What your checklist should include before signing
Hiring a professional SEO audit is not about asking for a pretty PDF with Semrush screenshots. It is about commissioning a diagnosis you can act on. The difference between a useful audit and a decorative report lies in whether it answers specific questions: what is blocking crawling, which pages are cannibalizing queries, what is causing a URL that previously performed well to have dropped. This checklist is designed for you to use during the selection process and also when you receive the deliverable.
One caveat up front: no audit can promise rankings or traffic. If a provider does so in writing, the checklist has already failed at the first point. According to official Google documentation, ranking systems change frequently and there is no contractual guarantee of results. What you can demand is methodology, evidence, and prioritization.
Phase 1: check the scope before hiring
1. Define what type of audit you need
A technical crawl and indexing review is not the same as a content and architecture audit. An ecommerce site with 40,000 SKUs needs a crawling budget, facet management, and duplicate control. A 30-page corporate website rarely justifies a server log analysis. Ask the provider to describe what they will look at and what they will leave out. The answer tells you more than any sales proposal.
2. Request a prior sample of the delivery format
Before paying, ask for an excerpt from a previous audit (anonymized). Pay attention to whether each finding includes: affected URL, evidence (screenshot, HTTP response, Search Console excerpt), estimated impact, and a specific recommendation with a technical owner. If you only see lists of “optimize titles” without URLs or priority, it is a generic, reusable report.
3. Ask who executes and who reviews
In large agencies, the person who sells you the audit is not always the one who performs it. Ask how many audits that person has completed, with which CMS, and whether they have worked with custom-built developments. An auditor who has only seen WordPress may overlook JavaScript rendering issues on a SPA. This is not a flaw of the agency; it is a scope limitation you should know about.
4. Verify access to real data
An audit without access to Google Search Console and analytics data is a blind audit. The provider should request read permissions (not administrator) and explain which metrics they will use: impressions, CTR, average position, pages with sustained decline, queries with commercial intent. If they do not ask for access, be suspicious.
Phase 2: checklist of the report’s technical content
5. Crawling and indexing
The report should include: robots.txt status, review of meta robots tags, canonicalization, sitemaps submitted versus indexed, and 4xx and 5xx errors grouped by pattern. A common error that only experience detects: redirect chains that go through three hops and lose signal; or misimplemented self-referencing canonicals on paginated pages that leave out page 2 of a category.
6. Architecture and internal linking
It should show how internal authority is distributed: orphan pages, click depth, broken links, and repetitive anchors. Ask for a map of the sections with the most internal inbound links and compare it with those that generate revenue. It is common to find that the “legal notice” page receives more internal links than a profitable product category.
7. Performance and Core Web Vitals
The analysis should separate lab metrics (Lighthouse) from field data (CrUX or Search Console). A high LCP in the lab may not be reflected in the field if the real user has a different connection. The report should indicate which template, which resource, and which provider cause the problem, not just the score.
8. Content and cannibalization
Checklist: queries where two or more URLs alternate positions, pages with duplicate or near-duplicate content, repeated titles and H1s, and pages that receive impressions but have a CTR below the site average. One nuance is worth noting here: cannibalization is not always an error; sometimes it reflects a poorly resolved intent architecture, and the solution is to merge, not rewrite.
9. Structured data and rich results
The auditor should check which schema types are implemented, whether they validate, and whether they match the page type. A frequent case on local service websites: marking LocalBusiness on all URLs, including blog ones, which generates inconsistent signals. According to official Google documentation, structured data must describe the visible content of that specific page.
10. Link profile and risks
A thorough backlink analysis is not necessary in every audit, but a review of obvious toxic links, loss of relevant links, and consistency between brand mentions and links is. If the provider promises to “clean” the profile without explaining the criteria, ask for details: a poorly executed disavow can do more harm than leaving a questionable link.
Phase 3: evaluate the deliverable when it arrives
11. Prioritization by impact and effort
Each recommendation should carry an impact estimate (high, medium, low), implementation effort, and dependency (development team, content, marketing). A report with 120 actions and no order is a report no one will execute. Ask that the first ten be justified with data.
12. Traceability of each finding
Check that you can reproduce the problem: exact URL, capture date, tool used, and expected result. If the report says “there is duplicate content” without listing the URLs, it is not an audit; it is an impression.
13. Monitoring and measurement plan
The audit should propose what to measure afterward: indexed pages, impressions by cluster, CTR of key pages, organic conversions. And it should warn that some improvements take weeks or months to be reflected. Any promise of results in seven days is a red flag.
14. Declared limitations
An experienced auditor acknowledges what they cannot know: the real impact of an algorithm change before it happens, the behavior of competitors with private data, or the effect of a migration without access to historical data. If the report does not include a section on limitations and assumptions, it is probably overselling certainty.
Common mistakes when hiring
One of the most common: hiring the audit and not setting aside budget to implement it. I have seen 60-page reports with critical crawling findings that ended up in a drawer because the development team had no hours assigned. Before signing, agree on who will execute the actions and by when. If there is no internal technical team, ask whether the provider offers implementation or at least support with validation.
Another mistake: requesting an audit as an excuse to justify a traffic drop without providing data. The auditor needs the Search Console history, deployment dates, and content changes. Without that context, the diagnosis will be superficial and the recommendations generic.
And a third: confusing an audit with a strategy. The audit diagnoses; the strategy decides what to do with resources. They are distinct deliverables and are often offered by the same provider, but they should not be mixed in the same document without clearly separating diagnosis and plan.
What not to expect from an audit
Do not expect it to solve business problems that are not SEO: a catalog with uncompetitive prices or a vague value proposition will not be fixed with canonical tags. Nor should you expect it to replace an accessibility or web security review, even though there are technical overlaps. And do not expect it to detect every problem on a huge website in a single pass: on sites with millions of URLs, the audit works by samples and patterns, not by exhaustive review.
The checklist that really matters fits into one question: does this report allow me to make concrete decisions next week? If the answer is yes, hiring makes sense.