SEO Audit Step by Step: Technical, Content and Authority

An SEO audit is a diagnosis of your site in three layers: technical (can Google access and index the pages?), content (do they answer well and stand apart from each other?) and authority (do other sites and people trust yours?). Do it in that order, because a technical failure invalidates the rest. Prioritize findings by impact and effort and deliver a report with an action, an owner and a metric for each item.

This guide assumes the basics from What is SEO: the complete guide and access to Search Console. If you have not set it up yet, start with the Search Console beginner's guide.

Quick summary

• The order matters: technical, content, authority. A blocked page does not benefit from better text or from links.
• Every audit needs a baseline (12 to 16 months of data) to prove later that something changed.
• Prioritize with a simple score: impact x confidence, divided by effort.
• Not every tool alert is a problem. "URL not indexed" may be exactly what you want.
• The final report is a list of actions with an owner and a deadline, not an 80-finding PDF.

How to read this guide

If you are new to SEO, read "What is an SEO audit", the technical layer in plain English and the hypothetical example; ask a developer for help with the technical items. If you already work in SEO, go straight to the checklist tables, the prioritization formula and the report template. Acronyms are in the glossary.

What is an SEO audit, and when should you do one?

It is a systematic review of the site to find what prevents or limits search performance, with a list of what to fix first. Do it when traffic drops, before and after migrations and redesigns, when you take over a new site, and on a recurring basis: a light check each quarter and a full one each year. That cadence is common practice, not a Google rule.

In plain English: it is a medical check-up. First you check that the patient is breathing (Google can access the site), then whether what they say makes sense (content) and finally whether other people vouch for them (authority). There is no point treating the reputation of someone without a pulse.

What should you prepare before starting?

Gather access and a baseline. Without them, any later improvement becomes opinion.

1. Access: Search Console, analytics, CMS and, if possible, DNS and the server.
2. Baseline: export clicks, impressions and pages from Search Console for recent months. Google keeps 16 months of performance data, and the interface shows at most 1,000 rows per table, so for larger sites use the API or the BigQuery export.
3. URL inventory: combine the URLs from the sitemap, the CMS and a crawl.
4. Goal: define what matters (leads, sales, traffic to specific pages).

Tool	What it is for	Limit to consider
Search Console	Indexing, performance, links, manual actions	Partial data, partly anonymized
Crawler (for example, Screaming Frog)	Simulates crawling: status, canonicals, links, orphans	The free version crawls up to 500 URLs at a time
PageSpeed Insights / Core Web Vitals report	Speed and experience	Measures per page/group, with field data when available
Spreadsheet	Inventory, prioritization and report	Depends on you keeping it up
Backlink tool	Link profile	See free tools

Layer 1: can Google access and index the site?

Check crawling, indexing, response status codes, duplication and speed. This is the layer with the most risk of total loss, because a wrong setting can take entire sections out of Google. The conceptual basis is in technical SEO basics.

Check	Where to look	Sign of a problem
robots.txt	/robots.txt	Disallow on folders that should be indexed
noindex	HTML (meta robots) and X-Robots-Tag header	A template applying noindex to categories or posts by mistake
Indexing	Search Console > Indexing > Pages	Important pages in "Crawled - currently not indexed" or "Discovered - currently not indexed"
HTTP status	Crawler and Search Console	404s in internal links, 5xx errors, redirect chains, soft 404s
Duplication and canonical	Crawler and URL Inspection	Several URLs with the same content and contradictory canonicals
Sitemap	/sitemap.xml	URLs with redirects, errors or noindex listed
Core Web Vitals	Search Console and PageSpeed	LCP above 2.5 s, INP above 200 ms or CLS above 0.1
Internal links	Crawler	Orphan pages, important pages many clicks from the home page

What Google's sources say:

• robots.txt is for managing crawler traffic and is not a mechanism for keeping a page out of Google: a blocked page can still be indexed if other sites link to it. For that, use noindex.
• For noindex to work, the page must not be blocked in robots.txt, because Google needs to crawl it to read the directive.
• On HTTP status codes: 4xx URLs are not indexed and drop out of the index; 5xx makes Google slow down crawling; Google follows up to 10 redirect hops; and 200 responses that show an error message are treated as soft 404s.
• The Page indexing report explains the reasons for non-indexing. It does not report the status of an individual URL, which is done in URL Inspection.
• The Core Web Vitals thresholds considered good are LCP within 2.5 s, INP below 200 ms and CLS below 0.1. See Core Web Vitals explained.

For SEO professionals: do not confuse "not indexed" with "problem". Filter pages, parameters and internal search should almost always stay out. The real alert is when revenue-generating URLs are out, or when the total of "not indexed" grows without explanation. On crawl budget: Google's guide is for very large sites (from about 1 million pages with weekly changes, or 10,000 with daily changes, as a rough estimate). For most sites, the bottleneck is quality and internal links, not crawl budget.

In plain English: robots.txt is a sign on the door saying "visitors, please do not enter this room". noindex is a sign inside the room saying "do not advertise this room". If you lock the door, nobody reads the sign inside.

Layer 2: does the content answer and stand apart?

Start from the data: list all pages with clicks and impressions from the last 12 months and classify each one. Good content answers the intent, is original and has clear authorship. In its helpful content guide, Google asks for content made first for people, with identifiable authorship, transparency about the use of automation and no mass production to attract search traffic.

Build the inventory with URL, clicks, impressions, average position, update date, links received and decision. The table below gathers practical readings (my heuristics, not Google's).

Pattern in the data	Likely reading	Typical action
High impressions, low CTR	Unconvincing title, or the answer is already delivered in the SERP	Rewrite title and description; check the SERP
Average position between 8 and 20 with impressions	Page almost there	Update, deepen, strengthen internal links
Clicks falling for more than 6 months	Outdated content or a better competitor	Update data, examples and date
Indexed, no impressions in 12 months	No demand or no quality	Improve, consolidate or remove
Several URLs on the same query	Possible cannibalization	See keyword cannibalization

Steps for this layer:

1. Export pages and queries from Search Console and cross them with the crawl.
2. Tag each URL with a decision: keep, update, consolidate or remove.
3. Check each page's elements with the on-page SEO checklist: title, H1, direct answer, links, images, authorship.
4. Check overlap between pages and resolve the cannibalization candidates.

Layer 3: does the site have authority and trust?

Assess who links, with what text and whether the link profile looks natural, as well as brand mentions and the site's trust signals. Start with the Search Console Links report, which Google describes as a sample rather than a complete list, and which does not report the nofollow attribute.

1. Check the Manual actions report. Normal is empty. If there is a notice, treat it as priority zero and see penalty for artificial links and disavow.
2. List the domains that link the most and classify them: relevant, neutral, suspicious. For criteria, see how to identify quality backlinks.
3. Examine the anchors: if an exact-match commercial anchor dominates the profile, it is a warning sign.
4. Look for broken backlinks: links from other sites that point to URLs that now return 404. Redirecting to the equivalent page is a low-effort gain.
5. Check brand mentions and the consistency of public data (profiles, authors, about page).

"Toxicity" scores from tools are the vendor's estimates, not Google's. Use them for triage and confirm manually before any disavow.

How do you prioritize findings by impact and effort?

Give each finding a score from 1 to 5 for impact, confidence and effort, and calculate the score. Sort from highest to lowest. The formula is deliberately simple:

Score = (Impact x Confidence) / Effort

Impact:     how many pages, how much revenue or how many leads are affected (1 = little, 5 = a lot)
Confidence: how solid the evidence is that the problem exists and that the fix resolves it (1 to 5)
Effort:     time and dependencies to fix it (1 = minutes, 5 = weeks and several teams)

Priority	Score	What to do
P0	above 15	Fix now: indexing blocks, improper noindex, manual action
P1	from 6 to 15	Go into the next sprint
P2	from 3 to under 6	Plan for the quarter
P3	below 3	Log it and review in the next audit

Hypothetical example: a fictional plant e-commerce store, "Green Roots", with about 1,200 URLs (all numbers below are made up for illustration).

ID	Finding	Impact	Confidence	Effort	Score
T2	18 categories with noindex by mistake in the template	5	5	1	25.0
A1	12 sites link to old URLs that return 404	2	5	1	10.0
T1	340 filter URLs in "Crawled - currently not indexed"	4	4	2	8.0
C1	2 posts compete for "how to care for a fern"	3	4	2	6.0
T3	LCP of 3.4 s on product pages on mobile	3	4	4	3.0
C2	60 products without their own description	3	3	5	1.8

The order of attack becomes: T2, A1, T1, C1, T3, C2. Notice that the highest-scoring finding is the cheapest one, not the most sophisticated.

How do you build the audit report?

The report exists to decide and to execute, not to show volume. Use a fixed template to make follow-up easier:

1. Executive summary: 5 lines with the 3 biggest risks and gains
2. Scope and baseline: period, sources, starting numbers
3. Findings by layer (technical, content, authority), each with:
   - ID, description and evidence (screenshot, URL, report)
   - Impact, confidence, effort and score
   - Recommended action, owner, deadline and success metric
4. Roadmap in 30, 60 and 90 days
5. What was verified and is fine (avoids rework)
6. Risks and dependencies

After applying the fixes, compare with the baseline in 4 to 8 weeks, using Search Console's comparison feature. Google does not give reprocessing timelines, so do not promise a date for results.

What about the AI layer?

The SEO audit covers the foundation: without indexing and helpful content, nothing holds up, not even in Google's AI features, which require an indexed page that is eligible for a snippet. The part specific to citations in ChatGPT, Perplexity and AI Overviews, such as robots rules for AI crawlers and citable structure, has its own roadmap in GEO audit step by step.

How does Contentor help you track what the audit changes?

Contentor's Results page brings together Search Console data by project, which makes it easier to compare before and after the fixes, and AI Visibility tracks, for the questions you choose, whether ChatGPT cites your brand (ChatGPT only). They measure; you diagnose and decide. If the bottleneck is content production, generate articles on Contentor with validated-structure templates and publish to WordPress.

Frequently asked questions

How long does an SEO audit take?

It depends on the size of the site and access to data. As our own estimate, not an industry standard, a site of a few hundred pages takes 1 to 3 days of focused work; large sites or ones with crawling problems take weeks. The longer part is usually carrying out the fixes, not the diagnosis.

Do I need paid tools to audit?

Not to start. Search Console, PageSpeed Insights, a crawler with a free version (up to 500 URLs at a time, in the case of Screaming Frog) and a spreadsheet cover most small sites. Paid tools help at scale, with history and backlink monitoring, but they do not replace analysis.

How often should I audit?

A light check each quarter (indexing, errors, Core Web Vitals, pages that lost clicks) and a full audit each year, or before and after migrations. That cadence is a practice, not a Google rule. Sites that change a lot deserve more frequent checks.

Does an SEO audit include GEO and AI?

It covers the foundation AI depends on (indexing, content, authority), but it does not replace a specific audit of visibility in AI answers. That one has its own items, such as rules for AI crawlers and citable content structure, described in the GEO audit roadmap.

Next step

With the diagnosis in hand, carry out the fixes in priority order and measure. For the AI layer, continue with the GEO audit step by step.

Read also:

• Technical SEO basics
• How to identify quality backlinks
• Keyword cannibalization