SEO Audit Hub

WordPress SEO audit

Every technical SEO check, plus the mistakes WordPress in particular makes easy to leave in place.

  • No sign-up to start
  • 141 checks for WordPress
  • 500 pages free

WordPress SEO audit: what’s checked

WordPress handles a lot of SEO basics well, but themes and plugins add their own problems: extra archive and tag pages, admin and core paths reachable from search, and a pile of scripts and styles on every page.

Choose the WordPress profile and the audit runs every generic check — including thin and duplicate content wherever it comes from — plus WordPress-specific ones.

3 Platform-specific Checks that apply only to the platform this site runs on, covering the mistakes that platform makes easy to leave in place.

  • WordPress /wp-includes/ in crawl

    A crawlable /wp-includes/ exposes internals and wastes crawl budget. Block it in robots.txt.

  • WordPress admin reachable

    A publicly reachable/indexed WordPress admin invites brute-force attacks. Restrict wp-admin and keep it out of search results.

  • xmlrpc.php publicly accessible

    An open xmlrpc.php is a common brute-force and DDoS vector. Disable it if unused.

14 Crawling & indexing Pages have to be crawled and indexed before they can rank at all. These checks cover the files, canonicals and directives that tell search engines what they may fetch and keep.

  • Broken canonical tag

    A canonical tag pointing to a broken or wrong URL can deindex the page. Point it at the correct, reachable preferred URL.

  • Canonical tags chained through another page

    Google does not follow canonical tags from one page to the next -- a chained canonical is treated as a weak hint and it picks its own winner instead, so the consolidation you set up is forfeited. Point every canonical straight at the final URL.

  • Missing canonical tag

    A canonical tag tells search engines which URL is the “real” one when several are similar. Add <link rel="canonical"> to avoid duplicate-content dilution.

  • Missing robots.txt

    robots.txt tells crawlers what they may access. Add one (even an allow-all) and point it at your sitemap.

  • Page blocked by robots.txt

    Googlebot won’t crawl this page, so its content can’t rank — and a noindex on it is never seen. If the page should be found, remove or narrow the Disallow rule shown; if it’s meant to be private, stop linking to it and keep it out of the sitemap. Test the rule in Search Console’s robots.txt report.

  • Page set to noindex

    This page tells search engines not to index it, so it can’t rank. If that’s unintended, remove the noindex directive.

  • Pages buried too deep

    Pages many clicks from the homepage get crawled and ranked less. Flatten your structure and link to deep pages.

  • SEO-unfriendly URLs

    Long, parameter-heavy URLs are harder for users and search engines to parse. Use short, readable, keyword-relevant paths.

  • Scripts or CSS blocked by robots.txt

    Google renders pages with their CSS and JavaScript. Blocked files can make a page look broken or empty to it. Remove the Disallow rules that cover theme, plugin or asset folders; there’s no SEO reason to hide scripts and stylesheets.

  • Sitemap URLs blocked by robots.txt

    The sitemap asks Google to crawl URLs that robots.txt forbids, which Search Console reports as “Submitted URL blocked by robots.txt”. Either take those URLs out of the sitemap or stop blocking them.

  • Soft 404 (server returns 200 for missing URLs)

    Returning HTTP 200 for missing pages makes search engines index empty pages. Serve a real 404 status for URLs that don’t exist.

  • robots.txt doesn’t name a sitemap

    Add a line like “Sitemap: https://example.com/sitemap.xml” to robots.txt. Every crawler reads robots.txt first, so this is how Bing and others find your sitemap without a manual submission.

  • robots.txt malformed

    A malformed robots.txt can accidentally block your whole site. Validate it and confirm it isn’t disallowing important paths.

  • www / apex not canonicalized

    Serving both www and non-www without redirecting splits your ranking signals. Pick one and 301-redirect the other.

10 Titles & meta tags Titles and descriptions are what a searcher sees in the results, and the first thing a search engine reads. These checks make sure each page describes itself once, clearly and uniquely.

  • Duplicate titles

    When pages share a title, search engines can’t tell them apart and may rank the wrong one. Make each title unique to the page’s content.

  • Meta description too long (over 160)

    Descriptions over ~160 characters get truncated in search results. Trim to the key selling point.

  • Meta description too short (under 70)

    Very short descriptions waste the chance to earn the click. Expand to a compelling 120–160 characters.

  • Missing <title>

    The <title> is the clickable headline in search results and the strongest on-page signal. Give every page a unique, descriptive title of 50–60 characters.

  • Missing Open Graph tags

    Open Graph tags control how your page looks when shared on social media. Add og:title, og:description and og:image for attractive link previews.

  • Missing Twitter Card tags

    Twitter Card tags control how links look on X/Twitter. Add twitter:card and related tags for rich previews.

  • Missing meta description

    The meta description is the snippet under your title in search results. A compelling 120–160 character summary improves click-through even though it isn’t a direct ranking factor.

  • Title and <h1> are identical

    The title and the <h1> are two chances to describe the page, not one. Write the title for the search result and the <h1> for the reader who has just arrived.

  • Title may be cut off in search results

    Google shows about 600px of a title — roughly 55–65 characters, depending on the letters — and cuts off the rest. Lead with the words that matter so the visible part still makes sense, or shorten it.

  • Title too short (under 30 chars)

    Very short titles waste your biggest ranking signal. Expand to a descriptive 50–60 characters.

9 JavaScript & CSS Script and stylesheet files are downloaded and parsed before a page can finish rendering. These checks find the ones that are unnecessary, unminified or broken.

  • Deprecated browser APIs in use

    Deprecated APIs keep working until the browser removes them, and then the feature built on them breaks without warning. Update the script or library that calls them.

    Measured on your homepage with Google PageSpeed Insights.

  • Errors in the browser console

    Console errors usually mean a script failed — a broken widget, a blocked request, a missing file. If the failing script renders content or links, Google may not see them either. Open the page with the browser console open and fix what it reports.

    Measured on your homepage with Google PageSpeed Insights.

  • Heavy inline CSS

    Large blocks of inline CSS can’t be cached and bloat every page. Move styles into external, cacheable stylesheets.

  • Heavy inline JavaScript

    Large inline scripts block rendering and can’t be cached. Move JavaScript to external, deferred files.

  • Images, scripts or stylesheets that fail to load

    The page asks for these files and the server does not deliver them. A missing image leaves a visible hole; a missing stylesheet or script can leave the page unstyled or half-working, and a crawler that cannot fetch your CSS judges the layout on markup alone. Fix the path or remove the reference.

  • Legacy / over-transpiled JavaScript

    Shipping transpiled ES5 to modern browsers wastes bytes. Serve modern JavaScript to capable browsers.

    Measured on your homepage with Google PageSpeed Insights.

  • Unminified CSS

    Unminified CSS ships extra bytes. Minify stylesheets in your build.

    Measured on your homepage with Google PageSpeed Insights.

  • Unminified JavaScript

    Unminified JavaScript ships extra bytes and slows parsing. Minify scripts in your build.

    Measured on your homepage with Google PageSpeed Insights.

  • Unused CSS rules

    Unused CSS forces browsers to download and parse styles that never apply. Remove dead CSS or split it per template.

    Measured on your homepage with Google PageSpeed Insights.

How it works

  1. 1

    Enter your URL

    Paste your homepage. No account, no install, no verification.

  2. 2

    We crawl your site

    The crawler follows your internal links and runs every check against each page it reaches.

  3. 3

    Get your results

    See your score and issue counts at once. A free account shows every finding, page by page, with how to fix it.

Frequently asked questions

Do I need to install a plugin?

No. The audit crawls your public site from outside, like a search engine, so there is nothing to install and nothing to give access to.

Does it work with Yoast, Rank Math or All in One SEO?

Yes — it checks what those plugins output (titles, descriptions, canonicals, sitemaps, schema) on the live pages, whichever plugin you use.

What WordPress-specific issues does it find?

Things like a publicly reachable wp-admin, /wp-includes/ files appearing in the crawl, and an exposed xmlrpc.php — alongside the generic checks every site gets.

Related free tools

Website SEO audit → Crawl your whole site and get a health score, every issue ranked by impact, and a report you can act on — in minutes. Shopify SEO audit → Audit your Shopify store’s products and collections — and the SEO problems Shopify themes and apps leave behind. Website security checker → Check your HTTPS setup, certificate and security headers — and find anything still served insecurely.

Ready to check your site?

It takes a couple of minutes and costs nothing.