What a good SEO audit includes — and what it shouldn’t.
If someone offers you an SEO audit, Google’s advice is to “be sure to carefully consider what’s involved”.1 This page spells out what that involves: the order a useful audit works in, what every finding should carry, what no honest audit can promise, and the red flags. It applies to anyone you might hire, including us.
Google’s and Bing’s words, quoted and datedOur opinions, labelled as oursA checklist to hold anyone to
Why the order matters
Google describes Search in three stages: crawling, where its automated programs download your pages; indexing, where Google processes them and stores them “in the Google index, a large database”; and serving, where “our machines search the index for matching pages” each time someone searches.2 Each stage depends on the one before. Google can’t judge a page it hasn’t read, and it can’t show a page that isn’t in its index.
Our view: a good audit works in the same order. It asks whether Google can reach and read your important pages, then whether Google has kept them, and only then how they are written. Rewording a service page that Google never filed is wasted effort.
Even a site that clears every stage is promised nothing: “Google doesn’t guarantee that it will crawl, index, or serve your page, even if your page follows the Google Search Essentials.”2 Search Essentials is the set of requirements, spam rules and best practices Google publishes for websites.8
What to check before anything else
Two reports come first. Both live in Search Console, Google’s own tool for site owners, which Google says “provides you with key information and data directly from Google Search itself.”3 Google’s guide to investigating a traffic drop names both checks: “Check the Security Issues report to find if Google detected a security threat on your website.” And, for any action Google has issued against a site: “check the Manual Actions report on Search Console to see if any have been issued to your website.”4
Our view: these go first because they change what the rest of the audit is for. A hacked site is an emergency to deal with before any SEO work, not item fourteen on a list. And when both reports are empty, a good audit says so, with the date it looked.
An audit that never asks for Search Console access hasn’t looked at either report. As for how much access, Google’s advice for an audit is to “only grant read access to Search Console (at this stage, don’t grant them write access).”1 Nobody auditing your site needs your password.
What every finding should carry
Google suggests asking any SEO: “Will you share with me all the changes you make to my site, and provide detailed information about your recommendations and the reasoning behind them?”1 For an audit, we read that as four things on every finding.
What was seen.
Evidence from your own site: a Search Console status, your server’s response, or the page as Google fetched it beside the page a visitor sees. A tool flagged it is not evidence on its own.
Where, and when.
The page, and the date it was checked, so that anyone can check it again.
The published rule behind it.
A link to the Google or Bing page it rests on. Where it is the provider’s professional judgment instead, it should say so. Judgment is fine; judgment dressed up as Google’s rule is not.
What to do, and how much work it is.
Google says an audit “should be about giving you realistic estimates of improvement, and an estimate of the work involved.”1 Our reading: what can be improved, in what order, and roughly what each fix takes. Not a forecast of where you will rank.
A good audit also says what it couldn’t check. A labelled gap is useful; a gap that looks like a clean result is not.
What a good audit won’t promise
No honest audit can promise these, and Google and Bing say so themselves.
A ranking. “If they guarantee you that their changes will give you first place in search results, find someone else.”1
That the changes will move anything. “there’s no guarantee that changes you make to your website will result in noticeable impact in search results”.5
A date. Google’s own range: “Some changes might take effect in a few hours, others could take several months.”6
A mention by an AI assistant. Bing: “SEO does not guarantee rankings or traffic, and GEO does not guarantee grounding or citations in AI experiences.”7 GEO is Bing’s term for work on whether content is eligible to be used and cited in AI answers.
What an audit can honestly deliver is an ordered list of fixes, with the evidence for each. We don’t promise a position, a date, a traffic number, an AI mention or a recovery, and in our view nobody should.
Red flags in an audit
In our view, each of these shows an audit working from habit or from a tool, rather than from what Google and Bing publish.
A long list of errors from a scanning tool.
Google’s technical bar is low: “most sites pass the technical requirements without even realizing it.”8 Of its report on which pages it has filed, Google says: “Non-indexed URLs can be fine.”9 A good audit separates real problems from normal ones and shows you the real ones.
Character counts presented as Google’s rules.
Titles must be under 60 characters is repeated everywhere. Google: “While there’s no limit on how long a <title> element can be, the title link is truncated in Google Search results as needed, typically to fit the device width.”10 (The title element is the page title in your site’s code; the title link is the headline Google shows.) Google says the same of meta descriptions, the short page summary in that same code.11 What it does document is why it rewrites some titles, inaccurate or repeated ones among them,10 and that is the useful thing to work from.
A keyword density target, or a word count.
We have found no keyword density figure in Google’s or Bing’s documentation. Google’s spam policy describes keyword stuffing by what it looks like, including “Repeating the same words or phrases so often that it sounds unnatural”.12 On length, Google says “there’s no magical word count target, minimum or maximum”.6
A tool’s score presented as Google’s opinion.
Authority scores and SEO health scores are made by software companies. Google: “Some third-party services provide data that some users of those tools misinterpret as somehow being from Google.” And: “Third-party tools don’t have access to our internal ranking data.”3 In our view, a score can help compare sites inside one tool. It is not Google’s view of yours.
FAQ markup sold to get question dropdowns in the results.
FAQ markup is code that labels questions and answers for search engines. It could once add question dropdowns to a listing, which Google calls a rich result. Google’s changelog records that in 2023 its documentation was updated to say the feature is only shown for “well-known, authoritative government and health websites”, and in 2026: “The FAQ rich result feature is no longer shown in Google Search results”.13 Questions and answers can still help your customers. The markup won’t bring the dropdowns back.
Disavowing links as routine upkeep.
The disavow tool asks Google to disregard particular links to your site. Google says “most sites will not need to use this tool”, and “If used incorrectly, this feature can potentially harm your site’s performance in Google Search results.” Google’s conditions for using it include links that “have caused a manual action, or likely will cause a manual action, on your site”.14 In our view, that calls for a diagnosis, not a monthly service.
AI visibility belongs in the audit
A good audit now also checks whether AI systems can reach your site. Much of that is decided by one file. Google: “A robots.txt file tells search engine crawlers which URLs the crawler can access on your site.”15 Each AI company publishes the names of its own crawlers (the automated programs that fetch pages), and most separate the crawlers that decide whether you can be seen in their answers from those that collect pages for training, each in its own way. A copied block the AI snippet can’t be right for all of them, so a good audit reads your file against each company’s list.
One switch isn’t in that file. Google says a site “must be included in Search generative AI features in Search Console to be eligible for display in generative AI features on Google Search.”16 Only an audit with Search Console access can read that setting.
We go through the eight AI platforms we check, in each company’s own words, on our AI visibility page. The same limit holds there: an audit can tell you whether an AI system is able to see your site, never whether it will mention you.
A checklist you can hold anyone to
Ours. Ask it of any provider, and of us.
Does it start from Search Console, with read-only access and no password?
Were Manual Actions and Security Issues checked first, and dated, even if empty?
Does every finding show what was seen, where, when, and the published rule behind it?
Is professional opinion labelled as opinion?
Are real problems kept apart from things that are normal?
Is any character count, keyword percentage, word count or tool score presented as Google’s rule?
If so, ask for the Google page it came from.
Does it read each AI company’s crawlers separately, and the Search Console AI setting?
Does it say what it couldn’t check?
Does it promise a ranking, a date, traffic or an AI mention?
Then Google’s advice applies: “find someone else.”1
Could you, your web person or another provider act on it without the author?
How we do ours, briefly. We ask for a read-only Search Console user, never a password. The first page of our audit carries the Manual Actions and Security Issues checks, with the date we looked. Every finding carries its evidence and the published rule behind it, and our own judgment is labelled as ours. You can hold our complete sample audit to this checklist before you decide anything.
We quote Google and Bing rather than paraphrase them because you should be able to check us. Every quotation on this page links to the page it came from, with the date we read it. Where we give our own view, we say so.