The technical SEO checklist for 2026

How to use this checklist

Work from top to bottom. The sections are ordered by how much damage a failure does. A site that cannot be crawled gains nothing from perfect titles, so crawling and indexing come before anything else.

Every item can be checked from the outside. Run the free SEO checker on your most important page to get most of the list in one go, or a full audit in standard mode to sample up to 25 pages.

1. The page answers with HTTP 200

Search engines only index pages that end in a 200 status after redirects. Pages that answer 404, 410 or a 5xx error drop out of the index, and a page that redirects to an error is treated as that error.

• The final status of every important url is 200.
• Removed pages answer 404 or 410, not 200 with an error message, which search engines call a soft 404.
• Server errors are rare and short. A long run of 5xx answers makes crawlers slow down.

2. robots.txt does not block what you want found

robots.txt is the first file a crawler requests. A single Disallow: / under User-agent: * removes the whole site from crawling.

• The file exists at /robots.txt and answers 200, or answers 404 if you have nothing to say.
• No important path is disallowed for the wildcard group.
• The file declares your sitemap with an absolute url.
• If you block AI crawlers, you block the ones you mean. See the guide to robots.txt for AI crawlers.

3. No accidental noindex

A noindex directive in the meta robots tag or in the X-Robots-Tag response header removes a page from search results. The header is easy to miss because it is invisible in the page source.

• Important pages carry no noindex in the HTML or in the headers.
• Pages you do want removed are crawlable, so the noindex can be read. A page blocked by robots.txt never shows its noindex to anyone.

The indexability checker checks the status, robots.txt, noindex and the canonical in one go.

4. One url per page

The same content at several addresses splits links and signals between duplicates.

• One protocol. Every http url redirects permanently to https.
• One host. Either www or the bare domain serves pages and the other redirects to it.
• One path. Trailing slash or not, consistently.
• A canonical link on every page, absolute, pointing at the page itself unless it really is a duplicate.
• Short redirects. One hop, never a chain or a loop. Check them with the redirect checker.

5. A sitemap that tells the truth

The sitemap is the list of urls you want indexed.

• It lists only canonical urls that answer 200 and carry no noindex.
• It stays under 50,000 urls and 50 MB per file, with a sitemap index for larger sites.
• lastmod reflects real content changes.
• It is declared in robots.txt and submitted in Google Search Console and Bing Webmaster Tools.

6. Titles, descriptions and headings

These are the signals people see in search results and the outline machines use to understand the page.

• A unique <title> of roughly 30 to 60 characters, most important words first.
• A unique meta description of roughly 70 to 160 characters that gives a reason to click.
• Exactly one H1 that names the page, and headings that descend one level at a time.
• An html lang attribute with a valid language tag.
• A viewport meta tag that does not disable zoom.

The meta tag checker previews how the result could look.

7. Content in the HTML

Google renders JavaScript, later and with limits. Most AI crawlers do not render at all. If the main content only appears after scripts run, a large part of the crawlers that matter see an empty page.

• The main text, the headings and the links are in the HTML the server sends.
• Titles, canonicals and structured data are in the server response, not added on the client.

The JavaScript SEO checker counts what is in the HTML before scripts run.

8. Structured data

Structured data in JSON-LD describes the page to machines and enables rich results.

• Every JSON-LD block parses.
• The home page declares the Organization or WebSite, with a logo and sameAs profiles.
• Nested pages declare a BreadcrumbList that matches the visible breadcrumbs.
• The main entity of each page type carries its required properties.

9. Speed

Core Web Vitals are part of Google’s page experience signals and they shape every visit.

• Time to first byte under 0.8 seconds.
• Largest Contentful Paint under 2.5 seconds.
• Cumulative Layout Shift under 0.1.
• Text responses compressed with gzip or Brotli, static assets cached, images in modern formats and sized for their display.

10. AI search readiness

AI assistants answer from pages their crawlers fetched. The AI search readiness guide covers this in depth.

• robots.txt allows the AI search and user crawlers you want to appear in.
• Your firewall or bot protection does not serve them a block page.
• An optional llms.txt gives models a curated map of the site.

11. HTTPS and security headers

• A valid certificate for every hostname that serves pages.
• No mixed content.
• Strict-Transport-Security, X-Content-Type-Options, a Referrer-Policy and framing protection. See the security headers guide.

12. Keep it that way

Technical SEO rots. A new plugin adds a noindex, a CDN rule blocks a crawler, a redesign drops the canonical. Set up a monitor that re-audits the site on a schedule and alerts you when the score drops or a critical check starts failing, so a regression is caught in days rather than discovered in a traffic report months later.