"SEO audit" gets used loosely enough that it's worth saying plainly what a real one actually covers. It's not a keyword report. A site can be doing everything right on keywords and still be losing customers, or exposed to a complaint, for reasons that have nothing to do with rankings. Here's the actual list, in the order we work through it.
1. Does the site actually do its job
Before anything about search engines: does the enquiry form work? Not "does it look like it works" — does it work when the thing it depends on is unavailable, when someone fills it in on a slow connection, when a bot tries to spam it. We've seen forms that looked perfect and had been silently failing for weeks, because the failure mode never showed an error to anyone. If the way customers contact you is broken, nothing else on this list matters yet.
2. Is it legally exposed
Canadian sites collecting names, emails or phone numbers are subject to PIPEDA at the federal level, and Quebec's Law 25 specifically if you market there. That means a real privacy policy, not a placeholder, and analytics that don't start tracking before a visitor has agreed to it. If you send marketing email, CASL requires you to be able to show consent was actually given — a checkbox with a timestamp, not just an assumption. None of this is optional once you're collecting contact details, which almost every business site does.
3. Is it obviously secure
Most small business sites send none of the standard security headers that tell a browser how to protect a visitor — the kind of thing that costs nothing to fix once you know it's missing, and that a five-minute scan will catch. Worth checking too: whether any leftover internal files are sitting on the live site where a search engine can find them, and whether visitor-supplied text (a search box, a comment field) gets shown back to the page safely or not. These aren't exotic risks. They're the low-effort ones that get found first.
4. Can everyone actually use it
Interactive elements — a map, a menu, a filter — need to work for someone using a keyboard or a screen reader, not just a mouse. This is both a real accessibility obligation in several Canadian provinces and, separately, just correct: a chunk of your visitors navigate this way, and a site that quietly excludes them is leaving business on the table before SEO even enters the conversation.
5. Can search engines actually understand it
This is the category people usually mean when they say "SEO audit," and it's genuinely last on the list, not first:
- Pages that exist for what you sell. A site can have a dozen pages about who it serves and none about what it actually does — no dedicated page for the specific service someone is searching for.
- Structured data. The machine-readable descriptions that tell Google what a page is, not just what it says. Most small business sites have none of it.
- Honest freshness signals. If your sitemap claims every page changed today, every day, search engines learn to ignore the signal entirely. It should only update when a page genuinely changes.
- Image loading and layout stability. A page whose main image loads late and shifts everything around it is penalized on two separate measures Google tracks, both of which are also just a worse experience for the visitor.
A useful test for any audit you're handed: does it say what was checked and how, or does it just list "issues" with no explanation of how they were verified? An audit that can't tell you how a finding was tested is a guess with a severity label on it.
Why this order
Fixing rankings on a site whose contact form doesn't work reliably, or that's exposed to a privacy complaint, is solving the least urgent problem first. We work top to bottom for a reason: each category is a bigger risk to the business than the one below it, even though the last one is the one most agencies lead with.
Our free SEO audit covers all five, not just the search-visibility ones — no cost, no obligation, walked through with you on a call.