How to Do a Technical SEO Audit (Step by Step, Free)

Published July 5, 2026 · 9 min read · by Liam O’Connor

Technical SEO fails silently. Content problems announce themselves — you can read a weak article and wince. But a noindex tag left over from staging, a redirect chain eating your link equity, a sitemap full of dead URLs? Those hide in plain sight for months while your traffic quietly leaks away.

The good news: a genuinely thorough technical audit doesn't require enterprise crawlers or a $400/month toolkit. It requires a checklist, an afternoon, and the discipline to work through layers in the right order. Here's the exact sequence.

Layer 1: Can search engines reach you?

Start at the front door. Fetch your robots.txt (yoursite.com/robots.txt) and read it slowly — this tiny file has taken down more sites than any algorithm update. Test your critical paths with the Robots.txt Tester: enter your homepage, a product page, a blog post, and confirm each shows "Allowed" for Googlebot. The classic disaster is a leftover Disallow: / from staging.

While you're there, check who else can crawl. The AI Crawler Access Checker shows whether GPTBot, PerplexityBot and friends can reach you — blocking them removes you from AI search answers, which may or may not be what you intend. Make it a decision, not an accident.

Next, verify your server responds correctly: run your homepage through the Website Speed Test. Response times over one second point to hosting or CDN problems that no amount of page optimization will fix.

Layer 2: Is the right content indexed?

Type site:yoursite.com into Google and study the count. Wildly fewer results than you have pages means indexing problems; wildly more means duplicate-content bloat — parameter URLs, tag archives, printer versions all competing with your real pages.

Then open Search Console's Pages report, which sorts every URL into indexed and excluded with reasons. Three exclusions deserve immediate attention: "Excluded by noindex" on pages that should rank (audit each with the On-Page Auditor, which surfaces meta robots), "Duplicate without user-selected canonical" (fix with self-referencing canonicals — verify using the Canonical Checker), and "Crawled — currently not indexed," which usually signals content Google judged too thin to bother storing.

Finish the layer by validating your sitemap in the Sitemap Validator. A sitemap should contain exactly your indexable canonical pages — no redirects, no 404s, no noindexed URLs. Every junk entry wastes a crawl.

Layer 3: Does anything leak?

Redirects and dead links are equity leaks. Check your domain-level redirects first with the Redirect Checker: http → https and www/non-www should each resolve in a single 301 hop, not a chain. Chains slow users and dilute the link value flowing through them.

Then sweep for corpses: point the Broken Link Checker at your key pages — homepage, top category pages, highest-traffic posts. Internal 404s block crawl paths and torch user trust in equal measure. Fix, replace, or remove every one.

If you have server access, this is where log files become gold. Drop an access log into the Log File Analyzer and see what Googlebot actually does on your site: which pages it hammers, which it ignores, and how many of its visits end in 3xx/4xx waste. Logs are ground truth; everything else is inference.

Layer 4: Is it fast and stable?

Speed auditing has two halves — what the lab says and what real users experience. Get both: the Page Speed Analyzer runs Lighthouse for the diagnostic detail, while the Core Web Vitals Monitor pulls 28 days of real-Chrome-user data — the numbers that actually feed rankings.

When something fails, the culprits rank in predictable order. Oversized images first: find them with the Page Size Checker, crush them with the Image Compressor. Render-blocking resources second: the Render-Blocking Checker lists each script and stylesheet delaying first paint, with the one-attribute fix for each. Missing compression and caching third: verify with the GZIP Test, then deploy the ready-made rules from the Caching Generator.

Don't skip mobile: Google ranks your phone experience, not your desktop one. The Mobile-Friendliness Checker audits viewport, tap targets and font sizes, and shows a live phone-frame preview.

Layer 5: Is your structure legible?

Structure is how authority flows. Two checks here. First, heading hierarchy on your templates — one H1, orderly H2/H3s — via the Heading Analyzer. Second, and far more interesting: internal link equity. Export your internal links and run them through the Internal PageRank Calculator. It runs the actual PageRank algorithm on your link graph and shows which pages hoard authority and which money pages starve. One internal link from your strongest page to a starving one is often the cheapest ranking improvement available.

Round out the layer with structured data (validate your JSON-LD in the Schema Validator) and, for multilingual sites, hreflang reciprocity via the Hreflang Generator — the single most commonly botched tag in international SEO.

Turning findings into a fix list

Audits fail in the follow-through, so triage ruthlessly. Now: anything blocking crawling or indexing — robots mistakes, stray noindex, server errors. These aren't optimizations; they're outages. This week: equity leaks — redirect chains, broken links, sitemap junk. This month: performance failures and structure improvements. Someday: everything cosmetic that a perfectionist would fix and a pragmatist schedules for later.

Write each fix down with its page, its symptom, and its deadline. An audit that lives in your head evaporates by Friday.

War stories: what audits actually find

Abstract checklists undersell how dramatic the findings can be, so here are the patterns that appear over and over in real audits. The staging leak: a development copy of the site at dev.example.com got indexed, and Google now sees every page duplicated — fixed with a noindex on the subdomain and a round of canonicals. The infinite calendar: an events plugin generating crawlable URLs for every month until the year 3000, burning the entire crawl budget on empty pages — visible instantly in a log file analysis as Googlebot marching through /events/2847-03/. The redirect onion: http → https → www → trailing slash, four hops on every single request because each rule was added by a different person in a different year. The plugin noindex: an SEO plugin update that silently flipped archive pages to noindex — including the blog homepage that fed forty percent of organic entrances.

None of these appear in content reviews. All of them are five-minute fixes once seen. That asymmetry — catastrophic impact, trivial repair, total invisibility — is the entire argument for auditing on a schedule rather than after a crash.

The tools stack, summarized

Everything in this audit runs free, and it helps to see the mapping in one place: crawl access via the Robots.txt Tester and AI Crawler Checker; indexing via Search Console plus the Sitemap Validator and Canonical Checker; leaks via the Redirect Checker, Broken Link Checker and Log Analyzer; speed via the Page Speed Analyzer, CWV Monitor and their supporting fixers; structure via the Heading Analyzer and PageRank Calculator. Bookmark the set; the afternoon you spend learning them repays itself on the first leak found.

Make it a habit, not an event

Sites decay. Plugins update, interns edit templates, CMSs regenerate files — and each change can quietly break something that was fine last quarter. The full five-layer audit twice a year keeps you honest; a fifteen-minute monthly mini-check (indexing count, homepage speed, broken links on top pages) catches most regressions early.

The monthly mini-check, concretely: site: search and compare the count to last month; homepage through the speed test; broken-link scan on your five most-visited pages; a glance at Search Console's Pages report for new exclusions. Calendar it for the first Monday of the month — fifteen minutes that catches ninety percent of regressions while they're still cheap.

And write findings down, even solo: a dated audit log turns next quarter's "wait, was it always like this?" into a lookup instead of a mystery. Half the value of auditing on a schedule is the baseline it leaves behind. The other half is psychological: sites with monitoring habits get fixed while problems are cheap and boring, and their owners sleep through the algorithm-update nights that keep everyone else refreshing dashboards. Choose boring; it compounds.

Start now, while it's fresh: open the Robots.txt Tester and check your front door. Layer 1 takes ten minutes — and it's the layer where the catastrophic stuff hides.

Reading the signals: how to interpret what you find

Audit tools produce data; audits produce judgment. Some interpretation guidance for the ambiguous findings. "Crawled — currently not indexed" on a few pages: normal — Google samples and skips; worry only when the count grows or hits pages you care about, which usually means the content reads as thin or duplicative. A slow homepage but fast interior pages: almost always the homepage's hero media and third-party scripts; audit it as its own project. Hundreds of parameter URLs indexed: not an emergency, but a canonical-tag project for the quarter — each duplicate dilutes. Googlebot crawling a page you deleted years ago: something still links to it; find the source with the Link Extractor on your suspect pages and either fix the link or 301 the ghost. Field data passing while lab scores look mediocre: ship it — real users outvote simulations, and Google agrees.

The meta-skill is distinguishing anomalies (sudden changes, growing trends) from background noise (stable imperfections every site carries). Sites are never perfect; healthy sites are merely stable and monitored. Chasing perfection on background noise is how audits become procrastination — the discipline is fixing what changed, watching what's trending, and shipping.

When to escalate beyond free tools

This workflow covers sites into the tens of thousands of pages. Three signals you've outgrown it: crawl-budget problems you can see in logs but can't localize (time for a desktop crawler that maps every URL relationship); JavaScript-rendered content that indexing reports show Google missing (time for rendering comparisons); and multi-site or multi-language operations where hreflang matrices exceed human patience. Even then, the free stack remains your verification layer — enterprise crawlers tell you what to look at; these tools confirm what's actually true, page by page, from the outside. The auditor who can work both layers is never hostage to either.

Frequently asked questions

Related Articles