WordPress is not automatically SEO-friendly
WordPress gives you a technically capable foundation: clean permalinks, sensible markup, fast fixes, a plugin for everything. But “capable” is not “configured”. Out of the box, a WordPress site still ships with duplicate archives, bloated themes and a search engine plugin that nobody ever finished setting up. A sensible setup is about an afternoon — here is what actually matters, in order.
Before anything else: the basics that compound
Permalinks
Set the permalink structure to /%postname%/ on day one, before you publish. Changing it later means redirects for every URL ever indexed. A clean slug — /seo-audit-checklist/ — is readable by people and search engines alike. If you must change an established structure, redirect the old URLs properly.
HTTPS and one canonical address
The site must load over HTTPS on exactly one form of the domain (with or without www — pick one, redirect the other). Duplicate addresses split signals and confuse crawlers. Most hosts issue certificates for free; there is no excuse left.
A theme that is light and current
The theme decides your markup, your speed ceiling and half your mobile experience. Choose a widely maintained theme from the official directory — the kind with years of updates and a real changelog — rather than the most feature-crammed multipurpose option. Test it with fewer plugins rather than more: a good theme needs almost none.
The plugin rule: fewer, better, configured
Every plugin is code you did not audit, running on every page. The setup that works is a short list, fully configured, rather than a long list half-used:
- One SEO plugin for titles, meta descriptions, sitemaps and structured data. Any of the mainstream ones does the job — the differentiator is whether you fill in the fields, not which one you installed.
- One caching/performance plugin (or server-level caching if the host provides it). Page caching is the single largest speed win on shared hosting.
- One security/backup plugin, or your host’s tooling — whatever you trust. Verify a restore before you need it; a backup that has never been restored is a hypothesis.
- Forms only as needed. Contact forms, spam filtering, analytics — one choice each, kept current.
Then delete (or at least deactivate and remove) the plugins you are not using. Abandoned plugins are the most common WordPress security hole, and their scripts still load on your pages.
Content defaults worth changing
- Media and uploads: big cameras produce 5 MB photos. Resize on upload and use compression; page weight is the top speed killer on real WordPress sites.
- Tag and category archives: use tags sparingly. Twenty tags each used once create twenty thin archive pages that compete with nothing and index nothing.
- Comment settings: if comments attract only spam, close them and save the moderation time — or keep them genuinely active. A dead comments field looks worse than none.
- Author and date archives: on a single-author site, the author archive is a duplicate of the blog page. Disable or redirect it.
The SEO plugin fields people skip
Installing the plugin is not the setup. The fields that actually matter:
- Site-wide titles: decide the pattern (page title | site name) and keep it consistent.
- Meta descriptions for your important pages — written by hand, not auto-generated from the first sentence.
- XML sitemap on, submitted once to the search consoles. Then forget it.
- Breadcrumbs where the theme supports them: small win for navigation, honest win for results display.
- Structured data for your organisation or business profile; local businesses add address and hours.
Speed, the WordPress way
- Page caching first, image compression second. These two cover most of the achievable improvement.
- Audit plugins by weight, not count: a page-builder plugin can add more requests than five small utilities. Check what actually loads on your homepage.
- Upgrade PHP to the newest version your host supports. It is free speed and better security; do it on a staging copy if the site is old.
- Remove unused themes and plugins from the server. Unused code is risk without benefit.
Maintenance that protects rankings
WordPress SEO is also hygiene: core and plugin updates applied on a schedule (tested on staging if the site earns money), weekly off-site backups, a malware scan after any incident on the server, and an eye on the index status of key pages after major changes. A hacked site loses rankings faster than any algorithm update — recovery takes longer than prevention.
A one-afternoon checklist
- Permalinks to postname; HTTPS on one canonical domain; redirects verified.
- Light, current theme; unused themes and plugins removed.
- SEO plugin configured: titles, descriptions, sitemap, breadcrumbs, business markup.
- Caching and image compression on; PHP current.
- Tags trimmed, archives under control, comments decided on purpose.
- Updates and backups scheduled; a restore rehearsed once.
None of these steps is glamorous, which is exactly why they separate the sites that grow from the sites that merely exist. WordPress handles the plumbing; the configuration — and the content — remain your job.