Google Search Console Audit: 12 Checks Most Agencies Skip

Most agencies check Search Console once a month. They glance at total clicks, skim the top queries report, screenshot a graph for the client deck, and move on. The actual audit — the systematic review that catches indexing gaps, cannibalisation, and slow-moving technical debt — never happens.

It’s not that they don’t know better. It’s that a proper Google Search Console audit is tedious. The interface buries critical data behind multiple clicks, the export limits are frustrating, and cross-referencing queries against pages against devices against countries requires more patience than a monthly retainer affords.

This is the checklist we use. Twelve checks, in order, covering everything from property setup to performance decay analysis. Most of them take five minutes individually — the problem is that most agencies never do them together.

What Is a Google Search Console Audit?

A Google Search Console audit is a systematic review of your GSC property configuration, index coverage, site health signals, and search performance data to identify technical SEO issues, missed opportunities, and data integrity problems. Unlike a broader SEO audit that spans content strategy and backlinks, a GSC audit focuses specifically on what Google sees, how it crawls your site, and where its understanding differs from your intent. Done properly, it surfaces issues that no other tool can — because GSC is the only source of truth for how Google actually treats your pages.

Why Most Agencies Skip These Checks

Before the checklist: a bit of honesty about why these get missed.

The monthly report template doesn’t include them. Most agency reporting is built around vanity metrics — total impressions, total clicks, top 10 queries. The template was set up two years ago, the client has never asked for more, and the analyst filling it in each month has no incentive to dig deeper.

GSC’s interface is hostile to systematic auditing. Switching between Performance, Coverage, Sitemaps, Mobile Usability, and Core Web Vitals tabs — each with its own date picker and filter system — is slow. Cross-referencing data across sections requires manual exports and spreadsheet work.

Some checks require context that only exists outside GSC. Crawl budget analysis means interpreting response codes alongside server logs. Cannibalisation detection means comparing query-level data across dozens of pages. These aren’t single-click checks.

The payoff is invisible until it compounds. Fixing a property verification method doesn’t show up in next month’s report. But six months of undetected index bloat absolutely will.

The 12-Point Google Search Console Audit Checklist

Here’s every check, why it matters, why it gets skipped, and how to fix what you find.

1. Property Verification Method

What to check: How is the property verified? GSC supports several methods — DNS TXT record, HTML file upload, HTML meta tag, Google Analytics tracking code, and Google Tag Manager container snippet.

Why agencies skip it: Verification is a one-time setup task. Once it’s green, nobody looks at it again.

Why it matters: HTML file and meta tag verification can break silently during site migrations or CMS updates. If verification lapses, you lose access to data — and you won’t know until you next log in. DNS verification is the most robust because it’s independent of your site’s code and survives redesigns, platform migrations, and CDN changes.

The fix: Switch to DNS TXT record verification if you’re using any other method. For clients where you don’t control DNS, use domain-level property verification (which requires DNS anyway). Document the verification method in your client onboarding checklist.

2. All Site Variants Added (or Domain Property Configured)

What to check: Are all variants of the site represented? That means http://example.com, https://example.com, http://www.example.com, and https://www.example.com — four distinct properties in GSC’s URL-prefix model.

Why agencies skip it: Most people add the canonical HTTPS version and assume that covers everything.

Why it matters: If someone links to http://www.example.com and you only have the https://example.com property, that traffic and those impressions are invisible. You’re making optimisation decisions based on incomplete data. The better solution is a domain-level property, which aggregates all variants automatically — but it requires DNS verification (see check #1).

The fix: Create a domain-level property. If that’s not possible, add all four URL-prefix variants and set up a single view that you cross-reference. Alethia’s GSC integration can discover all verified properties across a Google account in one call, which makes this a 10-second check instead of a manual hunt through the GSC property switcher.

3. Sitemap Submission and Status

What to check: Has a sitemap been submitted? What’s its status? How many URLs were submitted vs. how many were indexed? Are there errors?

Why agencies skip it: Sitemaps feel like a “set it and forget it” task. Submit it once, assume Google handles the rest.

Why it matters: Sitemaps degrade. A sitemap generated six months ago might reference URLs that no longer exist (returning 404s), include non-canonical URLs, or miss entire sections of the site added since it was last generated. A sitemap with a high ratio of submitted-to-excluded URLs is a signal that Google disagrees with your site’s idea of what should be indexed.

The fix: Check three things: (1) the sitemap was submitted and its status is “Success,” (2) the submitted URL count roughly matches your actual page count, and (3) there are no errors flagged. If you’re using a CMS that auto-generates sitemaps, verify it’s not including paginated archives, tag pages, or parameter variations you don’t want indexed.

If you’re managing multiple properties, you can programmatically check sitemap status and even submit updated sitemaps through GSC’s API — something Alethia handles natively for all connected properties.

4. Index Coverage Gaps

What to check: The Coverage report (now called “Pages” in the updated GSC interface) breaks every URL into categories: Indexed, Not Indexed, and the specific reasons for exclusion. The critical ones: “Crawled — currently not indexed,” “Discovered — currently not indexed,” “Excluded by noindex tag,” “Duplicate without user-selected canonical,” and “Page with redirect.”

Why agencies skip it: The Coverage report is overwhelming. A site with 10,000 pages might have 15 different exclusion reasons, each with hundreds of URLs. Parsing through them feels like a project, not a check.

Why it matters: This is where you find out that Google is ignoring 40% of your site. “Crawled — currently not indexed” means Google saw the page, evaluated it, and decided it wasn’t worth indexing. That’s a content quality signal. “Discovered — currently not indexed” means Google knows the page exists but hasn’t bothered to crawl it — a crawl budget signal. Both require different fixes.

The fix: Export the full exclusion list. Group URLs by pattern (e.g., /blog/tag/*, /products?page=*). For each pattern, decide: should these pages be indexed? If yes, investigate why Google is excluding them (thin content, duplicate content, canonicalisation issues). If no, add noindex tags or remove them from the sitemap to stop wasting crawl budget on pages you don’t want indexed anyway.

5. Manual Actions

What to check: Navigate to Security & Manual Actions > Manual Actions. Is it clean?

Why agencies skip it: They don’t. This is the one check everyone does — but only when they suspect a problem. It should be part of every regular audit.

Why it matters: A manual action means a human reviewer at Google has penalised your site for violating webmaster guidelines. Common triggers: unnatural links (inbound or outbound), thin content with no added value, cloaking, and user-generated spam. Manual actions suppress rankings for part or all of the site until you fix the issue and submit a reconsideration request.

The fix: If clean — document it and move on. If there’s an active manual action, it becomes the top priority. Fix the underlying issue, document what you’ve done, and submit a reconsideration request through GSC. Timelines vary, but expect 2-4 weeks for review.

6. Core Web Vitals Status

What to check: The Core Web Vitals report in GSC shows how your pages perform on three metrics — Largest Contentful Paint (LCP), Interaction to Next Paint (INP), and Cumulative Layout Shift (CLS) — grouped by mobile and desktop, categorised as Good, Needs Improvement, or Poor.

Why agencies skip it: Because fixing Core Web Vitals requires developer involvement, and most agency SEO teams don’t have direct access to the dev queue. It’s easier to note “CWV needs improvement” in a report than to actually push for fixes.

Why it matters: Core Web Vitals are a confirmed ranking factor. More practically, poor INP and LCP directly correlate with higher bounce rates and lower conversion rates. A page that takes 4 seconds to become interactive loses users regardless of how well it ranks.

The fix: Focus on the URLs grouped under “Poor” — these are the ones actively hurting you. For LCP issues, the usual culprits are unoptimised hero images, render-blocking JavaScript, and slow server response times. For CLS, look for images without dimensions, dynamically injected content, and late-loading fonts. For INP, investigate heavy JavaScript execution on interaction. Use PageSpeed Insights for URL-level diagnostics, then feed the recommendations to your dev team with priority rankings.

7. Mobile Usability Issues

What to check: The Mobile Usability report flags pages with issues like text too small to read, clickable elements too close together, and content wider than the screen.

Why agencies skip it: In 2026, most sites are responsive by default, so teams assume mobile usability is “handled.” It usually is — until a new page template, a plugin update, or a CMS change introduces regressions.

Why it matters: Google uses mobile-first indexing. If your mobile experience is broken, your rankings suffer across all devices. The Mobile Usability report catches issues that might not be obvious in a quick phone check — especially on pages with complex layouts, forms, or embedded content.

The fix: Export the affected URLs. Group by template (product pages, blog posts, landing pages). Fix at the template level rather than page by page. Re-validate in GSC after deploying fixes — the report updates within a few days of a successful re-crawl.

8. Structured Data and Rich Results Errors

What to check: The Enhancements section in GSC reports on structured data validity for types Google supports — FAQ, How-to, Product, Review, Breadcrumb, Article, and others. Each type shows valid items, items with warnings, and items with errors.

Why agencies skip it: Structured data is often implemented by developers during the initial build, then never reviewed. Agencies managing paid media and SEO rarely have structured data on their monthly checklist.

Why it matters: Valid structured data earns rich results — review stars, FAQ dropdowns, product prices, breadcrumb trails in SERPs. These dramatically improve click-through rates. A single schema error can disqualify an entire page from rich results. Worse, schema that was valid six months ago might now violate updated Google guidelines.

The fix: Check each enhancement type in GSC. For errors, click through to see the specific issue (missing required field, invalid value, etc.) and the affected URLs. Fix the schema markup, then use GSC’s validation tool to request re-evaluation. For pages where you expect rich results but see nothing in the Enhancements report, test the URL in Google’s Rich Results Test tool — the page might have schema markup that Google doesn’t recognise or support.

Alethia can pull search appearance data across all your properties, showing which rich result types are actually earning impressions and clicks — useful for prioritising which schema implementations to fix first.

9. Security Issues

What to check: Security & Manual Actions > Security Issues. This flags malware, hacked content, deceptive pages, and other security problems Google has detected.

Why agencies skip it: Like manual actions, this is typically checked reactively — when a “This site may be hacked” warning appears in search results — rather than proactively.

Why it matters: Security issues trigger browser warnings that effectively kill all organic traffic. If Google detects malware or hacked content, your pages get a warning interstitial in Chrome and can be demoted or removed from search results entirely. By the time you notice the traffic drop, the damage has been compounding for days.

The fix: If clean, document and move on — but check it regularly rather than waiting for the traffic cliff. If flagged, engage your security team or hosting provider immediately. Google provides details on the affected URLs and the type of issue. After cleaning up, request a security review through GSC. For ongoing protection, set up GSC email alerts (Settings > Email preferences) so you’re notified immediately if a security issue is detected.

10. Internal Linking Analysis

What to check: The Links report in GSC shows your top linked pages (internally), top linking pages, and the anchor text used. This reveals your site’s internal linking structure from Google’s perspective — which can differ significantly from what your CMS or crawling tool reports.

Why agencies skip it: Internal linking analysis isn’t in the standard SEO report template. It requires interpretation, not just data extraction. Most teams focus on external backlinks and ignore the internal linking graph entirely.

Why it matters: Internal links distribute PageRank and signal content hierarchy to Google. Pages with few or no internal links are effectively orphaned — Google may crawl them less frequently or not at all, regardless of their content quality. Conversely, if your homepage links to every page equally, you’re not signalling which pages matter most. The GSC Links report shows you what Google actually sees, which may differ from what your site navigation suggests (JavaScript-rendered links, for example, might not be followed).

The fix: Export the internal links report. Look for: (1) important pages with very few internal links — these need more contextual links from related content, (2) low-value pages with disproportionately many internal links — these are draining link equity, and (3) your most-linked pages — are these the pages you actually want to rank? If your top internally-linked page is your privacy policy, your linking structure needs work.

If you’re also running a GTM audit, cross-reference the internal linking data with your analytics to understand whether highly-linked pages are actually receiving traffic and converting.

11. Crawl Stats Review

What to check: Settings > Crawl Stats in GSC shows how Googlebot interacts with your site over the past 90 days — total crawl requests, download size, average response time, response code breakdown, file type breakdown, and crawl purpose (discovery vs. refresh).

Why agencies skip it: It’s buried in Settings, not in the main navigation. Most SEO analysts don’t even know it exists.

Why it matters: Crawl stats reveal whether Google is having trouble accessing your site. Average response times above 500ms suggest server performance issues that slow crawling. A spike in 5xx response codes means Google is hitting errors. A decline in crawl requests over time might signal that Google is losing interest in your content — a serious problem for large sites.

For sites with more than 10,000 pages, crawl budget becomes a real constraint. If Google is spending its crawl budget on parameter URLs, faceted navigation pages, or infinite scroll pagination, your important pages get crawled less frequently. The crawl stats report is the only place to see this.

The fix: Check three things: (1) average response time — should be under 300ms consistently, (2) response code distribution — 200s should dominate, with minimal 301s/302s and near-zero 4xx/5xx, and (3) crawl trend — stable or growing, not declining. If response times are high, work with your hosting team on server performance. If error rates are elevated, cross-reference the affected URLs with your server logs.

12. Search Performance Trends

What to check: This is the big one — the Performance report, but analysed properly instead of glanced at. You’re looking for: CTR decay (positions holding but clicks declining), position erosion (gradual drops across a query cluster), keyword cannibalisation (multiple pages competing for the same query), and opportunity gaps (high-impression, low-CTR queries where better titles or meta descriptions could win more clicks).

Why agencies skip it: They don’t skip Performance entirely — they just don’t analyse it at the depth required. Looking at top 10 queries and declaring “traffic is up 5%” is not a performance analysis. A real analysis requires query-page cross-referencing, device segmentation, date comparisons, and pattern recognition across hundreds or thousands of queries.

Why it matters: Performance trends are leading indicators. A page that drops from position 3 to position 6 over eight weeks won’t show up as a problem in a monthly traffic report — the traffic decline is gradual enough to be masked by normal fluctuation. But catch it in the query-level data and you can diagnose and fix it before it drops off page one entirely.

Keyword cannibalisation is the most common issue found here. Two pages targeting the same query split Google’s confidence between them, and both end up ranking lower than either would alone. GSC’s query-page breakdown is the definitive way to detect this — look for queries where two or more of your URLs appear, especially if their positions fluctuate relative to each other.

The fix: For CTR decay, A/B test your title tags and meta descriptions — if your position is stable but clicks are dropping, competitors have written more compelling SERP snippets. For position erosion, check whether the page’s content is still competitive (has the SERP intent shifted? Have competitors published better content?). For cannibalisation, consolidate: merge the weaker page into the stronger one and redirect. For opportunity gaps, sort by impressions descending, filter to position 5-20, and identify queries where you could realistically improve with better content or on-page optimisation.

This is also where an automated tool earns its keep. Manually cross-referencing queries, pages, devices, and countries in GSC’s interface is painstaking work — you’re limited to 1,000 rows per export, the filters are slow, and comparing date ranges requires switching back and forth. Alethia’s GSC agent can pull query-page breakdowns, device segmentation, country-level data, and date trends programmatically — making a check that would take an afternoon a task you can run in under a minute across every property you manage.

How to Structure Your GSC Audit Cadence

Running all 12 checks once is useful. Building them into a cadence is where the real value compounds.

Weekly (5 minutes): Check security issues and manual actions. These are time-sensitive — every day you don’t catch them costs traffic. Set up GSC email alerts as a backstop.

Monthly (30 minutes): Run through checks 3-8 — sitemap status, index coverage, Core Web Vitals, mobile usability, structured data. These are the checks that catch slow-moving problems before they become crises. Export the data and compare against last month’s baseline.

Quarterly (2-3 hours): Full 12-point audit. This is when you do the deep performance analysis (check #12), review internal linking patterns (check #10), and audit crawl behaviour (check #11). This is also when you compare your GSC data against your GA4 analytics data to identify discrepancies between what Google reports and what your analytics shows.

After major changes: Site migrations, CMS updates, domain changes, and large content publishes should all trigger a targeted audit. At minimum, re-run checks 2, 3, 4, and 11 within a week of any significant site change.

Mid-article CTA: If you’re managing GSC across multiple client properties, this cadence becomes impractical without automation. Alethia’s GSC agent with 13 search tools runs every check on this list programmatically — sitemap validation, performance trends, device breakdowns, cannibalisation detection — across all your connected properties. See how it works.

Common GSC Audit Mistakes

Even when agencies do audit GSC, they make predictable mistakes:

Checking only the last 28 days. GSC defaults to the last three months, but most analysts shorten the date range. Trends that are obvious over 12 months — gradual position decay, seasonal CTR patterns, crawl budget changes — are invisible in a 28-day window. Always compare against at least 6 months of data for trend analysis.

Ignoring the “Excluded” pages in Coverage. The “Valid” count going up feels like good news. But if “Excluded” is growing faster, you’ve got a content quality or canonicalisation problem that the green checkmarks are hiding.

Not segmenting by device. Aggregate performance data masks mobile-specific problems. A page that ranks position 2 on desktop and position 8 on mobile will show an average position of 5 — which looks fine until you realise 70% of your traffic is mobile.

Treating GSC data as absolute. GSC rounds, samples, and delays data. Click counts won’t match Google Analytics exactly. Position data is an average across all impressions, not a fixed ranking. Use GSC data directionally, not as a source of accounting-grade precision.

Pairing Your GSC Audit With Other Audits

A GSC audit doesn’t exist in isolation. The most useful findings come from cross-referencing GSC data with other audit outputs:

• GTM audit: If your conversion tracking is broken (duplicate tags, consent gaps), your GA4 data is unreliable — which means any traffic-to-conversion analysis that uses GSC impressions as a top-of-funnel metric is built on bad data. Fix tracking first, then analyse performance.

• Google Ads audit: GSC search query data and Google Ads search terms data should tell a consistent story. If a query is driving strong organic clicks in GSC but you’re also bidding on it in Google Ads, you might be cannibalising your own organic traffic with paid spend. Conversely, queries with high GSC impressions but low CTR might be worth targeting with paid ads to capture the clicks your organic listing isn’t winning.

• GA4 pipeline: GSC shows impressions and clicks from Google Search. GA4 shows what those users do after they land. Combining the two — GSC query data with GA4 engagement and conversion data — gives you the full picture from search intent to business outcome.

The Bottom Line

A Google Search Console audit checklist isn’t complicated. It’s twelve checks, most of which take minutes individually. The reason most agencies skip them isn’t complexity — it’s friction. The data is spread across multiple reports, the exports are limited, the cross-referencing is manual, and the payoff from any single check is too small to justify the time.

But compounded across a quarter, across a year, across a portfolio of client properties, the checks you skip are exactly where the problems hide. Index bloat growing at 2% per month. Cannibalisation slowly eroding your best-ranking pages. Crawl budget wasted on URLs that shouldn’t exist. Security issues festering for days before anyone notices.

Run the checklist. Build the cadence. And if you’re managing more than a handful of properties, automate the tedious parts so you can focus on the analysis that actually requires a human brain.