How to Conduct a Technical SEO Site Audit: Step-by-Step

Conduct a technical SEO audit by defining the scope, crawling allowed URLs, comparing crawl results with search-engine data, testing representative templates and recording evidence for each recommended fix. The nine steps below separate observed failures from assumptions.

Step 1: Gather Your Tools

Before you start, set up these essential tools:

• Screaming Frog SEO Spider — crawl the authorised URL scope; check the vendor's current limits and licence terms
• Google Search Console (free) — real-world crawl data, indexation status, and Core Web Vitals
• Google PageSpeed Insights (free) — speed metrics and optimisation recommendations
• SSL Labs (free) — SSL/TLS configuration testing
• Security Headers (free) — HTTP security header analysis
• Google Rich Results Test (free) — structured data validation

If you have access to Ahrefs or Semrush, their site audit tools automate many of these checks and provide additional insights.

Step 2: Crawl Your Website

Open Screaming Frog and enter your domain. Before starting the crawl, configure these settings:

• Crawl speed: Agree a rate limit and test window from server capacity, monitoring and operational constraints. Watch errors and latency while increasing load.
• Respect robots.txt: Enable this to see what search engines see. Then do a second crawl ignoring robots.txt to find accidentally blocked content.
• JavaScript rendering: If your site uses client-side rendering, enable JavaScript rendering in Configuration → Spider → Rendering.
• Connect GA and GSC: In Configuration → API Access, connect your Google accounts to pull traffic and indexation data directly into the crawl.

Wait for the crawl to complete and record the configuration with the export. Crawl duration depends on server limits, rendering mode, connection speed and URL count, so do not use elapsed time as a completeness check.

Step 3: Check Crawlability and Indexation

Robots.txt review:

• Visit yoursite.com/robots.txt and read every Disallow rule
• Verify no important pages or directories are blocked
• Check that CSS and JS files are not blocked (Googlebot needs these to render pages)
• Verify the Sitemap directive points to your correct sitemap URL

XML sitemap check:

• Visit your sitemap URL and verify it loads as valid XML
• Cross-reference sitemap URLs against your crawl — every sitemap URL should return 200
• Check for non-canonical URLs in the sitemap (redirecting URLs, noindexed pages)
• Verify the sitemap is submitted in both GSC and Bing Webmaster Tools

Indexation status:

• In GSC, check the Pages report (Indexing → Pages) for the total number of indexed pages
• Review the "Not indexed" reasons — focus on "Crawled - currently not indexed" and "Discovered - currently not indexed"
• Use a site: search only to discover examples; do not treat its approximate result count as the number of indexed pages
• Check for duplicate content by searching for unique paragraphs from your pages in quotes

Step 4: Audit Site Architecture

Good site architecture helps both users and search engines find content efficiently:

• Click depth: In Screaming Frog, open Site Structure → Crawl Depth. Compare priority pages with the site's navigation model and investigate deep or orphaned URLs. No universal click count guarantees crawling or ranking.
• Internal linking: Check the Inlinks report for key pages. High-value pages should have the most internal links. Look for orphan pages with zero internal links.
• Redirect chains: Filter for redirects in the Response Codes tab. Any chain longer than 2 hops should be fixed to point directly to the final destination.
• Broken links: Filter for 404 responses in Inlinks. Fix or redirect all broken internal links.
• URL structure: Review URLs for consistency — lowercase, hyphens between words, no special characters, logical hierarchy, reasonable length.

Step 5: Test Core Web Vitals

Check GSC's Core Web Vitals report for site-wide issues, then test specific pages with PageSpeed Insights:

• LCP (good: within 2.5 seconds): Inspect the LCP element and its TTFB, resource-delay, resource-duration and render-delay subparts.
• INP (good: at most 200 milliseconds): Trace affected interactions and separate input delay, processing and presentation delay.
• CLS (good: at most 0.1): Inspect shift clusters and the elements responsible for unexpected movement.

See our Core Web Vitals audit guide for detailed fix instructions.

Step 6: Check Mobile-Friendliness

• Inspect representative URLs in Search Console and test responsive behaviour because Google's Mobile Usability report was retired in December 2023
• Test key pages with Chrome DevTools device emulation at 375px width
• Verify the viewport meta tag is present on all pages
• Check WCAG 2.2 target size at 24 by 24 CSS pixels plus the criterion's spacing and inline exceptions; consider larger controls for touch comfort
• Verify content parity between mobile and desktop versions
• Test forms with mobile keyboard types (email, tel, number inputs)

See our mobile audit guide for the complete checklist.

Step 7: Review Security Configuration

• SSL Labs test: Run your domain through ssllabs.com/ssltest. Target an A or A+ grade. Fix any issues with certificate chain, protocol versions, or cipher suites.
• HTTPS enforcement: Verify all HTTP URLs redirect to HTTPS with 301 redirects. Check for mixed content using Chrome DevTools Console.
• Security headers: Test at securityheaders.com. Implement Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Strict-Transport-Security headers.
• GSC Security Issues: Check for any security warnings or manual actions related to hacking or malware.

Step 8: Validate Structured Data

• Crawl your site with Screaming Frog's Structured Data tab enabled to see schema across all pages
• Test key pages with Google's Rich Results Test for errors and warnings
• Verify BreadcrumbList schema matches visible breadcrumbs
• Check Organization schema on the homepage
• Verify only structured-data types supported for the visible page content; Google limits FAQ rich results mainly to authoritative government and health sites
• Ensure no misleading or spammy schema (review schema for self-reviews, etc.)

Step 9: Compile Your Report

Organise your findings into a prioritised report:

1. Critical issues: Confirmed loss of access to essential pages, exposed sensitive data or an exploitable vulnerability. Assign an owner and response deadline.
2. High priority (fix this week): Broken internal links, missing meta tags, duplicate content, redirect chains, missing schema
3. Medium priority (fix this month): Suboptimal URL structure, missing alt text, slow pages, non-critical missing headers
4. Low priority (fix when possible): Minor speed improvements, cosmetic URL inconsistencies, optional schema additions

For each issue, document: what the issue is, which pages are affected, how to fix it, and the expected impact. This makes the report actionable for whoever implements the fixes.

Check interpretations against Google's crawling and indexing topics, Core Web Vitals guidance and structured data policies. Our technical report framework shows how to record evidence and ownership.