fails a handful, you now know exactly what to tell an agency, and exactly how to judge what it tells you.

And if you would rather hand the whole thing over, get a free SEO audit quote. You will get the same 25 checks, run by people who do them every day, with a plan for what to fix first. The checklist above is free. The follow-through is the service.