Technical SEO checklist for 2026

Start with a full crawl

Most of the checks below can be found in one pass by crawling the site the way a search engine does. Run an audit first and use this checklist to understand and prioritise what it finds:

The other source you need is Google Search Console. A crawl shows what your site serves; Search Console shows what Google actually did with it. If you haven't verified your site there, do that before anything else.

1. Crawling

If search engines can't fetch a page, nothing else about it matters.

• robots.txt doesn't block anything important. One stray Disallow: / left over from a staging site removes a whole site from search. Test your key URLs, including CSS and JavaScript files, with the Robots.txt Tester. If Search Console reports blocked by robots.txt, find the rule responsible.
• You have an XML sitemap, and it's clean. It should list only canonical, indexable URLs that return 200: no redirects, no 404s, no noindex pages. Find yours with the Sitemap Finder, check its URLs in bulk with the Sitemap URL Extractor, or build one with the XML Sitemap Generator.
• The sitemap is listed in robots.txt and submitted in Search Console. See how to submit a sitemap to Google.
• Search Console's Crawl stats (under Settings) show no spikes in server errors or slow responses.
• Important content is in the HTML. Google can render JavaScript, but rendering is deferred and other crawlers, including most AI crawlers, often don't run JavaScript at all. Check that main text and links appear in the page source, not only after scripts run.

2. Indexing

Crawled isn't the same as indexed. These checks decide whether a page can be indexed, and which URL represents it.

• No accidental noindex. Check the robots meta tag and the X-Robots-Tag HTTP header on every page you want in search. Themes, plugins and staging settings add them without anyone noticing. The Noindex & Indexability Checker tests up to 1,000 URLs at once, and excluded by noindex tag covers where they come from.
• Every indexable page has a self-referencing canonical, and canonicals point at URLs that return 200, aren't redirected and aren't noindex. See canonical tags.
• Duplicate URLs are consolidated. Parameters, trailing slashes, uppercase paths, http and www variants and print versions all create copies. Find them with the Duplicate Content Checker, and see duplicate without user-selected canonical for the Search Console side.
• Review Search Console's Pages report. Every "not indexed" reason has a different fix: crawled – currently not indexed, discovered – currently not indexed, alternate page with proper canonical tag, page with redirect and soft 404. Many are expected; the job is to make sure none are pages you need.
• Spot-check key pages with URL Inspection. How to check if a page is indexed explains what each result means.

3. Status codes and redirects

• Pages return the right status. Real pages return 200, removed pages 404 or 410, and moved pages a redirect. An error page that returns 200 is a soft 404. Check URLs in bulk with the Bulk HTTP Status Code Checker, and see HTTP status codes for SEO.
• Your site has one canonical host. http://, https://, www and non-www should all end on one version, in one redirect.
• Permanent moves use 301 or 308. A 302 tells search engines to keep the old URL. See 301 vs 302 redirects.
• No redirect chains or loops. Every redirect should reach its destination in one hop. Trace them with the Redirect Checker and flatten them using this guide.
• Old URLs from past migrations still redirect. Removing old redirects turns every link pointing to them into a 404.
• A made-up URL returns 404. Visit /this-page-does-not-exist. If it returns 200 or redirects to the homepage, every broken link on the web becomes a soft 404 for your site.

4. Internal links and structure

• No broken internal links. Find them with the Broken Link Checker; how to find and fix broken links covers what to do with each.
• Internal links point at final URLs, not at redirects, and use real <a href> elements rather than JavaScript click handlers.
• Important pages are within three clicks of the homepage. Pages buried deep are crawled less often and look less important.
• No orphan pages. A page in your sitemap that no other page links to is hard for search engines to judge. The Website SEO Audit reports both click depth and orphans.
• URLs are short, lowercase and readable, with hyphens between words, and don't change once published.

5. HTTPS and security

• The SSL certificate is valid, covers every hostname you use, including www, and isn't about to expire. Check it with the SSL Checker. Certificate lifetimes are getting shorter, so automatic renewal matters more each year.
• Every page loads over HTTPS and HTTP redirects to it in one step.
• No mixed content. Images, scripts and stylesheets on HTTPS pages should load over HTTPS too.
• Security headers are in place, particularly Strict-Transport-Security. See what your server sends with the HTTP Header Checker.
• DNS and the domain are healthy. Records resolve as expected and the domain registration isn't close to lapsing. Check with DNS Lookup and the Domain Age Checker.

6. Speed and Core Web Vitals

Core Web Vitals measure real visitors' experience. Google's thresholds for "good", measured at the 75th percentile of page loads, are:

• Check field data in Search Console's Core Web Vitals report or PageSpeed Insights. Lab scores are useful for debugging but aren't what Google uses.
• The server responds quickly. Slow time to first byte delays everything else; caching and a CDN usually fix it.
• Images are sized, compressed and in modern formats, with width and height set to prevent layout shift, and the main image isn't lazy-loaded.
• The page works on phones. Google indexes the mobile version of pages, so content and links missing on mobile are missing for Google.

7. On-page technical elements

• Every page has a unique title and meta description that fit in search results. Preview them with the SERP Snippet Preview; title and meta description length explains the pixel limits.
• One clear H1 per page, and headings in a logical order.
• Images that carry meaning have alt text.
• The <html lang> attribute matches the page's language.
• Check a single page in depth with the SEO Checker, which runs 40+ of these checks at once.

8. Structured data and share tags

• Structured data is valid and matches the visible page. Use JSON-LD, and only types that describe what's really there. Test with the Schema Markup Validator; schema markup covers which types still earn rich results.
• Open Graph tags are set so shared links show a proper title and image. Check with the Open Graph Checker, and see Open Graph image size.

9. International sites

Skip this section if your site has one language.

• Hreflang tags use valid codes, every version lists itself and all the others, and every pair links both ways. The Hreflang Checker fetches every version and shows which return links are missing. Hreflang tags explains the rules.
• Each language version is its own crawlable URL, not switched by cookies or by detecting the visitor's location.

10. AI crawlers

• Your robots.txt says what you mean about AI. Decide whether to allow AI search crawlers such as OAI-SearchBot and PerplexityBot and training crawlers such as GPTBot, and check your CDN isn't blocking them without your knowledge. See how to block GPTBot and other AI crawlers, and build the rules with the Robots.txt Generator.
• An llms.txt file is optional. It helps developer documentation, but Google says no special AI files are needed for its AI features. See what llms.txt is or create one with the llms.txt Generator.

For Google's AI Overviews and AI Mode, nothing extra is required: a page has to be indexed and eligible for a snippet, which is what everything above ensures.

How often to run it

• Before and after every launch, migration or redesign. Most serious technical SEO problems arrive with a deployment.
• Monthly for a crawl of the whole site and a look at Search Console's Pages report.
• Quarterly for the slower-moving checks: Core Web Vitals, structured data, certificates, domain expiry and robots.txt.

Questions