Most SEO audits fail before they start — not because the checklist is wrong, but because the order is. Teams run through technical checks, on-page checks, and content checks as if they’re separate boxes to tick, when really they’re layered. Fix the wrong layer first and every audit finding above it becomes unreliable. A content gap analysis means nothing if half the pages you’re analyzing aren’t even indexed. A backlink audit tells you little if the pages those links point to were merged or removed eighteen months ago and nobody updated the redirects.

This checklist is built around that dependency, not around alphabetical convenience. It’s called The 6-Layer Site Health Stack — six layers, each one a precondition for the next, running from foundational crawlability up to the on-page, content, authority, and AI-readiness signals that actually move rankings. Work top to bottom. Skipping a layer doesn’t save time; it just means you’ll redo the work above it once you find the problem underneath.

What an SEO Audit Actually Checks in 2026

An SEO audit is a structured evaluation of whether a website can be crawled, indexed, understood, and trusted by search systems — and increasingly, by the AI models summarizing search results. It covers six interdependent areas: technical foundation, crawlability and indexation, on-page and content quality, AI and entity readiness, backlink health, and performance and conversion signals. The output isn’t a score. It’s a prioritized list of what to fix first, because in 2026 search systems weigh crawl efficiency, semantic clarity, and machine-readable structure as heavily as traditional ranking factors like backlinks and keyword targeting.

That last part matters more than most checklists admit. Google’s own guidance has been blunt about this: unless your site is unusually large or changes constantly, micro-optimizing crawl budget won’t move the needle much — what matters is keeping sitemaps healthy and monitoring indexing trends, not chasing every theoretical technical fix. The shift in 2026 isn’t that technical SEO stopped mattering. It’s that “technical” now includes whether your pages are structured cleanly enough for an AI system to summarize correctly, not just whether a bot can fetch them.

The other shift worth naming upfront: an audit isn’t a one-time diagnostic anymore. Search systems update continuously, competitors ship continuously, and your own site drifts continuously — content ages, internal links go stale, schema falls out of sync with what’s actually on the page. A 2026 audit treats the checklist below as a recurring instrument, not a single pass-fail exam.

The 6-Layer Site Health Stack

Each layer below assumes the one before it is reasonably healthy. If Layer 1 has serious problems, don’t bother deep-diving Layer 4 yet — you’ll be analyzing data that’s about to change.

Layer 1: Technical Foundation

This is infrastructure — the stuff that, when broken, makes everything above it unreliable. It’s also the layer most teams skip because it feels “done” once it was set up correctly years ago. It rarely stays that way.

• HTTPS and security: Confirm SSL is active site-wide, with no mixed-content warnings on any page. Check certificate expiry dates too — an expiring certificate that lapses mid-quarter is a self-inflicted outage, and it happens more often than it should on sites where renewal isn’t automated.
• Mobile responsiveness: Test rendering on actual devices, not just browser dev tools. Over 70% of search traffic in most verticals is now mobile, and rendering differences between viewport simulation and real devices still catch teams off guard — particularly with sticky headers, modal overlays, and font scaling that behaves differently on real hardware than in a simulated viewport.
• Core Web Vitals: Pull current LCP, INP, and CLS scores from PageSpeed Insights or Search Console’s Core Web Vitals report. Flag any page in the “poor” bracket — these are the ones search systems treat as a user-experience liability, not just a speed issue. Pay particular attention to LCP: across the broader web, it remains the most common point of failure among the three metrics, more often the bottleneck than either CLS or INP.
• Site architecture and URL structure: Check for excessive URL depth (anything requiring 4+ clicks from the homepage is a structural problem, not a content one), consistent trailing-slash usage, and a logical folder hierarchy that mirrors your actual topic structure. Sites that have been live for several years often accumulate “ghost” structures — folders and parameter patterns from a redesign two CMS migrations ago that no longer match anything in the current navigation.
• Robots.txt and XML sitemap health: Confirm robots.txt isn’t accidentally blocking sections it shouldn’t, and that the sitemap only lists canonical, indexable URLs — not redirects, 404s, or noindexed pages. A sitemap padded with dead URLs doesn’t just look messy; it actively wastes crawl attention on pages that were never going to rank.
• Hosting and server response: Time to First Byte (TTFB) sits upstream of every other speed metric — if the server itself is slow to respond, no amount of front-end optimization fully compensates. Shared hosting plans that were adequate at launch frequently become the quiet bottleneck once traffic and page count both grow.

Layer 2: Crawlability and Indexation

If Layer 1 is sound, this layer asks whether search engines can actually find and process what you’ve built. This is also where audits most often reveal a gap between what a site owner believes is indexed and what actually is.

• Index coverage: Run a full crawl with Screaming Frog (free up to 500 URLs) and cross-reference against Google Search Console’s Page Indexing report. Look specifically for orphaned pages — pages with no internal links pointing to them, which crawlers struggle to discover organically. Orphaned pages are one of the most common and most invisible findings in any audit, precisely because nothing about them looks broken when you view the page itself.
• Crawl errors and redirect chains: Identify 404s, soft 404s, and redirect chains longer than two hops. Each extra hop in a redirect chain dilutes link equity and slows crawl efficiency, and chains tend to accumulate quietly over multiple URL migrations — a page redirected in 2023, then redirected again in 2025, can end up three hops from its final destination without anyone noticing.
• Canonical tag accuracy: Check that canonical tags point to the correct version of each page, especially on faceted navigation, paginated content, and any URL parameters from filtering or sorting. Misconfigured canonicals on e-commerce and listing-heavy sites are a recurring source of self-inflicted duplicate-content signals.
• Duplicate content and thin pages: Flag pages with near-identical content (product variants, tag archives, auto-generated category pages) and pages under roughly 300 words doing little more than templating. The fix isn’t always deletion — sometimes it’s consolidation into a single stronger page with a 301 redirect from the weaker duplicates.
• JavaScript rendering check: For sites built on JS-heavy frameworks, verify Google’s renderer is seeing the same content a user does. Use the URL Inspection tool in Search Console to compare rendered HTML against source HTML. This single check catches a disproportionate number of “why isn’t this page ranking” mysteries on modern JS-framework sites.
• Pagination and infinite scroll: If category or blog archive pages use infinite scroll without a paginated fallback, confirm crawlers can still reach deeper content. A crawler that can’t trigger a scroll event can effectively dead-end after page one.

Layer 3: On-Page and Content Quality

With crawlability confirmed, this layer evaluates whether what’s indexed is actually good — and whether it’s still good, since content quality is rarely static.

• Title tags and meta descriptions: Audit for duplicates, missing tags, and length issues (titles under roughly 60 characters, descriptions under roughly 155). More importantly, check that titles match search intent rather than just stuffing the focus keyword — a title optimized for clicks but mismatched to what the page delivers tends to show up later as a high-bounce, low-dwell-time problem.
• Heading structure: Confirm a single H1 per page and a logical H2/H3 hierarchy that doesn’t skip levels. Headings should read like genuine sub-points, not keyword-rephrased duplicates of each other — a pattern that’s easy to spot once you scan a page’s heading outline in isolation, stripped of body copy.
• Content depth versus top-ranking competitors: Pull the current top three results for your target queries and compare structurally — not just word count, but what subtopics they cover that your page doesn’t. The goal isn’t to match length for length’s sake; it’s to identify genuine coverage gaps a reader would notice.
• Content decay: In Search Console, pull 12 months of clicks for pages that used to perform. If impressions held steady but clicks dropped, the title or description likely stopped matching what users expect to click. If both impressions and clicks declined together, the content itself has fallen behind a moving bar — competitors caught up, or the topic shifted and the page didn’t. This distinction matters because the fix is completely different in each case: a CTR problem is a metadata fix; a decay problem is a content rewrite.
• Internal linking patterns: This is the one most checklists treat as a footnote and shouldn’t. Pull your highest-authority pages and check where they actually link. It’s common to find that a site’s strongest, oldest pages never got updated to link to newer, relevant content — which means link equity keeps flowing to where it’s always flowed, not to where it would do the most good now.
• E-E-A-T signals: Check for visible author bylines, author bio pages with genuine credentials, and clear evidence of first-hand experience on YMYL-adjacent or expertise-sensitive topics. This is no longer a “nice to have” for trust-sensitive niches — it’s increasingly a baseline expectation search systems and AI summarizers both weigh.
• Readability and structure for scanning: Short paragraphs, genuine subheadings, and tables or lists where they aid comprehension all improve both human readability and AI summarization quality. A wall of unbroken text is harder for both audiences to extract value from.

Layer 4: AI and Entity Readiness

This layer didn’t exist in most 2020-era checklists. It exists now because a meaningful share of discovery happens through AI Overviews, ChatGPT, and Perplexity rather than ten blue links — and the signals that earn citation in those surfaces only partially overlap with the signals that earn a top-10 ranking.

• Schema markup validation: Confirm Article, FAQPage, BreadcrumbList, or other relevant schema types are present, valid, and not flagged for any policy violations. Schema doesn’t guarantee an AI citation, but its absence makes one far less likely — structured data is one of the clearest signals a machine-reading system has for understanding what a page is actually about.
• Entity clarity: Check whether your content clearly establishes what entities (people, organizations, concepts) it’s discussing, with consistent naming rather than varying terminology for the same thing across pages. Inconsistent naming — calling the same concept three different things across three different posts — actively works against entity recognition.
• Direct-answer formatting: For pages targeting question-based queries, confirm the page answers the question plainly within the first 60–80 words of the relevant section — in prose, not buried in a list or behind a paywall-style intro. This is the single highest-leverage formatting change for AI Overview eligibility on informational content.
• AI citation testing: Manually query ChatGPT, Perplexity, or Google AI Overviews with your target topics and see whether your site gets cited, and if a competitor’s site is cited instead, note what structural difference might explain it. This manual spot-check is cheap and reveals more than most automated tools currently can.
• Structured data eligibility versus markup that doesn’t match content: Watch for the inverse problem too — markup claiming a feature (review stars, FAQ rich results) that the visible page content doesn’t actually support. This kind of mismatch risks a manual action, not just a missed opportunity.
• Freshness signals: Content updated within the last couple of months tends to earn more AI citation weight than stale content covering the same ground, all else equal. An audit should flag your highest-value pages that haven’t been touched in a year or more, even if nothing on them is technically wrong.

Layer 5: Backlink Health

By this point you know the site itself is sound. Now you’re auditing what other sites are saying about it.

• Link profile composition: Use Ahrefs or Semrush to pull your full backlink profile and segment into three buckets: links clearly helping (relevant, authoritative, contextual), links that are neutral, and links that look manufactured or toxic (irrelevant niches, link farms, anchor text patterns that look automated).
• Anchor text distribution: Check for over-optimization — if a large share of inbound anchor text is exact-match commercial keywords, that’s a pattern search engines have flagged for over a decade. A natural link profile shows variation: brand mentions, naked URLs, generic phrases, and topical anchors mixed together.
• Disavow file review: If a disavow file already exists, confirm it’s still relevant and isn’t disavowing links that have since become legitimate, or missing newer toxic links that have appeared since the last review. Disavow files are easy to set and forget; they shouldn’t be.
• Authority gap versus competitors: Compare your domain’s backlink profile against the sites currently ranking where you want to be. The gap itself is informative — sometimes it’s volume, sometimes it’s the quality and relevance of referring domains rather than the count.
• Lost link recovery: Identify backlinks that existed previously but have since disappeared — often because the linking page was updated, deleted, or the link itself was removed during a redesign on the other site. A surprising share of “lost” links can be recovered with a simple outreach email pointing out the broken reference.

Layer 6: Performance and Conversion Signals

The final layer connects all five above to whether the traffic you’re earning actually does anything.

• Analytics and tracking accuracy: Confirm GA4 (or equivalent) is correctly configured, tracking the right conversion events, and not double-counting or missing data due to consent-mode misconfigurations. An audit that skips this step risks building every other recommendation on data that was never reliable to begin with.
• Organic traffic trends by page: Identify which pages are growing, flat, or declining, and cross-reference against the content decay findings from Layer 3 — a page can be indexed and well-structured and still be losing relevance.
• Conversion path analysis: For commercial and transactional pages, check whether organic visitors are converting at a rate comparable to other channels. A page with strong rankings and weak conversion usually has a content-intent mismatch, not a technical problem.
• Search Console query-to-landing-page alignment: Pull the actual queries driving impressions to a page and check whether they match the page’s intended target. Pages frequently end up ranking for adjacent queries the content wasn’t written for — which is a content-strategy signal, not a technical one.
• Reporting cadence: Set a recurring schedule — weekly checks on rankings, crawl errors, and Core Web Vitals regressions; monthly reviews of traffic trends and completed fixes; quarterly full re-crawls, since running them more often rarely justifies the time cost on most sites.