Most technical SEO audits arrive as a spreadsheet with four hundred rows and no opinion about which one to do first. I’ve been handed a few. They’re expensive wallpaper.

The checklist below is the order we work in when a new site lands with us. Order matters more than the list, because the checks are stacked: there’s no point tuning page speed on a page Google isn’t allowed to fetch. Each one takes minutes, and every one of them has cost a real client real traffic at some point.

1. Can the crawlers get in at all

Start at robots.txt. Type the domain, add /robots.txt, read it yourself. A Disallow: / that survived a launch is still the most expensive two-character mistake in the business, and it is invisible from the front end.

Then check the layer above it. Australian sites sit behind Cloudflare, AWS WAF or a hosting bot filter more often than not, and those tools block crawlers on rules nobody remembers writing. Google Search Console’s URL Inspection tool settles it: fetch a live URL as Google and see what comes back. If it can’t fetch, nothing below this line matters.

While you’re there, check whether your staging site is also crawlable. Duplicate copies of a site on a staging subdomain compete with the real one, and they’re usually the version with the placeholder copy.

2. Can the pages be indexed

Different question, different answer. A page can be crawled and still be told to stay out of the index.

Look for noindex in the page source and in the HTTP headers, since a plugin can set it in either. Then open the Pages report in Search Console and read the excluded reasons rather than the summary number. “Crawled, currently not indexed” on a handful of thin pages is normal. The same label across your entire service section means Google has judged those pages and declined.

I check the count of indexed pages against the count of pages you actually want indexed. When those two numbers are wildly different in either direction, that’s the audit finding, and everything else waits.

3. One page, one URL

Every page should be reachable at exactly one address. Most Australian sites fail this quietly.

Test all four variants of your homepage: http, https, with www, without. They should all end at the same final URL with a single 301, not a chain. Add the trailing slash question to the same test. Then look at parameters, especially the ones your filters and tracking tags create, and at whether uppercase and lowercase versions of a path both return 200.

Self-referencing canonical tags on every page are the cheap insurance here. They don’t fix a broken redirect setup, but they stop the duplicates you haven’t found yet from splitting your signals.

4. The bits that are specific to Australia

This is the section generic checklists skip, and it’s where multinational sites lose the most.

If your business runs a .com for global and a .com.au for here, the two are almost certainly cannibalising each other. Get hreflang right in both directions, en-AU and whatever the other market uses, with return tags that match. One-sided hreflang is ignored.

Check your Business Profile for consistency with the site: same trading name, same address, same phone number, same spelling. If you list an ABN or an address in the footer, mark it up so it’s machine-readable. This is the same entity work that decides whether an AI assistant will name you, which I wrote about in getting cited in AI answers.

One more, easy to miss: where your site is hosted. A server in Virginia serving Melbourne customers adds latency to every request, and while a CDN mostly solves it for static assets, uncached pages still make the round trip.

5. Internal links and orphan pages

This is the check that most often finds money, and almost nobody runs it.

Crawl the site with Screaming Frog or similar, then compare the list of URLs found by crawling against the list in your sitemap. Pages in the sitemap that the crawler never reached are orphans: they exist, they might even be indexed, and nothing on your site points at them. They’re usually old landing pages and, painfully often, the pages you most want to rank.

Then look at the reverse problem. Count internal links to your money pages. A service page with two links pointing at it, both from the footer, is telling Google exactly how important you think it is.

Fixing this costs nothing but time. It’s also the fastest-moving lever in this whole list.

6. Speed, but only the parts that move

Ignore the score out of 100. Look at field data in Search Console’s Core Web Vitals report, because that’s real Australian users on real connections, not a lab test run from a data centre.

Three things carry the weight. Largest Contentful Paint is usually a hero image that hasn’t been resized or a font that blocks rendering. Cumulative Layout Shift is usually an image without width and height attributes, or a cookie banner that pushes the page down after you’ve started reading. Interaction to Next Paint is usually a tag manager container that’s grown a decade of forgotten scripts.

Fix those and stop. I have watched teams spend a fortnight chasing a metric from 78 to 92 with no measurable effect on anything a business cares about.

7. Structured data and the entity layer

Organization schema on the site, with the name, URL and social profiles you actually use. Article schema with a named human author instead of “admin”. Breadcrumbs that match the navigation. Product or LocalBusiness markup if either genuinely applies.

Then validate it, and validate it as a graph rather than one page at a time. Broken references between schema blocks are common and silent. We ended up writing a gate into our own build that parses every JSON-LD block on the site and resolves its URLs, because a hand edit had quietly pointed fifteen pages at a page that no longer existed.

8. The crawlers that aren’t Google

New, and worth ten minutes. GPTBot, ClaudeBot, PerplexityBot and Google-Extended are separate user agents with their own robots.txt rules. Sites block them by accident all the time, usually through a blanket rule or a security product’s default setting.

Decide deliberately whether you want to be readable by AI assistants, then make robots.txt say what you decided. Blocking them is a legitimate choice. Blocking them without knowing is not.

What this adds up to

None of this is clever. It’s the sequence, run properly, before anyone talks about content.

With AGL we embedded into their internal optimisation team and worked through exactly this kind of groundwork alongside the content programme. Average search position across the tracked set improved by 58%, and the site picked up 14.5k features in Google’s AI Overviews. Details are in the AGL case study.

If you’d rather start with the content side, how to improve your SEO covers that ground. If you want us to run the audit above on your site, that’s where our SEO work starts anyway.

One warning before you go. Run this list top to bottom and you’ll find something. Everybody does. The point isn’t a clean report, it’s knowing which of the findings is actually costing you traffic this month, and doing that one first.

The technical SEO checklist we run on every new client site