A WordPress SEO audit answers one simple question: what is stopping your pages from being crawled, indexed and ranked well, and what should you fix first? This guide gives you the six-step method, the free tools that are enough for most sites, the WordPress-specific mistakes that turn up in almost every audit, and a grid that turns the list of issues into an action plan.
This article covers the diagnosis. For the optimisation work itself, see our practical guide to optimising WordPress SEO. For a whole-site review (security, backups, performance, maintenance), see how to audit a WordPress site in 12 points.
What an SEO audit should deliver
A score out of 100 from a tool is not an audit. The useful output is a list of confirmed issues, each with the URLs involved, its likely effect on traffic, the effort needed to fix it and the person in charge. A good audit also answers what the tool cannot know: which pages matter to your business, and which ones could drop out of the index without any loss.
- Before you start: list the 10 to 20 pages that bring in money (sales, leads, sign-ups) and the queries you target. They are your common thread.
- Baseline: export clicks and impressions for the last 3 and 12 months from Search Console, so you can measure the effect of your fixes.
- Access you need: a WordPress administrator account, Search Console, ideally SFTP or SSH and the server logs.
The tools you need, mostly free
| Tool | What it reveals | Price | Step |
|---|---|---|---|
| Google Search Console | Indexed or excluded pages and why, queries, Core Web Vitals, security issues | Free | 1, 3, 4, 6 |
| Crawler (Screaming Frog SEO Spider) | 404 errors, redirects, title tags, canonicals, page depth | Free up to 500 URLs, licence £199 a year | 2, 5 |
| PageSpeed Insights | Core Web Vitals measured on real visitors and page diagnostics | Free | 3 |
site: search in Google | Unexpected pages in the index, titles shown | Free | 1, 6 |
| Your SEO plugin and WP-CLI | Title templates, indexed archives, content inventory | Free | 2, 4 |
The six steps of the audit
Order matters: there is no point polishing the content of a page Google cannot index. Each step builds on the previous one.
Step 1: indexing
- In Settings, Reading, the box “Discourage search engines from indexing this site” must be unticked. It is the most expensive mistake after going live from a staging site.
- Open
/robots.txt: noDisallow: /line, and the URL of your sitemap is listed. - Search Console, “Pages” report: read every exclusion reason. “Crawled, currently not indexed” on important pages often means content judged too thin or duplicated.
- Compare the number of indexed pages with the number of pages you actually want in Google. A large gap either way is the first topic of the audit.
Step 2: technical crawl
Run a crawler on the HTTPS version of the site. Note the 404 errors linked from your pages, redirect chains, noindex pages listed in the sitemap, canonical tags pointing elsewhere, and the URL variants that still respond (with and without www, with and without a trailing slash). On WordPress, look closely at tag, date and author archives and at attachment pages: they produce lots of nearly empty pages.
Step 3: performance and Core Web Vitals
Google measures three Core Web Vitals on real visits, at the 75th percentile: LCP (rendering of the largest element) should stay under 2.5 seconds, INP (responsiveness) under 200 milliseconds and CLS (layout stability) under 0.1. In Search Console, the report groups pages by template: a poor score on “post” almost always comes from the theme, a heavy header image or a third-party script, not from one particular post. Images are the most common cause of a slow LCP (see the best plugins to optimise images).
Step 4: content and search intent
- Cannibalisation: in the Performance report, filter on an important query and open the Pages tab. If several pages take turns, merge them or give each a distinct intent.
- Titles and descriptions: duplicates, truncated titles, SEO plugin templates left on their defaults.
- Thin content: pages of a few lines, categories without text, outdated posts. Update, merge or remove from the index.
- Structure: one H1 per page and heading tags without skipped levels. Some themes put the site name in an H1 on every page.
Step 5: internal linking
The crawler shows the depth of each page (clicks from the home page) and the pages that receive no internal link at all. An important page more than three clicks deep, or orphaned, gets little attention. Check your anchor texts too: “click here” helps neither visitors nor search engines. Our definition of internal linking covers good practice in detail.
Step 6: security and trust
This step is missing from most audits, yet a hacked site can lose its traffic within days. Check the Search Console “Security issues” report, make sure there are no spam pages in the index (site: searches with words such as casino or viagra), and check the HTTP to HTTPS redirect, mixed content and security headers. If in doubt, follow our guide to detecting whether a WordPress site has been hacked; the effects of a hack on rankings are covered in SEO spam and deindexing.
Prioritise with an impact and effort grid
An audit often produces more than a hundred findings. Rank them by their effect on the pages that make money and by the time needed to fix them.
| Finding | Impact | Effort | Decision |
|---|---|---|---|
| Site or section set to noindex by mistake | Critical | Minutes | Fix today |
| Injected spam pages in the index | Critical | Days | Clean up, then request a review |
| Two pages competing for the same query | High | Hours | Merge with a 301 redirect |
| Slow LCP on the post template | High | Hours to days | Fix the template, not each page |
| Tag archives indexed | Medium | Minutes | Set to noindex |
| Missing alt text | Low to medium | Variable | Handle as content gets updated |
WordPress mistakes found in almost every audit
- Two SEO plugins active: two title tags, two sitemaps, conflicting canonicals. Keep only one.
- Attachment pages indexed: on sites installed before WordPress 6.4, every image may have its own empty page. Redirect them to the file or to the parent content.
- Author archives on a single-author site: a duplicate of the blog page that also shows the login name in its URL.
- URLs changed without a redirect after a permalink or title change.
- Multi-megabyte images uploaded straight from the camera.
- Indexed staging site: a test subdomain visible in Google as duplicate content.
How often to repeat the audit
One full audit a year is enough for most sites, plus a targeted audit after a migration, a theme change or a sudden traffic drop. In between, a fifteen-minute monthly check in Search Console (excluded pages, Core Web Vitals, security issues) catches regressions early. To track your rankings between audits, our comparison of rank tracking tools can help.
What WP Masquerade adds to the security step
WP Masquerade is not an SEO tool. It works on step 6: the free version removes WordPress traces and closes the doors bots test, without touching your page URLs or content (hiding WordPress has no negative SEO effect). Pro warns you when an installed plugin has a known vulnerability, checks every day that core files have not been modified and adds security headers: three points an SEO audit rarely covers, but which protect your traffic.
Frequently asked questions
How long does a WordPress SEO audit take?
For a site under 500 pages, allow one to two days with free tools, including writing the action plan. A site with several thousand pages or an online store takes longer, especially for the content analysis.
Can you do an SEO audit without paid tools?
Yes. Search Console, PageSpeed Insights, the free version of Screaming Frog (500 URLs) and the site: search cover all six steps for a small site.
Is my SEO plugin’s score enough?
No. It rates one page at a time on simple criteria (keyword, length). It sees neither indexing, nor duplicates between pages, nor real-world performance, nor a hack.
Should tag archives be noindexed?
Usually yes, unless a tag has a real introduction text and gets traffic. Check in Search Console before deciding.
Key takeaways
- Audit in order: indexing, crawl, performance, content, internal links, security.
- Search Console, a crawler and PageSpeed Insights are enough for most sites.
- The deliverable is an action plan ranked by impact and effort, not a score.
- On WordPress, watch archives, attachment pages and duplicate SEO plugins.
- Always add a security check: a hack wipes out months of SEO work.
Protect the traffic you have built
WP Masquerade reduces for free what bots can see of your WordPress site. Pro warns you about known vulnerabilities in your plugins and about modified core files, from €59 a year excl. VAT.
Sources
- Search Console Help: Page indexing report (external link, opens in a new tab)
- web.dev: Core Web Vitals (external link, opens in a new tab)
- Screaming Frog: SEO Spider pricing (external link, opens in a new tab)
- Google Search Central: SEO Starter Guide (external link, opens in a new tab)
