A week ago I ran a real technical SEO audit on a live site and found a critical crawl blocker that three "SEO checker" tools had completely missed: the site's robots.txt was serving Disallow: / from a stale CDN cache — the fixed file had been deployed hours earlier, but the CDN kept serving the old copy on that exact path. The tell was in the response headers (age: 35619, cache HIT). Any check done with a cache-buster query string masked the problem entirely.
That experience crystallized something I'd been thinking about: most audit reports fail not because the checks are wrong, but because the findings aren't verifiable. "Your SEO score is 72" is useless. "Your live robots.txt returns Disallow: /, here is the curl output" is something you can act on in the next five minutes.
So I extracted the exact report structure I use into a free template. Here it is.
The 6 sections
Executive Summary — written last, read first. Two to four sentences, a one-line verdict, and a findings count (❌ 1 critical · ⚠️ 2 major · 3 minor). If a client reads nothing else, this must be enough.
1. On-Page SEO — the classics, but measured: unique titles (with char counts for anything over 60), meta descriptions (over 160 = truncated), exactly one H1 per page, heading hierarchy, image alt coverage, canonicals, Open Graph tags, internal linking. No "titles could be better" — "index title = 75 chars, will truncate" instead.
2. Technical SEO — HTTPS, robots.txt, XML sitemap, Search Console status, structured data, objective page weight (KB, JS count, fonts, lazy-loading), security headers, mobile rendering on at least two viewports, broken internal links. This section carries the robots.txt lesson: fetch it plain. A cache-busted fetch can hide a stale CDN copy and make you report "all good" while Google is blocked.
3. Content & Duplicate Content — mirror domains (are canonicals pointing to the primary?), thin pages, non-text content indexability (audio/video without transcripts is invisible), and a content plan. One rule here: only recommend keywords with measured search volumes, never guesses.
4. Off-Page SEO — backlinks and referring channels. If the domain is four days old with near-zero backlinks, say exactly that. It's expected, and pretending otherwise destroys trust.
5. Priority Actions (Quick Wins) — ordered by impact over effort, each one a single line the site owner can execute, each shipped with its verification command. "Purge or wait out the stale robots.txt cache, then re-request the sitemap fetch in GSC — verify with curl https://yoursite.com/robots.txt (no cache-buster)."
6. Monitoring Plan — Search Console, analytics, weekly robots.txt/sitemap checks, and a re-audit date 30 days out.
The one rule that matters
Every finding must cite concrete evidence: a command output, a header, a measured value. Anything that couldn't be measured gets marked ⏳ not measured with the reason ("PageSpeed API quota exhausted") — never a guessed number. A client can re-run every line of the report and get the same result. That's the whole pitch.
Grab it
- Template (Markdown, free): seo-audit-report-template.md
- Template page with section-by-section guidance: SEO Audit Report Template
- The live sample report it's extracted from (the robots.txt war story above, full audit of a real 4-page site): Technical SEO Audit Report — sample
The status legend used throughout: ✅ pass · ⚠️ issue · ❌ critical · ⏳ not measured. Steal it, adapt it, and if you use it on a client report, the evidence rule is the part worth keeping.
Disclosure: I run an SEO audit service built on an AI-assisted pipeline — every finding is verified against real tool output before delivery, which is exactly the discipline this template encodes. If you'd rather have the audit done for you than DIY the template, the sample report shows what you get.
