Technical SEO: a verifiable audit protocol for a website’s foundations

Calling a page “SEO-friendly” hides the stage that failed. A URL may be discovered but blocked, crawled but rendered without critical content, indexed under another canonical, or indexed without being selected for a query. Diagnosis starts by locating that break.

The number of checks varies with risk: a symmetrical table must not dictate the audit. The public JSON dataset v1.1 is the canonical source for identifiers, methods, evidence, sources and limitations. The indexable HTML table and XLSX workbook are generated from it.

Identifiers TS01 through TS44 remain stable between versions. Cite a precise check with its fragment, for example #TS41.

This table is generated from the same JSON source as the workbook. Each row publishes the method, expected evidence, required access, default severity, primary source and explicit limitation. A consumer can therefore cite or replay one check without inferring the rest of the protocol.

A HEAD request alone is insufficient: a CDN, firewall or application can treat HEAD and GET differently. Record the final status, redirect count, effective URL and duration. Replay at least the canonical URL, an old URL, a removed resource and a nonexistent URL.

Disallow asks a compliant crawler not to crawl a path. It does not guarantee that the URL disappears from results. A noindex directive must be read in HTML or an HTTP header; if robots.txt blocks the resource, the crawler may never see it. Confidential data must be denied by server-side authentication and authorisation.

This corrects a common recommendation: combining noindex with Disallow does not automatically strengthen exclusion. It can prevent the noindex from being read. Google’s robots directives documentation and RFC 9309 define these boundaries.

Google describes redirects and rel="canonical" as strong canonicalisation signals, and sitemap inclusion as weaker. Signals reinforce one another when they converge. They do not turn the declared canonical into an absolute order: the engine may select another URL.

The public check compares final URL, declared canonical, sitemap and internal links. The private check then compares user-declared and Google-selected canonicals in URL Inspection. Without that second step, the audit can conclude only that the declaration is coherent.

Include only absolute, indexable candidate canonicals that return the intended status. A lastmod value must describe a meaningful page modification, not the time at which the sitemap was regenerated. Google ignores priority and changefreq; they must not become project KPIs.

Compare the sitemap against the crawler, CMS and analytics inventory. Gaps reveal orphan candidates, obsolete URLs, parameter spaces or pages accidentally excluded from navigation.

A visual click handler is not necessarily a crawlable link. Critical navigation should expose an <a href> destination in server-delivered or reliably rendered HTML. Compare the URL sets from internal crawl, sitemap and CMS to identify orphan pages and false depth.

Depth is not a universal ranking factor. It is an operational signal: if an important page requires many interactions, agents and users may struggle to discover it, and changes to upstream navigation carry disproportionate risk.

Inventory query parameters and classify them by function: content selection, filtering, sorting, tracking, pagination or session state. For every family, document whether it may be crawled, indexed, canonicalised, redirected or ignored. Apply the same discipline to host, protocol, case, duplicate slashes and trailing slash.

A rule that “removes parameters” without distinguishing their meaning can delete valid content states. A rule that keeps every combination can create an effectively unbounded crawl space.

Each locale URL should identify itself and its valid alternates with supported language or language-region codes. Alternates must be reciprocal and resolve to indexable candidate canonicals. Do not mix incomplete HTML, HTTP and sitemap declarations without a reconciliation process.

Automatic redirects based solely on IP or Accept-Language can prevent crawlers and users from reaching every locale. Provide stable URLs and an explicit language switch.

Critical content, links, title, canonical and structured data should be compared across the server response and rendered output. Record failed resources and console errors. A client-rendered page can be indexable; a server-rendered page can still hide its substance behind interaction. The evidence is in the output, not the framework label.

One descriptive title and H1, a coherent heading hierarchy, landmarks, native links and useful alternative text make the document easier to interpret across consumers. This does not guarantee ranking. It removes ambiguity and reduces dependence on consumer-specific heuristics.

Validate the rendered document, not only the source. Duplicate IDs, interactive elements nested incorrectly and links without destinations often appear after components are composed.

Parse every JSON-LD block, merge the graph by @id and compare important properties against visible content. Syntax validity is only the first gate. A technically valid rating that is not visible, a duplicated organisation with conflicting names, or a FAQ that does not exist in the page creates a semantic defect.

Google’s rich-result rules are product eligibility rules, not a complete Schema.org validator and not a ranking guarantee. Keep the broader entity graph coherent even when no rich result is available.

Verify the certificate chain, expiry, supported hostnames, mixed content and HSTS policy. Replay HTTP/HTTPS, www/non-www, case and slash variants. At the edge, compare cache status, redirects, Vary, locale behaviour and robot-specific responses. A correct origin response does not prove that the CDN serves the same result.

These checks are deliberately grouped because migrations often change several layers at once. Evidence must say where the response was observed and which headers were retained.

Turn invariant rules into automated gates: status, redirect budget, indexability, canonical presence, robots accessibility, structured-data syntax, hreflang reciprocity and critical server-rendered content. Store fixture URLs by template and preserve the report as a build artefact.

Automation does not own the release decision. It detects defined regressions. A human still arbitrates context, severity and exceptions, with an owner and expiry date.

Do not infer purpose from a generic “AI bot” label. OpenAI documents different tokens for search, user-triggered visits and training; Anthropic also documents distinct crawlers. Google-Extended is a separate product token and does not replace Googlebot. Record the operator’s documentation URL, policy owner and review date.

Google’s guidance primarily targets very large sites—around one million pages or more with weekly changes—medium or larger sites of roughly ten thousand pages with daily changes, or sites where a significant share remains “Discovered – currently not indexed”. These are reference orders of magnitude, not universal boundaries.

On a fifty-page B2B site, crawl budget often distracts from more plausible causes: orphan pages, contradictory canonicals, weakly differentiated content, broken rendering or missing internal links.

Observation performed on 22 August 2026 from an unauthenticated external connection. This example demonstrates evidence discipline; it is not presented as a complete audit of the entire domain.

The workbook does not compute a score out of 100. An average would dilute a critical defect: 43 successful checks do not compensate for an accidental noindex on the offer page. One failed Blocking check—or an applicable Blocking check left untested—imposes NO-GO; a failed Major check requires documented arbitration.

This article and the Edikka Technical SEO Audit Grid v1.1 are published under CC BY 4.0. Reuse is allowed with attribution to Edikka and this canonical URL. Files are available without a form.