Technical SEO Checklist for Small Business Websites (2026)

A technical SEO checklist answers one question: can Google reach and index the pages you want found, and do those pages work properly on a phone? For most small business sites that comes down to 19 checks, nearly all of them testable in an afternoon with free tools, starting with Google Search Console.

Order matters more than thoroughness. A page that isn't indexed can't rank, so crawl and indexing blockers come first and cosmetic fixes come last. The table below lists every check in that order, with how to test it and what a pass looks like. Work through it yourself or hand it to your developer as written.

The free tools that cover a full audit

You don't need a paid SEO suite to audit a small site. Four free tools do the job.

• Google Search Console. The only tool that shows what Google itself sees. The Page indexing report says which pages are indexed and why the others aren't, and URL Inspection shows the rendered page and Google's chosen canonical for any URL. Since the end of August 2026 it also has a Search generative AI control under Settings, which decides whether your content can appear in AI Overviews and AI Mode. Inclusion is the default.
• PageSpeed Insights. Field data from real Chrome users over the previous 28 days, plus a lab test that diagnoses why a page is slow. Read the field data first.
• Rich Results Test. Validates structured data and shows the rendered HTML Google sees, so it doubles as a JavaScript check.
• A site crawler. Screaming Frog's SEO Spider crawls up to 500 URLs for free, enough for most small business sites. It lists every URL with its status code, title and canonical, so broken links and duplicate titles surface in minutes. JavaScript rendering needs the paid licence.

Google's guide to its generative AI features adds a newer reason: a page must be indexed and eligible to show with a snippet before it can appear in AI Overviews or AI Mode. The technical basics are the entry ticket for AI answers too, as we argue in SEO vs AEO vs GEO.

The technical SEO checklist, in priority order

Priority here means the cost of ignoring a check. Critical items can hide pages from Google entirely and High items cost rankings or clicks; fix the rest once those pass.

Crawling and indexing: where sites go missing

Most serious problems we find on small business sites live here, and they are usually leftovers: a staging setting that went live, or an old version of the domain that still answers. Neither shows up in a browser.

robots.txt controls crawling, not indexing

robots.txt tells crawlers which URLs they may fetch. Google states that it is not a way to keep a page out of Google: a blocked URL can still be indexed if other sites link to it. To keep a page out of search, use a noindex tag and leave the page crawlable, because Google has to fetch the page to see the tag. Then open yourdomain.com/robots.txt and read it. A leftover "Disallow: /" line from development blocks the whole site.

Sitemaps: submit one, keep it clean

Most content management systems generate an XML sitemap automatically. Find it, submit it in Search Console's Sitemaps report, and confirm it lists only the canonical pages you want in search, with no redirects or noindexed URLs. Google's sitemap documentation says it ignores the priority and changefreq fields and only uses lastmod when it is consistently accurate. A plugin that stamps today's date on every URL teaches Google to distrust the field.

Read the Page indexing report properly

The Page indexing report lists every reason Google gave for not indexing a URL. Google says you shouldn't expect every URL to be indexed, only your canonical pages, so the goal is to confirm your important pages are in and each exclusion makes sense. The reasons that matter most on small sites:

• URL marked 'noindex'. Fine for thank-you pages. A real problem if a service page is on the list.
• Crawled - currently not indexed. Google fetched the page and passed on it for now. Resubmitting won't help; a stronger, more distinct page with internal links pointing at it usually does.
• Discovered - currently not indexed. Google postponed the crawl, typically because it expected to overload the site. We check server response times first.
• Duplicate, Google chose different canonical than user. Google sees the URL as a copy of another page and disagrees with your canonical tag.

One site, one canonical version

Your site can probably be reached at four addresses: http and https, each with and without www. All of them should redirect in one hop to the version you chose. Google prefers HTTPS pages as canonical and treats redirects and rel="canonical" tags as strong signals, a sitemap listing as a weak one. Give every page a self-referencing canonical tag and link internally to canonical URLs, so Google's choice in URL Inspection matches yours.

404s, soft 404s and redirect chains

A 404 is nothing to fear. Google recommends fixing only the 404s you link to or list in your sitemap. A soft 404 is worse: a page that says "not found" while returning a 200 success code. Return a real 404 or 410 when content is gone and a 301 when it has moved. The Page indexing report also flags redirect errors, which include chains that run too long, so point every internal link straight at the final URL. Redesigns are where chains and broken URLs multiply, which is why we wrote a guide to redesigning without losing rankings.

A page Google never indexed can't rank, however good it is. Check that first, every time.

Mobile, HTTPS and Core Web Vitals

Mobile-first indexing is finished

Google crawls and indexes the web with its smartphone crawler. The last sites still crawled as desktop moved over after July 5, 2024, and Google said content not accessible on a mobile device would no longer be indexable. To Google, your mobile page is your page. Check that it carries the same content, titles, robots tags and structured data as desktop, and that nothing important loads only after a tap or swipe, because Google won't trigger those interactions.

HTTPS on every page

Google's page experience guidance says that, beyond Core Web Vitals, aspects such as secure serving don't directly lift rankings. HTTPS stays in the critical rows anyway. Google prefers HTTPS URLs as canonical, and Chrome's security team announced that Chrome 154 would turn on "Always Use Secure Connections" by default from October 2026, asking permission before the first visit to any public site without HTTPS. A contact form behind that warning loses inquiries before anyone reads your offer.

Core Web Vitals: the current thresholds

Core Web Vitals are three metrics built from real visits, and the part of page experience Google says its ranking systems use. INP replaced FID in March 2024, so an audit template that still mentions FID is out of date. The thresholds from web.dev apply at the 75th percentile of page loads, separately for mobile and desktop:

• Largest Contentful Paint (LCP). 2.5 seconds or less is good; over 4 seconds is poor.
• Interaction to Next Paint (INP). 200 milliseconds or less is good; over 500 milliseconds is poor.
• Cumulative Layout Shift (CLS). 0.1 or less is good; over 0.25 is poor.

Search Console's Core Web Vitals report gives the site-wide view. Treat the fixes as a revenue project, as we did in why website speed sells. Google itself says chasing a perfect score purely for SEO may not be the best use of your time, so get every metric into "good" and move on.

Titles, headings, links and images

Titles and meta descriptions

Google writes its own title links. Your title element is one of several sources it uses, alongside the main visible heading, other prominent text and the anchor text of links to the page. It replaces titles that are half-empty, outdated, boilerplate or out of step with the page. There is no hard length limit; long titles get truncated to fit the screen. Write a unique, specific title per page, topic first and brand last.

Google also builds snippets mainly from page content and uses your meta description when it describes the page better, so snippets can change from one search to the next. Write a description for every important page anyway: a short pitch with concrete details like location or price.

Headings

Give each page one clear main title, ideally in the first visible h1. Beyond that, relax. Google's SEO Starter Guide says heading order doesn't matter to Search and there's no ideal number of headings. Keep a logical order for screen reader users, which is reason enough.

Internal links and URL structure

Google finds pages through links, and it can only reliably follow a proper anchor element with an href. Menus built from buttons and click handlers can hide whole sections. Every page you care about should be linked from at least one other page, with anchor text that says where the link goes. Keep URLs readable, with words instead of ID numbers and hyphens between them, and stick to one letter case, since Google treats URLs as case sensitive. Don't rename ranking URLs for cosmetic reasons; every change needs a redirect.

Images

Images are usually the heaviest part of a small business page. Use real img elements, since Google doesn't index CSS background images, and write alt text that describes the image in context. Serve WebP or AVIF at the size the layout displays, and set width and height so the page doesn't jump. Lazy-load only below the fold: web.dev's advice is to skip lazy loading for images likely to be visible on load, especially the LCP image.

JavaScript, structured data and hreflang

JavaScript rendering pitfalls

Google renders JavaScript with an evergreen version of Chromium, but rendering waits in a queue after the first crawl, and Google's JavaScript SEO basics still call server-side rendering or pre-rendering a great idea. The trouble we see most is copy and links that only exist after scripts run. Close behind: a noindex tag that a script removes later (Google may skip rendering once it sees noindex), single-page apps that show "not found" with a 200 status, and routes built on fragments like /#/services, which Google generally ignores. Run a key page through URL Inspection's live test and read the rendered HTML. If your main copy isn't there, Google can't rank it.

Structured data basics

Structured data describes a page's content to Google in a machine-readable format. Google recommends JSON-LD in most cases, and the markup must describe content visitors can see on the page. Validate it with the Rich Results Test before launch and watch Search Console's rich result reports afterwards, because template changes break markup quietly. Which types still earn anything is covered in our schema markup guide, and business listings in our local SEO guide.

hreflang, only if you have language versions

If your site has the same pages in more than one language or regional variant, hreflang annotations tell Google which version to show to whom. Each version must list itself and every other version, Google ignores the tags unless both pages point at each other, and URLs must be fully qualified. An x-default value catches everyone else. Google treats HTML tags, HTTP headers and sitemap entries as equivalent, so pick one method. Single-language sites can skip this row.

What not to worry about

Audit tools love to flag things Google has said don't matter. Most of these come straight from Google's SEO Starter Guide:

• Meta keywords. Google Search doesn't use the keywords meta tag.
• Word count targets. Length alone doesn't matter for ranking.
• A duplicate content "penalty". The same content at a few URLs is inefficient, but Google says it won't cause a manual action. Copying other sites is a different matter.
• Keywords in the domain name. Google says they have hardly any effect on ranking.
• Crawl budget. Google's crawl budget guide targets sites with a million or more pages, or 10,000 or more pages that change daily. For everyone else, an up-to-date sitemap and a regular look at the Page indexing report are enough.
• Sitemap priority and changefreq. Google ignores both.
• A perfect Lighthouse score. "Good" Core Web Vitals is the target. A score of 100 is a hobby.
• AI-specific files for Google. Google's generative AI guide says Google Search ignores llms.txt and similar files, and that you don't need to chop content into chunks for its AI features. Other AI tools are a separate question, covered in SEO vs AEO vs GEO.

How often to run this checklist

Technical SEO drifts. A plugin update adds noindex to a template, or a certificate fails to renew, and nobody notices until inquiries slow down. A light routine catches most of it early:

1. Monthly, 15 minutes. Check Search Console's Page indexing report for new exclusions on important pages, and the Core Web Vitals report for anything newly poor.
2. Quarterly, one afternoon. Crawl the site, fix broken links and redirect chains, and run your five most-visited pages through PageSpeed Insights.
3. After any big change. Run the full table after a redesign, a hosting or platform move, a domain change, or a major theme or plugin update. That is when serious damage usually happens.
4. Once a year. A full audit with fresh eyes, so nobody spends time fixing non-problems.

Start with the six Critical rows this week. If they all pass, you are ahead of many sites we audit, and the rest of the table becomes a steady to-do list instead of an emergency. If one fails and the cause isn't obvious, that is where our SEO work starts on every engagement. We find what's blocking Google and confirm the fix in Search Console before touching anything else.