A working lie circulating in 2026: "AI search changes everything, technical SEO is dead, just focus on content." It is incorrect. AI systems still depend on the same crawl-index-render pipeline that Google does. A technically broken site is invisible to Google, ChatGPT, and Perplexity simultaneously. Technical SEO didn’t die. The penalty for getting it wrong just got worse.
This is the 23-point checklist I audit against every site that hires me. Some items are 2005-era fundamentals. Some are 2026-specific. Every one of them still moves the needle, and skipping any of them while paying an agency for "AI optimization" is how sites end up with great content and zero visibility.
Ordered into 7 categories, within each by leverage. If you’re doing this yourself, work top to bottom.
Crawlability (the foundation).
01. robots.txt allows what matters and blocks what doesn’t
Open yoursite.com/robots.txt. It should allow Googlebot, Bingbot, and typically the main AI crawlers (GPTBot, PerplexityBot, ClaudeBot) unless you have a reason to block them. It should block staging, admin, and thin parameter URLs. The #1 mistake I see: a blanket Disallow: / left over from staging, still live in production.
02. XML sitemap is valid, current, and submitted everywhere
One sitemap (or sitemap index) listing every page you want indexed. Submitted to Google Search Console and Bing Webmaster Tools. Excludes noindexed pages. Updated automatically on publish. Validated with an XML parser, because a malformed sitemap silently fails to submit.
03. Important pages are indexable in Search Console
Spot-check your top 10 pages in Search Console’s URL Inspection tool. Every one should show "URL is on Google" or equivalent. If any show "Crawled, currently not indexed" or "Discovered, currently not indexed," there’s a deeper problem (thin content, canonical conflict, or a noindex tag) that needs fixing.
04. Noindex is used deliberately on low-value pages
Tag archives, author archives, duplicate date archives, thank-you pages, thin paginated pages. Noindex these explicitly with a meta robots tag or X-Robots header. Don’t let Google spend crawl budget on URLs that can never rank.
Crawl budget reality check
For sites under 500 pages, crawl budget is rarely a real constraint. Above 10,000 pages, it absolutely is. Use Search Console’s Crawl Stats report to see if Google is visiting your pages often enough. If important pages go 30+ days between crawls, you have a crawl budget problem and need to aggressively noindex or deprecate low-value URLs.
Indexing and canonicalization.
05. Canonical tags self-reference or point somewhere real
Every page should have a <link rel="canonical"> that either self-references or points to a real, indexable URL. Common disasters: canonical pointing to staging, canonical pointing to a 404, canonical pointing to an entirely different page’s content. Validate with a crawl (Screaming Frog, Ahrefs Site Audit).
06. No accidental duplicate content
HTTP and HTTPS versions serve the same content (both redirect to HTTPS). www and non-www redirect to one canonical version. Trailing slash consistency. URL parameters that don’t change content (session IDs, tracking) are handled via canonical or robots.txt. Duplicate content fragments Google’s ranking signal.
07. Redirect chains eliminated
A → B → C is a redirect chain. Google and AI crawlers tolerate it, but waste crawl equity and lose ~10% of link equity per hop. Collapse chains: every old URL should 301 directly to the final destination, single hop. Loops are fatal and must be fixed immediately.
08. 4XX errors cleaned up from internal links
Crawl your own site with Screaming Frog. Every internal link returning a 4XX should be fixed, either by updating the link or redirecting the dead URL to a live equivalent. External links to 4XX are less urgent but still bad UX.
Structured data (JSON-LD).
09. Organization and Person schema site-wide
Every page in the site should implicitly inherit (via site-wide include) a JSON-LD Organization schema for your business, and Person schema for the operator or lead provider. These are the entities AI systems use to disambiguate who you are. Without them, you are a brand-in-the-wild to AI systems, and they don’t cite brands they can’t identify.
10. Service, Product, FAQ schema where applicable
Service pages get Service schema linking back to the Organization. Product pages get Product + AggregateRating if reviews exist. FAQ-bearing pages get FAQPage. Each correctly typed entity increases citation likelihood proportionally.
11. Every schema validates on validator.schema.org
Not "passes in Google Rich Results Test", validator.schema.org is stricter and closer to what AI systems actually parse. Validate every schema block before shipping. Warnings are fine to leave. Errors must be fixed.
For the full schema patterns I ship on client sites, see the schema field guide.
Core Web Vitals and performance.
12. LCP under 2.5 seconds on mobile
Largest Contentful Paint. Usually the hero image. Fix by: compressing to WebP at quality 80-86, explicit dimensions in HTML, fetchpriority="high" on the hero image, <link rel="preload"> for above-the-fold images, and minimizing late-loading CSS or JavaScript that blocks render.
13. CLS under 0.1
Cumulative Layout Shift. Usually caused by images without explicit dimensions, ads that inject late, or fonts that swap after page load. Fix with: width/height attributes on every image, reserved space for ads, font-display: optional or font-display: swap with size-matched fallback fonts.
14. INP under 200ms
Interaction to Next Paint replaced FID in 2024. Fix by: minimizing main-thread JavaScript, deferring non-critical scripts, avoiding large synchronous event handlers, and breaking long tasks into chunks. Most WordPress sites fail this because of heavy plugins running on every interaction.
15. PageSpeed Insights mobile score 90+
Not a ranking factor directly, but a useful proxy. If mobile PSI score is below 80, at least one Core Web Vital is probably in the "Needs Improvement" or "Poor" bucket. Desktop should be 95+ for any non-legacy theme.
On-page basics.
16. Unique title tag on every page
Format: Primary Keyword | Secondary Context | Brand. 50-60 characters. No duplicates site-wide (a site with 15 pages called "Services | Brand" is a ranking disaster). Crawl your own site to catch duplicates.
17. Unique meta description on every page
Click-through is earned in the SERP description, not the title. 150-160 characters. Answer the intent of the query. No boilerplate "Welcome to our site" descriptions. Google rewrites ~70% of meta descriptions now, but the ones they keep are worth writing.
18. Logical H1 to H3 hierarchy
One H1 per page, matching the title. H2s for main sections, H3s for sub-sections. No skipping levels (H1 → H3 directly). H4+ rarely needed. AI systems use heading structure to build the document outline they cite from.
19. Answer-first intro paragraphs
Every long-form page opens with a 40-60 word paragraph that directly answers the query the page targets. AI systems preferentially cite this paragraph. Buying the reader’s attention with narrative comes after the answer, not before it.
Mobile and accessibility.
20. Real mobile test, not just DevTools
Chrome DevTools responsive mode lies about font rendering, tap target size, and real scroll behavior. Test on an actual phone (iPhone and Android, ideally). The number of sites I’ve audited that pass DevTools and fail on a real phone is depressing.
21. Tap targets at least 48×48 pixels
Buttons, links, navigation items. Anything interactive. Apple and Google guidelines both recommend 44-48px minimum. Failing this causes fat-finger errors and bounce. Lighthouse reports flag this specifically.
22. Alt text on every meaningful image
Descriptive, not keyword-stuffed. Decorative images get alt="". Meaningful images get a description that would make the image comprehensible to someone who can’t see it. Accessibility + small SEO lift + accurate captions for AI systems that cite with images.
Security and hygiene.
23. HTTPS site-wide, no mixed content
HTTPS everywhere, no HTTP subresources (images, scripts, CSS). No certificate warnings. Cert renewed automatically. Subdomains on HTTPS too. Mixed content downgrades trust signals in every modern browser and hurts both conversions and AI citation likelihood.
Bonus, not counted: malware check
Not on the 23-point checklist because it’s binary rather than gradational, but worth checking: run your site through Sucuri SiteCheck once a quarter. If your site has been compromised, no amount of content or schema will save you. See the malware recovery case study for an example of what bad infections look like and how fast they can kill rankings.
How to actually run this against your site.
Three approaches, from fastest to most thorough:
- Self-audit in a weekend. Work top to bottom. Use Screaming Frog (free tier up to 500 URLs) for crawlability, Search Console for indexing, validator.schema.org for schema, PageSpeed Insights for CWV. Document each fix in a simple spreadsheet.
- Get the operator kit. The full 23-point audit ships inside the Claude Code SEO Operator Kit as a playbook you run on your own site with Claude Code, with my sequencing notes on every check.
- Run it with the kit. The Claude Code SEO Operator Kit packages this checklist as a playbook with the scripts and prompts to execute every fix on your own site.
The key lesson.
AI search raised the penalty for technical debt. When Google was your only search surface, a broken site was invisible to 90% of buyers. Now it’s invisible to 100% of them, because AI systems can’t cite content they can’t crawl or parse.
Every fix above is either a 2005-era SEO fundamental that never stopped mattering, or a 2026-era requirement that AI systems added to the stack. None of them are optional if you want to be found.
If you’d rather not assemble this from scratch, the Claude Code SEO Operator Kit packages this exact audit as a playbook you can run on your own site, with my notes on which items move the needle fastest.
