Technical SEO Checklist 2026: 105 Checks for AI Search

Most technical SEO checklists still audit for one reader. That reader is Googlebot. But your pages now get judged by a second group as well, and that group behaves nothing like a search crawler. GPTBot, OAI-SearchBot, PerplexityBot and ClaudeBot arrive with less patience, weaker rendering and different goals. Some of them never arrive at all, yet still quote you. This checklist covers all 105 checks we run on client sites, split across 18 categories. Every item tells you why it matters and how to check it, so you can hand the list straight to a developer.

The shift nobody has priced in yet is this: AI systems are not simply crawlers you allow or block, they are users who have to read your page, render it, and increasingly act on it.

Key Takeaways

• 105 checks, 18 categories, 4 priority levels. Every item states why it matters and exactly how to check it.
• Fix these four first: the four-variant redirect test on a deep URL, the filetype: search for exposed documents, each AI user agent line in robots.txt, and your crawled-but-not-indexed ratio. Under an hour combined.
• Ten things here appear in no other published technical SEO checklist we audited, including the log file method for finding rendering gaps, accessibility tree testing, agent commerce readiness, and why you get cited by bots that never visit you.
• llms.txt is not robots.txt for AI. Three widely-shared checklists get this wrong. Add it if you want, but do not count it as strategy.
• Do not noindex thin pages. Noindex still leaves them crawled and still counted in sitewide quality. Remove them or improve them.
• Short on time? The 47-item version for small sites is near the end, and it covers roughly 90% of the risk.

What Is a Technical SEO Checklist and Who Needs One

A technical SEO checklist is a repeatable list of infrastructure checks that confirm search engines and AI systems can reach, read, render and trust your website. It sits underneath content and links. When it breaks, nothing above it works.

You need one in four situations. First, before a migration or replatform. Second, when organic traffic drops without an obvious content cause. Third, when you inherit a site and have no history on it. Fourth, on a fixed cadence, because technical debt accumulates quietly as a site grows.

Run the full 105 checks quarterly on a large site. On a small brochure site, run the 47-item short version twice a year. Then monitor the critical items monthly.

How This Checklist Is Prioritised

Every check carries one of four labels. Treat them as a work order, not a suggestion.

Setup and Access: The Three Checks That Come First

You cannot audit what you cannot measure. So before anything else, confirm you actually own the data.

Add Bing Webmaster Tools to that list too. It costs ten minutes and it matters more than it used to, because ChatGPT leans on the Bing index for live answers. We cover that properly in our guide to ranking in ChatGPT search.

Crawlability: 12 Checks Before Anything Else Counts

Crawlability is the first prerequisite. Without a crawl there is no index, and without an index there is no ranking and no AI citation. So this section runs before every other section in a real audit.

How Far Crawl Budget Can Actually Move

Crawl budget gets treated as a fixed constraint. It is not. In one case reported by Jairo Guerrero of AirOps, a client site went from roughly 8,000 crawl requests per day to about 1.2 million. The practical effect was that a full-site crawl fell from an estimated thirteen years to around a month.

That is a single practitioner account rather than a published study, so treat the exact figures as directional. The mechanism behind it is not in dispute though. Crawl capacity responds to server speed, internal link structure, response codes and the ratio of useful pages to junk. All four are things you control.

Track the number in the Search Console Crawl Stats report month over month. A flat line while you publish is a warning. A falling line while your URL count grows is the shape that usually precedes a ranking drop.

Why 410 Beats 404 for Injected URLs

This one deserves more than a table row, because almost every other checklist recommends robots.txt or noindex for parameter junk. That advice fails when the URLs were never yours.

A negative SEO attack or a compromised plugin can generate hundreds of thousands of fabricated URLs overnight. In one case we reviewed, a site went from roughly 10,000 known pages to over 500,000 discovered URLs, and rankings fell within days. Blocking those URLs in robots.txt makes it worse. Google can no longer crawl them, so it cannot see that they are gone, and they linger in the index.

Serve 410 Gone instead. A 404 says the page might come back. A 410 says it will not, and Google documents that difference directly. In practice Google drops 410 URLs noticeably faster. Match the injected pattern at server level rather than page by page, because you cannot hand-edit half a million URLs.

Blocking junk URLs in robots.txt is the most common wrong answer in a spam cleanup. You are not hiding the problem from Google, you are hiding the solution.

Indexation: 8 Checks That Decide If You Exist

Crawling gets you read. Indexing gets you eligible. And because AI systems retrieve from search indexes first, an unindexed page cannot be cited even by a chatbot that has never visited your server.

How to Read Your Crawled-But-Not-Indexed Ratio

Most guides tell you to open the GSC Page indexing report. Very few tell you what the number means. Here is the version we use with clients.

Take indexed pages and divide by total known pages. Then band the result.

The reason the low band is a quality problem rather than a crawl problem is worth spelling out. Guerrero describes a client where roughly 80 percent of crawled pages carried no value at all, and the effect was not confined to those pages. It dragged down the whole-site assessment, including the pages that were fine.

The instinct at that point is to noindex the weak pages. Resist it. Noindex removes the page from results but Google still crawls it and still weighs it when judging the site. Deleting or genuinely improving the page is what changes the sitewide picture. We go deeper on this in our programmatic SEO guide, where the problem shows up fastest.

Robots and Directives: 3 Checks With Outsized Consequences

One wrong character in robots.txt can switch off an entire site. This is the shortest section in the checklist and the most dangerous.

The AI User Agents Worth Naming Individually

Blocking AI crawlers is a real business decision, not a default. But most sites block them by accident, through an inherited rule or a security plugin. So check each agent separately, because they do different jobs.

Note the split in that last row. Google-Extended is not Googlebot. Blocking it does not affect your Google Search rankings, which is exactly why so many teams get the decision wrong in both directions.

A Straight Answer on llms.txt

Several checklists now recommend llms.txt as if it were robots.txt for AI. That framing is wrong, and it is worth saying plainly.

llms.txt is a proposed plain-text file listing your key pages for language models. No major AI provider has committed to reading it. Google has said publicly it is not needed. More importantly, it does not match how these systems actually work, because they retrieve through search indexes rather than browsing a directory of your choosing.

Add it if you like. It takes ten minutes and costs nothing. Just do not count it as an AI visibility strategy, and do not let it displace the checks in this list that genuinely move the needle.

Duplicate Content and Canonicals: 5 Checks

Duplicate content rarely arrives as a copy-paste problem. It arrives as an architecture problem, and the fix is usually a redirect rule rather than a rewrite.

The Four-Variant Test Almost Nobody Runs Properly

Here is the check itself, and it takes two minutes. Pick a deep URL, not your home page. A product page or a blog post is ideal. Then request all four of these and record the response.

• http://domain.com/deep-page/
• https://domain.com/deep-page/
• http://www.domain.com/deep-page/
• https://www.domain.com/deep-page/

Three of them should return a single 301 to the fourth. If any of them returns a 200, you have a live duplicate. If any of them returns a chain of two or more redirects, you are leaking crawl budget on every request.

We test the deep URL rather than the home page because home-page-only rules are the single most common miss. A server rule that redirects the root correctly can still pass inner paths through untouched.

Site Architecture and Internal Linking: 8 Checks

Internal links are how discovery actually happens, and they are the cheapest ranking lever most sites still ignore.

Rendering and JavaScript: The Section Most Checklists Skip

Googlebot renders JavaScript. Most AI crawlers do not, or they give up far sooner. So a page that looks complete in your browser can reach an AI system as an empty shell.

The Two-Minute Raw HTML Test

Open the page, then use view-source rather than inspect element. View-source shows what the server sent. Inspect shows what your browser built afterwards.

Now search that raw HTML for your H1, your first paragraph, your price and your primary call to action. If any of them is missing from view-source but visible on screen, JavaScript is producing it. Googlebot will probably still see it. An AI crawler often will not.

The Log File Check That Finds Rendering Gaps

This is the check we have not seen in any competing checklist, and it is the one that finds problems the other 98 items miss.

When a bot fetches a page, it requests the HTML document. If it then also renders, it requests the JavaScript and CSS assets that page depends on. So you can compare the two counts directly in your server logs.

Filter your logs by user agent. Count HTML document requests. Then count requests for the JS bundles those pages load. If a bot fetched a page template 10,000 times but pulled the associated JavaScript only a few hundred times, that bot is not rendering your pages. Whatever your JavaScript produces is invisible to it.

That single ratio tells you whether server-side rendering is a nice-to-have or an emergency. And it is measurable today, with logs you already have.

Speed and Core Web Vitals: 4 Checks

Speed stopped being purely a ranking conversation. It is now also a citation conversation, because a crawler on a budget abandons slow responses.

There is emerging evidence that this now affects citations as well as rankings. A study of more than 2,000 sites, cited in the AirOps session, reported that faster sites were referenced roughly 20 to 30 percent more often in AI answers, with one slide putting the gap at 1.47 times. We have not reviewed the underlying methodology, so treat those numbers as a direction of travel rather than a benchmark.

The mechanism is intuitive enough. A crawler working through a large candidate set on a fixed budget abandons slow responses. Googlebot usually comes back later. An AI crawler often does not.

Google’s published Core Web Vitals thresholds are LCP under 2.5 seconds, INP under 200 milliseconds and CLS under 0.1. Measure against field data where you have it, because lab scores flatter you.

Server and Security: 4 Checks That Are Really Business Risk

This section is short, and every item in it is Critical. That is not padding. Each one can take a site off the map in a week.

Run the Exposed File Search Before Your Client Does

Check 49 is the one that changes the temperature of a client meeting. Run these four searches on any site you take over.

• site:domain.com filetype:pdf
• site:domain.com filetype:xls OR filetype:xlsx
• site:domain.com filetype:doc OR filetype:docx
• site:domain.com filetype:csv

Most of the time you find old brochures. Sometimes you find an internal payroll sheet or a client contact export sitting in an uploads folder. Fix it by removing the file and serving 410, then requesting removal in GSC. Do not simply noindex it, because the file itself remains publicly downloadable.

Mobile: 1 Check, Still Non-Negotiable

On-Page Technical: 5 Checks at Template Level

These are on-page items, but you audit them technically. You are looking for template errors that affect hundreds of pages at once, not for one weak title.

Structured Data: 6 Checks After Google Removed FAQ Rich Results

Structured data is the one area where a 2026 checklist has to be more careful than a 2023 one. Google removed FAQ rich results from Search on 7 May 2026. HowTo went the same way in 2023. Plenty of checklists still tell you to add both. Six checks below, then two things worth saying plainly.

The Schema Types That Stopped Paying in 2026

FAQPage and HowTo are two of the most commonly recommended types in technical SEO checklists. Neither produces a result in Google Search any more.

The wider point is that markup follows Google’s feature list, not schema.org’s vocabulary. Schema.org publishes hundreds of types. Google renders a couple of dozen. Build for the second list.

A Straight Answer on Schema and AI Search

You will read everywhere that schema is how you get cited by AI. Google’s own documentation on AI features says the opposite in one line: there is no special schema.org structured data you need to add to appear in AI Overviews or AI Mode.

What Google does ask for is that the page is indexed, eligible to be shown with a snippet, and that its structured data matches the visible text. That last part is the useful instruction. Schema does not buy you a citation. Inaccurate schema can cost you one.

The studies reporting large citation lifts from schema are correlational. Sites that mark up properly tend to be sites that do everything else properly too. Mark up for the Search features you are genuinely eligible for, keep it accurate, and treat any AI benefit as a side effect rather than the business case.

Logs and Monitoring: 4 Checks Nobody Else Teaches

Search Console reports only on Google. Your server logs are currently the only reliable source of truth on AI crawler behaviour. That makes this section the highest-leverage part of a modern audit.

What to Do When Your Platform Will Not Give You Logs

Hosted ecommerce platforms are the usual problem here. Shopify, for example, does not expose raw server logs, so you cannot confirm whether an AI crawler ever reached a product page.

You are not completely blind though. Three workarounds get you most of the way.

1. Put the site behind a CDN such as Cloudflare and read the CDN logs instead. The request still passes through it.
2. Use GSC Crawl Stats as a proxy for Googlebot behaviour, then treat it as a floor rather than a full picture.
3. Add lightweight server-side logging through an app or middleware layer where the platform allows it.

If none of those is possible, factor it into your platform decision. Losing log visibility is a real cost, and it is worth naming at the point of choosing a stack rather than two years later.

AI Search, GEO and AEO: 7 Checks

This is where a 2026 checklist earns its title. These items are not content advice, they are infrastructure decisions about how retrieval works.

How Retrieval Picks Candidates Before It Picks an Answer

Check 60 tells you to cover topics and entities rather than exact keywords. The reason sits in how retrieval works, and it runs in two stages. Our guide to generative engine optimization covers what to do with that on the content side.

First the system finds candidates by meaning rather than by string match. Your query becomes a numerical representation, and passages that sit close to it in meaning get pulled in. That is why a page can be retrieved for a phrasing it never literally contains.

Then it reranks that pool before choosing what to quote. Guerrero puts the size of that shortlist in the region of 150 results. We have not found published documentation confirming that specific figure, so treat it as a practitioner estimate. The two-stage shape, retrieve broadly then rerank, is well established regardless of the exact number.

The practical instruction is the same either way. Name the entities. List the tools, standards, competitors, regulations and adjacent concepts a knowledgeable person would expect. Breadth of coverage gets you into the candidate pool. Repeating one phrase does not.

Why You Can Get Cited by a Bot That Never Visited You

This is the most misunderstood mechanic in AI search, and it changes what you should optimise.

When someone asks an AI assistant a question, the system does not usually crawl the open web in that moment. It queries a search index, gets back a set of results, and each result arrives as a title plus a short text extract. If that extract already answers the prompt, the model can write its answer and cite you without ever requesting your page.

Two consequences follow. First, your server logs will under-report AI visibility, because many citations leave no trace there. Second, the snippet is the artefact being judged, not your full page.

So the practical move is to make the first 200 characters of the relevant section carry the answer. Front-load the fact. Put the number, the definition or the direct response near the top of the passage rather than after three paragraphs of setup.

The scale of the click compression is worth naming, even though the numbers move around by study. Eric Siu cites work putting the organic traffic reduction from AI Overviews at more than 37 percent on affected queries. Published figures in this area vary widely, so use it to size the risk rather than to forecast your own result. Segmenting your own Search Console data by intent gives a far more useful answer than any industry average.

We got this wrong on our own site for most of 2025. We optimised full pages for depth and buried every direct answer under context. Impressions climbed, citations did not.

Agent Readability: 3 Checks for the Web That Clicks Back

AI agents are starting to complete tasks rather than just summarise pages. That means your site now needs to be operable by software, not only readable by it. No other technical SEO checklist we audited covers this at all.

How to Read Your Own Accessibility Tree

The check takes about five minutes and needs no tools beyond Chrome.

1. Open the page and press F12 to launch DevTools.
2. Go to the Elements panel, then open the Accessibility pane on the right.
3. Enable the full-page accessibility tree view.
4. Find your primary action, for example Add to Cart or Request a Quote.
5. Read its role and its accessible name.

You want to see a role of button or link with a clear name. What you often see instead is a generic node with no name at all. That happens when the element is built like this:

<div class="btn" onclick="submitOrder()">Add to Cart</div>

Visually that is a button. Structurally it is a rectangle. An agent reading the accessibility tree sees no interactive control, so it cannot complete the task. The fix is genuinely this simple:

<button type="submit">Add to Cart</button>

Same appearance with the right CSS, completely different machine meaning. Run this on your cart, your quote form and your booking flow first, because those are the pages where failure costs money.

Keyword and Intent: 13 Checks

Technical work gets you eligible. Intent work decides whether eligibility turns into traffic. These checks belong in a technical audit because they are diagnostic, not creative.

Why the Page Above You Has Already Done Your Research

Check 76 is the cheapest research method on this list, and the scale of it surprises people. Ahrefs analysis of roughly 3 million searches found that the page ranking first typically also ranks for close to 1,000 other keywords.

So the page beating you has already mapped the topic. Pull its full keyword profile, filter to positions 1 to 5, and read the result as a coverage map. You are not copying the page. You are reading the evidence of what the topic actually contains.

The same body of work sits behind check 55. A study of around 2 million keywords found shorter URLs correlate with better positions, which is why the slug should carry the primary keyword and nothing else. And check 39 comes from correlation work suggesting pages that link out to high authority resources tend to rank better, not worse.

The Position Band Framework

Most guides stop at low-hanging fruit and mean positions 2 to 10. We widen the first band and add two more, because SERP features and AI answers have pushed the click cliff further up the page.

Content Quality: 10 Checks

Quality is a technical concern because it is measured in bulk. A hundred weak pages will drag down the twenty good ones sitting beside them.

Two Content Quality Numbers Worth Holding On To

Check 88 exists because reading level is a distribution problem, not a matter of taste. Around half the adult population in the United States reads below an eighth grade level. A page written at graduate reading level is therefore not more authoritative. It is less accessible to half of its audience.

Check 89 is the one most teams skip when they start generating with AI. Eric Siu’s framing is that output reaches roughly 95 percent of usable quality when the model has learned your house style first, against generic output when it has not.

The method is straightforward. Have the model read ten of your strongest existing posts and extract the patterns: typical length, sentence rhythm, how you use tables, how you cite data, where links sit, how you open and close. Save that as a standing instruction. Then generate.

Off-Page: 7 Checks

Links are still the clearest external trust signal, and they now feed AI citation patterns as well as rankings.

Full Comparison: What Every Major Technical SEO Checklist Covers

Before writing this, we audited fourteen published technical SEO checklists, including the ones from Semrush, Ahrefs, Backlinko, DebugBear, Sitebulb, seoClarity, Yotpo and Page One Power. We logged what each one covers and, more usefully, what none of them do.

Here is the whole comparison. Everything below reflects those pages as published in August 2026, and every one of them is a genuinely useful resource. The point is not that they are weak. The point is that the field has a shared blind spot.

The Ten Things No Other Checklist Explains

Four of the columns above are empty across all fourteen competitors. Five more items are covered so thinly elsewhere that they may as well be. Here is the full list, with an honest note on who else touches each one.

The pattern underneath all ten is the same. Every other checklist treats an AI system as a crawler you either permit or block. None of them treats it as a user that has to read the page, render it, and increasingly act on it.

The 47-Item Short Version for Small Sites

Running all 105 checks on a twelve-page site is a poor use of a morning. So here is the reduced set. Run these, and skip the rest until the site grows past a few hundred URLs.

Keep every Critical item: 1, 4, 16, 24, 25, 27, 46, 47, 48, 49, 70 and 71. Then add these High items: 2, 5, 6, 8, 9, 10, 17, 18, 19, 20, 26, 28, 29, 30, 32, 33, 34, 35, 40, 41, 42, 43, 50, 51, 56, 57, 60, 61, 62, 63, 64, 67, 68, 72, 73 and 83.

That is 47 checks, and it covers roughly 90% of the risk on a small site.

How Often to Run a Technical SEO Audit

Cadence depends on site size and on how much changes between audits. If you are budgeting for one rather than running it yourself, our breakdown of what an SEO audit costs covers the ranges and what drives them.

Where the Data in This Checklist Comes From

Most technical SEO checklists cite nothing. Of the fourteen we audited, four of the highest-authority pages carry no external statistics at all. So it is worth being explicit about where the numbers on this page came from.

The field observations quoted throughout are drawn from five practitioner sessions, each linked below. Where a figure is a single practitioner’s reported client result rather than a published study, we have said so in the text rather than dressing it up as research.

Google’s own documentation is the source for the Core Web Vitals thresholds, the 404 versus 410 distinction and the sitemap size limits.

Frequently Asked Questions

What is the difference between a technical SEO checklist and a technical SEO audit?

The checklist is the list of things to check, the audit is the act of checking them on a specific site. A checklist is reusable and generic. An audit produces findings, priorities and owners for one property at one point in time. Use this checklist as the input to your audit template.

How long does a technical SEO audit take?

Between four hours and three weeks, depending almost entirely on site size and log access. A small brochure site running the 47-item version takes a focused morning. A large ecommerce site with faceted navigation, multiple templates and log file analysis realistically takes two to three weeks including the write-up.

Do I need to fix every item on the checklist?

No, and trying to is the fastest way to fix nothing. Clear every Critical item first, because those block crawling, indexing or revenue outright. Then work through High items over the following month. Medium and Low items are batch work you schedule, not emergencies.

Should I block AI crawlers like GPTBot in robots.txt?

Only if you have a specific commercial reason, and even then, block selectively. GPTBot collects training data while OAI-SearchBot powers live answers. Blocking the second one removes you from ChatGPT citations entirely. Most businesses that want AI visibility should allow the retrieval agents and decide separately about the training ones.

Is llms.txt worth adding to my site?

It is cheap to add and currently unproven, so treat it as optional housekeeping rather than strategy. No major AI provider has committed to reading it, and it does not reflect how retrieval actually works. Add it if you want, then spend your real effort on indexation, snippets and rendering.

How do I know if AI systems can actually read my page?

Use view-source rather than inspect element, then check whether your key content is present in the raw HTML. If your headline, price or main answer only appears after JavaScript runs, most AI crawlers will miss it. Follow that with a server log check comparing HTML fetches against JavaScript loads for each named AI agent.

Why do my server logs show no AI crawler visits even though I get cited?

Because many citations never require a visit. AI systems query a search index first and receive a title plus a short snippet for each result. When that snippet answers the prompt, the model writes its answer without fetching your page. Your logs will therefore always under-report AI visibility.

Can an AI agent complete a purchase on my website?

Only if your interactive elements are real semantic HTML. Open Chrome DevTools, view the accessibility tree, and check whether your primary action has a button or link role with a clear accessible name. A styled div reads as an inert rectangle to an agent, so the flow fails silently.

What is the most commonly missed check on this list?

Confirming that the http to https and www redirect applies site-wide rather than only on the home page. We find this on a meaningful share of audits. The root redirects perfectly, every inner URL stays reachable on all four variants, and the whole site quietly runs as duplicates.

Does schema markup help you get cited in AI search?

Not directly. Google’s own documentation on AI features states there is no special schema.org structured data you need to add to appear in AI Overviews or AI Mode. What it does ask is that the page is indexed, eligible to be shown with a snippet, and that its structured data matches the visible text. Accurate schema will not win you a citation on its own, but inaccurate schema can cost you one.

Should I remove FAQ schema now that Google has dropped FAQ rich results?

No need to rip it out. Google stopped showing FAQ rich results on 7 May 2026 and confirmed the markup causes no problems if it stays. Just stop treating it as a deliverable, remove it from new templates, and stop reporting FAQ impressions that no longer exist.

Where to Start This Week

Pick three things. Run the four-variant redirect test on a deep URL. Run the filetype searches for exposed documents. Then open your robots.txt and check each AI user agent line individually. Those three take under an hour combined and they surface the most expensive problems in this list.

After that, work the Critical items in order, then move to High. Do not start at item one and grind forward, because the numbering is a category order, not a priority order.

If you want a second pair of eyes on the results, we run this exact 105-point process for clients. Grab a Free ROI Audit and we will send you the findings with owners and priorities attached.