Every site audit check explained

This is the full list of checks the site audit runs, grouped by the category they count towards. For each check you get its severity, what it means and how to fix it.

The Button column shows what the audit offers next to the issue:

• Fix it: a one-click fix. RankKit SEO changes the setting, logs it in the Change Log and re-runs the audit.
• Set up: opens the RankKit SEO screen where you make the change.
• Open: opens the WordPress screen where you make the change.
• Fix with AI: RankKit SEO Pro writes new values for the affected items with your AI provider (up to 20 per click). On the free plan the button shows a Pro badge, and you fix the items one by one with View.
• None: the fix happens outside RankKit SEO or in your content. The issue's explanation says what to do.

Checks that list affected items have a View link. Severity can be Critical, Warning or Notice.

Indexing

Check	Severity	What it means	How to fix it	Button
Search engines are blocked	Critical	Settings → Reading → Discourage search engines from indexing this site is ticked, so nothing on the site gets indexed.	Untick it on the WordPress Reading screen.	Open
XML sitemaps are off	Warning	The sitemaps module is off. Sitemaps help search engines find new and updated pages.	Turn the module back on. See XML sitemaps.	Fix it
Google Search Console not verified	Notice	No Google verification code is set.	Add the code in Settings → Webmaster tools. See Verify your site.	Set up
IndexNow is off	Notice	The IndexNow module is off, so Bing and other engines are not told about new content.	Turn it on. See IndexNow.	Fix it

Metadata

Title and description checks look at the final SEO title and description of each page, after your title templates are applied.

Check	Severity	What it means	How to fix it	Button
Site tagline is empty or the WordPress default	Notice	The tagline is empty or still "Just another WordPress site". It is used in your home page title and llms.txt.	Write a tagline in Settings → General.	Open
Pages without a written meta description	Warning	These pages have neither a RankKit SEO description nor an excerpt, so Google picks a random snippet.	Write a description in the RankKit SEO panel of the block editor or the bulk SEO editor.	Fix with AI
Duplicate SEO titles	Warning	Two or more pages have the same SEO title and compete with each other.	Give each page a distinct title.	Fix with AI
Duplicate meta descriptions	Notice	Two or more pages share a meta description.	Describe what is unique about each page.	Fix with AI
SEO titles longer than 60 characters	Notice	Long titles get cut off in search results.	Shorten the title.	Fix with AI
SEO titles shorter than 25 characters	Notice	Short titles miss keywords and a reason to click.	Expand the title.	Fix with AI
Meta descriptions longer than 160 characters	Notice	Google truncates descriptions around 155 to 160 characters.	Shorten the description.	Fix with AI
Meta descriptions shorter than 70 characters	Notice	Short descriptions waste space in the search result.	Expand the description.	Fix with AI

Content

Check	Severity	What it means	How to fix it	Button
Keyword cannibalization (posts share a main focus keyword)	Warning	Several published posts have the same main (first) focus keyword and compete for it.	Merge the posts, or give each one a different main keyword.	None
Thin posts (under 300 words)	Warning	Posts (not pages) with fewer than 300 words rarely rank.	Expand, merge or noindex them.	None
No focus keyword set	Notice	Without a focus keyword RankKit SEO cannot score the page or spot cannibalization.	Set one in the General section of the RankKit SEO panel in the editor.	None
Focus keyword missing from the SEO title	Notice	The main focus keyword does not appear in the SEO title, the strongest on-page relevance signal.	Work the keyword into the title.	Fix with AI
Orphan posts (no internal links point to them)	Notice	No other checked page links to these blog posts, so search engines and readers struggle to find them.	Link to them from related posts.	None
Posts with no internal links	Notice	These blog posts do not link to any other page on your site.	Add links to related posts.	None
Images without alt text	Warning	Images in your media library have no alt text, which hurts image search and screen reader users.	Add alt text in RankKit SEO → Image SEO → Images missing alt text. See Image SEO and AI alt text.	Fix with AI

Technical

Check	Severity	What it means	How to fix it	Button
Plain permalinks	Warning	URLs look like ?p=123 and carry no keywords.	Choose Post name in Settings → Permalinks.	Open
Site is not served over HTTPS	Warning	Your site address starts with http://. Google treats HTTPS as a ranking signal and browsers flag HTTP sites as not secure.	Install an SSL certificate (most hosts do this for free) and change the site address to https://.	None

Social & schema

Check	Severity	What it means	How to fix it	Button
No default social image	Notice	Posts without a featured image share with a blank preview on Facebook, LinkedIn and X.	Choose a default image in Settings → Social. See Social sharing.	Set up
No logo in schema	Notice	No logo is set in RankKit SEO and the theme has no custom logo. Google uses it in knowledge panels and results.	Add a logo in Settings → Identity. See Site identity.	Set up
No featured or social image	Notice	These pages have no image to share, and their Article schema has no image.	Set a featured image or a social image on each page.	None

AI search

Check	Severity	What it means	How to fix it	Button
llms.txt is off	Notice	The llms.txt module is off. llms.txt gives AI agents a clean index of your key pages.	Turn it on. See llms.txt and Markdown pages.	Fix it
AI search crawlers are blocked	Warning	Your robots rules block AI search or user bots (OAI-SearchBot, ChatGPT-User, Claude-SearchBot, Claude-User, PerplexityBot or Perplexity-User), which keeps your pages out of their answers.	Unblock them in Settings → Robots & AI crawlers. Blocking training bots only is fine. See AI crawlers.	Set up
Markdown versions of pages are off	Notice	llms.txt is on but Markdown copies of your pages are off.	Turn on Serve Markdown versions in RankKit SEO → Settings → Markdown.	Fix it
No social profiles in your Organization schema	Notice	Your site is set up as an organization but has no social profile links (sameAs) and no Facebook page.	Add your profiles in Settings → Identity.	Set up

Security

The four checks marked Fix it turn on RankKit SEO's security hardening switches.

Check	Severity	What it means	How to fix it	Button
WordPress is out of date	Warning	A newer WordPress version is available. The title shows both versions.	Back up, then update WordPress.	Open
PHP no longer gets security fixes	Warning (Critical below PHP 7.4)	Your server runs a PHP version older than 8.2.	Ask your host to move the site to PHP 8.2 or newer, which is also faster.	Open
Plugins or themes need updates	Notice (Warning when more than 3)	Plugins or themes have updates waiting. View lists them with the new version.	Update them, or remove ones you no longer use.	Open
PHP errors are shown to visitors	Warning	Error messages are printed on pages, revealing file paths and plugin details.	Set WP_DEBUG_DISPLAY to false (and display_errors off) in wp-config.php on live sites.	None
The debug log can be downloaded by anyone	Critical	wp-content/debug.log is publicly readable and can leak paths, queries and personal data.	Point WP_DEBUG_LOG to a file outside the web root, or delete the log and block it in the server config.	None
Directory listing is on	Warning	Anyone can browse the files in your uploads folder.	Turn off directory indexes (Options -Indexes on Apache, autoindex off on nginx), or add an empty index.php.	None
Usernames can be discovered	Notice	/?author=1 or the public users REST endpoint reveals login names, which makes password guessing easier.	Block user enumeration. Author archives keep working.	Fix it
XML-RPC is enabled	Notice	XML-RPC is a common target for password brute-force and pingback abuse.	Turn it off, unless you use the WordPress mobile app or Jetpack.	Fix it
Theme and plugin file editing is enabled	Notice	If an admin account is compromised, the built-in file editor lets an attacker run any code.	Turn the editor off. You can still edit files over SFTP.	Fix it
A user is called "admin"	Notice	"admin" is the first username bots try.	Create a new administrator with another name, then delete this user and assign its content to the new one.	Open
The WordPress version is shown in your HTML	Notice	The generator tag tells bots which version to attack.	Hide it. This is harmless.	Fix it
Insecure (http://) files on an HTTPS page	Warning	Your HTTPS home page loads scripts, styles, images or media over http://, which browsers block or warn about.	Change these URLs to https://. A search-replace in the database usually fixes old image links.	None
http:// does not redirect to https://	Warning	The insecure version of your site still loads, which splits ranking signals between two URLs.	Add a 301 redirect from http:// to https:// at the server or CDN.	None
Security headers are missing	Notice	Two or more of these headers are missing: X-Content-Type-Options, X-Frame-Options (or a frame-ancestors CSP rule), Referrer-Policy and, on HTTPS sites, Strict-Transport-Security.	Add them in the server config, your CDN or a security plugin.	None

Performance

Most performance checks use one fetch of your home page as a logged-out visitor. If that fetch fails, you get the first check below and the checks that need the home page are skipped; the media library, object cache and autoload checks still run. For full Core Web Vitals, use Page speed.

Check	Severity	What it means	How to fix it	Button
The homepage could not be loaded for testing	Warning	The site could not fetch its own home page. Loopback requests may be blocked by the host or a firewall.	Ask your host to allow loopback requests.	None
The homepage takes N ms to generate	Notice over 1,000 ms (Warning over 2,500 ms)	The server is slow to build the page. Under 600 ms is good.	Use a page cache and a persistent object cache, and remove heavy plugins.	None
Pages are sent without gzip or Brotli compression	Warning	The HTML is sent uncompressed. Compression cuts transfer size by around 70%.	Turn on gzip or Brotli in the server config or your CDN.	None
No page cache detected	Notice	No sign of a page cache in the response, so WordPress builds every page on every visit.	Use a caching plugin or your host's cache.	None
The homepage is heavy	Notice (Warning over 5 MB)	Your own HTML, CSS, JavaScript and images on the home page add up to more than 3 MB, or the HTML alone is over 400 KB. Third-party files are not counted.	Aim for under 2 MB in total and under 200 KB of HTML: compress images, remove unused plugins and page-builder bloat.	None
The homepage loads N scripts, stylesheets and images	Notice	More than 60 files. Every file is another request.	Combine or remove scripts and styles that plugins add to every page.	None
Render-blocking files in	Notice (Warning over 10 files)	More than 2 scripts without defer or async, or more than 5 stylesheets, block the first paint.	Load scripts with defer or async and inline critical CSS. Most caching and optimization plugins can do this.	None
Images without width and height	Notice	Images without dimensions make the page jump while loading (layout shift, a Core Web Vitals metric).	Add width and height in the theme or block.	None
Images below the fold are not lazy-loaded	Notice	More than 2 images after the first three have no loading="lazy".	WordPress adds it to content images; fix theme and page-builder images.	None
Large image files on the homepage	Warning	Images on the home page are over 300 KB each.	Resize them to the size they are shown at, compress them, or serve WebP or AVIF.	None
Static files have no browser caching headers	Notice	CSS and JavaScript are sent without Cache-Control or Expires, so returning visitors download them again.	Set a long cache lifetime for static files in the server config or CDN.	None
Images over 500 KB in the media library	Notice	Large uploads among your 500 most recent images slow down every page they appear on.	Compress them, or use an image optimization plugin.	None
No persistent object cache	Notice	No Redis or Memcached, so database results are not kept between requests.	Many hosts offer Redis or Memcached with one click.	None
Autoloaded options are large	Notice over 900 KB (Warning over 3 MB)	WordPress loads these options on every request. Leftovers from removed plugins are the usual cause.	Clean them up with a database cleanup tool.	None

Search performance (RankKit SEO Pro)

RankKit SEO Pro These checks use real Search Console data. They appear when you have RankKit SEO Pro and Google Search Console is connected with a property selected. See Connect Google Search Console and GA4. Start a 14-day free trial or see plans.

Check	Severity	What it means	How to fix it	Button
Pages losing search traffic (N clicks lost in 28 days)	Warning	These pages got 30% fewer clicks than in the 28 days before.	Refresh the content, check for new competitors and make sure the title still matches what people search. See Traffic Recovery.	Set up
Titles that underperform for their ranking	Warning	Pages that rank on page one but get far fewer clicks than usual for their position.	Write a sharper title and description.	Fix with AI
Keywords close to page one	Notice	Queries ranking in positions 8 to 20 with real impressions.	Improve the content and internal links for these queries. See Search Console opportunities.	Set up

FAQ

Why is a page I expected missing from the content checks?

The audit checks up to 1,000 published items, most recently modified first, and skips password-protected and noindexed pages. Orphan and internal-link checks only look at blog posts, and the thin content check skips pages.

Can I hide a check I do not care about?

No. There is no setting to ignore a check. Each issue only takes a small number of points off, so a notice you choose to leave does not hurt the score much.

Which checks can an AI agent fix?

The fix_audit_issue tool applies the same fixes as the buttons: setting fixes through the Change Log, and on RankKit SEO Pro AI fixes for titles, descriptions and alt text. For other issues it returns the instructions.