A UK technical SEO checklist covers ten essentials: crawl access, indexation, Core Web Vitals (LCP ≤ 2.5s, INP ≤ 200ms, CLS ≤ 0.1), mobile-first usability, HTTPS and security, clean site structure, structured data (Organization, LocalBusiness, Article, FAQPage, BreadcrumbList), UK GDPR/ICO-compliant consent, hreflang if applicable, and log-file observability. A UK small business can audit all ten in a single working weekend using mostly free tools.
The list below is written as a pass/fail audit. Work through each section in order — the items at the top are foundational, and failing them will suppress the effect of every other SEO action you take.
Before you start: the tools you need
You do not need to spend money to run a thorough technical audit. The core stack is free:
- Google Search Console — free. The authoritative source of truth for how Google sees your site. Coverage report, Performance report, URL Inspection tool.
- Google PageSpeed Insights — free. Core Web Vitals measurement per URL, lab and field data.
- Chrome Lighthouse — free. Built into Chrome DevTools (F12 → Lighthouse tab). SEO, Accessibility, Performance audits per page.
- Screaming Frog SEO Spider — free up to 500 URLs; £259/yr for unlimited. UK-developed crawler, the industry standard.
- Sitebulb — paid (from £13.50/month). UK-developed auditor. More visual and beginner-friendly than Screaming Frog; excellent for first-time audits.
- Rich Results Test — free. Validates structured-data markup.
For UK small businesses under 500 URLs, start with free Screaming Frog + GSC + PageSpeed Insights. That covers 80% of the audit.
1. Crawl: is Google allowed to read your site?
Before Google can index or rank your pages, it must first crawl them. Blocking the crawler — even by accident — renders all other SEO work invisible.
Check your robots.txt — visit yourdomain.co.uk/robots.txt in a browser. Confirm it exists and does not contain Disallow: / (which blocks everything). Check that it does not block critical folders like /wp-content/, /assets/, or /css/ — blocking these prevents Google rendering your pages correctly, which tanks Core Web Vitals assessment.
Check internal link reachability — crawl your site with Screaming Frog. Export the list of pages found vs the list of pages in your sitemap. Pages that appear in your sitemap but are never discovered via internal links are effectively invisible — they have no PageRank flowing in. Every important page should have at least one inbound link from another indexed page.
Check for broken links (4xx/5xx) — Screaming Frog’s “Response Codes” report flags any URL returning a 4xx (not found) or 5xx (server error). Internal links to broken URLs waste crawl budget and bleed link equity.
Check for orphan pages — pages with no inbound internal links. If a page can only be reached via your sitemap (and not via a path from another page), it will crawl slowly and carry no internal equity. Fix: add relevant contextual links from related pages.
Pass criteria: robots.txt allows crawling of all important content; all important pages reachable via internal links in ≤3 clicks from homepage; zero internal 4xx links.
2. Indexation: is Google actually indexing the right pages?
Being crawlable and being indexed are different things. A crawled page may be excluded from the index for several reasons — and the wrong pages being indexed (thin duplicates, parameterised variants, test environments) dilutes your site’s quality signal.
Check GSC Coverage / Pages report — in GSC, navigate to Indexing → Pages. Review three categories:
- Indexed — these are live in Google’s index. Confirm they match your expected page list.
- Not indexed — review the reason codes. “Crawled — currently not indexed” often means thin content. “Duplicate without user-selected canonical” means you have duplicate pages without correct canonicals. “Excluded by noindex tag” means you’ve blocked pages — confirm this is intentional.
- Error — server errors or redirect errors. Fix these first.
Check canonical tags — every paginated page, every URL with UTM parameters, and every near-duplicate page should have a <link rel=”canonical”> pointing to the preferred URL. Run a sample crawl in Screaming Frog and export the canonical report.
Check for accidental noindex — it’s surprisingly common for a meta name=”robots” content=”noindex” tag to survive a theme change or staging migration. Screaming Frog’s “Directives” report catches these.
Pass criteria: key commercial and location pages are indexed; canonical tags are present on paginated and parameterised variants; no important pages carry an accidental noindex.
3. Core Web Vitals: is your site fast enough for Google?
Core Web Vitals are Google’s user-experience metrics. They are a ranking signal — not the strongest single lever, but a tiebreaker that matters when your content quality matches a competitor’s. The three thresholds for a “Good” rating in 2026 are:
- LCP (Largest Contentful Paint) ≤ 2.5 seconds — how fast the main content loads. The most common culprit is an unoptimised hero image. Fix: compress images (WebP/AVIF), preload the LCP element, use a UK CDN.
- INP (Interaction to Next Paint) ≤ 200 milliseconds — how fast the page responds to user interaction. Replaced FID in March 2024. The most common culprit is heavy JavaScript blocking the main thread. Fix: defer non-critical JS, reduce third-party scripts.
- CLS (Cumulative Layout Shift) ≤ 0.1 — how much the layout jumps during load. Common culprits: images without defined dimensions, cookie banners that push content down, late-loading web fonts. Fix: set explicit width/height on images; load cookie banners with reserved space.
How to measure: run PageSpeed Insights on your homepage, your most important service page, and your most important blog page. Check both Mobile and Desktop. The field data (real user measurements from the Chrome User Experience Report, CrUX) is more reliable than the lab data when your site gets traffic.
UK mobile reality note: UK 4G is excellent in London and major cities but patchy in rural areas, and 5G coverage is still city-centre-centric (Ofcom infrastructure data). Design for 4G real-world conditions, not fibre lab conditions.
Pass criteria: all three CWV are “Good” (green) in PageSpeed Insights field data on both mobile and desktop for your three most important pages.
4. Mobile-first: does it work on a phone?
Google uses the mobile version of your site as the primary source for indexing and ranking. A site that renders perfectly on desktop and breaks on mobile is being evaluated in its broken state.
Viewport meta — every page must include <meta name=”viewport” content=”width=device-width, initial-scale=1″>. Without this, Google reports the page as not mobile-friendly.
Tap target size — interactive elements (buttons, links, form fields) must be at least 48×48px with adequate spacing. Tiny taps fail usability testing and suppress mobile rankings.
Text readability — body text should be at least 16px on mobile without requiring pinch-zoom. Chrome Lighthouse’s “SEO” audit flags this as “Text too small to read”.
Mobile-first indexing check — in GSC, go to Settings → About → Google crawls primarily with the Smartphone crawler. This has been the default since 2023 for all sites. Confirm your mobile site serves the same content as desktop — hidden mobile content is not indexed.
Pass criteria: passes Google’s Mobile-Friendly Test; no “small tap target” or “text too small” Lighthouse errors; mobile and desktop serve the same core content.
5. HTTPS and security: is the site safe to trust?
HTTPS is a confirmed Google ranking signal and a user trust signal. Mixed-content warnings suppress rankings and can trigger browser security warnings that drive visitors away before they read a word.
Valid SSL/TLS certificate — check the padlock icon in Chrome. If you see a warning, your certificate may have expired or been misconfigured. Let’s Encrypt provides free certificates compatible with all major UK hosting providers.
HSTS (HTTP Strict Transport Security) — adds the header Strict-Transport-Security: max-age=31536000; includeSubDomains to instruct browsers to always use HTTPS. Prevents SSL stripping attacks. Check via Chrome DevTools → Network → click your domain → Response Headers.
Mixed content — a page served over HTTPS that loads resources (images, scripts, CSS) over HTTP generates a mixed-content error. Chrome blocks these and flags the padlock. Fix in Screaming Frog: Response Codes → filter for HTTP links on HTTPS pages.
Security headers — useful but not a ranking factor. Content-Security-Policy, X-Frame-Options, and X-Content-Type-Options protect your users and signal technical credibility. Check your headers at Security Headers.
Pass criteria: valid SSL certificate; HTTPS enforced with 301 redirects from HTTP; zero mixed-content errors; HSTS header present.
6. Site structure: can a visitor find anything in 3 clicks?
URL structure, breadcrumb navigation, and internal link depth affect how PageRank flows through your site, how quickly Google discovers new pages, and how users navigate. Topical-cluster sites that exceed 3 clicks from homepage to any priority page lose crawl efficiency and reduce the link equity reaching deep pages.
URL hygiene — all URLs should be: lowercase, hyphenated (not underscores), ≤75 characters, descriptive of the content, free of parameters (for canonical content), and free of dates for evergreen pages.
Crawl depth — crawl your site with Screaming Frog and check the “Crawl Depth” column. All commercial and location pages should be reachable in ≤3 clicks from the homepage. Pages at crawl depth 5+ rarely rank unless they receive direct external links.
Breadcrumbs — breadcrumbs tell Google the hierarchy of your site. They should be visible in the page UI (not just in schema) and should mirror the URL structure: Home > Services > Local SEO > London. Deploy BreadcrumbList schema alongside the visible trail.
Navigation consistency — your main navigation should be the same across all pages. Screaming Frog flags inconsistent navigation links.
Pass criteria: all URLs lowercase, hyphenated, descriptive; all priority pages reachable in ≤3 clicks; breadcrumbs visible and schematised; navigation consistent.
7. Structured data: does Google understand your entities?
Schema.org structured data in JSON-LD tells Google precisely what your pages are about, who created them, who your organisation is, and where you operate. It lowers the Cost of Retrieval, increases Knowledge Graph eligibility, unlocks rich results, and dramatically increases citation likelihood in AI Overviews, Perplexity, and ChatGPT Search.
Organization + Person schema — deploy globally in the site header or footer. Include: name, url, logo, sameAs (LinkedIn, Twitter/X, Wikidata, Companies House), founder, contactPoint, areaServed. This is the foundational entity declaration that every other schema type builds on.
LocalBusiness schema — for any UK business with a physical location or defined service area. Required fields: name, address (using UK PostalAddress with addressCountry: “GB”), telephone, openingHours, geo (latitude/longitude), url, sameAs.
Article schema — for every blog post and guide. Required: headline, author (Person with sameAs), publisher (Organization), datePublished, dateModified, image, mainEntityOfPage.
FAQPage schema — for any page with Q&A. Unlocks the FAQ rich result in Google SERPs and dramatically increases AIO citation rates for those questions.
BreadcrumbList schema — for every page deeper than homepage. Mirrors the URL hierarchy. Unlocks the breadcrumb display in SERPs.
HowTo schema — for step-based guides. Each step gets a name, text, and optionally an image. AI Overviews preferentially extract HowTo steps.
Validate with Rich Results Test — paste each page URL and confirm your schema is well-formed and detecting the correct schema types.
Pass criteria: Organization and Person schema sitewide; LocalBusiness on contact and location pages; Article on every blog post; FAQPage on FAQ-containing pages; BreadcrumbList throughout; all passing Rich Results Test with no errors.
8. UK GDPR and cookies: are you ICO-compliant?
Under the UK GDPR and the ICO’s cookie guidance under PECR, non-essential cookies (which includes Google Analytics, Google Ads pixels, Facebook Pixel, and most third-party tracking) must not fire before the user has given explicit consent. Pre-ticked boxes, cookie walls, or “by continuing to browse you agree” banners are non-compliant.
Cookie consent before non-essential cookies — your consent management platform (CMP) must block all non-essential scripts until consent is granted. Test by opening your site in Incognito and checking the Network tab before clicking the consent banner — no GA4 or ad pixels should fire.
Consent Mode v2 — Google’s Consent Mode v2 allows GA4 and Google Ads to use modelled conversions when consent is not given, preserving some analytics signal while respecting consent. It is required if you run Google Ads on a UK site. Configure it in your CMP before your Google tag.
Privacy policy and cookie policy pages — both are legally required in the UK. The cookie policy must list all cookies by name, purpose, and retention period.
Common CMP options: Cookiebot, OneTrust, Iubenda, Google’s own CMP partner platform, or a properly configured Complianz (WordPress plugin).
Pass criteria: non-essential cookies blocked pre-consent in testing; Consent Mode v2 configured; Privacy Policy and Cookie Policy pages exist and are linked from the footer; CMP banner is dismissible and does not use dark patterns.
9. International and hreflang (if you serve more than the UK)
For a purely UK-market business, you can skip this section. hreflang becomes necessary only when you have the same content in multiple languages, or the same site serving both UK and international markets with different URLs.
hreflang pairs — every localised URL must carry a <link rel=”alternate” hreflang=”en-gb” href=”[uk-url]”> tag pointing to itself and to each alternate locale. The alternate pages must reciprocate. Broken hreflang (pointing to pages that don’t return 200) is actively harmful — it confuses Google’s language-detection system.
GSC country targeting — in GSC → Settings → International Targeting, you can set a target country. For a pure UK site on a .com domain, set this to “United Kingdom”. For .co.uk domains this is unnecessary as the ccTLD already signals UK.
Currency and language detection UX — if you auto-detect and redirect users based on location, ensure the redirect is 302 (temporary), not 301 (permanent), so Google indexes the canonical UK version.
10. Logs and observability: how you know SEO is actually healthy
Server logs tell you what Google actually crawls — not what it discovered, not what it ranked, but what it requested. This is the ground truth that catches crawl budget waste invisible in GSC.
Log file basics — if you’re on Apache or Nginx, access.log captures every request. Cloudflare’s analytics tab provides a simplified version without raw log access. Filter for Googlebot user agent and look for: how often does Googlebot visit? Which pages? Are there 4xx or 5xx responses served to Googlebot?
GSC performance baseline — before any SEO work begins, export your GSC Performance report (12-month range, by page) and your Coverage report. This is your baseline. Every 90 days, compare to the current state. GSC data is the simplest KPI dashboard most UK small businesses ever need.
Monthly audit cadence — a full Screaming Frog crawl once a quarter; a light GSC coverage check and PageSpeed sample once a month; Rich Results Test re-validation after any site update that touches schema or templates.
Pass criteria: Googlebot is crawling your site on a consistent schedule (visible in log or GSC → Settings → Crawl Stats); no persistent 4xx/5xx in Googlebot logs; baseline GSC export saved for comparison.
Quick-win priority order for UK small businesses
If you have limited time, fix these three items first — they fix the most, the fastest:
- Submit a clean XML sitemap in GSC — if your sitemap contains 404s, noindexed pages, or redirected URLs, clean it before submission. A clean sitemap is the single fastest way to ensure Google indexes your intended pages.
- Add Organization + LocalBusiness schema to your homepage and contact page — the entity-declaration benefit is immediate and lasts indefinitely. Takes 30 minutes with a plugin (Yoast, Rank Math) or manual JSON-LD.
- Fix HTTPS mixed-content and ensure Core Web Vitals pass on mobile — these are the most frequently failing items on UK SME sites and directly affect user experience, trust, and ranking.
Common UK technical SEO mistakes
No canonical on paginated archive pages — a WordPress blog with /page/2/, /page/3/ and so on that lacks self-referencing canonicals generates duplicate-content clusters that dilute topical focus.
Blocking CSS and JavaScript in robots.txt — older robots.txt files sometimes disallow /wp-content/ or /assets/. Google cannot render your pages without these resources, which means the CWV it measures is the un-styled, un-scripted skeleton — not your real page.
CLS from shifting cookie banners — a cookie consent banner that pushes content down on load generates a CLS spike. Reserve the banner’s space statically or use a non-layout-shifting implementation.
LocalBusiness schema missing — the most common omission on UK SME sites. Adding LocalBusiness schema to the contact page and the homepage footer takes 20 minutes and is a direct Knowledge Panel eligibility signal.
Consent banner blocking GSC signals — some CMPs misconfigure Consent Mode and accidentally block Google’s own measurement tags. Check that GSC-level data (which does not require consent) is still reporting post-CMP deployment.
FAQ
Q: What’s the single biggest technical SEO problem UK small business sites have?
Indexation noise — templated pages, paginated archives, and parameterised variants being indexed alongside the canonical versions. Fixing this with correct canonical tags, noindex on thin pages, and a clean XML sitemap usually lifts impressions quickly.
Q: Do I need paid tools for a UK technical SEO audit?
Not to start. Google Search Console, PageSpeed Insights, Chrome Lighthouse, and the free tier of Screaming Frog (500 URLs) cover most of what a UK small business needs. Sitebulb or Ahrefs Site Audit add depth once your site grows beyond a few hundred URLs.
Q: How strict is UK cookie consent in 2026?
ICO guidance requires explicit consent for non-essential cookies before they fire. Consent Mode v2 lets you preserve modelled analytics data while respecting consent. A compliant CMP is effectively non-optional for UK commercial sites — the ICO has issued enforcement notices and fines to UK businesses for non-compliance.
Q: Does Core Web Vitals really affect UK rankings?
Yes, as a tiebreaker within Page Experience. A page that fails CWV loses out to equivalent content that passes, especially on mobile. UK mobile network realities (patchy 4G in rural areas) make performance gaps more visible to real users than lab conditions suggest.
Q: What’s the quickest technical SEO win for a UK small business?
Submit a clean XML sitemap in GSC, add Organization + LocalBusiness schema to your homepage and contact page, and fix any HTTPS mixed-content warnings. Each takes under an hour and moves measurable signals within weeks.
Q: Do I need hreflang if I only serve the UK?
No. hreflang matters when you operate in multiple language/region pairs. A pure UK business on a .co.uk with a UK GBP and UK phone number does not need hreflang.
Q: How often should I re-run this checklist?
Full checklist once a quarter for an active UK small-business site; light checks (GSC coverage + PageSpeed sample + Rich Results re-validation) monthly. After any major site change, run the full checklist the week after launch.
Related reading:
- Complete UK SEO guide — technical SEO in context of the full strategy
- How long does UK SEO take? — how fixing technical issues speeds the timeline
- Local SEO vs national SEO — technical requirements differ by SEO type
- How much does UK SEO cost? — budget for technical implementation
- How to choose an SEO specialist — checking if your specialist can do technical work themselves
