Coverage
What we check
Every check the audit runs, in plain English, and every check it doesn't.
The audit walks 279 checks in 9 phases. 240 of them we measure ourselves from your live site; the rest need your Search Console data, a backlink export, or a judgement no crawler gets to make. They are all listed below either way, because a check nobody ran is not a check you passed, and a scoring system that quietly drops them is one that flatters every site it touches.
None of it is our own invention. Every group below says where it comes from and links the page it is grounded in. That is Google's own documentation in almost every case, and where a check isn't Google's (Open Graph, for one) we say so rather than lending it authority it doesn't have.
Our score never does that. A check we couldn't measure comes out of both sides of the fraction, so it can neither help you nor hurt you, and the report says how many of those there were.
The free scan returns 50 of these: the ones whose verdict is arithmetic, where a threshold decides it and no reading of the page is required. Everything that needs the page read rather than measured is in the paid report.
1. Crawlability & Indexability
92 checks · 77 on every audit · 8 on a site crawl · 7 needing your data
Before anything else can matter, Google has to be able to reach the page, read it, and decide it is the version worth keeping. Most of the damage we find in real audits lives here. A stray directive, a redirect chain, a canonical pointing at the wrong URL: none of it is visible from the front end.
1.1 robots.txt
A single line in this file can hide a whole section of a site, and nothing on the page will look wrong. We fetch it, parse the groups that apply to Google, and test them against the URL you gave us instead of assuming.
Source: How Google reads robots.txt · robots.txt syntax
- Every auditExists at /robots.txt, returns 200
- Every auditDoes not block important content
- Every auditCSS/JS/image resources not blocked
- Every auditSitemap: directive present
- Every auditAI-crawler directives intentional
- Every auditAlso checked training blocked ≠ search blocked: the 14 tokens sorted into training / search / agent; Cloudflare's September 2026 "disallow AI training" writes rules for the first group only, and refusing OAI-SearchBot, Claude-SearchBot or PerplexityBot is what removes a site from AI answers
- Every auditNo stray crawl-delay / unsupported directives
- PartialWildcard / $ rules behave as intended
- Not automatedUnderstood as crawl control, not index control
1.2 XML Sitemaps
A sitemap is how you tell Google which URLs you consider worth having. It helps most when it is honest, listing canonical, indexable URLs with real modification dates, and hurts when it lists redirects, 404s and a lastmod of "today" on every row.
Source: Sitemaps overview · Building a sitemap
- Every auditExists, returns 200
- Every auditWithin limits
- Every audit<lastmod> accurate
- Every auditImage/Video/News sitemaps where relevant
- Every auditxhtml:link hreflang alternates declared in the sitemap
- Every auditAlso checked RSS/Atom autodiscovery and web app manifest: other discovery surfaces the same <head> advertises
- PartialURLs absolute, single host, correctly encoded (100-URL sample)
- PartialAlso checked listed URLs lead somewhere: five fetched, so a sitemap of soft 404s is visible
- Site crawlLists canonical, indexable URLs only (sitemap ↔ crawl reconciliation)
1.3 Indexability
Whether the page is allowed into the index at all. A noindex left over from a staging deploy, or a "missing" page that answers 200 instead of 404, costs more traffic than any amount of keyword work will win back.
Source: Blocking indexing · robots meta tag and X-Robots-Tag · HTTP status codes and soft 404s
- Every auditNo accidental noindex
- Every auditCorrect status codes
- Every auditMeta robots / X-Robots-Tag don't conflict
- Every auditCustom 404 returns a real 404/410
- Every auditInternal search results pages noindex
- Every auditStaging / dev / preview not indexable
- Every auditSnippet/preview controls intentional (directives.snippet, incl. data_nosnippet_elements, noimageindex, indexifembedded, and the Bing side: noarchive = out of Copilot/grounding, nocache = URL-title-snippet only, onpage.data_snippet_count = the allow-list marker
- Every auditOnly supported meta tags used
- Every auditAlso checked every robots meta is read, in the head or out of it: Google honours one in the body, so the first tag is not the answer
- Every auditAlso checked unavailable_after has not already passed: a page Google has dropped while the URL still returns 200
- Every auditAlso checked page-level nofollow intentional: set by content="none" without naming itself
- Partialnoindex used, not robots.txt, to exclude pages
- Site crawlAlso checked a Disallow does not hide a noindex: up to 5 robots-blocked URLs are fetched and read for a noindex; Google never fetches a disallowed URL, so one carrying noindex can still be indexed from its inlinks
1.4 Canonicalization & duplicates
The same page is usually reachable at several URLs: with and without www, with a trailing slash, with tracking parameters. Google picks one to index. These checks are about making sure it picks the one you meant.
Source: Canonicalization · Consolidating duplicate URLs
- Every auditOne self-referencing canonical
- Every auditAlso checked canonical written correctly: relative href, #fragment, http:// on an https page, an inner page canonicalising to the homepage, a canonical <link> in the <body>; null when there is no canonical (Sitebulb's canonical hint family; 2–4 of 500 corpus pages each)
- Every auditSingle hostname + protocol (4-way http/https × www probe)
- Every auditTrailing-slash, case, index-file variants consolidated
- Every auditAlso checked tracking parameters on internal links: utm_*, gclid, fbclid, msclkid on a link to the site's own page breaks the GA4 session mid-visit, reports the site as its own traffic source and hands Google one more URL per parameter set (Search Engine Land, Sep 2026)
- Every auditAlso checked an unknown query parameter canonicalises back: the shape of tracking parameters, session ids and share links, Ahrefs' three most common duplicate-content causes after URL variants
- Every auditCanonical target indexable, final-status, relevant
- PartialAll signals agree
- Site crawlParameter / sort / filter URLs don't duplicate
- Not automatedGoogle-selected canonical matches declared (needs GSC)
1.5 Redirects & migrations
Redirects pass ranking on, but only if they are permanent, short and pointed at a real equivalent. Chains, loops and long-lived temporary redirects are the usual reason traffic never comes back after a site move.
Source: Redirects and Google Search · Site moves with URL changes
- Every auditPermanent moves use 301/308 (every hop recorded)
- Every auditNo chains or loops
- Every auditHTTPS migration fully canonicalized
- Every auditNo meta-refresh, HTTP Refresh: header or JS redirect
- Every auditAlso checked noindex not changed by JavaScript: Googlebot does not render a page whose raw HTML says noindex (documented 15 Dec 2025), so a script that removes it never runs and the page stays out; a script that adds one works, and the template shows nothing
- Every auditLong-lived 302s converted to 301 (status per hop)
- Every auditInternal links point to final URLs
- Not automatedRedirects point to relevant equivalents
- Not automatedMigration has a tested 1:1 redirect map
1.6 Rendering & JavaScript SEO
Google renders JavaScript, but what it ends up with is not always what you see. We fetch the raw HTML and the rendered page separately and compare them, so "the content is there" is a measurement rather than a hope.
Source: JavaScript SEO basics · Fixing JavaScript problems
- Every auditPrimary content + links in rendered HTML
- Every auditAlso checked internal links that exist only after JavaScript: rendered internal link set minus the raw one
- Every auditRendered DOM size attributable to the template vs. third-party script
- Every auditInternal links are real <a href>
- Every auditTitle / description / canonical / schema / noindex stable after render
- Every auditAlso checked back-button hijacking: a Google spam policy since April 2026, enforced 15 June, and the site owns it even when an ad or consent script makes the call
- PartialUnique crawlable URLs (History API, not hash routing)
- PartialLazy-load / infinite scroll fallback
- PartialRendering strategy sound
1.7 Site architecture & internal linking
How pages are linked decides which of them Google treats as important. A page the navigation carries but no article ever cites is a page you have told Google not to care about.
Source: SEO starter guide: site structure · Breadcrumb structured data · Link best practices for Google
- Every auditBreadcrumbs marked up as BreadcrumbList
- Every auditNo broken internal links
- Every auditNav/footer link volume sane
- Every auditAlso checked in-page jump links resolve: #anchor matched against the document's ids and legacy <a name>s; #top needs no element and is never counted broken
- PartialPagination crawlable and self-canonical
- Site crawlImportant pages ≤ ~3 clicks from home
- Site crawlLogical hierarchy reflected in URLs
- Site crawlAlso checked pages one link from orphaned: a single inbound internal link, usually one menu entry
- Site crawlNo orphan pages
- Site crawlDescriptive anchors to priority pages
1.8 Crawl budget & server logs
Only large sites need to think about this: if Google spends its visits on filter combinations and session URLs, the pages you actually sell from get crawled less often. Most of it can only be answered from your own logs and Search Console.
Source: Managing crawl budget · Managing crawling of faceted navigation URLs · Googlebot
- Every auditConditional requests / 304 supported
- PartialNo infinite URL spaces / crawl traps (template clustering)
- Not automatedGSC Crawl Stats reviewed
- Not automatedLog-file sample analyzed
- Not automatedFaceted/parameter URLs mostly not crawled
1.9 HTTP responses & headers
The part of the site no visitor sees. Wrong content types, missing compression, a stale cache policy or an open directory listing all cost something, and all are usually a one-line fix in the server config.
Source: HTTP status codes, network and DNS errors · Googlebot
- Every auditCorrect Content-Type + charset
- Every auditCompression enabled
- Every auditHTTP/2 or HTTP/3 served
- Every auditSensible Cache-Control on static assets
- Every auditNo 5xx under normal load
- Every auditAlso checked within Googlebot's 2 MB fetch cap: uncompressed, per resource; past it the rest of the document is never indexed
- Every auditAlso checked Content-Security-Policy present: and csp_report_only separately, because a policy that only reports is enforced on nothing
- Every auditAlso checked domain registration expiry: the one outage no SEO survives, and the only deadline here that nothing on the site can reveal; null on ccTLDs that publish no RDAP
- Every auditAlso checked open directory index: not in the playbook, but a real leak
- Every auditAlso checked /ads.txt presence and record count: adtech hygiene, not an SEO check
- Every auditAlso checked subresources aimed at private or internal addresses: the browser refuses them, and the attempt is recorded
- Every auditAlso checked WordPress core currency: the running version against wordpress.org's own stable-check map, so insecure is quoted, not inferred
- Every auditAlso checked WordPress REST user enumeration: an open /wp-json/wp/v2/users publishes every author's login name
- Every auditAlso checked WordPress author enumeration: /?author=1 redirects to the archive, and the slug is the login name
- Every auditAlso checked xmlrpc.php reachable: the pingback / system.multicall amplification surface, detected on a GET's 405, never POSTed to
- Every auditAlso checked /readme.html readable: core ships it and it prints the version, including on a site that stripped its generator tag
- Every auditAlso checked the page is served to Googlebot as well as to a browser: collected since long before version 28 and sliced into no group until it, so the request was spent every audit and shown to no model
- Every auditAlso checked what an AI crawler is actually served: one GET with GPTBot's user-agent, plus cf-mitigated / server and bot_challenge_reason()'s vendor fingerprint
2. On-Page & Metadata
31 checks · 30 on every audit · 0 on a site crawl · 1 needing your data
What the page tells a search engine about itself, and what the result looks like in the search listing. Cheap to fix, easy to get quietly wrong, and directly visible to anyone deciding whether to click.
2.1 Titles & descriptions
The title and description are the advert for the page. Google rewrites them when they are missing, duplicated, or describe something the page does not actually contain, which is why we also measure whether the title's words appear in the body at all.
Source: How Google generates title links · Control your snippets · Valid page metadata
- Every auditUnique, descriptive <title>
- Every auditTitle length sane
- Every auditAlso checked no stale year in the title, description or H1: "Best X in 2024" read in 2026 is the one staleness signal the searcher sees before clicking (Backlinko: add the current year, keep it current)
- Every auditUnique, accurate meta description
- Every auditSingle clear <h1>
- Every auditReal headings, not styled <div>s
- Every auditNo headless sections or level jumps
- Every auditAlso checked no heading repeated on the page: usually a template printing a section title twice, once for a hidden mobile copy
- Every auditAlso checked semantic structure, not div soup: main/article/section/nav/header/footer/aside and ARIA-role equivalents counted against div_count
- Every auditviewport + charset present
- Every auditAlso checked viewport allows zoom: user-scalable=no or maximum-scale under 2 stops pinch-zoom, a WCAG 1.4.4 failure that Android honours (iOS ignores it); 51 of 500 corpus pages
- Every auditAlso checked <head> intact: a <div>, <img> or <a> inside the head ends it early and every <meta>/<link> after it lands in the body, where Google's "valid page metadata" doc says it may not be read; read off the raw bytes because libxml and browsers both repair the DOM
- Every auditAlso checked head signals declared once: title, description, viewport and og:title/og:description/og:image/og:url counted per name as tags and distinct values; two values is a conflict Google resolves by rules the site does not control (Mueller, July 2026: fix it, don't test it)
- Every audit<html lang> correct
- Every auditFavicon valid & findable (fetched: status, type)
- Every auditAlso checked favicon geometry: Google wants 1:1 and ≥ 48×48 (8×8 is its floor); measured off the fetched bytes: an ICO by its largest directory entry, since getimagesize() reads only the first (the 16×16): null for SVG
- Every auditAlso checked favicon fetchable by Googlebot-Image: a blanket Disallow: /wp-content/ blocks the icon while every other robots check passes; googlebot- agents inherit the googlebot group before , per Google's spec
- Every auditAlso checked apple-touch-icon declared: the home-screen / share-card icon on iOS and Safari, which never falls back to the favicon
- Every auditVisible dates honest & consistent
2.2 Social & sharing metadata
Open Graph and Twitter cards decide what a shared link looks like in a message or a feed. Worth saying plainly: this is not a Google specification and not a ranking factor. It is in the audit because a link that renders as a bare grey box gets clicked less.
Source: The Open Graph protocol · Google Images best practices
- Every auditog:title, og:description, og:image, og:url
- Every auditog:image correct size & absolute URL (fetched: status, bytes)
- Every auditAlso checked preferred image for Discover and Images: resources.og_image.width ≥ 1200 and directives.snippet.max_image_preview = large (Google, 2 Mar 2026: both are needed for the large-image treatment); two facts already collected, now read together
- Every audittwitter:card set
- PartialSocial meta consistent with visible content
2.3 URLs & images
Readable URLs and described images. Alt text is an accessibility requirement first and an SEO one second, and image weight is usually the single biggest thing standing between a page and a good LCP score.
Source: URL structure · Google Images best practices
- Every auditSlugs short, readable, hyphenated, lowercase
- Every auditDescriptive alt on meaningful images (list + count)
- Every auditAlso checked linked image carries an accessible name: a distinct check, not a stricter one: alt="" is correct on decoration and wrong on the only content inside an <a>, where it leaves the link with no name and Google with no anchor text
- Every auditResponsive, compressed, modern formats
- Every auditContextual internal links in body copy
- PartialDescriptive filenames (src URLs captured)
- Not automatedImages discoverable (image sitemaps)
3. Content Quality, E-E-A-T & AI/Generative Search
38 checks · 25 on every audit · 0 on a site crawl · 13 needing your data
Whether the page is actually worth ranking. Very little of this is measurable, and we say so rather than dressing up a word count as a quality score. What we can do is put the rendered text, the structure and the topic coverage in front of a model and have it read the page the way an editor would.
Source: Creating helpful, reliable, people-first content · Google Search Essentials · AI-generated content and Search
- Every auditWell-organized & scannable
- Every auditThin content
- Every auditTags across the crawl
- Every auditContent crawlable, indexable, renderable (the render diff proves it)
- Every auditAlso checked theme/CMS boilerplate still live: Lorem ipsum, "Hello world!", "Just another WordPress site", demo contact details
- Every auditAlso checked Google Preferred Sources offered: the swg library, the button container, or the no-JS google.com/preferences/source deeplink, read as three legal declaration sites
- Every auditAlso checked Search profile badge: a link to profile.google.com/@handle, documented 16 Sep 2026; a publisher/creator feature, na elsewhere
- Every auditAlso checked /llms.txt: presence, size, link count, and whether it is really markdown rather than an HTML error page served as 200
- Every auditAlso checked business identity declared and complete: an Organization or any LocalBusiness subtype naming who runs the site, with logo, contact_point and same_as profiles
- Every auditAlso checked an About page that exists: discovered in ~25 language forms, then fetched
- Every auditAlso checked a working contact route
- Every auditAlso checked legal pages reachable: a footer linking /terms to a 404 is a worse signal than no link, and only a fetch sees it
- Every auditAlso checked review profiles linked beyond Google: Maps/Business Profile forms collapse to google; Yelp, Trustpilot, TripAdvisor, Facebook reviews, Healthgrades, Doctolib, Checkatrade, BBB and ~15 more are read by host
- Every auditAlso checked answer-first structure: headings that pose a question, and whether prose follows before the next heading
- Every auditAlso checked extractability: lists, tables, and paragraph length
- Every auditAlso checked citable-fact density: numerals, years and percentages per 1000 words, the externally visible form of "this page states something specific"
- Every auditAlso checked outbound citations: links out of the site from body copy only, deduped by registrable domain
- Every auditAlso checked attributable authorship: a schema author resolved to a named Person with a url or sameAs
- Every auditAlso checked dating: datePublished vs dateModified and days since
- Every auditAlso checked independent crawler reach: whether the latest Common Crawl index has the site's URLs
- PartialSatisfies search intent
- PartialDuplicate / near-duplicate
- PartialKeyword cannibalization (duplicate titles + content; crawl.issues.competing_titles, collector 121
- PartialClear entity/author/business info
- PartialAlso checked site age: first web.archive.org capture and years since
- Not automatedUnique POV / first-hand value
- Not automatedE-E-A-T signals present
- Not automatedNo scaled-content abuse
- Not automatedAI-assisted content meets the quality/spam bar
- Not automatedCurrent & accurate
- Not automatedContent gaps
- Not automatedFreshness on time-sensitive pages
- Not automatedAuthor pages / entity clarity
- Not automatedClaims cite sources
- Not automatedContent-pruning process exists
- Not automatedAnswers the main query clearly, early
- Not automatedOriginal facts/comparisons/examples/evidence
- Not automatedFAQ content genuinely useful, not schema spam
4. Structured Data & Rich Results
14 checks · 12 on every audit · 0 on a site crawl · 2 needing your data
Structured data is what turns a plain blue link into a rich result. We check that it parses, that it carries the properties its type requires, that it survives JavaScript rendering, and that it agrees with the dates and entities on the page.
Source: Introduction to structured data · Search gallery: every supported type
- Every auditJSON-LD format
- Every auditAlso checked JSON-LD escaped as JSON, not HTML: RFC 8259 wants \u0026, not &; since 20 Aug 2026 Googlebot applies one pass of HTML unescaping and ships a double-escaped &amp; verbatim into the rich result
- Every auditRequired properties present per type
- Every auditOne canonical set per page; no conflicting duplicates
- Every auditJS-generated schema in the rendered DOM
- Every auditOrganization schema on homepage
- Every auditArticle dates match visible dates
- Every auditEntities connected via @id
- Every auditNo effort spent on retired rich results
- Every auditAlso checked review-snippet structure: self-serving aggregateRating/review on an Organization/LocalBusiness type (ignored by Google since Sep 2019; 52 of 67 dental sites with any rating had one), a rating with no Review node behind it, a review nested inside the aggregateRating (Nov 2025 clarification), ratingValue outside its range
- Every auditAlso checked merchant-listing price fields: Offers without priceValidUntil, sale prices without validFrom/validThrough (Google, 7 Jul 2026), Products without category or without an Offer; since v111 also AggregateOffer-only products (no merchant listings), offer price not above zero / currency not ISO, and offers without shipping / return policy unless the Organization declares it
- PartialMost specific applicable type used (types listed)
- Not automatedValidates in Rich Results Test + GSC enhancements
- Not automatedMatches visible page content
5. Page Experience, Core Web Vitals & Mobile
25 checks · 25 on every audit · 0 on a site crawl · 0 needing your data
Core Web Vitals as Google measures them: field data from real Chrome users first, lab diagnostics only to explain it. Where the field data exists we also pull six months of trend and the four parts LCP breaks into, which is the only evidence that says why a page is slow rather than that it is.
Source: Page experience · Understanding Core Web Vitals and Google search results · Web Vitals, and the thresholds we use
- Every auditLCP ≤ 2.5 s
- Every auditINP ≤ 200 ms
- Every auditCLS ≤ 0.1
- Every auditTTFB reasonable
- Every auditLCP image prioritized
- Every auditWeb fonts don't block/shift
- Every auditpreconnect/dns-prefetch for critical third-party origins
- Every auditThird-party scripts audited
- Every auditbfcache not broken
- Every auditAlso checked third-party embeds lazy-loaded: YouTube / Vimeo / Maps / Facebook / Instagram / TikTok / X / Calendly / Spotify iframes without loading="lazy"; one YouTube embed is ~500 KB of script on the main thread before anyone presses play
- Every auditAlso checked speculation rules: prerender/prefetch of the next click, shipped by WordPress core since 6.8 (210 of 501 corpus pages); absence is a one-plugin note, never a fault
- Every auditRender-blocking resources minimized
- Every auditAlso checked features every browser supports: Lighthouse 13.1's Baseline audit: the web features the page uses that are still Limited Availability , i.e
- Every auditMinify + compress + cache + CDN
- Every auditMobile-first ready (mobile strategy + render.layout.target_size
- Every auditNo intrusive interstitials
- Every auditContent fits the phone screen
- Every auditSticky elements stay visible
- Every auditLegible text size
- Every auditHTTPS everywhere, no mixed content (up to 20 offending URLs)
- Every auditAlso checked TLS setup graded: five openssl s_client handshakes against the pinned address with SNI, SECLEVEL=0 so 1.0/1.1 are actually offered; graded in SSL Labs' spirit (legacy protocols and no forward secrecy cap at B, weak ciphers C, bad chain or no 1.2+ F)
- Every auditAlso checked internal links still written as http:// on an https page: each one is a redirect the site placed on itself; and links.internal_nofollow, internal links the page tells Google to drop (Semrush's internal-link audit, items 3 and 9)
- Every auditAlso checked nothing on the page posts or points somewhere insecure: onpage.forms_insecure_action, password_on_http, links_to_localhost (a developer's machine or a private range left in the template)
- Every auditAlso checked no version-leaking headers: the version-bearing subset of OWASP's secure-headers remove list and a Server: with a version number; nothing a visitor needs, the first thing a scanner reads
- Every auditSecurity headers where appropriate
5b. Accessibility
8 checks · 7 on every audit · 0 on a site crawl · 1 needing your data
- Every auditaccess-001 text legibility
- Every auditaccess-002 form labels and purpose
- Every auditaccess-003 controls have accessible names
- Every auditaccess-004 ARIA validity
- Every auditaccess-005 keyboard and focus
- Every auditaccess-006 tables and lists structure
- Every auditaccess-007 media and motion (version 66)
- Not automatedEverything axe cannot decide alone
6. Off-Page / Backlinks
8 checks · 0 on every audit · 6 on a site crawl · 2 needing your data
Backlinks. We do not buy a link-index API, so we measure none of this and never pretend otherwise. The report tells you exactly which export to drop in and what it would answer.
Source: Link spam policies
- Site crawlReferring domains: quantity, quality, trend
- Site crawlLink relevance
- Site crawlAnchor-text distribution natural
- Site crawlToxic / spammy links identified
- Site crawlLost & broken backlinks reclaimed
- Site crawlAlso checked nofollow share of referring domains
- Not automatedCompetitor backlink gap
- Not automatedUnlinked brand mentions
7. Specialty
46 checks · 32 on every audit · 8 on a site crawl · 6 needing your data
The checks that only apply to some sites: a local business, a multi-language site, a storefront. Irrelevant sections are skipped rather than padded with passes.
7.1 Local SEO
Most local ranking is decided outside your website, in your Business Profile and in how consistently your name, address and phone number appear elsewhere. We can read the schema on the page; the rest needs your account.
Source: LocalBusiness structured data · Google Business Profile help
- Every auditlocal-001 LocalBusiness schema
- Every auditlocal-002 Postal address complete
- Every auditlocal-003 geo coordinates per location, with at least 5 decimal places
- Every auditlocal-004 Opening hours
- Every auditlocal-005 Phone in the schema when the page shows one
- Every auditlocal-006 Schema phone matches the clickable tel: link
- Every auditlocal-007 Click-to-call
- Every auditAlso checked the town the owner serves is named where searchers look: typed at scan time (optional), matched as a whole word in title / H1 / description / rendered text / schema address; free check local_town (title or H1 passes, elsewhere warns, nowhere fails, no town given = not measured), paid: the title card in On-page SEO
- Every auditlocal-008 Phone in E.164 (carries a country code, so it works from any market)
- Every auditlocal-009 Map link or embed
- Every auditlocal-010 sameAs profiles on the business entity
- Every auditlocal-011 Multiple locations are separately addressable
- Every auditlocal-012 areaServed declared when the site has region alternates
- Every auditlocal-013 Per-locale parity
- Every auditlocal-014 NAP invariance across locales
- Site crawllocal-015 Google Business Profile tied to the site
- Site crawllocal-016 Profile phone matches the site
- Site crawllocal-017 Opening hours on the profile
- Site crawllocal-018 Profile not marked closed
- Site crawllocal-019 Reviews: fewer than 10, or an average under 4 stars
- Site crawllocal-020 Profile name matches the site's schema
- Site crawllocal-021 Profile address matches the site's schema
- Not automatedLocal citations accurate
- Not automatedReview recency and responses
- Not automatedLocal keywords on-page
- Not automatedUnique local landing pages
7.2 International / Multilingual
hreflang tells Google which language version to show which visitor. It only works when the references point both ways and at indexable URLs, which is exactly where most implementations break.
Source: Localized versions and hreflang · Multi-regional sites
- Every audithreflang correct + bidirectional
- Every auditx-default set
- Every audithreflang references canonical, indexable (200) URLs
- PartialURL strategy signals locale
- Not automatedGenuine localization
7.3 E-commerce
Product markup, clean category URLs, and filters that do not generate an endless supply of near-identical pages for Google to crawl instead of your products.
Source: Ecommerce on Google Search · Product structured data
- Every auditProduct data shared (schema)
- Every auditBreadcrumbs + category → product structure
- PartialFaceted nav / filters don't create crawl traps
- PartialPagination / "load more" is crawlable
- Site crawlClean, stable category/product URLs
- Not automatedOut-of-stock handled well
7.4 Conversion & contact paths
- Every auditAlso checked an ask exists: button-shaped controls only: a <button>, a submit control, or an <a> whose class or role says it is styled as one, or whose text ends in an arrow (→ » ›, since v103)
- Every auditAlso checked the first screen asks for something: button-shaped links actually painted in the first 390×844 phone screen, by the same shape rule as ctas
- Every auditAlso checked CTA labels say what happens: labels matched whole against a multi-language list of words that name a button without naming its effect ("Submit", "Click here", "Mehr erfahren")
- Every auditAlso checked competing asks: several button-shaped controls pointing at different places before the first subheading
- Every auditAlso checked a way to get in touch: a form that is not the theme's search box, or a tel:/mailto: link
- Every auditAlso checked form length: how much is asked before a stranger can send anything
- Every auditAlso checked the reply route: a form that captures neither an address nor a number takes a message the site cannot answer
- Every auditAlso checked a way to come back: an email-only signup form or a list tool's script (Klaviyo, Mailchimp, MailerLite, Brevo, OptinMonster…) that draws its form at runtime
- Every auditAlso checked a price or a way to ask for one: a same-site page that publishes prices, or takes a request for a quote, discovered by the same whole-segment rule as the trust pages so /blog/pricing-mistakes is a blog post
8. Analytics, Search Console & Monitoring
17 checks · 10 on every audit · 0 on a site crawl · 7 needing your data
Search Console, analytics and monitoring. All of it needs your account, so all of it is listed as needing data, with the specific export and the specific finding it would unlock.
Source: Search Console: getting started · Debugging a drop in search traffic
- Every auditAlso checked page framed over by another site: iframes over ≥ 50% of the mobile viewport with viewport_pct, covers_center and cross_site; free check cover_frame fails a cross-site frame at ≥ 90%
- Every auditAlso checked hidden links to other sites: outbound links inside an element whose inline style puts it 1000+ px off screen (left/right/top/text-indent); count, domains, ≤5 samples
- Every auditAlso checked tracker cookies before consent: cookies read right after the mobile load, before any click (the render never clicks a banner), classified by tracking_cookies() (GA, Google Ads, Meta, Hotjar, Clarity, MS Ads, TikTok, Pinterest, LinkedIn, HubSpot, Snap, YouTube, Google embeds); raw list dropped
- Every auditAlso checked mobile vs desktop text: words outside nav/header/footer on each render
- Every auditAlso checked near-duplicate titles: titles equal once brand/town (words in >½ the titles) and filler are dropped, word order kept (reversed routes stay apart); advanced prompt warn
- Every auditAlso checked action list export: report.csv (serve-time projection of fail/warn cards, P0 first, Done column, formula cells neutralised), paid like report.md, linked beside the Markdown download
- PartialGSC property verified
- PartialSecurity Issues report clean
- PartialGA4 firing correctly
- PartialBing Webmaster Tools verified
- Not automatedNo manual actions
- Not automatedGSC + GA4 used together
- Not automatedCTR opportunities reviewed
- Not automatedStriking-distance keywords
- Not automatedTrends used for demand/seasonality
- Not automatedChange monitoring / alerts in place
- Not automatedAI-surface visibility tracked
Run it on your own site
One page, no account, no card. You'll get the 50 measured checks above with the real values from your site.
One account can have up to 1 site crawl, 2 single-page scans and 2 keyword checks running at once — why.