A practical technical SEO audit checklist: 40 checks explained

This is the checklist behind Semhack's page audit, written out so you can run it by hand, use it to review another tool's report, or explain a finding to a client. Each item says what to look at, the threshold we use, and how to fix it.

Two notes before the list:

• Thresholds are rules of thumb, not Google rules. Google doesn't publish an ideal title length or a maximum number of links. The numbers below are where we draw the line between "fine" and "worth a look". A page can rank well while failing some of them.
• Not every check matters equally. We mark each one high, medium or low importance. In our audit score a high-importance check counts three times as much as a low one; a warning earns half the credit of a pass.

How to use this checklist

Start with the page that matters most: the homepage, your best-selling product, the article that earns the most clicks. Fix the high-importance failures first. Then audit one page of each template (a product page, a category page, a blog post), because most issues come from templates and repeat on every page built from them.

A single-page audit can't see problems that only show up across a site, such as duplicate titles, orphan pages or broken internal links. For those you need a crawl; the last section covers what to add.

SEO: 15 checks

1. Title tag (high). One <title> per page, roughly 30–60 characters, unique, with the main topic near the start. Longer titles tend to be cut off in results. Preview yours with the SERP preview tool.
2. Meta description (high). Present, roughly 120–160 characters, a real summary of the page. Google often writes its own snippet, but a good description is still the default it can use.
3. Headings (medium). Exactly one H1 that says what the page is about, and heading levels in order: no H4 directly under an H2.
4. Content keywords (medium). The words the page uses most often should also appear in its title or description. If they don't, the title may be describing a different topic from the text.
5. Image alt text (medium). Every <img> has an alt attribute: a short description, or alt="" for purely decorative images.
6. SEO-friendly URL (medium). Lowercase, words separated by hyphens rather than underscores, no query parameters, no more than about 100 characters and four levels deep.
7. 404 page (medium). A request for a page that doesn't exist answers 404 or 410. A 200 there means every missing URL is a soft 404; redirecting missing pages to the homepage is treated much the same way.
8. robots.txt (high). The file exists, loads without a server error, and doesn't block Googlebot from the page. A 5xx on robots.txt is serious: Google can stop crawling the site until it's fixed. Test rules with the robots.txt tester.
9. In-page links (medium). The page links to other pages, but not to hundreds of them. We warn above 150 links and when a page has none.
10. Favicon (low). Declared in the HTML with <link rel="icon">, or available at /favicon.ico. Google can show it next to your site's name in search results.
11. Language (medium). The <html> tag declares a valid language code, such as lang="en" or lang="tr-TR".
12. Noindex (high). No noindex in the robots meta tag or the X-Robots-Tag header, unless the page really should stay out of search. Staging settings left on after launch are a classic cause.
13. Meta refresh (low). No <meta http-equiv="refresh">. Use a server-side 301 for redirects.
14. Meta keywords (low). Google ignores the keywords tag. It does no harm to rankings, but it tells competitors which terms you target, so you can remove it.
15. Canonical URL (medium). Exactly one canonical tag, normally pointing at the page itself. Several different canonicals cancel each other out; a canonical pointing elsewhere tells search engines to index the other URL instead.

Security: 8 checks

16. HTTPS (high). The page is served over HTTPS, and HTTP redirects to it. Browsers label plain HTTP pages "Not secure". Check the certificate with the SSL checker.
17. HTTP/2 (low). The server or CDN supports HTTP/2, which loads many small files faster than HTTP/1.1.
18. Mixed content (high). An HTTPS page loads no images, scripts or stylesheets over http://. Browsers block or flag those files.
19. Server signature (low). Response headers like Server or X-Powered-By don't reveal exact software versions, which makes known vulnerabilities easier to target.
20. Unsafe cross-origin links (medium). External links that open in a new tab (target="_blank") have rel="noopener" (or noreferrer), so the new page can't control yours. Modern browsers apply this by default, but older ones don't.
21. Insecure forms (high). No form submits to an http:// address.
22. HSTS (medium). HTTPS responses send a Strict-Transport-Security header with a max-age of at least 180 days; one year (31536000) is the usual choice. See all headers with the HTTP headers checker.
23. Plaintext emails (low). Email addresses in the page text are easy for spam bots to collect. Use a contact form or obfuscate them.

Performance: 8 checks

24. Text compression (high). HTML (and CSS and JavaScript) is sent compressed with gzip, Brotli or zstd. This is usually a single setting on the server or CDN.
25. Load time (high). The HTML arrives within 1.5 seconds; we warn up to 3 seconds and fail beyond. This measures the server's response, not how long the page takes to become visible in a browser.
26. Page size (medium). The HTML itself is under 200 KB; we warn up to 1 MB. Large HTML usually means inlined data, scripts or SVGs.
27. HTTP requests (medium). The page references 50 files or fewer (scripts, stylesheets, images); we warn up to 100.
28. Image format (medium). Images use modern formats such as WebP or AVIF rather than JPEG or PNG, which are usually larger at the same quality.
29. Render-blocking JavaScript (medium). External scripts in the <head> have defer or async (or are type="module"), so the browser doesn't stop rendering to run them.
30. DOM size (medium). The page has 1,500 elements or fewer; we warn up to 3,000. Very large DOMs make pages slow to style and update.
31. Doctype (low). The page starts with <!DOCTYPE html>. Without it, browsers fall back to quirks mode.

Markup and content: 9 checks

32. Structured data (medium). The page has structured data (JSON-LD, microdata or RDFa), and any JSON-LD parses without syntax errors. Start with Organization on the homepage and Article or Product where they fit; the schema generator writes the JSON-LD for you.
33. Meta viewport (high). <meta name="viewport" content="width=device-width, initial-scale=1">, without user-scalable=no or maximum-scale=1, which stop people from zooming.
34. Charset (medium). The page declares UTF-8, ideally with <meta charset="utf-8"> near the top of the <head>.
35. Sitemap (medium). The site has a valid XML sitemap, at /sitemap.xml or listed in robots.txt, and it loads.
36. Social tags (low). Open Graph (og:title, og:description, og:image) and twitter:card, so shared links show a proper preview. The meta tag checker shows them all.
37. Content length (medium). At least 300 words of visible text. Short pages can be fine; this flags pages that may not answer the question well.
38. Text to HTML ratio (low). Visible text makes up at least 10% of the HTML. A low ratio usually points to inlined scripts and styles.
39. Inline CSS (low). Few style="…" attributes and <style> blocks; we warn above 20 attributes or 5 blocks.
40. Deprecated HTML (low). No obsolete elements such as <font>, <center> or <marquee>.

What a page audit can't tell you

Be clear with yourself and your clients about the limits of any automated page audit, including ours:

• It reads the HTML the server sends. Content that only appears after JavaScript runs isn't checked. Use Search Console's URL Inspection ("View crawled page") to see what Google rendered.
• Load time isn't Core Web Vitals. The load-time check measures the HTML response. Real-user metrics like Largest Contentful Paint come from browsers; see the Core Web Vitals report in Search Console or PageSpeed Insights.
• Passing every check doesn't make a page rank. These are technical basics. Whether the page is the best answer to the search is a separate question.
• Some failures are fine. A login page should be noindex. A short contact page doesn't need 300 words. Read each result in context.

Add a crawl for site-wide problems

Some issues only appear when you look at many pages together. A crawl that follows your internal links and reads your sitemap should also report:

• Broken internal links and pages that return errors, with the pages that link to them.
• Duplicate titles and meta descriptions across pages.
• Redirect chains, and internal links that point to redirects instead of the final URL.
• Orphan pages: in the sitemap, but not linked from any crawled page.
• Sitemap entries that aren't 200, and noindex pages listed in the sitemap.
• Pages blocked by robots.txt that are still linked internally.
• Deep pages (more than four clicks from the homepage), thin pages (under 300 words) and slow pages (HTML over three seconds).
• Possible soft 404s: pages that answer 200 but look like error pages.

Semhack's site audit runs all of these, plus the page checks above on every crawled page. When you connect Search Console, failing checks on pages that earn search traffic go into the weekly action list, ranked by how many clicks those pages bring in.