How to do an SEO audit step by step (2026)
An SEO audit is seven checks run in a fixed order: reachability, indexation, JavaScript dependence, AI crawler access, topic clarity, structured data honesty, and speed. A non-technical owner can run all seven by hand in an afternoon using free tools from Google, and each step below names exactly what to look at and what a pass looks like. The order matters more than the tooling, because a failure early in the list makes everything after it noise. Every step also maps to a named check in our public catalog of 164 graded checks, so you can confirm the automated version runs the same tests.
Step 1: Can search engines reach your pages?
Open yourdomain.com/robots.txt in a browser. Google's documentation is plain about what this file does: "A robots.txt file tells search engine crawlers which URLs the crawler can access on your site." Read yours and confirm it does not disallow the pages that earn you money. Then confirm you have a sitemap, usually at /sitemap.xml, and that the pages it lists actually exist. Google's sitemap docs explain what belongs there. In our catalog these are gate.crawlable, gate.robots_quality, and gate.sitemap.
Step 2: Are your important pages actually indexed?
Reachable is not the same as indexed. Set up Google Search Console, which is free, and run the URL Inspection tool on your homepage and your top money pages. It tells you whether Google holds the page in its index and, if not, why. Also view each page's source and search for the word noindex. A forgotten noindex tag, left over from a redesign or a staging copy, quietly removes a live page from search and no dashboard warns you. This is gate.indexable.
Step 3: Does your content survive without JavaScript?
View the source of your homepage (Ctrl+U in most browsers) and search for a sentence you can read on the rendered page. If your visible text is not in the source, your site is assembled by JavaScript in the visitor's browser. Google can render JavaScript, but its own documentation treats rendering as a separate, heavier stage, and many AI crawlers read only the raw HTML. We wrote up what that costs in why AI assistants cannot see half your website. The check is gate.renders_no_js.
Step 4: Can AI crawlers read your site?
Go back to robots.txt and look for the AI user agents by name:
- GPTBot and OAI-SearchBot, documented by OpenAI, one for training and one for search
- ClaudeBot, Anthropic's crawler
- PerplexityBot
- Google-Extended, the token in Google's crawler docs that controls AI training use of your content
Blocking any of them can be a legitimate choice, but it should be a choice, not an accident of a template or a CDN default. And a permissive robots.txt is not the whole answer: firewall and CDN settings can turn the same bots away at the door while your robots file says yes. We probe both sides, as gate.ai_bot_access and gate.bot_reachability.
Step 5: Does each page say what it is about?
Pick your five most important pages and read each one's title, meta description, main heading, and opening paragraph cold, the way a stranger would. Google's guidance on titles asks for descriptive, concise text, not a keyword pile. Then apply a harder test: does the first paragraph answer the visitor's question in words that would survive being quoted on their own? That paragraph is what an answer engine lifts. We grade these as core.title, core.meta_description, core.h1, and core.answer_block.
Step 6: Does your structured data tell the truth?
Structured data is machine-readable markup that describes your page: the business, the product, the article, the opening hours. Paste a page into Google's Rich Results Test and read what comes back. Then compare it against the visible page, because Google's structured data policies require markup to reflect content a reader can actually see. Review stars on a page with no reviews, or marked-up hours that disagree with your footer, do more harm than no markup at all. We test this as core.structured_data and core.schema_visible_parity.
Step 7: Is the site fast, light, and secure?
Run your homepage through PageSpeed Insights, Google's free measurement tool, and read the Core Web Vitals verdict before the long list of suggestions. Then check the padlock: every page should load over HTTPS, including old URLs from before any migration. Heavy pages usually trace back to oversized images and third-party scripts, which is why our catalog carries hyg.page_weight and hyg.third_party_scripts alongside the security, accessibility, and privacy checks.
What order do you fix things in?
Worst first, and gates before polish. A page that cannot be crawled makes its title irrelevant, so anything failing in steps 1 through 4 outranks everything cosmetic. That is also how honest scoring should work: a broken front door caps the grade no matter how polished the rest is, and that rule is public in our methodology. When a fix ships, verify it in Search Console over the following weeks, not in a tool's score. Any score, ours included, is a hypothesis. Your own traffic numbers are the ground truth.
When should you pay someone instead?
The manual version costs nothing but an afternoon, and it will catch the failures that matter most. What it cannot give you is judgment: which finding matters most for your business, what competitors are doing about the same weakness, and hands to do the work. If your list comes back longer than you can act on, paying can be rational, and we published what an audit costs and what you get at each price so you can price that decision with open eyes.
The automated version
The seven steps above are the manual version of exactly what our scanner runs page by page, plus the rest of the catalog: the same reachability probes, the same no-JavaScript read, the same schema parity test, every failure named in plain language and ranked worst first. When you want the afternoon back, run a free Visibility Scan at auditlamp.com.