How to Do an SEO Audit: The Definitive Playbook

Let me start by killing the most common mistake. An SEO audit is not a list of everything wrong with a website. If that were the goal, a crawler could do it in twenty minutes and you would be redundant. The audit is the part the crawler cannot do: deciding what matters, in what order, and why.

A good audit answers three questions in plain language. What is holding this site back right now? In what order should we fix it? And what is each fix worth if we do? If your deliverable does not answer those three, you did not run an audit. You ran a scan and pasted the results into a document.

I have watched agencies hand clients a 180-page PDF with every missing alt tag and every 302 redirect lovingly cataloged, and watched those PDFs die in a Downloads folder. The client cannot tell whether a missing meta description matters more than a crawl trap eating half their budget. That is your job. The value you add is judgment, not enumeration.

The deliverable, defined up front

Before I crawl a single URL, I know what I am building toward. The deliverable is a short, ranked document. At the top, three to five issues genuinely costing the site traffic or money right now, each with the fix and the expected impact. Below that, the medium and low priority items, grouped so they do not drown the headline.

Every audit starts the same way for me. I need to see the site the way a crawler sees it, then compare that against what Google has actually indexed. The gap between those two numbers is where most of the interesting problems live.

Run a full crawl first. I use Screaming Frog for most sites, the cloud crawlers for the big ones. Configure it to render JavaScript if the site relies on it, because crawling the raw HTML of a React app and calling it a day is how you miss half the site. The crawl gives you the architecture: every URL, its status code, its title, its canonical, its depth from the homepage, its internal links in and out.

Then pull the indexation picture from Google Search Console. The Pages report tells you how many URLs Google has indexed and, more usefully, how many it has chosen not to, and why. Excluded by canonical, crawled but not indexed, discovered but not indexed, soft 404. Those exclusion reasons are Google telling you in writing what it thinks of your pages.

1. 1Crawl the site and count the indexable URLs (200 status, self-canonical, not noindexed).
2. 2Pull the indexed count from Search Console's Pages report.
3. 3Compare. A big gap in either direction is a flag.
4. 4If crawl is much bigger than index, Google is rejecting pages. Read the exclusion reasons.
5. 5If index is much bigger than crawl, you have orphaned or parameter URLs the crawler never reached.
6. 6Check the XML sitemap against both. Sitemap URLs should be indexable and live, with no redirects or 404s.

Crawl budget and the server logs

Crawl budget matters here too, though far less than people think for small sites. If you have 5,000 pages, ignore it. If you have 500,000, look hard at what Googlebot is actually spending its time on. The honest way to answer that is the server logs, not a tool's estimate. I cover that in my guide on log file analysis, and for big sites it is the single most underused audit input there is.

With the crawl in hand, I walk the technical foundation. This is the plumbing. None of it is glamorous, and most of it will not make a site rank on its own, but any one of these can quietly cap your ceiling no matter how good your content is.

Status codes and redirect chains

Start with status codes because they are unambiguous. 404s that still have internal links pointing at them are bleeding link equity. 302s used where a 301 belongs are telling Google the move is temporary when it is not. Redirect chains, where A points to B points to C, waste crawl and dilute signals at every hop. Map every chain and collapse it to a single hop.

Canonicals and duplication

Canonical tags are where I find the most self-inflicted damage. Pages canonicalizing to the homepage. Paginated sets canonicalizing to page one and losing their deeper products. Parameter URLs with no canonical at all, multiplying into thousands of near-duplicates. Every canonical should point to the one version of a page you want ranked, and it should match the URL in your sitemap and your internal links. When they disagree, Google picks, and it does not always pick your favorite.

Now we leave the plumbing and ask the question that actually decides rankings. For each important page, does it deserve to win? Technical perfection on a thin, intent-mismatched page is a fast car with no engine. This is where most of the real upside hides.

I audit on-page in three passes. First, intent. Pull the keywords each page targets and look at what currently ranks for them. If the page is a product page but the results are all how-to guides, you have an intent mismatch no title-tag tweak will fix. That is a strategy problem dressed up as an on-page problem, and it is worth catching early.

Second, the fundamentals. Title tags that earn the click and contain the primary term naturally. One H1 per page that matches the promise. A meta description that sells, even though it is not a ranking factor, because click-through is. Headings that structure the content for a skimmer. On a neglected site, fixing titles alone can move things in weeks.

Judging content depth honestly

Third, depth, and here you have to be ruthless. Open the page and ask: does this fully answer the query better than the pages above it? Not is it long. Word count is not depth. A 400-word answer that nails the question beats a 3,000-word one padded to hit a target. Look for genuine first-hand substance and specifics a rewrite of page one could never contain.

The output of this chapter is a content verdict for every important URL: keep as is, improve, consolidate, or remove. Page by page, that verdict is often the single most valuable thing in the audit, because it tells the client where to point their writers next instead of publishing more of what is not working.

Internal linking is the most underrated section of any audit, because it costs nothing to fix and you control all of it. No outreach, no waiting on Google, no third parties. You decide how authority moves through your own site, and most sites do it by accident.

Three things I check every time. Click depth: how many clicks from the homepage to your most important pages. If a money page sits five clicks deep, you are telling Google it is unimportant, whatever you actually believe. The pages you care about most should be close to the surface and linked from your strongest pages.

Orphans: pages with zero internal links pointing at them. The crawler finds these by comparing your sitemap and analytics against the link graph. An orphan is a page Google struggles to find and has no reason to value, because nothing on your own site vouches for it. Every orphan is either a page to link or a page to delete.

Where does the authority pool?

Look at the distribution of internal links. Most sites accidentally pour links into the footer and navigation, blasting equity at the privacy policy and the contact page while their best commercial pages get a single link from one blog post. Map your highest-value pages and check whether your internal link counts actually reflect that priority. They almost never do, and rebalancing them is free.

Off the site now, into the trust layer. Backlinks and E-E-A-T are different things, but I audit them together because they answer the same underlying question: does the rest of the world treat this site as credible, and would a careful person trust it?

On backlinks, I am looking for quality and relevance, not raw volume. Pull the profile from your link tool of choice and judge it. Are the linking domains relevant, or a graveyard of directories and irrelevant blogs? Is the growth curve natural, or are there suspicious spikes that scream a past link scheme? A hundred links from real, relevant sites beat ten thousand from a network nobody respects.

Benchmark against the competitors who actually outrank the client for the money terms. If the three sites beating them have links from industry publications and the client has none, that gap is a finding with a clear action. Resist the urge to obsess over a toxic-links cleanup unless there is real evidence of a penalty. Most disavow panic is wasted effort on links Google already ignores.

Auditing E-E-A-T as four questions

E-E-A-T is not a score you can read off a tool, so I audit it by asking the four questions on the pages that matter. Where is the proof of first-hand experience? Where is the proof of expertise, like a credentialed author? Who off-site vouches for this site? And why would a stranger trust this page, today, on the first read? Gaps in any of those four are findings, and on YMYL topics they move from nice-to-have to mandatory.

The signals are concrete and checkable: named authors with relevant bios, real credentials shown not just claimed, primary-source citations, a strong About page with a transparent identity, and Organization and Author schema that links to verifiable profiles. I lay out the full framework in my E-E-A-T guide, and an audit is the perfect moment to find where those proofs are missing.

Performance gets either ignored or wildly overhyped in audits. Let me set the weight correctly. Core Web Vitals are a real, confirmed ranking signal, but a small one, and they are mostly a tiebreaker. A fast page with weak content still loses. That said, on a competitive query where everything else is equal, speed and stability can be the edge.

The first thing to get right is field data versus lab data. Field data is what real Chrome users actually experienced, reported through the Chrome User Experience Report and visible in Search Console and PageSpeed Insights. That is what Google uses. Lab data, from a single Lighthouse run, is a diagnostic tool for finding the cause, not for judging whether you pass. Always anchor your verdict to the field data.

The three metrics, in plain terms

• Largest Contentful Paint (LCP): how fast the main content shows up. Usually a server, image, or render-blocking-resource problem.
• Interaction to Next Paint (INP): how snappy the page feels when the user taps or clicks. Usually a heavy JavaScript problem.
• Cumulative Layout Shift (CLS): how much the page jumps around as it loads. Usually missing image dimensions or late-loading fonts and ads.

In the audit, I report which of the three is failing at the 75th percentile, on mobile, because that is the bar Google holds. I do not report a generic speed score. I report the specific failing metric and its likely cause, because LCP, INP, and CLS have completely different fixes and lumping them into one number helps nobody implement anything.

For the full diagnosis-and-fix process on each metric, including the common causes and the order to tackle them, see my Core Web Vitals guide.

This is the chapter most audits in the wild still skip, and it is the one that separates a current playbook from a 2019 one. A growing share of searches now end in an AI answer instead of a list of blue links. So I audit a new question: when an AI engine builds an answer in your space, can it find you, parse you, and quote you with confidence?

Generative Engine Optimization is not a separate discipline bolted on the side. It is mostly the same fundamentals seen through a new lens. The same clear structure, strong E-E-A-T, and clean technical foundation that win in classic search also make a page easy for a language model to extract and trust. But there are specific things I now check that a 2019 audit never would have.

Can the AI crawlers even reach you?

First, discoverability for AI crawlers. Check robots.txt for the AI user-agents like GPTBot, OAI-SearchBot, ClaudeBot, and PerplexityBot. Plenty of sites have blocked these without realizing it, through a blanket rule or an over-eager security plugin, then wonder why they are invisible in ChatGPT. An audit should flag whether that block is a deliberate choice or an accident, because being uncited because you blocked the crawler is a self-inflicted wound.

Second, extractability. AI engines lift answers from content structured to be lifted. A page that buries its answer under 600 words of preamble is hard to quote. A page that states the answer directly, supports it, and structures the supporting points clearly is easy to quote. In the audit I flag the high-intent pages that are structurally hostile to extraction, because that is a fixable reason they are not getting cited.

Treat GEO readiness as a first-class section, not an afterthought. The encouraging part is that the work overlaps heavily with everything else in this audit. Fix the fundamentals, prove your experience, structure for clarity, and you improve classic rankings and AI citations at the same time. The payoff is double, and skipping this section dates your whole audit.

You have gathered everything. Crawl, indexation, technical, on-page, links, E-E-A-T, performance, GEO. Now comes the part that actually determines whether your audit changes anything: turning a pile of findings into a ranked plan someone will execute. A brilliant diagnosis that nobody acts on is worth exactly nothing.

I rank every finding on two axes: impact and effort. Impact is how much traffic, revenue, or risk reduction the fix is likely to deliver. Effort is how hard it is to implement, factoring in developer time and dependencies. Plot them and your priorities draw themselves. High impact and low effort go to the top. Low impact and high effort go to the bottom, or off the list entirely.

Presenting so it actually gets done

Be honest about that bottom-right quadrant. High effort and low impact is where good audits show discipline: you note the issue exists and explicitly recommend not doing it yet. Then structure the deliverable for the person who reads it, not for you. Open with an executive summary a non-technical decision-maker understands in two minutes: the state of the site, the three things costing the most, and what fixing them is worth. Then the prioritized issue list. Then a technical appendix for whoever implements it. Three layers, three audiences, one document.

An audit nobody implements is a very expensive way of being right. Your job is not to be thorough. Your job is to get the important things fixed.Shmul

Close with a clear next step. Not here are 200 problems, good luck. Instead: start with these three this month, here is who owns each, here is how we measure it. An audit is the beginning of work, not the end. The best audit I hand over is the one that gets the top three findings shipped within a quarter, and that is the standard I hold every one of mine to.