Technical SEO Audit Checklist for 2026: 15 Issues That Kill Rankings

Crawlability and Indexation: The Starting Point

Before any other technical audit work, confirm that Google can find and access your key pages. Check your robots.txt file for accidental disallow rules blocking important sections — a common mistake is blocking the entire site during development and forgetting to remove the rule at launch. Verify that your XML sitemap is submitted to Google Search Console, contains all priority URLs, and that every URL in the sitemap returns a 200 HTTP status code. Check the GSC Coverage report for pages marked as 'Crawled - currently not indexed', 'Discovered - currently not indexed', and 'Page with redirect' — each status indicates a different underlying issue. Use Screaming Frog or Sitebulb to crawl your entire site and identify pages that are accidentally blocked, noindexed, or returning non-200 status codes.

• robots.txt: verify no critical paths are blocked — check /wp-admin, /cart, and staging subfolders separately
• XML sitemap: submit to GSC, verify all URLs return 200 status using Screaming Frog
• Noindex audit: crawl all pages and flag any with meta robots noindex that should be indexed
• GSC Coverage report: review and categorise every excluded URL — fix systematic exclusions first
• Check for crawl budget waste: infinite scroll pages, faceted navigation, and parameter URLs consuming crawl budget

Core Web Vitals: The Performance Ranking Signals

Core Web Vitals became a confirmed Google ranking signal in 2021 and remain a meaningful ranking factor in 2026. The three metrics are: Largest Contentful Paint (LCP — how fast the main content loads, target under 2.5 seconds), Interaction to Next Paint (INP — how fast the page responds to interactions, target under 200ms, replaced FID in 2024), and Cumulative Layout Shift (CLS — how much the page visually shifts during loading, target under 0.1). Use Google Search Console's Core Web Vitals report for field data from real users, and PageSpeed Insights for lab data with specific recommendations. The most common issues: LCP failures from large, unoptimised hero images; INP failures from heavy JavaScript execution blocking the main thread; CLS failures from images without explicit dimensions, dynamically injected ads, and web fonts causing layout reflow.

1. 1Open GSC Core Web Vitals report — identify URLs rated Poor (red) first, then Needs Improvement (orange)
2. 2Run each Poor-rated URL through PageSpeed Insights to get specific recommendations
3. 3Fix LCP: optimise hero image with WebP format, preload the LCP element, use a CDN
4. 4Fix INP: audit JavaScript execution time, defer non-critical scripts, reduce main thread blocking
5. 5Fix CLS: add explicit width and height attributes to all images, reserve space for ads and embeds
6. 6Re-run validation in GSC after fixes — Google takes 28 days to update CWV field data

Duplicate Content and Canonicalisation Issues

Duplicate content occurs when Google can access the same or very similar content at multiple URLs. This splits PageRank between the duplicate versions, reducing the ranking power of any individual URL. Common duplicate content sources in Indian business websites: www vs non-www (both accessible without a redirect), HTTP vs HTTPS (HTTP pages still accessible), trailing slash variations (/about vs /about/), URL parameters from analytics or session tracking (?utm_source=email&utm_campaign=jan), paginated pages without proper canonical handling, and printer-friendly page variants. Use Screaming Frog to identify pages with duplicate or very similar title tags — a reliable proxy for duplicate content issues. Implement canonical tags on all affected pages pointing to the authoritative version, and use 301 redirects for URL variations that should never be directly accessible.

• Ensure www redirects to non-www (or vice versa) with a permanent 301 redirect — not both accessible
• HTTP to HTTPS: all HTTP URLs must 301 redirect to HTTPS equivalents without exception
• Add canonical tags to all pages — self-referencing canonicals on unique pages, cross-referencing on duplicates
• URL parameter handling: use GSC's URL Parameters tool or canonical tags to handle tracking parameters
• Paginated series: use rel=canonical to the first page on paginated series that do not need separate indexation
• Check for content scraped from or duplicated to other domains — disavow if linking to your site

Site Architecture and Internal Linking

How your website is structured internally determines how PageRank flows through your site and which pages Google considers most important. Pages with zero internal links — orphaned pages — receive no PageRank from the rest of the site and rarely rank regardless of their content quality. A flat site architecture (every important page within 3 clicks of the homepage) is preferred over deep hierarchies where important pages are 5-6 clicks from the homepage. Use Screaming Frog to identify: orphaned pages (no internal links pointing to them), pages with only one or two internal links, broken internal links (returning 404 or 500), and redirect chains where pages link to redirected URLs instead of the final destination. Fix systematically: add internal links from high-authority pages to orphaned content, update broken links to point to live URLs.

• Every important page should be reachable within 3 clicks from the homepage
• Identify orphaned pages using Screaming Frog — these pages receive zero internal PageRank
• Fix broken internal links (404s) immediately — they waste crawl budget and PageRank
• Ensure internal links use descriptive anchor text, not 'click here' or 'read more'
• Pillar pages should link to all supporting cluster pages, and all cluster pages should link back
• Avoid redirect chains in internal linking — update links to point to the final URL directly

Structured Data and Schema Markup

Structured data tells Google (and AI search systems) exactly what type of content a page contains, who authored it, when it was published, and what questions it answers. Proper schema implementation can enable rich results in the SERP — star ratings, FAQ dropdowns, breadcrumbs, and How-To cards — that significantly improve CTR even without position changes. In 2026, schema also feeds AI Overview citations directly. Priority schema types: Organization (homepage), LocalBusiness (location pages), Article (blog posts), FAQ (any Q&A content), HowTo (process guides), BreadcrumbList (all pages), Person (author pages). Use Google's Rich Results Test and Schema Markup Validator to check implementation accuracy. A single missing required field can prevent rich result eligibility.

• Organization schema on homepage with logo, contact info, and social media profile URLs
• LocalBusiness schema on all location pages with NAP, opening hours, and service area
• Article schema on all blog posts: author, datePublished, dateModified, headline
• FAQ schema on pages with question-and-answer sections — directly feeds AI Overviews
• BreadcrumbList schema site-wide for breadcrumb rich results in search snippets
• Validate all schema using Rich Results Test after implementation — fix all errors and warnings

Mobile Usability and Responsive Design

Google uses mobile-first indexing — it crawls and indexes the mobile version of your site as the primary version. Issues on mobile that do not exist on desktop still affect your rankings. Common mobile usability failures identified in Google Search Console: text too small to read without zooming, clickable elements too close together (touch targets under 48x48 pixels), content wider than screen requiring horizontal scrolling, and interstitials or pop-ups blocking content on mobile. Use GSC's Mobile Usability report to identify specific pages with issues. Test key pages on multiple device sizes using Chrome DevTools device simulation and on real devices. Pages that pass desktop but fail mobile usability negatively impact the entire site's mobile ranking performance.

• Check GSC Mobile Usability report monthly — address any flagged issues within 2 weeks
• Touch targets (buttons, links) must be minimum 48x48px with adequate spacing between elements
• Body text minimum 14px on mobile — 16px preferred for readability without zooming
• No horizontal scroll: all content must fit within the viewport width on 360px screens
• Interstitials: avoid full-screen pop-ups on mobile — Google penalties apply for intrusive interstitials

Page Speed and Server Response Time

Server response time (Time to First Byte, TTFB) is the foundational performance metric that affects every subsequent page load metric. A slow server inflates LCP, delays crawling, and signals poor infrastructure quality. Target a TTFB under 600ms — most modern hosted WordPress sites achieve 200-400ms with proper configuration. Common TTFB culprits: shared hosting with resource contention, unoptimised database queries on WordPress, no server-side caching, and geographic mismatch between server location and primary audience (a server hosted in the US serving primarily Indian traffic adds 150-300ms latency). For Indian businesses, hosting on servers in Mumbai or Singapore with a CDN like Cloudflare delivers significant performance improvements over US-based hosting.

• Target TTFB under 600ms — test using WebPageTest from a server in India
• Enable server-side caching (WP Rocket, LiteSpeed Cache, or Redis for WordPress)
• Use Cloudflare CDN with Indian edge nodes to reduce latency for Indian visitors
• Host on servers in Mumbai or Singapore for Indian traffic — not US or European data centres
• Audit WordPress plugins quarterly — deactivate and remove any not actively used
• Enable gzip or Brotli compression for HTML, CSS, and JavaScript files

HTTPS, Security, and Technical Trust Signals

HTTPS has been a Google ranking signal since 2014 and is now table stakes. More important in 2026 are the secondary security signals that affect both rankings and user trust. Mixed content errors — HTTPS pages loading HTTP assets like images, scripts, or stylesheets — trigger browser warnings and can suppress rankings. Expired SSL certificates cause complete site access failure for most users. Missing security headers (Content-Security-Policy, X-Frame-Options, X-Content-Type-Options) are not ranking factors but affect your domain's trust profile in security assessment tools that some AI systems reference. Use SSL Labs to check your SSL configuration grade (target A or A+), Qualys SSL Test for certificate validation, and a security header checker to verify header presence.

• Verify SSL certificate is valid, properly installed, and not expiring within 60 days
• Fix all mixed content errors — every page must load all assets over HTTPS
• Check for HTTP internal links in the HTML source — these cause mixed content warnings
• Implement HSTS header to prevent protocol downgrade attacks
• Review Google Search Console Security Issues report quarterly for any flagged vulnerabilities