Comprehensive Website Audit: 9-Step Technical & SEO Process (2026)

A comprehensive website audit in 2026 is six audits stacked: technical SEO, Core Web Vitals, on-page SEO, content, backlinks, conversion, and security. Skip any one and you’ll fix the wrong thing. The site that’s losing rankings to a thin-content competitor doesn’t need a backlink audit. The site bleeding revenue at checkout doesn’t need an h1 rewrite. Diagnosis before treatment, every time.

This guide is the exact audit process I’ve run on 2,000+ client projects over 18 years, updated for 2026. The tools are Sitebulb, Screaming Frog, Ahrefs, Semrush, PageSpeed Insights, Search Console, GA4, and a handful of niche scanners. The thresholds are the ones Google actually uses to decide what ranks, what gets indexed, and what gets buried. I’ll walk through each audit, what to measure, what numbers mean “fix this now,” and the 30-day plan to ship the fixes that move the needle.

Why a comprehensive audit beats a partial one

Most “SEO audits” you see for sale are surface-level technical scans. They flag missing alt tags and duplicate meta descriptions and call it a day. That’s not an audit. That’s a checklist with billing attached.

A real audit answers four questions: can search engines crawl and index this site, do real users have a good experience, does the content match what users actually search for, and does the site convert traffic into business outcomes. Each question maps to a specific audit. Each audit produces specific fixes. Each fix has a measurable impact you can report on 60 days later. Without all four, you’re guessing. The detailed framework I use also borrows from marketing audit methodology, which adds the channel and conversion layers most pure-SEO audits miss.

Tools you’ll need (and what each does)

The audit stack I run in 2026. Some are free, most are paid. Skip nothing on this list if you’re auditing a site that drives meaningful revenue.

• Screaming Frog SEO Spider: desktop crawler, free up to 500 URLs, $259/year for unlimited. The standard for technical crawling.
• Sitebulb: cloud-based crawler with prioritized hint output, $35/month. Better visualizations than Screaming Frog for non-technical stakeholders.
• Ahrefs: backlink, keyword, and content gap analysis. $129/month minimum. Industry standard.
• Semrush: similar coverage, often better for competitive analysis. $139/month.
• Google Search Console: free. The only data source for what Google actually sees.
• Google Analytics 4: free. User behavior, conversion funnels, traffic source attribution.
• PageSpeed Insights and CrUX: free. Real-user Core Web Vitals data.
• WebPageTest: free for basic, $20/month Pro. Detailed waterfall analysis.
• Lighthouse CI: free. Lab data automation in CI/CD pipelines.

For a one-time audit you can run with just Screaming Frog (free tier), Search Console, and PageSpeed Insights. For ongoing audits and competitive monitoring, Ahrefs or Semrush is non-negotiable. Pick one. Don’t pay for both.

Step 1: Technical SEO audit (crawl, index, redirects, hreflang)

Technical SEO determines whether search engines can reach your pages at all. Run this before anything else, because no amount of content optimization helps if Googlebot can’t read the page. The technical audit covers crawlability, indexation, redirects, hreflang, structured data, and XML sitemap health.

Crawl the entire site

Run Screaming Frog or Sitebulb against the full site with JavaScript rendering enabled. The crawl tells you how many URLs exist, response codes, redirect chains, canonical declarations, and internal link counts. For a typical 5,000-URL site the crawl takes 30-90 minutes. For larger sites, segment by directory.

The crawl reveals: orphan pages (no internal links), redirect chains over 3 hops, broken internal links (404s), canonical declarations pointing to wrong targets, and pages blocked by robots.txt that shouldn’t be. Each of these is a fix. Each fix has a defined impact.

Compare crawl to Search Console index coverage

Pull the Search Console index coverage report. Compare indexed pages count to your crawl. The gap is informative. If you crawl 5,000 pages and Google indexes 1,200, something is wrong. Common causes: duplicate content, thin content, soft 404s, noindex tags accidentally applied, or pages excluded as “Crawled, currently not indexed.”

Audit redirects

Redirect chains over 3 hops leak crawl budget and link equity. Redirect loops break crawling entirely. The technical SEO best practice is single-hop 301s wherever possible. Run Screaming Frog’s redirect chain report and fix any chain over 2 hops by updating the source link directly. The companion guide on 301 vs 302 redirects covers when each makes sense.

Verify hreflang on multilingual sites

If you serve multiple languages or regions, hreflang tags tell Google which version to serve to which user. Hreflang errors are common: wrong language codes, missing return tags, conflicting canonical tags. Use the Hreflang Tag Testing Tool or Sitebulb’s hreflang reports. A correctly implemented hreflang setup increases the right-version index rate by 30-60% based on the audits I’ve run.

Validate structured data

Structured data drives rich results, FAQ snippets, How-To panels, and increasingly AI Overview citations. Validate using Schema Markup Validator and Google’s Rich Results Test. Common errors: missing required fields, wrong type declarations, dates in non-ISO format. Sitebulb auto-extracts and validates schema during crawl.

Step 2: Core Web Vitals and INP audit

Core Web Vitals are now ranking signals. The three metrics: Largest Contentful Paint (LCP) under 2.5 seconds, Interaction to Next Paint (INP) under 200ms (replaced FID in March 2024), and Cumulative Layout Shift (CLS) under 0.1. Pages above these thresholds at the 75th percentile of real users get flagged in Search Console.

Pull real-user data, not just lab data

Lab data (Lighthouse, PageSpeed Insights) is a synthetic test on one device. Real-user data (CrUX, Search Console Core Web Vitals report) is what Google actually ranks on. Always start with real-user data. PageSpeed Insights shows both. The CrUX section is the truth.

Diagnose LCP failures

LCP fails because the largest visible element loads slowly. Usually a hero image. Fixes: serve next-gen formats (AVIF or WebP), use the loading=”eager” and fetchpriority=”high” attributes on the hero image, preload the hero image with a link rel=”preload” in the head, host on a CDN with edge caching, and eliminate render-blocking JavaScript above the LCP element. Most sites can drop LCP from 4-6 seconds to under 2 seconds with these five fixes alone.

Diagnose INP failures

INP measures responsiveness across all interactions, not just the first. INP fails because long JavaScript tasks block the main thread when users click, tap, or type. Fixes: code-split routes, defer third-party scripts (especially analytics, chat widgets, A/B testing), debounce and throttle event handlers, use requestIdleCallback for non-critical work. WebPageTest’s main-thread breakdown is the diagnostic tool here.

Diagnose CLS failures

CLS fails because elements move during load. Usually images, ads, or embeds without reserved space. Fixes: set explicit width and height on every image, reserve space for ads and embeds with min-height containers, avoid inserting content above existing content (cookie banners are common offenders), use CSS aspect-ratio for responsive media. CLS is the easiest of the three to fix and the one most sites still get wrong.

Step 3: On-page SEO audit

On-page audits answer: are these pages optimized for the queries they should rank for. The audit covers title tags, meta descriptions, heading hierarchy, internal linking, image optimization, and entity coverage.

Title and meta tag audit

Export every URL with its title and meta description from Screaming Frog. Filter for: titles over 60 characters (truncated in SERPs), titles under 30 characters (under-optimized), missing meta descriptions, duplicate titles across pages, and titles missing the primary keyword. The standard fix is rewriting titles to under 60 characters with the primary keyword in the first 30 characters.

Heading hierarchy

Every page needs exactly one H1. Subsequent headings descend in order: H2, H3, H4. Skipping levels (H2 to H4 with no H3) breaks accessibility and confuses search engines. Pages with no H1 or multiple H1s underperform in rankings by 10-20% based on Ahrefs data. Sitebulb flags these directly.

Internal linking density and anchor diversity

Internal links distribute link equity. Pages with fewer than 3 internal links pointing to them rarely rank for competitive queries. Run Screaming Frog’s internal link count report. Identify high-value pages with low inbound link counts and add contextual links from related content. Diversify anchor text. The same anchor on every link signals manipulation.

Image and media audit

Images without alt text fail accessibility and miss image-search traffic. Images over 200KB drag down LCP. Images served as JPEG instead of WebP/AVIF cost roughly 30% in payload. Run the Screaming Frog images report and fix the worst offenders first: large hero images, header logos, and product images on commercial pages.

Step 4: Content audit

Content audits separate the pages earning their keep from the dead weight. Most sites I audit have 30-50% of pages producing zero traffic, conversions, or backlinks. That dead content drags down domain quality. The fix isn’t always rewrite. Often it’s consolidate, redirect, or delete.

Pull traffic and conversion data per URL

Combine Search Console (impressions, clicks, average position per URL), GA4 (sessions, conversions per landing page), and Ahrefs (backlinks per URL). The combined export shows which pages earn traffic, which earn revenue, and which earn neither. Pages with no traffic, no backlinks, and no conversions for 12 months are candidates for deletion or consolidation.

Identify content gaps

Use Ahrefs Content Gap or Semrush Keyword Gap to find queries where competitors rank and you don’t. The output is a list of topics worth covering. Filter by search volume (over 100/month), keyword difficulty (under your domain rating), and commercial intent. The top 20-30 gaps are your next 6 months of content strategy.

Decay analysis

Pages that ranked well historically and slipped need attention. Pull the year-over-year traffic comparison in Search Console. Filter for pages with 30%+ decline. The fix is usually content refresh: update statistics, add recent examples, expand thin sections, fix broken links, and republish. Refreshed content typically recovers 60-80% of lost traffic within 90 days.

Step 5: Backlink audit

Backlinks remain a top-3 ranking factor. The audit checks: total referring domains, quality distribution, anchor text profile, and toxic links that need disavowing.

Pull referring domains and authority distribution

Ahrefs and Semrush both export referring domains with domain rating or authority score. Healthy profiles have 60-70% of links from DR 30+ sites and 30-40% long-tail from smaller sites. Profiles dominated by DR 0-20 sites usually indicate low-quality link building or PBN exposure.

Anchor text profile

Anchor distribution should be roughly 40% branded, 30% naked URL or generic, 20% partial-match, 10% exact-match. Profiles with 40%+ exact-match anchors trigger algorithmic penalties. Sitebulb and Ahrefs both have anchor distribution charts. Compare against direct competitors who outrank you.

Disavow toxic links

Spam, hacked sites, and irrelevant link networks should be disavowed. Use Ahrefs’ Toxic Links report or Semrush’s Backlink Audit. Manual review is still needed because both tools produce false positives. Submit the disavow file via Search Console only for clear toxic patterns. Aggressive disavowing of borderline links costs more than it helps.

Step 6: Conversion audit

SEO traffic is meaningless without conversions. The conversion audit identifies where users drop off, what’s blocking them, and what changes would lift conversion rate. The companion piece on conversion rate optimization covers the full CRO playbook. Here I’ll cover the audit-specific workflow.

Map the funnel in GA4

Build a funnel exploration in GA4: landing page → key page view → form start → form submit → confirmation. Identify the largest drop-off step. That’s where to focus. Most sites lose 60-80% of users between landing and the first conversion event. Cutting that drop by 10 percentage points usually doubles overall conversion rate.

Heatmaps and session recordings

Hotjar, Microsoft Clarity (free), and FullStory show what users actually do. Watch 20 sessions on the highest-traffic landing page. Note where users stall, which CTAs they ignore, and where rage-clicks happen. Patterns emerge fast. The first 10 sessions usually surface the major issues.

Form and checkout audit

Forms with 8+ fields convert about 50% as well as forms with 4 fields. Audit field count, optional vs required marking, error message clarity, and inline validation. For ecommerce, audit checkout step count, guest checkout availability, payment method options, and trust signals near the submit button. Each removed field or step typically lifts completion by 5-15%.

Step 7: Security audit

Security failures kill rankings, traffic, and trust simultaneously. The minimum security audit covers SSL/TLS configuration, mixed content warnings, security headers, and known vulnerabilities.

• SSL/TLS: run SSL Labs Server Test. Aim for A+ grade. Drop TLS 1.0 and 1.1.
• Mixed content: any HTTP resource on an HTTPS page. Browser warnings tank trust signals. Crawl with Screaming Frog “Insecure Content” filter.
• Security headers: Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy. Test with securityheaders.com.
• WordPress vulnerability scan: WPScan or WordFence. Outdated plugins are the #1 attack vector for WordPress sites.
• Hosting and server: pick a host with proper isolation and active monitoring. The best web hosting services guide covers which providers ship the security features that pass an audit by default.

Step 8: Mobile and accessibility audit

Mobile and accessibility are now ranking and conversion factors, not afterthoughts. Google indexes mobile-first since 2019. ADA lawsuits hit US sites at over 4,000 per year. Both audits are cheap to run and expensive to skip.

Mobile usability audit

Run Search Console’s Mobile Usability report and PageSpeed Insights mobile tab. Common failures: viewport not configured, content wider than the screen, tap targets too close together, text too small to read. Fix these in CSS, not in a separate mobile site. Test on real mid-tier Android devices, not just Chrome DevTools. The performance and rendering gap between flagship and budget Android is the gap most teams miss.

Accessibility audit (WCAG 2.2)

Run axe DevTools, WAVE, and Lighthouse Accessibility. Aim for Lighthouse Accessibility score of 100. Manual checks: keyboard-only navigation through every page, screen reader pass on critical flows (NVDA on Windows, VoiceOver on Mac), color contrast at 4.5:1 minimum for body text, focus indicators visible and not hidden under sticky headers, form labels associated correctly. Sites that fail WCAG 2.2 Level AA are the ones receiving demand letters.

Step 9: Competitive benchmarking

An audit in isolation tells you what’s broken. An audit with competitive benchmarks tells you how broken you are relative to the people you’re trying to outrank. Pick 3-5 direct competitors. Run the same audit checks on each.

The benchmarks worth comparing: Domain Rating or Domain Authority, total referring domains, Core Web Vitals scores, indexed pages count, top 100 ranking keywords overlap, branded search volume. The gap between your numbers and theirs sets the realistic 12-month target. Closing 50% of each gap in 12 months is achievable. Closing 100% in 6 months is fantasy.

Audit deliverable: priorities, fixes, and 30-day plan

An audit without a prioritized fix list is a 200-page PDF that gets archived. The deliverable that matters is a prioritized backlog: 30-50 fixes ranked by impact (high/medium/low), effort (hours), and dependency. Group into weekly sprints over 30 days for the high-impact, low-effort wins, and a longer roadmap for structural fixes.

The fixes that move rankings within 30-60 days: Core Web Vitals improvements (especially LCP and CLS), broken internal link cleanup, title tag rewrites for top 50 traffic pages, content refresh on decay-analysis hits, and structured data implementation on high-intent commercial pages. The fixes that take 60-180 days: backlink improvements, content gap fills, full information architecture changes.

Track baseline metrics before any fix lands: impressions, clicks, average position, conversion rate, Core Web Vitals scores, and indexed pages count. Re-measure at 30, 60, and 90 days. Without baselines, you can’t prove what worked. With them, every fix becomes evidence for the next budget cycle.

Common audit pitfalls and how to avoid them

Five mistakes show up in nearly every site audit I review from another vendor or in-house team. Each costs measurable traffic.

• Crawling without JavaScript rendering enabled. Half the modern web is rendered client-side. A non-JS crawl misses most of the content. Always enable JavaScript rendering in Screaming Frog or Sitebulb.
• Trusting lab data over real-user data. Lighthouse on a clean device with fast wifi tells you nothing about what 75% of your real users experience. Always cross-check with CrUX and Search Console.
• Confusing crawled with indexed. Google crawls pages it has no intention of indexing. Indexed page count, not crawled page count, is what matters for SEO.
• Treating every Lighthouse warning equally. Lighthouse flags hundreds of issues. Most don’t move rankings. Focus on Core Web Vitals real-user data, not the lab score.
• Producing reports nobody reads. A 200-page audit PDF is useless. Ship a prioritized 30-fix backlog with effort estimates and link to detail elsewhere.

Frequently asked questions

The bottom line

A comprehensive website audit costs 25-40 hours of focused analyst time and typically returns 20-40% organic traffic lift within 90 days when the recommendations actually ship. The audits that fail aren’t the ones with bad findings. They’re the ones whose fixes never made it into a sprint. Run the audit. Prioritize ruthlessly. Ship the top 10 fixes in 30 days. Re-measure. Repeat the cycle every 12 months. That’s the work.

Different industries need different playbooks. We break down a financial services marketing agency, higher education marketing, hospitality marketing, franchise SEO, a YouTube SEO agency, content marketing SEO services, general SEO optimization services, and a dedicated technical SEO audit service.