A complete SEO audit is a systematic review of everything that affects how well a website can be crawled, understood and ranked by search engines — technical health, on-page elements, content quality, backlinks, local signals and analytics tracking all get checked in turn. The point isn't to produce a wall of red flags; a proper audit ends with a prioritised, realistic action plan that either you or your developer can start working through the same week.
That's the short version. In this guide I'll walk through the exact process I use when auditing a website for a client — the order I work in, the tools I open, and what I'm actually looking for at each stage. Because I both diagnose problems and write the code to fix them, this process is built around what's genuinely actionable, not what looks impressive in a forty-page PDF nobody reads twice.
Before I open a single tab of analysis, I make sure I actually have access to look inside the site rather than just at it from the outside. Half of a good audit is data you can only get with the right permissions and tools connected.
Once access is confirmed, I run a full crawl before doing anything else, because most of the audit that follows depends on having that raw crawl data on hand rather than clicking around page by page.
| Audit area | Primary tools | What I'm checking |
|---|---|---|
| Crawl & indexation | GSC, Screaming Frog | Crawlability, indexed vs. excluded pages, sitemap accuracy |
| Technical health | PageSpeed Insights, Screaming Frog, GSC | Speed, Core Web Vitals, mobile-friendliness, HTTPS, redirects, schema |
| On-page | Screaming Frog, manual review | Titles, meta descriptions, headings, content, internal links |
| Content & E-E-A-T | Manual review, GSC queries | Depth, accuracy, authorship, freshness, search-intent match |
| Backlinks | Ahrefs / Semrush | Link quality, anchor text, toxic links, competitor gaps |
| Local SEO | Google Business Profile, manual checks | NAP consistency, citations, reviews, local landing pages |
| Analytics & tracking | GA4, GSC, Tag Manager | Goal setup, event tracking, property verification |
This comes first because if search engines can't reach and index your pages, nothing else in the audit matters yet — a beautifully optimized page that's blocked or unindexed ranks for nothing.
I let Screaming Frog or Sitebulb crawl the entire site and immediately sort by response code. Any 4xx or 5xx errors get logged first, followed by redirect chains — pages that bounce through two or three redirects before landing, which wastes crawl budget and dilutes link equity along the way.
Next I check robots.txt line by line for accidental disallow rules — it's surprisingly common for a whole section of a site, or even the entire site, to be blocked after a redesign or a security-plugin change nobody noticed. I then compare the XML sitemap against the crawl: every important page should be in the sitemap, and the sitemap shouldn't list pages that 404, redirect, or are marked noindex.
GSC's Pages report shows exactly why a URL isn't indexed — "Discovered, currently not indexed," "Crawled, currently not indexed," duplicate without a user-selected canonical, and so on. Each reason points to a different fix, so I go through the excluded list category by category rather than treating it as one blob. If a site's core pages simply aren't ranking at all despite looking fine on the surface, this is usually where the real answer is hiding — I go into more of the common causes in why your website isn't ranking on Google.
With crawlability confirmed, I move to the technical factors that affect how well the site performs once search engines and users actually reach it.
I run PageSpeed Insights on the homepage and two or three representative inner pages, checking both the lab data (Lighthouse) and, where available, real-world field data from the Chrome User Experience Report. Largest Contentful Paint, Interaction to Next Paint and Cumulative Layout Shift each get looked at separately, since a site can pass on one and fail badly on another.
Since Google indexes the mobile version of a page by default, I check the mobile rendering directly — tap target sizing, font legibility, whether content is hidden behind interstitials, and whether the mobile page actually contains the same content as desktop.
A quick check confirms the whole site loads over HTTPS with no mixed-content warnings, the SSL certificate is valid and not close to expiry, and HTTP versions of every URL redirect properly to HTTPS rather than serving duplicate content on both.
Beyond the basic crawl, I look specifically for canonical tags that point to the wrong URL, self-referencing canonicals that are missing entirely, and redirect chains left over from old migrations. These are exactly the kind of quiet technical issues that technical SEO work is meant to catch before they compound.
I validate existing schema markup — Article, Product, LocalBusiness, FAQPage, BreadcrumbList — against Google's guidelines, checking for both syntax errors and missing opportunities where rich results could realistically be earned but aren't currently marked up at all.
Once the technical foundation is confirmed, I move page by page through the on-page elements that most directly influence how a page is understood and clicked on in search results.
Using the crawl export, I scan for missing, duplicate, or truncated titles and meta descriptions across the whole site at once rather than page by page. Titles need to be unique, include the primary keyword naturally, and stay within a length that won't get cut off in search results; meta descriptions should read like genuine ad copy that earns the click, not a keyword list.
Every page should have exactly one H1 that matches its topic, followed by a logical H2/H3 hierarchy rather than headings chosen purely for their visual size. I flag pages with multiple H1s, skipped heading levels, or headings that don't actually describe the content beneath them.
I check whether the visible content genuinely matches what the page is trying to rank for, whether it's thin relative to competing pages, and whether it answers the underlying question a searcher actually has rather than just repeating the keyword. This overlaps heavily with the content review in the next section, but at the on-page stage I'm mainly checking coverage and structure rather than depth or accuracy.
I map which pages link to which, looking for orphan pages with no internal links pointing to them at all, important pages buried too many clicks from the homepage, and generic anchor text ("click here") where a descriptive, keyword-relevant anchor would help both users and search engines understand the destination page.
Technical and on-page checks tell you whether a page is built correctly; this section asks whether it deserves to rank at all. I read the actual content on key pages the way a real visitor would, asking whether it demonstrates genuine experience and expertise or just paraphrases what's already ranking. Google's E-E-A-T framework — Experience, Expertise, Authoritativeness, Trustworthiness — rewards content written by someone identifiable, with a real name and bio, rather than anonymous or generic copy.
I also check content freshness: pages with outdated prices, old screenshots, or references to past years that were never updated tend to lose trust and rankings over time even when nothing else about them has changed. And I compare a sample of pages against what's currently ranking for the same terms, to see whether the existing content is genuinely more useful and specific, or noticeably thinner and vaguer by comparison. A surprising number of underperforming pages in Nepal fail here for reasons that are easy to fix once spotted — I've catalogued the recurring patterns in common SEO mistakes on Nepali websites.
Next I pull the site's full backlink profile in Ahrefs or Semrush and look at it from three angles: quality, diversity and risk. Quality means checking whether links come from relevant, reasonably authoritative sites rather than link farms or unrelated directories. Diversity means the anchor text isn't overwhelmingly one exact-match phrase, which can look manipulative rather than natural. Risk means scanning for obviously toxic or spammy links — old paid-link schemes, hacked sites, or link networks — that might be worth disavowing.
I also run a competitor gap report, which shows domains linking to two or three direct competitors but not to the site being audited. These are often the fastest realistic wins in the whole off-page picture, since they've already demonstrated willingness to link to a business in the same space.
For any business with a physical location or a defined service area, I add a local layer to the audit. This starts with the Google Business Profile itself: is it claimed and verified, is the category correct, are business hours accurate, and are photos and posts kept current. From there I check NAP consistency — name, address and phone number matching exactly across the website, the Business Profile, and the directories and citation sites the business appears on, since mismatches quietly undermine local trust signals.
I also review the volume and recency of customer reviews, whether the business responds to them, and whether location-specific landing pages (for businesses serving multiple areas) actually contain unique, locally relevant content rather than the same template copied across every city name.
An audit is only as good as the data feeding it, so I verify the measurement setup itself before trusting any of the numbers it produces. That means confirming the GA4 property is correctly linked to the right website, that key conversion events (form submissions, calls, purchases) are actually firing and not just configured on paper, and that Google Tag Manager, if used, doesn't have duplicate or conflicting tags left over from old campaigns.
I also cross-check GSC and GA4 against each other — if organic sessions in GA4 look wildly different from clicks reported in GSC for the same period, that mismatch usually points to a tracking or filtering problem rather than a genuine traffic anomaly, and it's worth resolving before drawing any conclusions from the rest of the audit.
By this point, most audits have surfaced anywhere from a dozen to well over a hundred individual issues. The real work — and the part that actually determines whether the audit was worth doing — is turning that list into an order of operations. I rank every finding on two axes: how much ranking or traffic impact it's likely to have, and how much effort it takes to fix.
An audit that ends in an unranked list of problems isn't finished — it's just diagnosis without a prescription.
Quick wins — a missing canonical tag, a blocked robots.txt rule, duplicate titles across a handful of pages — get fixed first because they're cheap and often show measurable movement within weeks. Larger structural issues — a content rewrite across dozens of pages, a site migration, a backlink disavow campaign — get scheduled over months with clear milestones. This is also where having a single person handle both the audit and the technical fixes pays off: nothing sits in a queue waiting for a separate developer to understand, prioritise and finally implement someone else's recommendations.
Want a second pair of eyes on your own site? I run complete SEO audits for businesses in Nepal and abroad, and I fix what I find rather than just handing over a report. Get in touch and let's see exactly where your site stands.
For a small to mid-sized website, a thorough audit typically takes anywhere from a few days to two weeks, depending on how large the site is and how many issues turn up. Larger or older sites with years of accumulated content and technical debt can take longer to fully work through.
At minimum you need Google Search Console, Google Analytics 4, a crawler such as Screaming Frog or Sitebulb, and PageSpeed Insights or Lighthouse for performance. A paid tool like Ahrefs or Semrush adds backlink and keyword-gap data that free tools can't fully replicate.
A full audit once or twice a year is enough for most websites, with lighter monthly check-ins on rankings, indexation and Core Web Vitals in between. Audit sooner than that if you've just launched a redesign, migrated domains, or noticed a sudden traffic drop.
A basic technical and on-page check is doable yourself using free tools if you're willing to learn the terminology. A professional audit adds more value when you need someone to interpret ambiguous findings correctly, prioritise them realistically, and then actually implement the fixes in code rather than just listing them.