Free website SEO audit

Asks for location on page load

A location prompt before the visitor has done anything is usually refused and makes the site look untrustworthy. Ask only when the visitor uses a feature that needs it.

Measured on your homepage with Google PageSpeed Insights.

Asks to send notifications on page load

A notification prompt on arrival is mostly refused, and Chrome now quiets sites that get refused often. Ask after the visitor has shown interest, from a button they press.

Measured on your homepage with Google PageSpeed Insights.

BIMI brand logo for email

BIMI shows your logo beside your emails in Gmail, Apple Mail and Yahoo, which makes them easier to recognise and harder to fake. It works only once DMARC is enforced (p=quarantine or p=reject): publish a v=BIMI1 TXT record at default._bimi pointing to an SVG logo. Gmail also asks for a Verified Mark Certificate.

CORS misconfigured: Allow-Origin * + credentials

Allow-Origin * combined with credentials exposes user data to any site. Restrict Access-Control-Allow-Origin to trusted origins.

Cross-origin scripts without SRI

Subresource Integrity verifies third-party scripts haven’t been tampered with. Add integrity hashes to cross-origin <script>/<link>.

DNS nameserver single point of failure

If the only nameserver — or one of two — is down or doesn’t resolve, visitors and mail servers can’t find your domain at all. List at least two working nameservers at your registrar; a managed DNS provider gives you several by default.

Domain registration expiring

An expired domain takes your site, your email and every link pointing at it offline on the same day, and desirable names are bought within hours of dropping. Renew it and turn on auto-renew.

HTTPS certificate expiring

When an HTTPS certificate expires, browsers block the page with a full-screen security warning before anyone reaches your site. Renew it, and set up automatic renewal so the deadline never comes round again.

Injected spam content (possible hack)

Gambling, pharma or loan copy the page isn’t about is the usual sign a plugin or theme was hacked — you see your own page, search engines see the spam. View the page source, find where the text comes from (often a plugin, a theme file or the database), remove it, update everything and change passwords, then request a review in Search Console if Google has flagged the site.

Missing Content-Security-Policy

A Content-Security-Policy limits which scripts can run, mitigating XSS. Add a CSP header scoped to your trusted sources.

Missing HSTS header

HSTS forces browsers to use HTTPS, protecting visitors from downgrade attacks. Add a Strict-Transport-Security response header.

Missing Permissions-Policy

A Permissions-Policy limits access to powerful browser features (camera, geolocation). Set one to reduce abuse risk.

Missing Referrer-Policy

A Referrer-Policy controls how much URL data is sent to other sites. Set one (e.g. strict-origin-when-cross-origin).

Missing SPF / DMARC

Without SPF and DMARC, others can spoof email from your domain and your mail may be marked spam. Publish SPF and DMARC DNS records.

Missing X-Content-Type-Options

Without X-Content-Type-Options: nosniff, browsers may MIME-sniff responses into executable content. Add the nosniff header.

Missing X-Frame-Options / frame-ancestors

Without frame protection, your pages can be embedded for clickjacking. Set X-Frame-Options or a CSP frame-ancestors directive.

Mixed content (HTTP on HTTPS)

Loading HTTP resources on an HTTPS page triggers browser security warnings and can break the page. Serve every asset over HTTPS.

No CAA record

A CAA record lists the certificate authorities allowed to issue certificates for your domain, so a certificate from anyone else is refused. Add one naming the CA you use (and any your CDN uses), e.g. 0 issue "letsencrypt.org".

No HTTP-to-HTTPS redirect

If HTTP doesn’t redirect to HTTPS, visitors can land on the insecure version. Add a 301 redirect from http:// to https://.

Obsolete TLS version still accepted

TLS 1.0 and 1.1 were retired in 2020 and no current browser will use them, so leaving them enabled serves no visitor — it only leaves a weaker protocol an attacker can try to force the connection down to, and it fails the security questionnaires clients send. Turn off everything below TLS 1.2 in the server or CDN configuration.

Plaintext emails exposed

Email addresses in plain text get harvested by spam bots. Obfuscate them or use a contact form.

Relies on third-party cookies

Browsers increasingly block third-party cookies, so embeds and tracking that depend on them stop working for many visitors. Check which vendors set them and move to their first-party or cookieless option.

Measured on your homepage with Google PageSpeed Insights.

Server header reveals version

Exposing server software and version helps attackers target known vulnerabilities. Suppress the Server header version.

Vulnerable JS library version

Outdated JavaScript libraries can carry known security holes. Upgrade to a patched version.

Broken canonical tag

A canonical tag pointing to a broken or wrong URL can deindex the page. Point it at the correct, reachable preferred URL.

Canonical tags chained through another page

Google does not follow canonical tags from one page to the next -- a chained canonical is treated as a weak hint and it picks its own winner instead, so the consolidation you set up is forfeited. Point every canonical straight at the final URL.

Missing canonical tag

A canonical tag tells search engines which URL is the “real” one when several are similar. Add <link rel="canonical"> to avoid duplicate-content dilution.

Missing robots.txt

robots.txt tells crawlers what they may access. Add one (even an allow-all) and point it at your sitemap.

Page blocked by robots.txt

Googlebot won’t crawl this page, so its content can’t rank — and a noindex on it is never seen. If the page should be found, remove or narrow the Disallow rule shown; if it’s meant to be private, stop linking to it and keep it out of the sitemap. Test the rule in Search Console’s robots.txt report.

Page set to noindex

This page tells search engines not to index it, so it can’t rank. If that’s unintended, remove the noindex directive.

Pages buried too deep

Pages many clicks from the homepage get crawled and ranked less. Flatten your structure and link to deep pages.

SEO-unfriendly URLs

Long, parameter-heavy URLs are harder for users and search engines to parse. Use short, readable, keyword-relevant paths.

Scripts or CSS blocked by robots.txt

Google renders pages with their CSS and JavaScript. Blocked files can make a page look broken or empty to it. Remove the Disallow rules that cover theme, plugin or asset folders; there’s no SEO reason to hide scripts and stylesheets.

Sitemap URLs blocked by robots.txt

The sitemap asks Google to crawl URLs that robots.txt forbids, which Search Console reports as “Submitted URL blocked by robots.txt”. Either take those URLs out of the sitemap or stop blocking them.

Soft 404 (server returns 200 for missing URLs)

Returning HTTP 200 for missing pages makes search engines index empty pages. Serve a real 404 status for URLs that don’t exist.

robots.txt doesn’t name a sitemap

Add a line like “Sitemap: https://example.com/sitemap.xml” to robots.txt. Every crawler reads robots.txt first, so this is how Bing and others find your sitemap without a manual submission.

robots.txt malformed

A malformed robots.txt can accidentally block your whole site. Validate it and confirm it isn’t disallowing important paths.

www / apex not canonicalized

Serving both www and non-www without redirecting splits your ranking signals. Pick one and 301-redirect the other.

Internal links pointing at redirects

The link in your markup is stale: it points at a URL that redirects, costing every visitor an extra round trip and the crawler an extra fetch. Update the link to the final destination.

Redirect chain on root URL

Multiple hops before the final URL waste time and dilute link signals. Redirect straight to the destination in one step.

Redirect chains between pages

Each hop is a round trip before anything appears, and search engines spend crawl budget on the URLs in between. Chains usually build up from separate rules for https, www and trailing slashes; point the first redirect straight at the final URL.

Redirects landing on an error page

Someone set up these redirects on purpose and their targets have since moved or been deleted, so visitors who follow a promise that content moved land on an error. Repoint each redirect at a page that exists, or remove it.

Missing sitemap.xml

An XML sitemap helps search engines discover all your pages. Generate one and reference it in robots.txt.

Sitemap lists broken or redirecting URLs

Your sitemap tells search engines these URLs are worth indexing, but they error or redirect. Remove the dead entries and point the rest straight at their final URL so crawl budget goes to real pages.

Sitemap lists pages that block indexing

These pages are listed in the sitemap as worth indexing, yet the pages themselves say otherwise via noindex or a canonical pointing elsewhere. One of the two is wrong — decide which, then make them agree.

sitemap.xml malformed

A malformed sitemap can be ignored by search engines. Validate and fix the XML so all URLs are discoverable.

Duplicate titles

When pages share a title, search engines can’t tell them apart and may rank the wrong one. Make each title unique to the page’s content.

Meta description too long (over 160)

Descriptions over ~160 characters get truncated in search results. Trim to the key selling point.

Meta description too short (under 70)

Very short descriptions waste the chance to earn the click. Expand to a compelling 120–160 characters.

Missing <title>

The <title> is the clickable headline in search results and the strongest on-page signal. Give every page a unique, descriptive title of 50–60 characters.

Missing Open Graph tags

Open Graph tags control how your page looks when shared on social media. Add og:title, og:description and og:image for attractive link previews.

Missing Twitter Card tags

Twitter Card tags control how links look on X/Twitter. Add twitter:card and related tags for rich previews.

Missing meta description

The meta description is the snippet under your title in search results. A compelling 120–160 character summary improves click-through even though it isn’t a direct ranking factor.

Title and <h1> are identical

The title and the <h1> are two chances to describe the page, not one. Write the title for the search result and the <h1> for the reader who has just arrived.

Title may be cut off in search results

Google shows about 600px of a title — roughly 55–65 characters, depending on the letters — and cuts off the rest. Lead with the words that matter so the visible part still makes sense, or shorten it.

Title too short (under 30 chars)

Very short titles waste your biggest ranking signal. Expand to a descriptive 50–60 characters.

Duplicate H1 headings across pages

The H1 says what a page is about; when several pages say the same thing they compete for the same searches. Give each page a heading that describes its own content.

Duplicate content

Identical content on multiple URLs splits ranking signals and can suppress all copies. Consolidate, rewrite, or add a canonical tag to the preferred version.

Low reading-ease score

Hard-to-read text loses visitors. Shorten sentences and use plainer language to raise the reading-ease score.

Low text-to-HTML ratio

A very low ratio of text to code can signal thin or template-heavy pages. Add meaningful content and trim unnecessary markup.

Missing <h1>

The <h1> tells users and search engines the page’s main topic. Add exactly one clear <h1> per page.

Multiple <h1> headings

Multiple <h1> headings dilute the page’s topic. Keep one <h1>; use <h2>/<h3> for sub-sections.

Thin content (low word count)

Very thin pages give search engines little to rank. Add genuinely useful content, or consolidate thin pages into stronger ones.

Below-fold images load eagerly

Eagerly loading off-screen images wastes bandwidth and slows first paint. Add loading="lazy" to below-the-fold images.

Images displayed stretched or squashed

An image drawn at the wrong aspect ratio looks distorted. Match the width and height attributes or CSS to the file’s proportions, or use object-fit.

Measured on your homepage with Google PageSpeed Insights.

Images missing alt text

Alt text describes images to screen-reader users and to search engines (helping image search). Add concise, descriptive alt text; leave it empty only for decorative images.

Images missing width/height

Images without width/height cause layout shift as they load. Set explicit dimensions or aspect-ratio.

Images too low-resolution for the screen

An image with fewer pixels than its display size times the screen density looks soft on phones and retina displays. Serve a larger version through srcset.

Measured on your homepage with Google PageSpeed Insights.

Images use legacy formats (jpg/png)

Modern formats like WebP/AVIF are far smaller than JPG/PNG. Serve next-gen formats to speed up loads.

Images without srcset

Serving one large image to every device wastes mobile bandwidth. Provide srcset/sizes so browsers pick the right size.

Inefficient animated GIFs

Animated GIFs are huge; video is far smaller. Replace them with MP4/WebM video.

Measured on your homepage with Google PageSpeed Insights.

Large image files

Heavy images slow every page that uses them, and a large hero image is often what decides the page’s Largest Contentful Paint. Resize to the size it is displayed at, compress it, and serve WebP or AVIF.

Deep critical request chain

Long chains of dependent requests delay rendering. Reduce nesting and preload key resources.

Measured on your homepage with Google PageSpeed Insights.

Excessive DOM size

A very large DOM slows rendering and JavaScript. Simplify page structure and paginate or lazy-load long lists.

HTML not compressed

Uncompressed HTML wastes bandwidth and slows loads. Enable gzip or Brotli compression on your server.

Heavy main-thread work

Too much main-thread work makes pages feel sluggish. Minimize JS, simplify styles, and offload work.

Measured on your homepage with Google PageSpeed Insights.

Heavy third-party scripts

Third-party scripts (analytics, chat, ads) can dominate load time. Audit and defer or remove non-essential ones.

Measured on your homepage with Google PageSpeed Insights.

High Cumulative Layout Shift (CLS)

Cumulative Layout Shift measures unexpected movement as the page loads. Set width/height on images and reserve space for ads/embeds.

Measured on your homepage with Google PageSpeed Insights.

High JavaScript bootup time

Heavy JavaScript execution delays interactivity. Reduce, split, or defer scripts.

Measured on your homepage with Google PageSpeed Insights.

High Total Blocking Time (TBT)

Total Blocking Time reflects how long the page is unresponsive to input. Break up long JavaScript tasks and defer non-critical scripts.

Measured on your homepage with Google PageSpeed Insights.

Large HTML payload

Oversized HTML delays first render, especially on mobile. Trim inline data, whitespace and unused markup.

Large total page weight

Heavy pages are slow and costly on mobile data. Compress images, scripts and fonts to cut total weight.

Measured on your homepage with Google PageSpeed Insights.

Legacy HTTP/1.x in use

HTTP/1.x is slower than HTTP/2/3, which load many resources in parallel. Enable HTTP/2 on your server or CDN.

Low Lighthouse Performance score

A low Lighthouse Performance score signals slow real-world loads. Work through the LCP/CLS/TBT items to improve it.

Measured on your homepage with Google PageSpeed Insights.

No CDN detected

A CDN serves assets from locations near your visitors, cutting latency. Consider putting static assets behind a CDN.

No IPv6 (AAAA) DNS record

Without an IPv6 (AAAA) record, IPv6-only clients can’t reach you directly. Add AAAA DNS records if your host supports it.

No cache headers

Without cache headers, browsers re-download assets on every visit. Set Cache-Control/Expires on static resources.

Render-blocking resources

CSS/JS in the <head> delays first paint. Defer or async non-critical resources and inline only what’s needed above the fold.

Measured on your homepage with Google PageSpeed Insights.

Slow First Contentful Paint (FCP)

First Contentful Paint is when the first content appears. Reduce render-blocking CSS/JS and speed up the server to improve it.

Measured on your homepage with Google PageSpeed Insights.

Slow Largest Contentful Paint (LCP)

Largest Contentful Paint measures how fast the main content appears; slow LCP hurts rankings and UX. Optimize your largest image/text block and server response.

Measured on your homepage with Google PageSpeed Insights.

Slow server response (TTFB)

A slow Time To First Byte delays everything else. Improve hosting, caching, or database performance.

Measured on your homepage with Google PageSpeed Insights.

Too many script or stylesheet files

Each script and stylesheet is a file the browser has to fetch, parse and run before the page settles. A page pulling dozens of them is usually carrying a plugin per feature; bundle what belongs together and drop what the page never uses.

Web fonts missing font-display:swap

Without font-display:swap, text can be invisible while web fonts load. Add font-display:swap to your @font-face rules.

Measured on your homepage with Google PageSpeed Insights.

Deprecated browser APIs in use

Deprecated APIs keep working until the browser removes them, and then the feature built on them breaks without warning. Update the script or library that calls them.

Measured on your homepage with Google PageSpeed Insights.

Errors in the browser console

Console errors usually mean a script failed — a broken widget, a blocked request, a missing file. If the failing script renders content or links, Google may not see them either. Open the page with the browser console open and fix what it reports.

Measured on your homepage with Google PageSpeed Insights.

Heavy inline CSS

Large blocks of inline CSS can’t be cached and bloat every page. Move styles into external, cacheable stylesheets.

Heavy inline JavaScript

Large inline scripts block rendering and can’t be cached. Move JavaScript to external, deferred files.

Images, scripts or stylesheets that fail to load

The page asks for these files and the server does not deliver them. A missing image leaves a visible hole; a missing stylesheet or script can leave the page unstyled or half-working, and a crawler that cannot fetch your CSS judges the layout on markup alone. Fix the path or remove the reference.

Legacy / over-transpiled JavaScript

Shipping transpiled ES5 to modern browsers wastes bytes. Serve modern JavaScript to capable browsers.

Measured on your homepage with Google PageSpeed Insights.

Unminified CSS

Unminified CSS ships extra bytes. Minify stylesheets in your build.

Measured on your homepage with Google PageSpeed Insights.

Unminified JavaScript

Unminified JavaScript ships extra bytes and slows parsing. Minify scripts in your build.

Measured on your homepage with Google PageSpeed Insights.

Unused CSS rules

Unused CSS forces browsers to download and parse styles that never apply. Remove dead CSS or split it per template.

Measured on your homepage with Google PageSpeed Insights.

Broken links

Links that return an error frustrate visitors and waste search engines’ crawl budget. Fix the target URL, redirect it, or remove the link.

Broken or redirecting links to other sites

Links to other sites rot without anything on your server changing — the other end moved or shut down. Dead outbound links are one of the clearest signals to a reader that a page is no longer maintained. Update or remove them.

Generic anchor text

Generic anchors like “click here” tell search engines nothing about the target. Use descriptive, keyword-relevant link text.

Links search engines can’t follow

Google follows only <a> elements with a real URL in href. Links built from click handlers or javascript: URLs pass no authority and may hide pages from the crawl. Use a normal href, and keep JavaScript for enhancement.

Measured on your homepage with Google PageSpeed Insights.

Orphan page (no internal links)

Orphan pages with no internal links are hard to discover and rank poorly. Link to them from relevant pages.

Pages returning a server error (5xx)

A server error means the page exists but the server failed to build it, so visitors and search engines get nothing. Check the server or application logs for these URLs — a plugin, database or hosting problem is the usual cause.

Pages that didn’t respond (timeout or connection failure)

These pages didn’t answer our requests, even when asked again slowly, so we couldn’t check them. Open them in a browser: if they load, the server is probably slow or limiting automated requests, which can slow search engine crawling too; if they don’t, check hosting, firewall and DNS.

Pages with only one inbound link

Internal links are how importance flows around a site, and a page hanging off one link gets the least of it — and becomes unreachable if that link is ever removed. Add a link from another relevant page where it makes sense.

Sitemap pages nothing links to

These pages are in your sitemap, so you are asking Google to index them, but nothing on the site links to them — visitors can only reach them by knowing the address. Link them from a relevant page, or drop them from the sitemap if they are not meant to be found.

Missing <html lang> attribute

The <html lang> attribute tells browsers and screen readers the page language. Add e.g. <html lang="en">.

Multilingual site missing hreflang

hreflang tells search engines which language/region version to show. Add hreflang tags linking your localized pages.

hreflang tags that are not valid

A broken hreflang cluster is ignored in silence — Google does not warn you, it just stops using it, so the tags look present and do nothing. Every code must be a real language (en-GB, not en-UK), every tag needs a URL, and each page you name must name you back.

Missing viewport meta

Without a viewport meta tag, pages don’t scale on phones — hurting mobile usability and rankings. Add <meta name="viewport" content="width=device-width, initial-scale=1">.

Tap targets too small / too close

Small or crowded tap targets are hard to hit on touch screens. Make buttons/links at least ~48px and space them out.

Measured on your homepage with Google PageSpeed Insights.

Text too small to read

Text under ~12px is hard to read on phones and forces zooming. Use a legible base font size (16px is a good default) for body copy.

Measured on your homepage with Google PageSpeed Insights.

Buttons without accessible name

Buttons without an accessible name can’t be used by assistive tech. Add visible text or an aria-label.

Measured on your homepage with Google PageSpeed Insights.

Duplicate IDs on ARIA-referenced elements

Duplicate element IDs break ARIA references and scripting. Make every id unique on the page.

Measured on your homepage with Google PageSpeed Insights.

Form fields that block pasting

Blocking paste breaks password managers and makes forms harder for anyone using assistive tools, and it adds no security. Remove the paste handler from those fields.

Measured on your homepage with Google PageSpeed Insights.

Form inputs without labels

Inputs without labels are unusable with screen readers. Associate a <label> (or aria-label) with every field.

Heading levels skipped

Skipping heading levels (e.g. h1 straight to h3) confuses screen readers and weakens content structure. Use headings in order.

Links without accessible name

Links without discernible text are useless to screen-reader users. Give every link meaningful text or an aria-label.

Measured on your homepage with Google PageSpeed Insights.

Low Lighthouse Accessibility score

A low accessibility score means real barriers for disabled users (and legal risk). Address the flagged contrast, label and ARIA issues.

Measured on your homepage with Google PageSpeed Insights.

Low text contrast (WCAG AA fail)

Low-contrast text fails WCAG AA and is hard to read. Increase the contrast between text and background.

Measured on your homepage with Google PageSpeed Insights.

No skip-navigation / landmarks

Without skip links or landmarks, keyboard users must tab through everything. Add a skip-to-content link and semantic landmarks.

Measured on your homepage with Google PageSpeed Insights.

Page uses meta refresh redirect

Meta-refresh redirects are slow and bad for SEO and accessibility. Use a server-side 301 redirect instead.

Measured on your homepage with Google PageSpeed Insights.

JSON-LD failed to parse

Structured data that fails to parse can’t earn rich results. Fix the JSON-LD syntax and validate it.

Missing structured data (JSON-LD)

Structured data (JSON-LD) can earn rich results (stars, FAQs, breadcrumbs) that stand out in search. Add schema.org markup relevant to the page.

Structured data missing recommended properties

The markup qualifies for a rich result, but Google uses these properties to make it fuller and show it more often (an image, an author, opening hours, a brand). Add the ones that apply to your content.

Structured data missing required properties

Google shows no rich result for markup that lacks a required property, and lists the page as invalid in Search Console. Fill in the properties named — usually a field left empty in your SEO or e-commerce plugin, or a theme template — then test the page with Google’s Rich Results Test.