Technical SEO checklist: sitemap, robots, canonicals, redirects

Technical SEO is the unglamorous half. No writing, no design, nothing a visitor notices. It is the set of things that are either right or wrong, and when one is wrong the site can be invisible to Google no matter how good the pages are. This is the checklist we run at launch and again every quarter.

Indexing

The site is allowed to be indexed. No noindex on pages that should rank, no “discourage search engines” setting left on from staging, no robots.txt blocking everything. The first thing to check after any redesign, because it is the first thing that goes wrong.

A sitemap exists and is submitted. Lists every page that should rank, updates itself when pages change, and is submitted in Search Console. Most platforms generate one. Check that it contains the right pages and not the wrong ones: no tag archives, no author pages, no drafts.

robots.txt is sane. It should block admin and private areas and point at the sitemap. It should not block CSS, JavaScript or images, which Google needs to render the page.

One address per page

Canonicals. Every page declares its own preferred address in a canonical tag, so the version with tracking parameters, the version with a trailing slash and the version reached through a filter all count as one page. Most platforms do this by default; custom sites often forget.

One version of the domain. With www or without, https always. The other three combinations redirect to the one. Test all four.

Redirects that are permanent and single-hop. Every old address, from any previous version of the site, sends a 301 straight to its current equivalent. No chains, no redirects to the homepage, no 302s left over from a “temporary” change two years ago. Search Console’s Pages report will list every address it cannot find.

Speed and rendering

Core Web Vitals in the green, or at least out of the red, on mobile. Server response under half a second, images sized and in modern formats, no render-blocking scripts that are not needed.

Google can render the page. The address inspection tool shows the page as Google sees it. If content depends on JavaScript that fails for crawlers, it does not exist for ranking.

Mobile is the full site. Google indexes the mobile version. Content hidden on mobile is hidden from ranking.

Structure

One H1 per page that says what the page is, then a sensible order of H2 and H3. Not for the search engine’s benefit alone; it is what makes the page readable.

Internal links. Every important page reachable within three clicks of the homepage, linked from relevant text on other pages, not only the menu. Orphan pages, ones nothing links to, rarely rank.

Clean addresses. Short, readable, with words rather than IDs, and stable. Changing addresses is the single biggest cause of lost rankings, so choose them once.

Trust and metadata

HTTPS everywhere, with a valid certificate that renews itself and HSTS sent.

Titles and descriptions unique and specific on every page.

Structured data where it applies: Organization or LocalBusiness on the site, Article on guides, Product on products, BreadcrumbList on deep pages. Validated with Google’s rich results test, because invalid schema is ignored.

No security warnings. A site flagged by Safe Browsing loses its visitors and its rankings together.

Housekeeping

Broken links found and fixed quarterly, internal and outbound.

Thin and duplicate pages removed or consolidated. Ten short pages about the same thing rank worse than one good one.

Search Console read monthly so the next broken item is found by you, not by a drop in traffic.

Our scanner covers the outward-facing half of this list in one pass: HTTPS, redirects, robots and sitemap presence, canonical, title and description, headings, schema, speed signals. It will not fix anything, but it shows in ten seconds which lines of this checklist need a look.