Technical SEO checklist for small business websites

A technical SEO checklist for a small business website covers the checks that decide whether Google can find, read, index and show your pages: Search Console access, indexing, robots.txt, the sitemap, one address per page, HTTPS, phones, speed, JavaScript, errors and redirects, structured data, and page titles. Work through it in that order, because the later checks only matter once the early ones pass. Run the full list at launch or after a rebuild, then check the main Search Console reports once a month.

What is a technical SEO checklist?#

Google's Search Essentials set three technical requirements for indexing: Googlebot isn't blocked, the page returns an HTTP 200 status code, and it has indexable content. Meeting them does not guarantee indexing. Every check below protects those three or helps Google pick and show the right page.

You can usually skip crawl budget. Google wrote its crawl budget guide mainly for sites with a million or more pages that change weekly, sites with 10,000 or more that change daily, and sites where Search Console lists a large share of URLs as discovered but not indexed. If Google crawls your new pages on the day you publish them, the guide says you don't need to read it.

Some basics are often missing, though. HTTP Archive's 2025 Web Almanac found a title on 98.5% of mobile pages but a canonical tag on only 67% and a meta description on 67.2%, and half of home pages had no structured data.

The checklist at a glance#

Each row matches a numbered section below. After the first pass, the last column is your routine.

1. Own your Search Console property#

Search Console is free, and most checks below use its reports. Add a Domain property, which includes all subdomains and both http and https. You verify it with a DNS record at your domain provider, and the record must stay in place afterwards.

Every property needs at least one verified owner, and if all of them are removed, the other users lose access after a grace period. If your freelancer or agency is the only verified owner, your access depends on them. Verify ownership from a Google account the business controls, then add your freelancer or agency as a Full user under Settings, Users and permissions. The business should own its domain name and accounts for the same reason.

2. Check that Google has indexed your important pages#

The Page indexing report lists the reasons pages are not indexed, such as noindex tags, redirects and duplicates. Google says not to expect every URL to be indexed, so duplicates there are normal, but important pages should not be on the list. After a fix, click Validate fix. Validation typically takes up to about two weeks.

For one page, the URL Inspection tool shows whether it is indexed, which canonical Google chose and, in a live test, how Google sees it now. You can request indexing there, but a request guarantees nothing, there is a daily limit, and indexing typically takes a day or so, sometimes much longer. A site: search is no way to count indexed pages, because the site: operator doesn't necessarily return every indexed URL.

On WordPress, check Settings, Reading. The "Discourage search engines" box adds a noindex,nofollow tag to your pages and turns off the built-in sitemaps. Untick it when the site goes live.

3. Read your robots.txt file#

Open yoursite.com/robots.txt in a browser. The file is mainly there to stop crawlers overloading your site, and it does not keep pages out of Google: a disallowed page can still be indexed if other sites link to it. To keep a page out, use noindex, which only works if robots.txt lets Google fetch the page.

A missing file is fine: Google treats a 4xx response (other than 429) as no crawl restrictions. A server error is worse, because Google stops crawling for the first 12 hours, then uses the last good copy for up to 30 days. Most small sites need no more than this:

User-agent: *
# Optional: a folder you want crawlers to skip
Disallow: /admin/

Sitemap: https://www.example.com/sitemap.xml

Decide what AI crawlers may fetch#

You don't need llms.txt or special AI markup for Google: its guide to AI features in Search says Google Search ignores such files. Google-Extended controls whether Gemini models may use your content, and blocking it does not affect inclusion or ranking in Google Search. OpenAI says disallowing GPTBot tells it not to use your content for training, while sites that block OAI-SearchBot are not shown in ChatGPT search answers. So blocking GPTBot or Google-Extended is a choice about how AI models may use your content. Few sites have acted either way: in the 2025 Web Almanac, 4.2% of mobile sites named GPTBot in robots.txt and 2.1% had a valid llms.txt file.

4. Submit a clean XML sitemap to Google#

A sitemap lists the pages you want Google to find. A site of about 500 pages or fewer, with every important page reachable through links from the home page and few videos, images or news articles you want in search results, may not need one. We would still have one. On Shopify and WordPress it is automatic: Shopify generates a sitemap.xml for every store, and WordPress has made one at /wp-sitemap.xml since version 5.5. Google's sitemap rules, in short:

• List only the canonical URLs you want in search results, as full addresses.
• Keep lastmod accurate, because Google uses it only when it is. Google ignores priority and changefreq.
• Submit the sitemap in the Sitemaps report and add a Sitemap line to robots.txt, as above.

5. Give every page one address#

One page often loads at several addresses, for example http and https versions, sorting and filtering options, or a demo copy of the site left open to crawlers. Some duplication is normal and not spam, but Google will pick one version as canonical. A redirect or a rel="canonical" link is a strong signal for the version you prefer, and a sitemap entry a weak one. Don't use robots.txt or noindex for this: noindex blocks the page from Search completely. URL Inspection shows the canonical you declared next to the one Google selected.

Online stores need the most care, because sorting and filters can give one category page many addresses. Clean URLs are part of our online store builds.

6. Finish the move to HTTPS#

Chrome 154 became the stable release on 22 September 2026. It prompts users by default when they connect to a site over http. The Chrome team's announcement explains that Chrome asks for permission before the first visit to any public site without HTTPS. Nothing is blocked, but a first-time visitor sees a warning. Most traffic has moved already: the same announcement, dated 28 October 2025, put HTTPS at 98% of Chrome visits to public sites on Windows and over 99% on Android and Mac.

Check that the HTTPS report shows no HTTP URLs, that every http address redirects permanently to https, and that your canonical tags, sitemap and internal links use https. Keep the certificate renewing automatically: Google prefers HTTPS pages as canonical unless there are problems such as an invalid certificate.

7. Check the site on a phone#

Since 5 July 2024, Google has crawled and indexed with only Googlebot Smartphone, and content that is not accessible at all on a mobile device can no longer be indexed. Because Google indexes the mobile version, give phones the same content, headings, titles and meta descriptions as desktop. It also won't load content that needs a swipe, a click or typing to appear.

The Mobile-Friendly Test was retired on 1 December 2023, so use a real phone. Try the menu, forms and call buttons, and look for anything cut off or too small to tap. A URL Inspection live test adds a screenshot of what Google rendered. This matters even more if your customers are in India, where StatCounter counted 77.3% of page views from phones in September 2026, against 58.99% worldwide.

8. Measure speed with real-user data#

Google rates a page's Core Web Vitals as good when loading (LCP) takes 2.5 seconds or less, response to taps and clicks (INP) takes 200 milliseconds or less, and layout shift (CLS) is 0.1 or less. Each is measured at the 75th percentile of page loads, on mobile and desktop separately. Google's ranking systems use these measures, but Search always aims to show the most relevant content, even when the page experience is sub-par. So fix poor results without chasing a perfect score.

PageSpeed Insights shows field data from real visits over the last 28 days beside a simulated lab test, and the two can differ. When they do, go by the field data. A site with little traffic may have no field data at all.

Visitors in India get a slower web. In September 2026, HTTP Archive's Core Web Vitals report showed that 31.6% of sites gave phone visitors in India a good experience, against 52.8% worldwide. Loading was the biggest gap: 41.2% of sites had a good LCP for those visitors, against 65.6% worldwide. In the 2025 Web Almanac, an image was the largest element in view on 76% of mobile pages, so start with your main image. Our guide explains what LCP, INP and CLS measure and how to fix each one.

9. Make sure JavaScript is not hiding content#

Google can run JavaScript, but it still calls server-side rendering or pre-rendering a great idea, because it makes a site faster for users and crawlers and not all bots can run JavaScript. It also warns that using JavaScript to remove a noindex tag may not work.

Links should be <a> elements with an href, which Google says is generally the only kind it can crawl, so a menu built from scripted buttons can hide pages. Googlebot reads only the first 2MB of an HTML file, uncompressed, so keep large inline scripts out of the HTML, where they could push your content and links past that point. To check, open the rendered HTML in a URL Inspection live test.

10. Fix errors and use the right redirects#

Google doesn't index URLs that return a 4xx code and removes ones already indexed. It slows its crawling on 5xx and 429 errors and follows up to 10 redirect hops. In the Page indexing report, watch Not found (404), Server error (5xx), Redirect error and Soft 404, which means an empty or error page that returns a success code.

When a page moves for good, use a permanent redirect (301 or 308): Google uses it as a signal that the new URL should be canonical, and does not use a temporary one (302 or 307) that way. Before a redesign, map every old URL to its new address. Keep the redirects for at least a year, and don't send many old URLs to one irrelevant page such as the home page. To close the site for a day or two, serve a 503. Check the Security issues report monthly too, because hacked pages can carry a warning label in search results.

11. Add structured data that matches the page#

Structured data is a standard format for telling Google what a page is about, and Google recommends JSON-LD. On the home page, start with Organization, which has no required properties, and WebSite, which tells Google your preferred site name. A logo, if you add one, must be at least 112 by 112 pixels. Replace the placeholders with your own details:

<script type="application/ld+json">
{
  "@context": "https://schema.org",
  "@graph": [
    {
      "@type": "Organization",
      "name": "Your Business Name",
      "url": "https://www.example.com/",
      "logo": "https://www.example.com/logo.png",
      "sameAs": ["https://www.instagram.com/yourbusiness"]
    },
    {
      "@type": "WebSite",
      "name": "Your Business Name",
      "url": "https://www.example.com/"
    }
  ]
}
</script>

LocalBusiness markup requires an address, so use it only if you have a real street address to show. If you travel to customers, keep Organization and set up a service-area Google Business Profile. Whatever you add must be a true representation of the visible page, and even correct markup does not guarantee a rich result. Two old tactics do not work: a business that controls the reviews about itself is ineligible for review stars, and FAQ rich results stopped appearing on 7 May 2026.

12. Tidy titles, descriptions, links and favicon#

• Give every page its own <title>, as Google asks.
• Write a meta description for each important page. There is no length limit, but Google truncates snippets to fit the device, so put the useful part first.
• Link every page you care about from at least one other page, with link text that says where it leads.
• Use a square favicon of at least 8 by 8 pixels (Google recommends larger than 48 by 48), and don't block Google from crawling it.

Outdated advice you can skip#

Each row links to the Google page that retired or rules out the advice.

What to ask your developer or SEO provider#

Whoever you hire, us included, ask these before work starts and get the answers in writing:

• Will the business be a verified owner in Search Console?
• Can you show Core Web Vitals field data on phones for sites you have built, and which platform, theme or page builder will you use?
• At relaunch, will every old URL redirect to its new address?
• Who removes the staging noindex at launch, and who checks that it has gone?
• What will robots.txt block, and which structured data will you add?

Google's guide to hiring an SEO lists questions to ask, among them whether they follow the Google Search Essentials and what results they expect, in what timeframe. It says no one can guarantee a #1 ranking, and warns against claims of a "special relationship" with Google or a "priority submit". Ask us the same about website design and development or the technical SEO audit in our SEO services.

Where to start#

This week, make the business a verified owner in Search Console, run your home page through URL Inspection to confirm it is indexed and the live test finds no noindex, and submit your sitemap. Then give it time. Google's SEO Starter Guide suggests waiting a few weeks before judging changes, Page indexing validation typically takes up to about two weeks, and the Core Web Vitals report tracks a fix for 28 days. If you would rather hand the list over, ask us for a free SEO audit. More guides are on our SEO topic page.