Most "technical SEO checklists" floating around the internet are marketing copy dressed up as advice — vague bullet points like "optimize your content" that tell you nothing actionable. Here's the version we actually built into SEO Loop's Site Audit, because when you have to write real code to check something, you can't hide behind vague language. Every item below is something our audit engine literally tests, line by line.

Indexability comes before everything else

None of the rest of this checklist matters if the page isn't indexable in the first place. Check for a stray noindex in your meta robots tag or in the X-Robots-Tag HTTP header — it's an easy thing to leave switched on after a staging deploy, and it silently removes the page from Google with zero visible error anywhere on the page itself. This is, in our experience, one of the single most common self-inflicted SEO disasters: a site that "just stopped ranking" for no apparent reason, months after someone forgot to flip a flag back off after testing.

Also worth checking here: whether your robots.txt is accidentally blocking paths that should be crawlable, and whether your XML sitemap actually exists and returns real URLs rather than a 404 or an empty file.

The on-page basics, done properly

• Exactly one H1 per page, a real title tag under roughly 60 characters, and a meta description under about 160 characters — long enough to be useful, short enough not to get truncated in search results
• A canonical tag on every page, even if it just points at itself — this prevents duplicate-content confusion when the same content is reachable via multiple URLs (with and without trailing slash, with tracking parameters, etc.)
• At least 300 words of genuine content, broken into sections with H2 subheadings rather than one dense wall of text
• Descriptive alt text on every image that carries actual meaning (decorative images are the exception, not the rule)
• A reasonable number of internal links pointing to other relevant pages on your own site — pages with almost no internal links pointing to them are effectively invisible to both users and crawlers

Structured data and social metadata

JSON-LD structured data (schema.org markup) is what lets Google show rich results — star ratings, FAQ dropdowns, breadcrumb trails — instead of a plain blue link. It's not mandatory, but its absence is a genuinely free opportunity being left on the table. Use our Schema Markup Validator to check what's actually present and whether it parses as valid JSON, since a syntax error in your structured data means Google ignores all of it silently.

Open Graph and Twitter Card tags matter for a different reason: they control how your page looks when someone shares it on social media or pastes the link into Slack. A page with no og:image shows up as a bare gray box when shared — an easy, invisible-until-someone-tests-it credibility loss. Check this directly with our Social Share Preview tool.

Security signals that quietly affect trust

HTTPS itself is table stakes now — Chrome actively warns users away from plain HTTP sites. But the details underneath still matter: HSTS headers (which tell browsers to never even attempt an HTTP connection), zero mixed content (no HTTP resources loading on an HTTPS page, which browsers will block or warn about), a valid and current SSL certificate, and headers like Content-Security-Policy, X-Content-Type-Options, and Referrer-Policy that signal a site is actually maintained rather than abandoned. None of these are direct, heavily-weighted Google ranking factors on their own — but they're increasingly used as trust signals, and a site failing basic security hygiene is a site more likely to be flagged, blocklisted, or simply distrusted by users who notice the browser's "not secure" warning.

Performance, without needing a lab

You don't need Lighthouse open in a second browser tab to catch the obvious problems: response time under roughly two seconds, whether your HTML response is actually gzip or brotli compressed (an enormous, nearly-free win that a shocking number of sites still miss), render-blocking scripts loaded without defer or async, and images missing loading="lazy". Our audit checks all of this automatically on every run — and if you add a free PageSpeed Insights API key in Site Audit settings, it layers in a real Lighthouse mobile performance score on top of the heuristics, giving you Google's own measurement rather than an approximation.

Crawlability and site architecture

A checklist item that's easy to overlook because it's invisible from the outside: can a crawler actually reach every page you want indexed within a reasonable number of clicks from your homepage? Pages buried five or six levels deep in your navigation, with no other internal links pointing to them, get crawled rarely if at all. This is where a full-site crawl earns its keep over a single-page audit — it surfaces orphaned pages and broken internal link chains that no amount of single-page checking would ever reveal.

Redirects and dead links

Every redirect hop adds latency and dilutes link equity slightly; a chain of three or four redirects to reach the final URL is a real, measurable drag. Use our Redirect Chain Checker to trace exactly how many hops any given URL takes, and our Broken Link Checker to find dead links before your users — or Google — do it for you.

How often should you actually re-check all this?

After any deploy that touches templates, server configuration, hosting, or DNS — that's when regressions happen, not randomly on a Tuesday. Beyond that, a monthly pass on your most important pages is a reasonable cadence for most sites; anything faster is usually unnecessary unless you're actively mid-migration or debugging a specific ranking drop.

Run the full checklist yourself, for free, at seoloop.in/site-audit — single page in seconds, or a full crawl in a couple of minutes.

International sites and hreflang

If you serve multiple language or regional versions of the same content, hreflang tags tell search engines which version to show to which audience — without them, Google has to guess, and it frequently guesses in ways that show the wrong language version to the wrong region. This is a narrower concern than the rest of this checklist (it only applies if you actually run multiple locales), but it's a common and quietly expensive gap on sites that expanded internationally without revisiting their original single-language SEO setup.

A performance budget, not just a performance score

Beyond the pass/fail checks, it's worth setting yourself an actual budget rather than chasing an abstract number: a target HTML payload size, a maximum number of render-blocking resources, a response-time ceiling you treat as non-negotiable for any new template or plugin you add. Checklists catch violations after the fact; a budget, enforced during development, prevents them from shipping in the first place. Teams that treat performance as a design constraint from the start consistently end up with fewer audit failures than teams that treat it as a cleanup pass at the end.

The checklist, as an actual checklist

• Page is indexable — no accidental noindex, robots.txt allows the path
• One H1, title under ~60 characters, meta description under ~160
• Canonical tag present on every page
• 300+ words of real content with H2-structured sections
• Alt text on meaningful images
• Healthy internal link density to and from the page
• Valid JSON-LD structured data, if used
• Complete Open Graph and Twitter Card tags
• HTTPS with HSTS, zero mixed content, valid certificate
• CSP, X-Content-Type-Options, Referrer-Policy headers present
• Response compressed (gzip/brotli), response time under ~2s
• No render-blocking scripts missing defer/async
• Images using loading="lazy" where appropriate
• Sitemap and robots.txt both exist and are valid
• No broken links, no unnecessary redirect chains

Run every item on this list in one pass, automatically, at seoloop.in/site-audit.

Why weighting matters more than counting

A checklist with fifteen items on it invites a natural but misleading instinct: count how many you've ticked off and treat that as your score. Resist it. Two sites can both fail exactly three items on this list and be in wildly different actual health — one failing three low-importance cosmetic items, the other failing a missing canonical tag, a noindex left on by accident, and no HTTPS at all. Always ask which three, not how many. This is precisely why SEO Loop's own scoring weights every check by real importance rather than treating a favicon and an HTTPS certificate as equally significant — because they plainly aren't, and a raw pass/fail count would flatten that difference into meaninglessness.

One final practical note on maintaining this over time: assign an actual owner to technical SEO health, even if that's just you personally checking on a fixed schedule rather than waiting for a traffic drop to prompt a look. Checklists that live only in a document nobody revisits after the first read tend to catch the same handful of issues once and then quietly stop catching anything new as the site evolves around them.

Print this list, pin it to whatever project management tool your team actually uses, and revisit it after every significant site change — it's more useful as a living reference than as something read once and forgotten in a browser tab that eventually gets closed.