A technical SEO checklist is the list of "plumbing" jobs that must be done before content even matters. It makes sure search engines and AI tools can crawl your pages, read them, and index the right ones. Think robots access, clean indexing, security, tidy URLs, and simple redirects. Get these right and your good content gets a fair chance.
This guide walks the checklist the way our audit scores it. We go in order: crawlability, indexing, duplicates, security, URLs, redirects, and one fast-publishing trick. Each item has a plain-English "why" and an exact pass condition you can hand to a developer.
What does technical SEO mean (and what changed for AI)?
Technical SEO is the health of your website's foundation. It decides whether search engines and AI systems can reach your site, read it, and index the right pages at all. If this layer is broken, nothing else you do can save you.
Here is the AI-era twist. The same plumbing now serves AI crawlers too. Tools like ChatGPT and Perplexity send out bots to read the web. But those bots are stricter than Google. Most do not run JavaScript, and they spend less time per site. So a clean, simple setup matters more than ever.
One framing helps. Most of this checklist is the same timeless work SEO always needed. The AI era did not replace it. It just raised the stakes, because a second set of stricter readers now depends on it.
Crawlability: can robots get in and find everything?
Crawlability means automated visitors can enter your site and reach your pages. If they cannot get in, none of your work is seen. This is the first gate.
Start with your robots.txt file. This is a small text file at your site root that tells crawlers where they may go. It should exist, load with a "200 OK" status, and be written correctly. It is a voluntary convention (the RFC 9309 standard), so well-behaved bots honor it. But it is not a lock or a security tool.
Here is the trap to avoid. Your robots.txt must not block your CSS, JavaScript, or image folders. Blocking them is like inviting a guest in but locking the light switches. If Google cannot fetch your CSS and JavaScript, it cannot see the page the way your visitors do.
A few more crawlability checks round this out:
- Sitemap reference. Your robots.txt should include a
Sitemap:line pointing to your sitemap. It is a signpost to your full page list. - Click depth. Every important page should sit within 3 clicks of your homepage. Pages buried at depth 4 or more get less crawl attention and fewer AI citations.
- AI crawler rules. If you set rules for AI bots, make them deliberate. An accidental block is a common, costly mistake.
For the full picture on bots, see our guide to AI crawlers and robots.txt and the deeper walkthrough of XML sitemaps.
Indexability: are the right pages in the index?
Indexability is whether the correct pages end up in the search index. Crawling lets a bot read a page. Indexing decides whether that page can ever appear in results. You want your good pages in, and your junk pages out.
Every page you want found needs a self-referencing canonical tag. A canonical tag is a hidden note about which address is the official one. For a normal page, that note should point to itself. It helps engines pick the right URL when copies exist. Note that it is a strong hint, not a hard command. Google can still pick a different one. Our canonical tags guide covers the details.
Watch for two indexing errors that quietly hurt you:
- Canonical chains. Page A points to B, which points to C. Flatten it so A points straight to C. Chains confuse engines.
- Accidental noindex. A "noindex" tag tells engines to leave a page out of the index. One stray tag can silently remove a key page from Google and from AI answers. Use it only on pages you truly want hidden, like a thank-you page.
Never put both a canonical tag and a noindex tag on the same page. That sends two contradictory instructions. Engines then resolve the conflict in unpredictable ways. Our guide on when to use noindex explains the safe cases.
Duplicate content: one page, one address
Duplicate content means the same page is reachable at more than one web address. Engines then see two copies and split your ranking strength between them. The goal is simple: one page, one address.
Most duplicates come from a few common forks. Check each one:
| Duplicate trap | The problem | The fix |
|---|---|---|
| www vs non-www | Both www.site.com and site.com load |
Pick one, 301-redirect the other to it |
| HTTP vs HTTPS | The old insecure version still loads | Force HTTPS with a 301 redirect |
| Trailing slash | /page and /page/ both return "200 OK" |
Pick one style, redirect the other |
| URL parameters | ?sort=price creates indexable copies |
Canonical to the clean URL or block the pattern |
If both www and the bare domain load, engines see two separate websites. That is the most common version of this problem. Our guide to finding and fixing duplicate content covers the rest.
Thin content and index bloat: stop feeding robots junk
Thin content is a page with almost nothing on it. Picture a headline and two sentences pretending to be a real page. Index bloat is having far more indexed pages than you have real content. Both waste a crawler's limited attention.
For thin pages, you have two clean options. Expand the page into something genuinely useful. Or merge it into a stronger page and redirect the old address. Our thin content guide shows how to decide.
Index bloat usually comes from auto-generated filler. Think date archives, tag pages, and every filter combination on a shop. Crawlers spend a fixed amount of attention per site. Filler pages burn that attention and dilute how good your site looks. The fix is to add noindex to those archive, tag, and filter pages. Keep your sitemap to valuable pages only. See crawl budget and index bloat for the full method.
Pagination: don't hide page 7 of your catalog
Pagination is how you split a long list across numbered pages. The risk is simple. If a crawler cannot reach page 7, it never finds the items listed there. So deeper pages must stay reachable.
Each list page needs its own real web address. It also needs plain HTML links to the next and previous pages. If your deeper pages only appear when a visitor scrolls in a browser, crawlers never see them. They cannot scroll.
A quick note on an old tag. Google dropped support for the rel="next" and rel="prev" tags back in 2019. But Bing still uses them. That matters more now, because Bing's index feeds ChatGPT and Microsoft Copilot. Keep paginated pages out of "noindex" if they hold unique items. Our pagination guide covers the safe setup.
HTTPS and security headers: the trust layer
HTTPS is the secure, encrypted version of your website (the padlock in the address bar). It is the single heaviest security item in our audit. It is also a baseline trust signal for both Google and AI tools.
To pass, you need three things:
- A valid, unexpired security certificate.
- Every HTTP address 301-redirecting to its HTTPS version.
- No "mixed content" — no insecure files loading on a secure page.
On top of HTTPS, a set of security headers tells browsers how to handle your site safely. These are short lines of code your server sends. None are hard to add. Together they signal a professionally run, trustworthy site.
| Security header | What it does, in plain terms |
|---|---|
| HSTS | Says "never connect to me insecurely for a year" |
| Content-Security-Policy | The most substantial one; limits what code can run |
| X-Content-Type-Options | Stops browsers from guessing file types |
| X-Frame-Options | Blocks others from framing your site (clickjacking) |
| Referrer-Policy | Protects your visitors' privacy across sites |
| Permissions-Policy | Turns off unused camera, mic, and location access |
HSTS preload is an optional extra. It is polish that mostly banks pursue, so skip it unless you need it. For the full setup, see our guides to HTTPS and SEO and security headers.
URLs: addresses people and machines can read
A clean URL is a web address a human can read and understand. Compare /blog/seo-guide with /p?id=8372&s=xK2. The first one tells you what the page is about. Clean addresses signal the topic and earn more clicks in results.
Use this short URL checklist:
- Descriptive slugs. Lowercase words, separated by hyphens. No session IDs, no underscores, no encoded spaces.
- Logical folders. Mirror your site structure, like
/services/accounting/payroll. Stay shallow — 2 or 3 levels is plenty. - Reasonable length. Flag and shorten any URL over 100 characters.
- One slash style. Pick a trailing-slash convention and use it site-wide.
Our SEO-friendly URLs guide has more examples to copy.
Redirects: forward once, permanently
A redirect forwards an old web address to a new one. Picture mail forwarded between apartments. You want it to arrive in one clean hop, every time. Two rules cover almost everything.
First, forward in a single hop. If an old URL points to another redirect, which points to a third, you have a chain. Each extra hop leaks ranking credit and slows crawlers. A loop breaks access entirely. Send the old address straight to its final home.
Second, use the right type. A 301 is a permanent forwarding notice. A 302 is a temporary one. For permanent moves, always use 301. With a 302, engines assume the move is temporary and do not transfer the old page's earned ranking credit. Our 301 vs 302 guide explains when each fits.
IndexNow: the doorbell that gets you indexed faster
IndexNow is a protocol that pings search engines the moment you publish or change a page. Instead of waiting for a crawler to drop by, you ring the doorbell. It is the most AI-relevant item on this list.
Here is why it matters now. ChatGPT's web search and Microsoft Copilot both answer from Bing's index. IndexNow gets your new content into that index almost instantly. So fresh pages can reach AI tools faster. One caveat: Google does not take part. The engines that do include Bing, Yandex, Seznam, and Naver.
Three checks confirm IndexNow is set up right:
- Protocol supported. Your site can send IndexNow pings.
- Key file hosted. A
{key}.txtfile sits at your site root. It proves the pings really come from you. Without it, submissions get rejected. - Submissions firing. Pings actually go out when you publish. A configured-but-dormant setup delivers none of the benefit.
The easiest route is a plugin in your CMS (your content management system, like WordPress). Our guide on what IndexNow is covers setup.
The technical SEO checklist, by severity
Here is the whole list on one screen. It is ordered by how much damage each item can do, worst first. Fix from the top down.
| # | Check | Pass condition |
|---|---|---|
| 1 | No blanket disallow | robots.txt does not block the whole site or CSS/JS |
| 2 | No accidental noindex | No key page carries a stray "noindex" tag |
| 3 | HTTPS enforced | Valid certificate; HTTP 301s to HTTPS; no mixed content |
| 4 | Canonicals correct | Self-referencing tag; no chains; never paired with noindex |
| 5 | No duplicate addresses | www, HTTPS, and slash style all resolve to one version |
| 6 | Redirects clean | One hop, no loops; 301 for permanent moves |
| 7 | Security headers set | HSTS, CSP, and the rest are present |
| 8 | URLs readable | Short, lowercase, hyphenated, shallow folders |
| 9 | Pagination crawlable | Each list page has a real URL and HTML links |
| 10 | IndexNow active | Key file hosted; pings fire on publish |
This list maps to how an audit grades the plumbing. To see how that scoring works end to end, read how an AI-visibility audit works. For the bigger AI picture, start with what GEO is.
A note for sites built on JavaScript: most AI crawlers cannot run it. So they may see a blank page where your content should be. The fix is server-side rendering, covered in can AI crawlers see your JavaScript website?.
Frequently asked questions
What is a technical SEO audit? A technical SEO audit is a structured check of your site's foundation. It tests crawlability, indexing, security, URL quality, and redirects. The output is a pass/fail list of fixes. It does not judge your writing or design. It only checks whether engines and AI tools can read and index your pages.
Which technical SEO item should I fix first? Start with the catastrophic ones. First, make sure nothing blocks crawlers in robots.txt. Second, check that no key page has a stray "noindex" tag. Either one can hide your whole site. After that, confirm HTTPS, then clean up canonicals and duplicates.
Do AI crawlers care about technical SEO? Yes, often more than Google does. Most AI bots do not run JavaScript and spend less time per site. So a clean, fast, simple setup matters more for them. If a bot cannot read your page, it can never quote you in an answer.
How often should I run a technical SEO checklist? Run a full pass after any big site change, like a redesign or migration. Otherwise, a quarterly check is a sensible rhythm. Things drift over time. A stray redirect or a blocked folder can creep in without anyone noticing.
The bottom line
Technical SEO is the plumbing under everything else. It decides whether engines and AI tools can crawl your site, read it, and index the right pages. None of it is glamorous. All of it has to be true before your content gets a fair shot.
Work the list in order of damage: crawl access first, indexing next, then security, URLs, redirects, and faster indexing last. Our visibility audit runs 80+ technical checks across both the SEO and AI scorecards. Every item in this checklist maps to a named pass/fail check with evidence, so your developer gets a fix list, not a lecture.
The first step is seeing where you stand. Run a free visibility audit to get your technical score and the fixes that move it most.