Technical SEO Audit Checklist for 2026: 40 Items for Marketing Directors Operating in Indonesia

Technical SEO Audit Checklist for 2026: 40 Items for Marketing Directors Operating in Indonesia

Direct answer: A technical SEO audit is a systematic inspection of a site's foundations — crawlability, indexation, render speed, and structured data — to confirm search engines can find, render, and understand every commercially important page. For brands operating in Indonesia, where roughly three-quarters of web sessions happen on mobile (StatCounter), the audit almost always starts and ends with mobile performance. Google's Core Web Vitals thresholds are LCP ≤ 2.5s, INP ≤ 200ms, and CLS ≤ 0.1 at the 75th percentile of visits (web.dev). In Jakarta — the country's commercial center and the source of most high-intent brand search — those are the three thresholds that break first.

Why This Matters Differently for Foreign Brands

If you are a CMO in San Francisco, Singapore, or Sydney evaluating an Indonesia market entry, you already know the demand side of the argument. Indonesia is the fourth-largest country by population, has one of the highest mobile-first internet penetration curves in Southeast Asia, and is one of the few markets where organic search still meaningfully outperforms paid on cost per qualified lead in most B2B and considered-purchase categories.

What gets underestimated is the delivery side. Three conditions make technical SEO a materially higher-stakes discipline in Indonesia than in most Western markets:

Device and network reality. A significant share of your audience is on mid-tier Android devices over congested mobile networks. A JavaScript bundle that renders comfortably on a MacBook over office fiber can push INP past 400ms on the device your actual buyer is holding. Lab scores from your agency's dashboard will look fine. Field data will not.

Local hosting and CDN topology. Many international brands serve Indonesian traffic from US-East or EU-West origin infrastructure with no edge presence in Singapore or Jakarta. The latency penalty compounds every one of the metrics above. This is one of the most common and most fixable findings we see.

Agency handoff risk. When a global brand appoints a local partner — or when a local team inherits a globally built platform — the technical layer is the seam where things break. Staging noindex tags survive the migration. Hreflang gets configured for id-ID but points at pages that no longer exist. A regional subfolder gets excluded from the sitemap because nobody owned that file.

We have seen a premium automotive brand launch a model microsite where the campaign page rendered perfectly in a browser but returned an essentially empty shell to Googlebot, because content was rendered entirely client-side. Paid media ran on schedule. Organic capture of the model-name search wave — the highest-intent query volume the launch would ever generate — was zero. Nobody caught it for six weeks, because every dashboard the marketing team looked at was measuring paid.

The short version: a technical SEO audit worth a marketing director's attention is not a tool export. It maps whether every commercial page can be crawled, indexed, rendered, and understood — then ranks findings by business impact rather than by warning count. The 40 items below are sequenced for exactly that.

What Changed by 2026

The question executives ask has shifted. It used to be "why did our rankings drop." Now it is more often: why aren't we cited in AI answers when our content is the most comprehensive in the category?

The answer is frequently technical. Whether it is Google's AI Overviews, ChatGPT with browsing, Perplexity, or an enterprise assistant, every one of these systems can only cite what it successfully retrieved and parsed from your rendered HTML. Answer engines have not made technical SEO obsolete. They have raised the penalty for failing it, because a page that a crawler can't parse is now invisible in two channels instead of one.

Three specific shifts moved this from a developer concern to a board-adjacent one.

First, premium brand sites got heavier. Hero video, scroll-triggered animation, high-resolution product galleries — each one pressures Core Web Vitals, and INP in particular, because INP measures responsiveness to real interaction rather than initial paint. Design agencies optimize for the pitch deck. Nobody in the room is measuring interaction latency on a mid-tier Android device.

Second, modern JavaScript architecture shifted the failure mode from "wrong content" to "invisible content." A CMS typo is obvious. A hydration error that silently drops the main content block from the rendered DOM that a bot sees is not.

Third, structured data stopped being decorative. It is now the most direct mechanism you have for telling a machine what your page claims to be — and, increasingly, what your organization is, where it operates, and which entities it is authoritative about.

If you are currently evaluating a partner to own this work, we cover the commercial side of that decision separately in our guide to choosing an SEO agency and in our breakdown of SEO and AEO services.

Six Pillars and Why the Order Is Non-Negotiable

Sequence matters more than completeness. Optimizing the load speed of a page blocked by robots.txt is tidy, expensive, and worthless. So the audit runs in layers, from the most fundamental to the most refined.

Each pillar is only worked once the previous one passes. This is the difference between a structured audit and a CSV export of 1,400 warnings that ends its life in a shared drive.

The 40-Item Technical SEO Audit Checklist

Every item is written as a pass condition, so your team can tick it or log a finding directly against it.

Pillar 1 — Crawlability & Indexation (Items 1–8)

1. robots.txt does not block CSS, JS, or image directories required to render the page.
2. The XML sitemap contains only URLs returning 200 and canonicalizing to themselves — no redirects, no noindex pages.
3. The sitemap is submitted in Search Console and referenced from robots.txt.
4. No noindex tag has survived in a global template after a staging migration. This is simultaneously the most brutal and most trivial cause of traffic loss in existence.
5. The ratio of indexed pages to submitted URLs is plausible; a large gap is investigated, not ignored.
6. "Crawled – currently not indexed" and "Discovered – currently not indexed" reports are reviewed by URL pattern, not page by page.
7. Crawl budget is not consumed by parameter URLs, faceted navigation, or unbounded calendar archives.
8. No soft 404s — empty pages or zero-result searches that still return status 200.

Pillar 2 — Site Architecture & URL Structure (Items 9–14)

1. Commercial pages are reachable within three clicks of the homepage.
2. URLs use kebab-case, are descriptive, and carry no session parameters or random IDs.
3. Canonical tags are self-referencing on standard pages and point to the primary version on duplicates.
4. Pagination is built so every child page retains a followable internal link path.
5. No orphan pages — pages with zero inbound internal links. Service pages reachable only through a JavaScript dropdown menu routinely fall into this category.
6. Redirects are always single-hop, use 301 for permanent moves, and contain no loops.

Pillar 3 — Core Web Vitals & Performance (Items 15–21)

1. LCP under 2.5 seconds in field data, not just lab simulation. For Indonesian traffic, segment this by device class — the aggregate number hides the problem.
2. INP under 200 milliseconds. This metric replaced FID in 2024 and is the one most sensitive to third-party scripts, which is precisely what marketing teams keep adding.
3. CLS under 0.1, with image and ad dimensions reserved in CSS.
4. Images served in modern formats (WebP/AVIF), responsively sized, with loading="lazy" outside the initial viewport.
5. Render-blocking CSS and JavaScript are minified, deferred, or split.
6. Fonts load with font-display: swap and preconnect to the provider domain.
7. Cache headers and CDN configuration are correct — long-lived static assets, short-lived HTML — with edge presence in or near Southeast Asia for Indonesian traffic.

Pillar 4 — Mobile & Rendering (Items 22–26)

1. Mobile content is identical to desktop. Mobile-first indexing means the mobile version is the version being evaluated; hiding a paragraph on small screens is functionally the same as deleting it.
2. Meta viewport is correct, tap targets are comfortably sized, and there is no horizontal scroll.
3. Primary content appears in the rendered HTML. Verify with URL Inspection in Search Console, not "view source" alone.
4. No hydration errors that drop content when a bot renders the page.
5. No interstitials covering primary content immediately on arrival from search results.

Pillar 5 — Structured Data & AEO Readiness (Items 27–32)

1. Organization schema is deployed site-wide with logo, address, and official social profiles. For foreign brands, ensure the Indonesian entity's address and legal name are consistent with local registration documents.
2. Article and BreadcrumbList are implemented on blog content, with honest publication and update dates.
3. FAQPage is used only on pages that genuinely display those FAQs to visitors.
4. Service or product pages use the appropriate schema type, consistent with actual page content.
5. Zero errors and zero critical warnings in the Rich Results Test and Search Console Enhancements reports (Google Search Central documentation).
6. A concise answer sits near the top of the page as a standalone 40–70 word paragraph — the format most readily lifted as a direct citation by answer engines.

Pillar 6 — Security, Internationalization, and Hygiene (Items 33–40)

1. HTTPS is fully enforced, with no mixed content on any page.
2. HSTS is deployed and certificates have an automated renewal schedule.
3. One canonical domain version is enforced — www or non-www, trailing slash or not — with everything else redirecting in a single hop.
4. Hreflang is correctly configured for id-ID and en variants, is reciprocal in both directions, includes a valid x-default, and points only at live 200-status URLs. This is the single most common failure on international brand sites serving Indonesia.
5. Localized pages are genuinely localized, not machine-translated boilerplate with a language attribute swapped. Search engines and Indonesian buyers both detect the difference, in roughly that order of forgiveness.
6. The backlink profile has been reviewed for toxic or spam patterns, with a disavow file maintained where warranted.
7. Custom 404 pages return an actual 404 status and offer useful navigation paths back to commercial pages.
8. Server logs are reviewed at least quarterly to confirm crawlers are spending budget on revenue pages rather than on parameter noise.

How to Actually Run This

A realistic first pass on a mid-sized brand site takes two to three weeks. Roughly one week for data collection across Search Console, field CrUX data, a full crawl, and log samples; one week for analysis and prioritization; a few days for the write-up and the remediation sequence.

The deliverable that matters is not the finding list. It is the ranked remediation plan, where every item carries an estimated business impact, an implementation owner, and a verification method. If your agency hands you a 60-page PDF without those three columns, you have received a document, not an audit.

One discipline worth enforcing: re-verify after every deploy, not once at the end. Technical SEO regressions are introduced by well-intentioned releases far more often than they are introduced by neglect.

What to Ask a Prospective Indonesian Agency Partner

If you are evaluating local partners for this work, four questions separate the credible from the merely fluent:

"Show me a remediation plan you delivered, with the before-and-after field data." Field data, not Lighthouse scores. Anyone can produce a green lab number.

"How do you test on mid-tier Android over local mobile networks?" If the answer is "we throttle in Chrome DevTools," that is a partial answer, not a complete one.

"Who on your team writes the actual fix?" Many agencies audit and hand off. That is a legitimate model, but you need to know it before you scope internal engineering capacity.

"How do you handle hreflang and entity consistency for a foreign parent brand with an Indonesian subsidiary?" This is a specific, non-obvious problem. A partner who has solved it will answer immediately and with detail.

Frequently Asked Questions

How often should we run a full technical audit?

A full 40-item pass twice a year, plus a lightweight regression check after every significant release or migration. Sites under active development need the post-deploy check more than they need the semi-annual deep dive.

Our global site already ranks well in the US. Why would Indonesia be different?

Because the ranking factors that matter are evaluated against the traffic you actually receive. Your US Core Web Vitals pass at the 75th percentile of US visits, on US devices, over US networks, served from US infrastructure. None of those inputs hold for Indonesian traffic. Additionally, id-ID content quality, local entity signals, and hreflang correctness are conditions that simply do not exist in your domestic setup.

Should we build a separate .co.id domain or use a subfolder on our global domain?

In most cases a subfolder on the global domain, because it inherits existing domain authority — which is usually the scarcest resource in a market entry. A .co.id domain makes sense when the Indonesian operation is a legally and commercially distinct entity, when local trust signals are a primary purchase driver, or when local regulation effectively requires it. It is a strategic decision with a multi-year cost of reversal; do not let it be made by whoever files the domain registration.

How much does a technical SEO audit cost in Indonesia?

Meaningfully less than the equivalent scope in the US, SG, or AU — typically a fraction of Western agency rates for comparable depth, which is a large part of why international brands look here in the first place. The variable worth scrutinizing is not the audit price but whether the engagement includes implementation. An audit without a remediation path is a report you will pay someone else to act on.

Can we just use an automated tool instead?

Use the tools — Search Console, a crawler, field data, the Rich Results Test — they generate the raw material. What they cannot do is tell you that item 4 costs you more revenue this quarter than items 15 through 21 combined, or that a hydration error is silently removing your primary service description from the rendered DOM. Prioritization by business impact is the entire deliverable. The tools produce inputs to it.

Does any of this still matter if buyers are moving to AI assistants?

More, not less. Answer engines cite what they can retrieve and parse from rendered HTML. Every failure in pillars 1 through 4 removes you from both traditional search results and AI citations simultaneously. Pillar 5 is specifically what makes a page easy for an answer engine to quote. The channel changed; the technical prerequisite did not.

The Bottom Line

Technical SEO is not a growth lever. It is a precondition — the thing that determines whether every other investment you make in the Indonesian market actually compounds. Content strategy, paid media, KOL activation, and PR all route buyers toward pages that either work or do not.

Run the 40 items in order. Rank the findings by revenue impact. Fix the top five before you commission anything else. If you are choosing a partner to own this, our guide to selecting an SEO agency covers the evaluation criteria in detail.