A graphic illustrating the importance of HTTPS and website data security, featuring a central smartphone displaying a masked hacker, large protective padlocks, and a laptop with spider legs.

SEO Foundations Checklist: What to Fix Before Keywords

Lionel Lowery
April 02, 2026

Last Updated: August 5, 2026

TL;DR

SEO doesn't win you the race. It qualifies you to enter it.
Five layers, in this order: security, speed, crawlability, intent, structure. Each one holds up the next.
Most sites fail on crawlability, the third layer. Google can't rank a page it can't read, and plenty of sites quietly block their own pages without knowing it.
You will not get a perfect speed score, and chasing one wastes time. Aim for the green band and recheck quarterly.
Rankings get you seen. Matching what the searcher actually wanted is what turns the visit into a conversation.

Your website might have all the right keywords and still get found by nobody.

Most SEO advice starts with the terms you want to rank for. That's the wrong starting line. None of that matters until your site is readable, fast enough, and secure enough to be considered at all.

Think of it like a restaurant. Marketing gets people to walk toward the door. But if the lights are off, the door sticks, or there's a health inspection notice taped to the window, nothing you said outside matters.

Here's the order I work in. Five layers, each one holding up the one above it. Fix them out of order and you'll do a lot of work that never shows up in search.

1. Secure the Connection With HTTPS

HTTPS is the "s" at the end of https:// in your address bar, and the little padlock next to it. It means the connection between your visitor and your site is encrypted.

The clearest way to picture it: without HTTPS, everything traveling between your visitor and your site moves like a postcard. Anyone handling it along the way can read it. With HTTPS, that same information is in a sealed envelope. On a page where somebody types a name, an email, or a card number, the difference is obvious.

Google announced back in 2014 that HTTPS was a ranking signal. That's still true, but it's a small one, and it's not where the real damage happens.

The real damage is what your visitor sees. When a browser hits a page without HTTPS, it doesn't show a subtle note. It throws up a full-screen red warning that looks, to most people, exactly like a virus alert. "Your connection is not private." Nobody reads past that. They hit back and go to the next result.

You lose the visit before a single word of your content gets a chance.

HTTPS won't move you up the page. Skipping it takes you out of the running.

Checklist: security

Load your homepage and confirm the address bar shows https:// with a padlock.
Type your domain with http:// in front of it. It should redirect to the https:// version, not load as its own separate page.
In Google Search Console, open the HTTPS report to see which of your URLs Google has indexed as insecure. (Search Console data runs a few days behind, so a fix you made this morning won't show up yet. Check back later in the week before you assume it didn't work.)

While you're in there, click through your own navigation like a first-time visitor. Broken links, dead pages, and copy that contradicts what your ads promise all create the same kind of friction. It erodes trust long before anyone tells you something felt off.

2. Get Your Speed Into the Green

Google measures three things about how a page feels to use. They're called Core Web Vitals, and the names sound worse than the ideas.

Largest Contentful Paint (LCP) is how long it takes for the biggest thing on the screen to show up. Usually that's your hero image or your headline. It's the moment the page stops looking empty. Target: under 2.5 seconds.

Cumulative Layout Shift (CLS) is how much the page moves around while it's still loading. You've felt this one. You go to tap a button, an image finishes loading above it, everything jumps down, and you tap an ad instead. That's layout shift. Target: under 0.1.

Interaction to Next Paint (INP) is how fast the page responds when you actually do something. You click, and it takes a beat before anything happens. That lag is INP. It replaced an older metric called First Input Delay in March 2024. Target: 200 milliseconds or better.

Three things about scoring that trip people up.

First, Google grades these on your real visitors, not on you. It looks at the slowest 25 percent of the experiences people actually had on your site and asks whether even they had a good one. Testing on your own laptop, on your own fast connection, tells you close to nothing. Your visitors are on phones, on hotel wifi, in parking lots.

Second, your mobile score will be worse than your desktop score, and that's by design. When the test runs in mobile mode, it deliberately simulates a mid-range phone on a slower connection, then slows the processor down on top of that. Same page, harder conditions. So don't read a good desktop score as good news. Mobile is the one that reflects how most people actually arrive.

Third, you are not going to score 100, and chasing it is a bad use of your time. PageSpeed Insights grades on three bands:

0 to 49, red. Something is genuinely wrong. Worth fixing now.
50 to 89, yellow. Functional, with real room to improve.
Most sites live here.
90 to 100, green. Well optimized.

Your score also moves between runs, because it depends on network conditions and server load at the moment of the test. Google's own guidance is to run it about five times and take the middle result, not the best one and not the worst.

There's a real tradeoff underneath all of this, and it's worth naming while you're still designing. Every image, video, embedded map, and animation you add costs load time. That doesn't mean strip your site down to text. It means make the call deliberately, page by page. A hero video on a homepage might be worth the weight. Six of them scattered through a service page almost never are. Decide what each element is doing for the visitor, and cut the ones that are only decorating.

Getting into the green band and staying there is maintenance, not a one-time fix. Every new plugin, embed, and full-size image nudges it back down. Put a speed check on the calendar quarterly, and give it to a specific person, whoever manages the site day to day. A site nobody owns drifts.

The single most common cause of a slow site is images that went live at full size. A photo straight off a phone can be six megabytes. The same photo, properly compressed, can be under 300 kilobytes and look identical on screen. Export photos as WebP, and use SVG for logos and flat graphics so they stay sharp at any size.

Checklist: Speed

Test your homepage and your top three landing pages at pagespeed.web.dev.
Run each page about five times and use the middle score, not your best one.
Check mobile separately from desktop, and treat the mobile number as the real one.
Re-export any image over about 300KB. Convert photos to WebP and logos to SVG.
Give every image and embed explicit width and height values, or a set aspect ratio, so the browser holds the space open while it loads. This is the single biggest fix for layout shift.
Put the next check on the calendar before you close the tab.

3. Make Sure Google Can Read Your Pages

This is the layer people skip, and it's the one that quietly costs the most. A page Google can't reach never competes, no matter how good the writing is.

Start with the easiest check in SEO. Go to Google and search site:yourdomain.com, with no space after the colon. That shows you what Google has actually indexed. If pages you expect are missing, stop. No amount of keyword work fixes a page Google doesn't know exists.

If pages are missing, walk the same path a crawler does. It happens in four steps, and each one can break independently.

Step one, the master switch. Before anything else, check your site settings for an option like "discourage search engines from indexing this site." Most website builders have one. It exists so you can build in private before launch, and it gets left on constantly. It's the single most common reason a brand new site never appears in search, and it takes ten seconds to rule out.

Step two, permission to enter. A crawler's first stop is a file at yourdomain.com/robots.txt. Go read yours. It's a plain list of what crawlers are and aren't allowed to open. If a page is blocked here, Google never gets to see what's on it.

Worth knowing: blocking a page in robots.txt does not remove it from search results. It only stops the reading. A blocked page can still appear if another site links to it, usually as a bare link with no description underneath, because Google knows the address but has never seen the contents.

Step three, permission to list. Once a crawler is on a page, it looks for a noindex tag. That's the instruction that actually keeps a page out of search results.

Here's the part that catches almost everyone. Noindex only works if the page stays crawlable. Google can't read a rule on a door it isn't allowed to open. Block a page in robots.txt and add noindex to it, and the block wins. The noindex never gets seen, and the page can sit in results indefinitely.

The short version: robots.txt controls who gets in the room. Noindex controls whether the room shows up on the map. They are not interchangeable, and using both on the same page cancels one out.

Step four, understanding what it found. Two things help here. Your XML sitemap is a list of every page you want crawled, submitted through Google Search Console so nothing gets missed. Schema markup is structured code that labels what's on the page for machines: this is an event on this date, this is a business at this address, these are the reviews. Schema doesn't get you indexed. It helps Google display you better once you are, and it's how you end up with star ratings or event dates in the result instead of a plain blue link.

checklist: crawl & index

Search site:yourdomain.com and confirm your important pages show up.
Check your site settings for a "discourage search engines" switch and turn it off.
Open yourdomain.com/robots.txt and read what you're blocking.
Submit your XML sitemap in Google Search Console and confirm it processed without errors.
To remove a page from search, in this order: first make sure the page is crawlable (not blocked in robots.txt), then add the noindex tag, then use the removal tool in Search Console to speed it up. Doing it out of order is why pages people thought they removed are still showing.
Confirm every page has one title tag and one meta description, both written for a person to read.
Confirm one H1 per page, with H2s and H3s that follow the real structure of the content.
Add alt text to every image that carries meaning.
Add schema markup for what you actually are: local business, service, article, event.

4. Answer the Question They Actually Asked

A ranking gets you seen. Whether the visit turns into anything depends on whether the page answers the question the person typed.

Every search falls into one of four kinds, and every page you publish should be built for one of them:

Informational. They want to understand something. "How much does a new roof cost."
Navigational. They're looking for one specific place. "City of Winston-Salem permits office."
Commercial. They're comparing before they commit. "Best CRM for small nonprofits."
Transactional. They're ready to act right now. "Emergency plumber near me."

Get this wrong and it shows up fast. A sales page written for an informational search bounces, because the person wanted an answer and got a pitch. An explainer sitting on a transactional search loses the sale to whoever made buying easy.

The shortcut is free and takes two minutes. Search your target keyword and look at the first ten results. Google has already decided what kind of page it

thinks that searcher wants. If the top ten are all comparison lists and you're

publishing a service page, you're not competing. You're in the wrong race.

One caution, because this gets oversold. You'll see advice saying that if people stay on your page longer, or bounce less, Google ranks you higher. Google has said directly and repeatedly that it does not use bounce rate or time on page as ranking factors. Don't build a strategy around moving those numbers.

Matching intent does something better anyway. It produces people who found what they needed, which turns into inquiries, return visits, and other sites linking to you on their own. Those are real.

This is also where E-E-A-T comes in. It stands for four things Google's human reviewers look for when they're checking whether search results are any good:

Experience. Have you actually done the thing you're writing about?
Expertise. Do you have the knowledge to be right about it?
Authoritativeness. Do others in your field treat you as a source?
Trustworthiness. Can someone tell who you are and reachyou?

E-E-A-T isn't a score sitting inside the algorithm. It's the standard Google's reviewers use to judge whether the algorithm is doing its job. The practical version is simple: make it obvious that a real person with real experience wrote this, and make it easy to find out who. A byline, an author bio, a real contact page, and specific examples from actual work do more here than a page of adjectives.

5. Give Your Site a Shape

Structure does two jobs at once. It helps visitors find things, and it tells Google what you know enough about to be worth ranking for.

Most navigation problems are really decision problems. A menu with twelve options doesn't feel thorough, it feels like a test. Every extra choice makes the visitor slower and less certain. Group things, cut what nobody clicks, and let the structure make the easy decisions for them.

The same idea applies to your content. A blog that's one running feed of everything you've ever written is a pile. The same posts grouped into real categories become a body of work, and Google reads it that way. If you publish about food insecurity and about sustainable living, those are two sections with their own logic, not one stream.

Categories also make internal linking obvious, which matters more than most people realize. When a page that already ranks links to a newer one, it passes some of that credibility along. That only happens if you can tell which pages belong together.

Then there's currency. A blog with nothing new in eighteen months sends a quiet signal, and it's not that the information is wrong. It's that nobody's home. Crawlers weigh recency on topics where recency matters, and visitors register it too, even when they don't consciously notice the dates.

checklist: structure

Count your top-level menu items. Over seven, start grouping.
Sort posts into real categories instead of one running feed.
Pick any page that matters and count the clicks it takes to reach from the homepage. More than three, and both visitors and crawlers are working too hard to find it.
Link every new post to your strongest related page, then go back and link that strong page forward.
Pick your three most important pages and set a real date to review them.

SEO Is Where You Qualify, Not Where You Win

A solid foundation doesn't guarantee you'll rank. It qualifies you to compete. Without it, strong content doesn't stand a chance. With it, everything you build on top has somewhere stable to land.

Start at the top of the list and work down. Most sites find their real problem in the first three.

If you want help building that foundation, or a second set of eyes on what you already have, let's talk.