How to Do an SEO Audit: A 15-Step Tutorial With Real Thresholds

What an SEO audit is, and what it is not

An SEO audit is a structured review of everything that decides whether your pages get crawled, indexed, ranked and clicked. It produces a prioritised list of fixes, not a score.

It is not a tool report. Running a crawler and exporting 400 warnings is the easy part, and it is the part most audits stop at. The work is deciding which of those 400 things actually costs you traffic, and in what order to fix them. This guide is built around that decision, with numbers rather than adjectives.

Every step below tells you what to pull, what number means trouble, and roughly how long it takes.

The 60-minute audit versus the full one

Do not start a 20-hour audit on a site you have not looked at yet. Run the short version first, because it tells you whether the long version is worth doing. If you would rather work from a tick list than prose, our site audit checklist covers the same ground in that format.

If the quick audit finds an indexing problem, stop and fix that before doing anything else. Nothing else on this list matters on a page Google cannot index.

Before you start: what to have open

• Google Search Console, with at least 90 days of data and the right property selected
• Google Analytics or your analytics of choice
• A crawler: Screaming Frog is the standard, Sitebulb and Lumar are the alternatives
• PageSpeed Insights for Core Web Vitals
• A spreadsheet, because the audit's output is a prioritised list and a tool cannot make that list for you

One setup note that saves a wasted afternoon. Confirm your Search Console property is the domain property, not a URL-prefix property, or you will audit a partial view of your own traffic and not realise it. If you are not sure which one you set up, our explainer on what a URL prefix property actually is clears it up in a minute.

Step 1: Crawl the site

Point the crawler at your homepage and let it run. On a site under 500 URLs this takes minutes; on a large ecommerce site, budget an hour and configure the crawl limits first. If the crawl stops earlier than the site should allow, read your robots file before blaming the crawler: our free robots.txt generator shows which crawlers and AI bots you are currently blocking.

What you are looking for, in priority order:

• 4xx and 5xx responses on pages that have internal links pointing at them
• Redirect chains longer than one hop
• Pages with no internal links pointing at them, which are orphans
• Duplicate titles and duplicate meta descriptions
• Pages blocked by robots.txt that should not be
• Missing or duplicated canonical tags

The threshold that matters: any 4xx with inbound internal links is a fix today. A 4xx with no inbound links and no backlinks is usually not worth touching.

Step 2: Check indexing, page by page

Open the Pages report in Search Console and read the "Not indexed" reasons. This is the single most valuable screen in an audit and the one most guides give one line to.

"Crawled, currently not indexed" on more than roughly 10% of your pages is a content quality problem, not a technical one. No amount of schema markup fixes it.

Step 3: Pull 90 days of Search Console data

Export queries and pages, both with clicks, impressions, CTR and average position. 90 days is the right window: 28 is too noisy, 12 months hides recent decay.

Do this before touching any on-page work. Almost every worthwhile finding in an audit comes out of this export, and almost every audit that feels unproductive skipped it in favour of crawling.

Step 4: Find the striking-distance pages

Filter your pages export to average position between 8 and 20. These are pages Google already considers relevant that are not getting clicked because they sit at the bottom of page one or the top of page two.

The threshold: position 8 to 20 with more than 100 impressions in 90 days. That is your list. Sorted by impressions, the top 10 rows on that list are usually worth more than everything else in the audit combined, because moving position 12 to position 6 multiplies clicks rather than adding them.

For each one, check whether the page actually answers the query it ranks for. Usually it half does, and the fix is a section, not a rewrite.

Step 5: Find decay

Compare the last 90 days against the previous 90 days, page by page. Sort by clicks lost.

The threshold: any page down more than 30% in clicks with impressions flat is losing to competitors on quality, and is a refresh candidate. A page down in both clicks and impressions has usually lost rankings to a Google update or to a newer competitor page, which is a bigger job.

Decay is the most under-audited thing on this list. Sites obsess over new content while their best pages quietly halve.

Step 6: Find cannibalisation

Two or more of your pages ranking for the same query means you are competing with yourself, splitting links and confusing the intent signal.

Group your query export by query and count distinct landing pages. Any query where the same site shows two URLs across the period is a candidate. Then check which one Google prefers, and whether the other should be merged into it or redirected.

The threshold: the same query returning two of your URLs in the same week, where neither ranks in the top 5. If one ranks 3rd and the other 40th, that is not cannibalisation, that is just an unrelated page.

This step is the one that most often finds something worth real money, and it is the one no crawler can do for you because it needs query data.

Step 7: Audit titles and meta descriptions against CTR

Now go back to the query export and calculate expected CTR by position. As a working baseline, position 1 sits around 30%, position 3 around 10%, position 5 around 6% and position 10 around 2.5%.

The threshold: any page more than 30% below the baseline for its position has a title problem, not a ranking problem. Rewriting the title of a page that already ranks 4th is the highest-return hour in SEO, and it takes ten minutes.

Also check for titles Google has rewritten. If the title in the SERP is not the title you wrote, Google judged yours unhelpful and you should take the hint.

Step 8: Core Web Vitals and speed

Run PageSpeed Insights on your homepage, your most-trafficked article, and one product or conversion page. Three pages, not the whole site: templates repeat, so three tells you almost everything.

The thresholds are published ones, not opinions: Largest Contentful Paint under 2.5 seconds, Interaction to Next Paint under 200 milliseconds, Cumulative Layout Shift under 0.1. Use the field data section rather than the lab score, because field data is what Google actually uses.

Do not chase a score of 100. Speed is a tiebreaker between comparable pages, and it will not lift a page that lost on relevance.

Step 9: Mobile

Check that the mobile rendering shows the same content as desktop. Google indexes the mobile version, so any content hidden or dropped on mobile effectively does not exist.

Tap targets, font size and intrusive interstitials are the usual failures. An interstitial that covers the content on mobile is one of the few things that reliably damages rankings on its own.

Step 10: Internal links and orphans

From your crawl, list every page with zero inbound internal links. Then list every page with fewer than three.

The threshold: any page you care about with fewer than three inbound internal links is under-linked. Any page with zero is invisible to both crawlers and readers, no matter how good it is.

Fixing this is cheap and it compounds. Our own guide to building an effective backlink network covers the external side; internally, the rule is simply that every page should be reachable within three clicks of the homepage.

Step 11: Duplicate and thin content

Sort your crawl by word count ascending. Anything under 300 words that is meant to rank is thin, and anything appearing on multiple URLs with near-identical text is duplicate.

The judgement call: thin is not automatically bad. A pricing page can be 150 words and rank perfectly. Thin matters when the query expects depth and you have not provided it.

The threshold for deletion: zero clicks and under 50 impressions in 12 months, no backlinks, no conversions, and a better page on the same topic already exists. That page should be redirected, not refreshed.

Step 12: Structured data

Run your key templates through the Rich Results Test. You are checking for two things: that the markup is valid, and that it matches what is visible on the page. On sites with many similar templates, automated schema markup generation is usually less error prone than hand-writing it per page.

Invalid markup is a warning. Markup that claims things the page does not show is a manual action risk, and it is a surprisingly common finding on sites that installed a schema plugin and forgot about it.

Step 13: Audit the backlink profile

Pull your referring domains and sort by authority. You are answering three questions: is the profile growing, are the links relevant, and has anything obviously spammy appeared. Which metric you sort by matters here, and we compared the options in our roundup of domain authority checkers. Whether the headline authority number is worth chasing on its own is a separate argument, and we take it up in how to increase domain rating.

The threshold: a sudden spike of low-quality referring domains you did not build is worth investigating; a slow trickle of irrelevant links is normal and Google ignores it. Disavow almost nothing. The disavow file is for manual actions and negative SEO, not for tidiness.

For finding out what you are missing rather than what you have, best backlink exchange and backlink monitoring tools cover the two halves of that job.

Step 14: Check AI visibility, not just rankings

This is the step that did not exist in audits three years ago and now belongs in every one. Ask ChatGPT, Perplexity and Gemini the questions your customers ask, and record whether you are cited. This step has grown enough to deserve its own process, which we set out in our guide to running an AI SEO audit.

Two things to watch for. First, a page can carry thousands of impressions at position 8 and zero clicks because an AI answer consumed the query, which looks like a CTR problem and is not one. Second, answer engines vary their responses, so check the same prompts across a few days and read the trend rather than any single result.

The threshold: a query with high impressions, a decent position and a CTR near zero is an AI-answered query. Rewrite that page to be quotable, with direct answers near the top, rather than rewriting the title.

Step 15: Competitor gap

Take your three closest competitors and list the queries they rank for that you do not. Sort by search volume, then strike out everything that does not fit your business.

What remains is your content plan for the next quarter, ranked by evidence rather than by brainstorm.

How to prioritise what you found

You now have a long list. This is the table that turns it into a plan, and it is the part almost every audit guide leaves as "prioritise by impact and effort" without saying how.

Work top down. The first four rows are where the traffic is, and the temptation in every audit is to start at the bottom because the bottom rows are easier to close.

Run the whole audit as one command

Everything above is fifteen steps across five tools, and the reason most sites audit once a year is that it takes a day and a half. It does not have to.

The Distribb skill for Claude Code runs the Search Console half of this list as a single command. Install the skill from the Bomx/distribb-skill repository, connect Search Console, and run /gsc-audit yoursite.com. It pulls 90 days of query and page data and works through CTR gaps, decay, striking-distance pages, cannibalisation, dead pages, brand versus non-brand split, topic clusters, competitor gaps and on-page checks, then returns a prioritised action plan where each finding maps to a specific fix.

The honest limit: it does not crawl your site. Steps 1, 8, 9 and 12 above, the crawl, Core Web Vitals, mobile rendering and schema validation, still need a crawler and PageSpeed Insights. What it removes is the data work, which is where the day and a half actually goes. The audit runs on every plan including the free one, so you can test the claim before paying anything.

If you want the fixes done as well as found, Distribb takes the same GSC data and rewrites the page-2 pages it identifies.

The tools, and what each is actually for

Note what this means: eleven of the fifteen steps can be done at zero cost. Paid tools buy you the backlink index and the competitor data, which is real value, but the idea that you cannot audit a site without a subscription is wrong.

For a deeper look at the crawler category, see best website audit tools. If you would rather work from a printable list than a narrative, our SEO audit checklist is the condensed version of this page.

How often to audit

• Quick audit, monthly. Steps 1 to 4 and 6, under 90 minutes.
• Full audit, twice a year.
• Always after a site migration, a CMS change, or a Google core update that moved your traffic.
• Always before you commission a quarter of new content, because the gap analysis in step 15 should decide what gets written.

Frequently asked questions

How long does an SEO audit take? 45 to 90 minutes for the quick version, 8 to 20 hours for the full one on a mid-sized site. Automating the Search Console analysis takes the full version down to a few hours, because that is where most of the time goes.

How much should an SEO audit cost? Agencies charge roughly $500 to $5,000 depending on site size. Doing it yourself with the free tools above costs your time. The value is not in the document, it is in whether the fixes get made.

What is the difference between an SEO audit and a website audit? An SEO audit covers crawling, indexing, rankings and clicks. A website audit is broader and includes design, conversion and accessibility. They overlap on speed and mobile.

Do I need a paid tool? No. Eleven of the fifteen steps here run on Search Console and free tools. Paid tools become necessary for competitor keyword data and backlink indexes.

What should I fix first? Anything blocking indexing on a page that makes money. After that, work down the prioritisation table above, starting with striking-distance pages.

How often does Google update its ranking systems? Continuously, with several named core updates per year. This is why decay checks belong in a monthly routine rather than an annual one.

Where to start tomorrow

Open Search Console, export 90 days of pages, and filter to positions 8 through 20 with more than 100 impressions. That single filter, which takes about five minutes, is the highest-value output of an entire audit.

Fix those pages first. Then come back and do the other fourteen steps properly, using the prioritisation table to decide the order. If you would rather have that list generated for you along with the rest of the analysis, Distribb runs it from your Search Console data on any plan, and you can compare its output against the manual version above.