There is a particular kind of fatigue that settles on a business owner when they are told, once again, that their website "needs an SEO audit." The word itself has been abused into meaninglessness -- used by agencies to justify retainers, by consultants to sell PDFs, by software companies to upsell enterprise plans. The truth is that a genuinely useful technical SEO audit is neither mysterious nor expensive. It is a checklist. A long one, yes, but a checklist nonetheless, and one that any business owner with a few uninterrupted hours can work through.
This guide is that checklist. It is organized by category, written without jargon where possible, and focused entirely on what matters for small and medium businesses. It is deliberately pragmatic: each item explains not just what to check but why, and more importantly, whether it is worth your time. Because the fundamental mistake most SEO audits make is treating every issue as equally urgent, when in reality some findings are catastrophic and others are cosmetic.
Before you begin, understand that this is the complete guide to SEO audits for small businesses, distilled into a practical checklist. If at any point during this process you think "this is genuinely too much work," the honest answer is: you are right, and Licheo's free SEO check will do ninety percent of this in about thirty seconds. That is, in truth, what we built it for.
Part 1: Crawlability -- Can Google Even See Your Site?
The foundation of technical SEO is deceptively simple: search engines must be able to find, access, and read your pages. If this layer is broken, nothing else you do matters. Naturally, this is also the layer where small business sites most commonly have silent, years-old problems that nobody noticed.
1. Verify your robots.txt file exists and is not blocking important pages. Visit yourdomain.com/robots.txt and read what is there. If you see Disallow: / as the only instruction, your entire site is being blocked from search engines. This sounds unlikely, but we have seen it on real client sites -- usually a leftover from a development environment that was pushed to production by accident. Fix this before you do anything else.
2. Check that your XML sitemap exists and is submitted to Google Search Console. Your sitemap should live at yourdomain.com/sitemap.xml or yourdomain.com/sitemap_index.xml. It is a map of all the pages you want Google to know about. If it does not exist, your CMS (WordPress, Shopify, Squarespace) probably has a plugin or setting to generate one automatically. Once it exists, submit it via Google Search Console's Sitemaps section.
3. Look for manual actions in Google Search Console. In GSC, navigate to Security & Manual Actions > Manual Actions. If there is anything listed here, Google has taken human action against your site for guideline violations. This is the most serious issue a site can have, and it trumps everything else on this checklist.
4. Review the Coverage report for indexing errors. GSC's Pages report shows you exactly which pages Google has tried to crawl and what happened. Look for patterns: are entire categories of pages showing as "Crawled - currently not indexed" or "Discovered - currently not indexed"? These are not errors in the traditional sense, but they are signals that Google does not find those pages valuable enough to include.
5. Check for unexpected pages in the URL inspection tool. Pick three of your most important pages (homepage, top service page, top blog post) and run each through GSC's URL Inspection. Look at what Google has actually indexed. If the indexed version is missing content you can see on the page, you have a rendering problem.
6. Confirm your site is accessible on both www and non-www, but only one is canonical. Type both https://yourdomain.com and https://www.yourdomain.com in your browser. Both should work, and both should redirect to the same version. If they do not, you have a duplicate content issue that has probably been split your ranking signals for years.
7. Verify HTTPS is enforced everywhere. Try visiting http://yourdomain.com (note: no S). You should be automatically redirected to the HTTPS version. If you are not, search engines and modern browsers will treat your site as insecure, and mixed content warnings will undermine trust.
Part 2: Indexation -- Is Google Actually Including Your Pages?
Being crawlable is not enough. Search engines must also decide that your pages are worth keeping in their index. This distinction matters enormously, and it is where most small business audits find their biggest opportunities.
8. Count the pages in your sitemap vs the pages in Google's index. In GSC, note the total indexed pages. Compare that to the number of URLs in your sitemap. If you have 50 URLs in the sitemap and only 20 indexed, something is preventing Google from keeping the others.
9. Search site:yourdomain.com in Google directly. This shows you the pages Google has indexed. Scroll through the first few pages of results. Do you see anything unexpected? Old dev pages, thank-you pages, internal search result pages, tag archives that should not exist? These all need to be noindexed or removed.
10. Check for noindex tags on pages that should be indexed. This is one of the most common silent SEO killers. A developer or plugin accidentally adds a <meta name="robots" content="noindex"> tag to an important page, and it silently drops out of Google. Right-click any page, View Source, and search for "noindex." If it appears on a page you want ranked, remove it.
11. Audit your canonical tags. Every page should have a canonical tag pointing to itself (or to the preferred version if duplicates exist). Use GSC's URL Inspection to see what canonical Google recognized -- if it differs from the one you set, there is a conflict somewhere.
12. Look for soft 404s in the Coverage report. A soft 404 is a page that returns a "200 OK" status code but shows thin or error-like content. Google usually catches these and reports them. They waste crawl budget and dilute your authority.
13. Confirm pagination is not fragmenting your authority. If you have blog category pages or ecommerce category pages with multiple pages, Google needs to understand they are related. The old rel=next/prev solution is deprecated; instead, use a self-referencing canonical on each paginated page, plus strong internal linking.
14. Check for duplicate content from URL parameters. Visit a few pages with and without trailing slashes, with and without UTM parameters. They should all canonicalize to a single version. If each produces a separate indexable page, you are creating duplicate content automatically.
15. Review index bloat from tag pages, author archives, and search results. WordPress sites in particular generate hundreds of low-value pages: every tag gets a page, every author gets an archive, every search query can be indexed. Most of these should be noindexed or disabled entirely.
Part 3: Site Architecture -- Is Your Structure Sane?
16. Test your site's click depth. From your homepage, can you reach your most important pages in three clicks or fewer? If not, those pages are structurally invisible to both users and search engines. Flatten your architecture by improving navigation and internal linking.
17. Audit your internal linking from important pages. Your homepage passes the most authority. How many of your high-priority pages are linked directly from the homepage? If your top service pages are not in the primary navigation, they are probably being under-ranked.
18. Identify orphan pages -- pages with no internal links. A page with zero internal links is, functionally, a page that does not exist. Use a free crawler like Screaming Frog (free tier allows 500 URLs) to find orphaned content, then link to it from relevant places.
19. Check your URL structure for clarity. URLs should be readable and descriptive. /services/plumbing/emergency-repair is good. /page.php?id=47&cat=3 is bad. Old URLs like the second type signal an outdated CMS and hurt click-through rates even if they still rank.
20. Verify breadcrumbs exist and are marked up with schema. Breadcrumbs help users navigate and help search engines understand your site structure. They also frequently appear in search results, improving CTR.
21. Look for deep content buried in old blog posts. Many small businesses have written good content years ago and forgotten about it. Old posts with decent traffic can be refreshed, updated, and internally linked to drive renewed rankings.
Part 4: Performance -- Does Your Site Actually Load?
22. Run Google PageSpeed Insights on your homepage. Accept that lab scores fluctuate, but look at the Core Web Vitals metrics: LCP, INP, CLS. If any are in the "Poor" zone (red), you have work to do. If they are all "Good" (green), performance is not your bottleneck.
23. Check Core Web Vitals in Google Search Console. GSC's Core Web Vitals report shows field data from real users -- this is what Google actually uses for ranking. Trust this report over isolated PageSpeed runs.
24. Audit your hero image size. On most pages, the hero image is the Largest Contentful Paint element. Right-click it and "Save image as" to see the file size. If it is over 300KB, resize and recompress. This one change often moves LCP from red to green.
25. Check for render-blocking resources. PageSpeed Insights will list scripts and stylesheets that block the initial render. Defer third-party scripts (chat widgets, analytics, ad networks) wherever possible.
26. Test mobile performance, not desktop. Google uses mobile-first indexing. Desktop scores are almost always better than mobile, but mobile is what counts for ranking. Always test on mobile.
27. Verify images have width and height attributes. Every <img> tag should specify dimensions. Missing dimensions cause Cumulative Layout Shift -- text jumping around as images load. Modern browsers handle responsive sizing correctly when dimensions are present.
Part 5: Mobile & Accessibility
28. Run the Mobile-Friendly Test. Google's free tool at search.google.com/test/mobile-friendly tests whether a page is mobile-optimized. Every important page should pass.
29. Check tap target sizes. Buttons and links should be at least 48x48 pixels for comfortable tapping. Small, cramped navigation is a ranking and UX problem.
30. Verify font sizes are readable on mobile. Body text should be at least 16px on mobile. Smaller text fails mobile usability.
31. Check that critical functionality works without JavaScript. Turn off JavaScript in your browser and revisit your site. Core navigation and content should still be accessible. If the site completely breaks, Google may have rendering issues.
Part 6: Structured Data
32. Test your homepage in Google's Rich Results Test. Paste your homepage URL into search.google.com/test/rich-results. Look at what schema types are detected and whether they pass validation.
33. Verify LocalBusiness schema if you are a local business. Every local business should have LocalBusiness schema with name, address, phone, hours, and geo coordinates. This is non-optional for local SEO.
34. Check for invalid or misleading structured data. Schema must match visible page content. Fake review schema or inflated ratings will trigger manual actions.
35. Review Search Console's Enhancements reports. GSC shows you every schema type it has detected on your site, along with valid and invalid items. Fix the invalid ones.
Part 7: Security & Trust
36. Confirm your SSL certificate is valid and current. Visit your site and check for the padlock icon. If the browser warns of an expired or invalid certificate, users will leave immediately.
37. Look for mixed content warnings. A page loaded over HTTPS that includes HTTP resources (images, scripts, stylesheets) triggers browser warnings. Open DevTools and check the Console for mixed content errors.
38. Verify there is no malware or hacked content. GSC's Security Issues report flags this. Outdated WordPress installations are a common target.
Part 8: Content Quality
39. Identify pages with thin content. A page with fewer than 200 words of unique content is usually not valuable enough to index. Either expand these pages or remove them.
40. Look for duplicate title tags and meta descriptions. Each page should have a unique title and description. GSC will flag duplicates in the Enhancements report.
41. Check for missing H1 tags. Every page should have exactly one H1 that describes the page topic.
Part 9: Backlinks & External Signals
42. Review your backlink profile for toxic links. Use a free tool like Ahrefs Webmaster Tools (free for site owners) or GSC's Links report. Look for obvious spam -- link farms, completely unrelated sites, foreign-language bulk links.
43. Confirm your Google Business Profile is claimed and verified. For local businesses, this is as important as any on-page signal. See our Google Business Profile guide for the full walkthrough.
Part 10: International & Specialized Checks
44. If you serve multiple countries or languages, check hreflang. Hreflang tags tell Google which version of a page to show to which users. They are notoriously easy to implement incorrectly.
45. Verify your GEO / AI search visibility. Traditional SEO is only half the picture now. Check whether ChatGPT, Perplexity, and Google AI Overviews can find and cite your business. See our AI Search Guide.
What to Do With All These Findings
Congratulations -- you now have, in all likelihood, a list of twenty to forty issues. This is where most audit guides leave you: drowning in findings, with no framework for what to fix first. The next step is to prioritize them, which is precisely what our impact-effort prioritization framework explains in detail.
Or, if this entire exercise has convinced you that you would rather not spend your afternoon cross-referencing Google Search Console tabs, run the Licheo audit for free. It takes thirty seconds, requires no account, and will give you the same findings in plain language with priorities already sorted. That is, in truth, what we built it for.