Technical SEO Checklist for 2026

Why Technical SEO Still Matters in 2026

Ten years ago, technical SEO was about robots.txt and XML sitemaps. In 2026 it's about making sure your React SPA renders correctly for Googlebot, that GPTBot can retrieve your pages, that your Core Web Vitals pass on real mobile hardware, and that your structured data is rich enough for AI Overviews to quote you. The stakes are higher because the surfaces that consume your pages have multiplied — Google, Bing, ChatGPT, Perplexity, Claude, Gemini, and dozens of niche AI search tools all crawl the same web.

The good news: technical SEO is largely a one-time investment. Once your site is set up correctly, most fixes stay fixed. This checklist walks through every audit item in the order I run them on client sites, from most-common-cause-of-lost-traffic down to nice-to-haves.

1. Crawlability

If bots can't crawl your pages, nothing else matters. Confirm:

• robots.txt exists at /robots.txt and does not contain Disallow: / on the production host.
• AI bots are allowed unless you explicitly want to block them: GPTBot, PerplexityBot, ClaudeBot, Google-Extended, ChatGPT-User.
• XML sitemap at /sitemap.xml, referenced from robots.txt, submitted in Google Search Console and Bing Webmaster Tools.
• Sitemap is complete and current — every canonical URL is listed, lastmod reflects real updates, no noindex URLs slipped in.
• Internal links reach every important page in 3 clicks or fewer from the homepage.
• No orphan pages — every URL in the sitemap has at least one internal link pointing to it.
• Server responds fast to crawler requests — under 600ms TTFB for HTML.

2. Indexability

Crawled ≠ indexed. Google discards ~50% of what it crawls as low-quality or duplicative. Your indexability audit:

• Meta robots — no accidental noindex on money pages. Check with view-source, not just DevTools.
• X-Robots-Tag HTTP header — check with curl -I; a server-level noindex is invisible in the HTML.
• Canonical tags on every page, self-referential unless the page is genuinely a duplicate.
• No canonical loops or chains — page A canonicals to B canonicals to C is confusing signal.
• Parameter handling — filter and sort URLs should either canonicalize to the base, be noindexed, or be blocked in robots.txt.
• Pagination — each paginated page is self-canonical (rel prev/next is deprecated).
• HTTP status codes — 200 for live pages, 301 for permanent redirects, 404 for gone content, 410 for intentionally removed. Never 302 for permanent moves.
• Search Console Pages report — investigate every "Crawled - currently not indexed" and "Discovered - currently not indexed" URL.

3. Site Architecture & Internal Linking

Internal linking is the most underused ranking lever on the web. It's free, permanent, and directly shapes how Google understands what your site is about. The hub-and-spoke model:

• Every content cluster has a pillar page targeting the head term (e.g. "on-page SEO").
• The pillar links out to 10–30 supporting articles targeting long-tail variants.
• Every supporting article links back to the pillar and to 3–5 sibling articles.
• The homepage links to every pillar. The main nav surfaces the top pillars.

Anchor text should be descriptive and vary naturally. Over-optimized exact-match anchors on internal links look manipulative and can suppress rankings. Full pattern in pillar pages & topic clusters.

4. Core Web Vitals & Performance

Measurement matters as much as optimization. Lab data (Lighthouse, PageSpeed Insights) is a starting point; field data (CrUX in Search Console) is what Google uses for ranking. Common wins:

• Serve images as WebP/AVIF, set explicit width/height, lazy-load below the fold.
• Preload the LCP image and self-hosted fonts.
• Defer non-critical JavaScript; move analytics/chat widgets to a delayed load.
• Use a CDN (Cloudflare, Fastly, Bunny) with HTTP/3 and Brotli compression.
• Reserve space for embeds, ads, and dynamic content to prevent layout shift.
• For INP: break long JS tasks, use requestIdleCallback, audit third-party scripts.

5. Mobile & Rendering

Google has been mobile-first for years. The mobile version of your page is the version Google indexes.

• Responsive design, not a separate m. subdomain (which duplicates SEO problems).
• Font size ≥ 16px, tap targets ≥ 48×48px, adequate spacing between clickable elements.
• Viewport meta tag set: <meta name="viewport" content="width=device-width, initial-scale=1">.
• No horizontal scroll on any mobile breakpoint.
• Content parity — desktop and mobile show the same content, headings, structured data, and internal links.
• Use Search Console's URL Inspection tool to see the rendered HTML Google actually gets.

6. JavaScript SEO

Modern frameworks make this easier than it used to be, but the pitfalls still bite:

• Server-render or prerender critical routes. Client-only React sites still have indexing delays and missing social previews.
• Meta tags in initial HTML — title, description, canonical, og:*, JSON-LD must be present in the server response, not injected by client JS.
• Internal links use real <a href> — buttons that navigate via onClick are invisible to crawlers.
• Content in the initial HTML — Googlebot renders JS but with a delay and imperfect success rate.
• Avoid infinite scroll without paginated fallbacks — Google typically only sees the first page.
• Test with mobile-friendly tool and URL Inspection; check the "More info → HTTP response" and rendered screenshot.

7. Structured Data & Schema

Structured data is the machine-readable version of your page. It powers rich results in Google, helps AI Overviews quote you accurately, and surfaces your content in Knowledge Panels. Priority schema types:

Validate every deployed schema with Google's Rich Results Test and Schema.org validator. A single syntax error can drop rich results silently. Full patterns in structured data for AI search.

8. International SEO (hreflang)

Skip this if you serve one language, one country. For everyone else:

• Decide your URL structure: subdirectories (/en/, /de/) are usually best for SEO. Subdomains and ccTLDs are heavier lifts.
• Every localized page has hreflang tags for every language variant, plus x-default.
• hreflang references are reciprocal — page A pointing to B means B must point back to A. Non-reciprocal tags are ignored.
• Use ISO 639-1 language codes and ISO 3166-1 alpha-2 country codes (en-US, en-GB).
• Content is genuinely localized, not just auto-translated with the same URL.

9. HTTPS, Redirects & Security

• HTTPS everywhere — HTTP URLs 301 to HTTPS, HSTS header on the production domain.
• One canonical hostname — either www or non-www, with the other 301'd to it.
• No redirect chains — every 301 goes directly to the final URL, never through 2–3 hops.
• Old URLs 301 to their new equivalents after migrations; keep the mapping documented.
• No mixed content — HTTPS pages don't load HTTP resources.
• Security headers: Content-Security-Policy, X-Content-Type-Options, Referrer-Policy. Not ranking factors, but trust signals.

10. Monitoring & Log Analysis

Set up the alerts that catch technical regressions before they cost you traffic:

• Uptime monitoring (UptimeRobot, Better Uptime) — 30s frequency.
• Search Console email alerts for indexing issues, manual actions, and Core Web Vitals regressions.
• Weekly automated crawl (Ahrefs Site Audit, Sitebulb) with change-diff reports.
• Server log analysis quarterly — see which URLs Googlebot crawls and how often. Reveals crawl waste and orphan pages instantly.
• Rank tracking for your 20–50 priority keywords (Ahrefs, Semrush, Nightwatch).

Technical SEO Tools I Actually Use

Frequently Asked Questions