WordPress SEO Audit Checklist for SEO Teams

Why WordPress Sites Need Special SEO Attention

WordPress powers over 40% of all websites, which makes it the most common CMS encountered in SEO audits. While WordPress is fundamentally SEO-friendly, its plugin ecosystem, theme diversity, and configuration options create unique technical challenges that do not exist on custom-built sites.

Plugin conflicts, bloated themes, misconfigured settings, and outdated software are responsible for the majority of WordPress-specific SEO issues. A targeted audit can uncover problems that generic SEO tools often miss.

Crawlability and Indexation

Check Search Engine Visibility Setting

WordPress has a built-in setting under Settings > Reading called “Discourage search engines from indexing this site.” This adds a noindex meta tag to every page. It is often enabled during development and forgotten at launch.

Audit action: Verify this setting is unchecked. Also check that your robots.txt file does not disallow important content.

Review Robots.txt

WordPress auto-generates a virtual robots.txt file. However, many SEO plugins and custom configurations override this. Check for:

Disallowed important directories — /wp-content/uploads/ should be crawlable (images need indexing)
Plugin-generated rules that may block content unintentionally
XML sitemap reference — ensure your sitemap URL is listed

XML Sitemap Configuration

Most WordPress sites use a plugin (Yoast SEO, Rank Math, All in One SEO) to generate sitemaps. Audit these for:

All important post types included — posts, pages, products, custom post types
Excluded content types — tags, author archives, and date archives may not need to be in the sitemap
No 404 or redirect URLs in the sitemap
Proper formatting — validate against our XML sitemap guide

WordPress-Specific URL Issues

Trailing slashes — WordPress defaults to trailing slashes. Ensure consistency and redirect non-trailing to trailing (or vice versa)
Attachment pages — WordPress creates individual pages for every uploaded media file. These are thin content pages that should redirect to the parent post or be noindexed
Author archives — on single-author sites, author archives duplicate the main blog. Disable or noindex them
Date-based archives — rarely useful for SEO. Noindex them to avoid thin, duplicate content

Plugin Audit

Too Many Plugins

Every plugin adds code, database queries, and potential security vulnerabilities. Sites with 30+ active plugins often have:

Conflicting output — multiple plugins injecting the same meta tags or schema markup
Performance overhead — each plugin adds HTTP requests, CSS, and JavaScript
Security risks — outdated or abandoned plugins are the primary attack vector

Audit action: Deactivate and delete unused plugins. For active plugins, check each one’s impact on page load time and whether it adds unnecessary front-end resources.

SEO Plugin Configuration

If using Yoast SEO, Rank Math, or similar:

Title tag templates — verify they produce unique, keyword-relevant titles for each page type
Meta robots settings — check that no important content types are accidentally noindexed
Schema markup — ensure the plugin’s schema output is correct and not conflicting with theme-generated schema
Social meta tags — verify Open Graph and Twitter Card markup is present and correct
Breadcrumbs — if enabled, verify the breadcrumb schema is valid

Duplicate Schema Markup

A common WordPress problem: the theme outputs schema, the SEO plugin outputs schema, and a dedicated schema plugin outputs schema — resulting in duplicate or conflicting structured data. Audit your pages for multiple instances of the same schema type.

Theme Performance Audit

Page Speed Issues

WordPress themes are a leading cause of poor Core Web Vitals. Common theme-related problems:

Render-blocking CSS and JavaScript — themes that load all their CSS and JS on every page, even when not needed
Unoptimized images in theme assets — hero images, background images, and icons that are not compressed
Excessive DOM size — page builder themes (Elementor, Divi, WPBakery) generate deeply nested HTML structures
Web font loading — themes loading 5-10 font weights when 2-3 would suffice

For font performance details, read our font optimization guide.

Mobile Responsiveness

Test every template type (homepage, single post, archive, product page) on mobile devices. Common issues:

Horizontal scrolling — elements wider than the viewport
Touch targets too close together — buttons and links that are hard to tap
Text too small — content requiring pinch-to-zoom
Fixed-position elements covering content on mobile

Database and Server Performance

Database Optimization

WordPress databases accumulate bloat over time:

Post revisions — WordPress saves every revision by default. Limit revisions with define('WP_POST_REVISIONS', 5); in wp-config.php
Transient data — expired transients from plugins clutter the options table
Spam comments — delete regularly
Orphaned metadata — leftover data from deleted plugins

Caching Configuration

Proper caching is essential for WordPress performance:

Page caching — serve static HTML instead of running PHP and MySQL on every request
Object caching — Redis or Memcached for database query caching
Browser caching — set appropriate cache headers for static assets
CDN — offload static assets to a content delivery network

PHP Version

Running an outdated PHP version hurts both performance and security. PHP 8.x is significantly faster than PHP 7.x, and PHP 7.x is faster than PHP 5.x. Check your hosting control panel and upgrade to the latest supported version.

Security Audit

Security issues directly affect SEO. Hacked sites get deindexed, and Google Safe Browsing warnings destroy organic traffic overnight.

Critical Security Checks

WordPress core — running the latest version?
All plugins — updated to the latest versions?
Theme — updated and from a reputable source?
Admin username — not “admin” (the default)?
Login URL — consider changing from /wp-admin/ to reduce brute force attempts
SSL/HTTPS — enforced on all pages?
File permissions — wp-config.php should be 440 or 400, not world-readable

Malware Indicators

Check for signs of compromise:

Unexpected redirects — especially on mobile devices
Injected links — hidden links in footer or content areas
New admin users — accounts you did not create
Modified core files — WordPress core files that differ from the official release
Suspicious cron jobs — check wp-cron.php and server cron for unexpected scheduled tasks

Content and On-Page SEO

Heading Structure

WordPress themes sometimes misuse headings — using H2 or H3 for widget titles, navigation items, or footer content. Audit your heading hierarchy to ensure:

One H1 per page — the post/page title
Logical hierarchy — H2 > H3 > H4, no skipped levels
Headings used for structure, not styling — use CSS for visual formatting

Image Optimization

WordPress’s default image handling has improved but still needs attention:

Alt text — check that all images have descriptive, keyword-relevant alt attributes
Image sizes — WordPress generates multiple sizes per upload. Ensure your theme uses appropriate sizes, not full-resolution images
WebP conversion — use a plugin or CDN to serve modern formats
Lazy loading — WordPress adds loading="lazy" by default since version 5.5, but verify it works correctly with your theme

Read our complete image optimization guide for more strategies.

Running a Comprehensive WordPress Audit

The most effective approach is to combine WordPress-specific checks with a full technical SEO audit. Start with the WordPress-specific items above, then run a broader crawl to catch issues that affect all websites regardless of CMS — broken links, redirect chains, thin content, and missing meta data.

Regular audits — monthly for active sites, quarterly at minimum — catch problems before they impact rankings. WordPress updates, plugin changes, and content additions all introduce potential SEO issues that only systematic auditing can detect.