The Starfish Spring Audit: What We Check on Every Client Site
Every spring, Starfish Ad Age runs a structured site audit across all client websites using the Starfish Substrate framework. Here is the full 20-point checklist organized by the 5 Substrate layers.
The Starfish spring site audit covers 20 specific checks across five layers of the Starfish Substrate: Structure (technical foundation), Speed (performance), Schema (structured data), Signal (content and authority), and Shipboard (deployment and maintenance). Most client sites have 3 to 5 issues at audit time, with schema errors and outdated content being the most common findings. The audit takes one to two business days per site and produces a prioritized action list with estimated impact scores.
The Starfish Spring Audit: What We Check on Every Client Site
Every spring, we run a structured audit across our client websites. Not a vague review — a specific checklist with 20 defined checks organized by the five layers of the Starfish Substrate.
This post documents what we check, why each check matters, and what the most common findings are from Q1 2026 audits. If you want to run this yourself, the checklist is in section five.
Why Audit in Spring
The case for a spring audit is practical, not ceremonial.
Google’s algorithm updates concentrated in Q1 2026 included refinements to the helpful content system, an update to how AI Overviews select citations, and continued Core Web Vitals scoring refinements with Interaction to Next Paint as the active interactivity metric. The effects of these updates are visible in Q1 Search Console data by April.
Most websites experience gradual technical drift over the course of a year: plugins updated without testing, content that becomes stale, redirects that were temporary but were never cleaned up, and third-party scripts added without auditing their performance impact. Spring is the right moment to catch and correct this drift before it compounds through the summer and fall search seasons.
The Starfish Substrate: Five Layers
The Starfish Substrate organizes site health across five layers. Each layer is sequential in the sense that structural problems limit the value of higher-level work — you cannot fix Signal (content) problems if Structure problems are preventing Google from crawling the pages.
Layer 1: Structure The technical foundation of the site. Crawlability, indexation, site architecture, navigation, internal linking, and URL structure.
Layer 2: Speed Page performance as measured by Core Web Vitals: Largest Contentful Paint (LCP), Interaction to Next Paint (INP), and Cumulative Layout Shift (CLS). Also covers mobile responsiveness.
Layer 3: Schema Structured data coverage and validation. Which schema types are present, whether they validate without errors, and whether they qualify for rich result display.
Layer 4: Signal Content quality, topical authority, and external signals. Content freshness, keyword relevance, internal linking depth, and backlink profile health.
Layer 5: Shipboard Operational health. SSL certificate validity, form functionality, redirect chains, 404 errors, CMS and plugin versions, and Google Business Profile consistency.
Layer 1: Structure — 4 Checks
Check 1: Crawl Coverage and Indexation
Tool: Google Search Console → Coverage report and URL Inspection
What we look for:
- Pages in “Indexed” status vs. pages that should be indexed
- “Excluded” pages with reason — “Crawled, not indexed” is a quality signal flag
- “Errors” — 404s, redirect errors, server errors appearing in indexed pages
- Sitemap submission and last-crawled date
Common finding: Pages excluded as “duplicate without canonical tag” or “crawled, not indexed” often represent thin or near-duplicate service area pages created for local SEO purposes. Google is increasingly filtering these. The fix is either consolidating content or significantly deepening the page’s unique value.
Check 2: Site Architecture and Internal Linking
Tool: Screaming Frog (free up to 500 URLs) or manual crawl
What we look for:
- Orphan pages (pages with no internal links pointing to them)
- Pages deeper than 3 clicks from the homepage
- Navigation structure reflecting current service offerings
- Broken internal links (404 errors in internal link destinations)
Common finding: Blog posts from 2022-2023 that are orphaned — no internal links from current pages. These posts may still have organic traffic or backlinks, but they are not receiving PageRank distribution from the rest of the site.
Check 3: URL Structure and Redirects
Tool: Screaming Frog, Google Search Console
What we look for:
- Redirect chains longer than one hop (301 → 301 → destination)
- URL parameters appearing in indexed URLs
- Inconsistent URL structures (mixed /services/ and /service/ patterns)
- Old URLs from prior CMS migration returning 404 errors
Common finding: Sites migrated from a previous CMS in the last two years often have 30 to 100 unaddressed 404 errors from old URLs that were not redirected. These represent lost link equity if any external sites linked to those URLs.
Check 4: Mobile Rendering
Tool: Google’s Mobile-Friendly Test, manual device testing
What we look for:
- Text size readable on mobile without zooming
- Tap targets (buttons, links) at least 48 pixels in size
- No horizontal scrolling on standard mobile viewports
- Viewport meta tag correctly set
Common finding: Contact page forms that break on mobile — fields that require horizontal scrolling or submit buttons that are below the viewport on smaller screens.
Layer 2: Speed — 4 Checks
Check 5: Largest Contentful Paint (LCP)
Tool: Google PageSpeed Insights, GSC Core Web Vitals
Target: Under 2.5 seconds on mobile
What we look for:
- What element is the LCP element (most commonly: hero image, H1, video poster)
- Whether the LCP element is preloaded
- Image format (WebP preferred over JPEG/PNG)
- Image compression level
Common finding: Unoptimized hero images. A 3.8MB hero image with no compression and no WebP conversion will consistently produce an LCP of 4 to 7 seconds on mobile. Converting to WebP and adding preload typically reduces LCP by 1.5 to 2.5 seconds.
Check 6: Interaction to Next Paint (INP)
Tool: Google PageSpeed Insights (field data), Chrome User Experience Report
Target: Under 200 milliseconds
What we look for:
- Third-party scripts loading synchronously (chat widgets, analytics, ad networks)
- Large JavaScript bundles blocking the main thread
- Long tasks (over 50ms) visible in Chrome DevTools Performance panel
Common finding: Chat widgets and Facebook Pixel loading synchronously on every page. Deferring these scripts to load after the critical rendering path is complete typically reduces INP from Poor to Needs Improvement or Good without any visual change to the user experience.
Check 7: Cumulative Layout Shift (CLS)
Tool: Google PageSpeed Insights, Chrome DevTools
Target: Under 0.1
What we look for:
- Images without explicit width and height attributes
- Web fonts loading without font-display: swap or font-display: optional
- Ad or embed slots that resize after load
- Dynamically injected content above existing content
Common finding: Google Fonts loading without font-display: swap. The browser holds layout while waiting for the font to load, then reflows when it arrives. Adding font-display: swap or switching to a system font stack eliminates most font-related CLS.
Check 8: Mobile Speed Score
Tool: Google PageSpeed Insights — Mobile tab
Target: Performance score above 70 (Good is 90+, but 70+ is the practical threshold for most local business sites)
What we look for:
- Overall mobile score vs. desktop score
- Top opportunities identified by PageSpeed (render-blocking resources, unused JavaScript, image sizing)
- Whether the score has changed since the last audit
Common finding: Mobile scores 30 to 40 points lower than desktop scores due to unoptimized images and third-party scripts that have more impact on mobile network conditions.
Layer 3: Schema — 4 Checks
Check 9: Schema Coverage
Tool: Google Rich Results Test, GSC Enhancements
What we look for:
- Is LocalBusiness schema present on the homepage and location pages?
- Is Organization schema present sitewide?
- Is FAQPage schema present on pages with FAQ sections?
- Is Article/BlogPosting schema present on blog posts?
Common finding: FAQPage schema absent from pages that have FAQ content as HTML but no structured data markup. These pages contain the right content but are not eligible for FAQ rich result display.
Check 10: Schema Validation
Tool: Google’s Rich Results Test (per URL), GSC Enhancements section (sitewide)
What we look for:
- Zero errors for each schema type (errors block rich result eligibility)
- Warnings reviewed and addressed where feasible
- AggregateRating properties (ratingValue, reviewCount, bestRating) all present
- LocalBusiness hours in
openingHoursSpecificationformat (not just in HTML)
Common finding: AggregateRating schema with ratingValue but missing bestRating. Google requires both values to use the rating for rich results. This is a one-line addition to the schema code.
Check 11: Author Attribution Schema
Tool: Rich Results Test, manual code review
What we look for:
- Article schema
authorproperty references a Person schema entity - Person schema includes name, URL, and
sameAslinks to LinkedIn and other authoritative profiles - Author bio page exists on the site and links to from articles
Common finding: Blog posts with no author schema or with author set as the organization rather than an individual Person. For AI citation purposes, individual author attribution with credentials is more authoritative than organizational attribution.
Check 12: Schema Consistency with GBP
Tool: Google Business Profile dashboard compared against LocalBusiness schema
What we look for:
- Business name identical between schema and GBP
- Address format consistent (abbreviations, suite formatting)
- Phone number format consistent
- Category in schema aligned with primary GBP category
- Hours matching between schema and GBP
Common finding: Business name with LLC or DBA variations causing inconsistency (“Starfish Ad Age” in schema vs. “Starfish Ad Age LLC” in GBP). Google treats these as separate entities in some contexts, diluting local authority signals.
Layer 4: Signal — 4 Checks
Check 13: Content Freshness
Tool: GSC Performance report (identify high-impression, declining-CTR pages), manual review
What we look for:
- Service pages or resource pages last updated more than 12 months ago with declining organic performance
- Blog posts that reference outdated statistics or tools
- Homepage content that still reflects 2024 or earlier positioning
- Pricing pages with outdated pricing (if applicable)
Common finding: Homepage hero copy and service descriptions from the site’s launch date (often 2022-2023) with no updates. Homepage freshness signals to both users and crawlers that the business is active and current.
Check 14: Topical Coverage Gaps
Tool: GSC Queries report, keyword gap analysis (Semrush or Ahrefs if available)
What we look for:
- Service queries where the site ranks on page 2 or 3 but has no dedicated content
- FAQ questions the site’s FAQ content does not address
- Geographic service area pages missing for markets the business actively serves
- Competitor content that covers topics the client’s site does not address
Common finding: Businesses serving both Longview and Tyler with a single service page that targets only Longview. A Tyler-specific service page with local context would capture additional geographic search volume.
Check 15: Internal Link Depth for Priority Pages
Tool: Screaming Frog, manual audit
What we look for:
- Primary service pages (the pages driving leads and revenue) receiving internal links from the homepage, blog posts, and related service pages
- Blog posts linking to relevant service pages (not just floating in the blog section)
- Contact page linked from every service page
Common finding: Blog posts that are internally isolated. A 2,000-word blog post with strong keyword alignment that has no internal links from other pages and no outbound internal links to service pages is contributing less to the site’s overall authority than its content quality should allow.
Check 16: Backlink Profile Health
Tool: Google Search Console Links report, Ahrefs or Semrush if available
What we look for:
- Referring domain count trend (growing, stable, or declining)
- High-authority referring domains (industry associations, local media, chambers of commerce)
- Any toxic or spammy referring domains that should be disavowed
- Google Business Profile and major directory citations as foundational links
Common finding: No links from local media or industry associations despite the business having newsworthy activities. Local chamber websites, BBB profiles, and local newspaper coverage are citation opportunities that are often unclaimed.
Layer 5: Shipboard — 4 Checks
Check 17: SSL and Security
Tool: Browser check (padlock icon), SSL Labs test (ssllabs.com)
What we look for:
- Valid SSL certificate with no expiration within 60 days
- All pages loading over HTTPS (no mixed-content warnings)
- Certificate chain valid and complete
- HTTP to HTTPS redirects functioning correctly
Common finding: SSL certificate expiring in under 60 days. Most hosting providers auto-renew SSL certificates, but failures occur. A lapsed SSL certificate causes browsers to display security warnings that immediately drive visitors away.
Check 18: Form and CTA Functionality
Tool: Manual testing across desktop and mobile
What we look for:
- Contact forms submit successfully and send to the correct email address
- Form confirmation message displays after submission
- Call-to-action buttons link to correct destinations
- Phone numbers are click-to-call on mobile
- Any booking integrations (GHL, Calendly, etc.) load and function correctly
Common finding: Contact forms that deliver to an email address that is no longer monitored — often a general inbox or a former employee’s email. This is the most commercially damaging finding in the audit because it means the site is generating leads that the business never receives.
Check 19: CMS and Plugin Versions
Tool: Manual review of WordPress dashboard (if applicable), hosting control panel
What we look for:
- WordPress core version (within two major versions of current)
- Plugins with available updates, particularly security-related plugins
- Deactivated plugins that should be removed
- Themes with available updates
Common finding: 8 to 14 WordPress plugins with pending updates, some overdue by 6 or more months. Unpatched plugins are the primary attack vector for WordPress site compromises. Plugin updates should happen monthly, not at audit time.
Check 20: Google Business Profile Consistency
Tool: Google Business Profile dashboard, cross-referenced against website
What we look for:
- Name, address, phone (NAP) identical between GBP and website
- GBP hours matching website hours and LocalBusiness schema
- GBP photos updated within the last 60 days
- GBP posts published within the last 30 days
- Q&A section populated with common questions
- Reviews responded to within 7 days (response rate above 80%)
Common finding: GBP posts not published in the last 60 to 90 days. GBP activity — regular posts, photo additions, Q&A responses — correlates with Local Pack ranking consistency. Dormant profiles drift down in Pack positions over time.
The 20-Point Master Checklist
Structure
- 1. Crawl coverage: No critical indexation errors in GSC; site map submitted and crawled
- 2. Architecture: No orphan pages; all pages reachable within 3 clicks; no broken internal links
- 3. URL structure: No redirect chains; no 404 errors from prior migrations; clean URL patterns
- 4. Mobile rendering: Text readable, tap targets correct size, no horizontal scroll
Speed
- 5. LCP: Under 2.5 seconds on mobile; hero image preloaded and WebP formatted
- 6. INP: Under 200ms; no synchronously loading third-party scripts on critical path
- 7. CLS: Under 0.1; images have explicit dimensions; fonts use font-display swap
- 8. Mobile PageSpeed: Score above 70; top opportunities identified and scheduled
Schema
- 9. Coverage: LocalBusiness, Organization, FAQPage, and Article schema present where applicable
- 10. Validation: Zero errors in GSC Enhancements; all required properties present for each type
- 11. Author attribution: Person schema present for all authors; author bio pages exist on site
- 12. GBP consistency: Schema name, address, phone, hours match GBP exactly
Signal
- 13. Content freshness: High-traffic pages updated within 12 months; stale statistics replaced
- 14. Topical gaps: Service queries without dedicated content identified and scheduled
- 15. Internal linking: Priority pages receive links from blog and related pages; contact page linked from all service pages
- 16. Backlink profile: No toxic domains; local citations present; chamber and association links claimed
Shipboard
- 17. SSL: Valid certificate; no mixed content; auto-renewal confirmed or 60-day warning set
- 18. Forms and CTAs: All forms submit and deliver to active email; phone numbers click-to-call on mobile
- 19. CMS updates: WordPress/platform within two versions of current; all plugins updated
- 20. GBP activity: Photos updated in last 60 days; posts in last 30 days; review response rate above 80%
Questions
worth answering.
Why do a site audit every spring specifically? +
Spring audits catch the compounded drift from the previous year — algorithm updates, platform changes, team turnover, and the gradual decay of content freshness and technical configurations. Google's algorithm updates typically roll out in Q1, and Core Web Vitals benchmark changes take effect on a six-month cycle. Running a structured audit in April captures the full impact of Q1 changes before they compound into Q2 and Q3 ranking losses. It also aligns with client budget cycles — spring is when most clients plan mid-year investments.
What is the Starfish Substrate framework? +
The Starfish Substrate is a five-layer website health framework: Structure (site architecture, crawlability, navigation), Speed (Core Web Vitals, LCP, INP, CLS), Schema (structured data validation, schema type coverage), Signal (content quality, topical authority, link signals), and Shipboard (deployment health, SSL, redirects, form functionality, CMS updates). The Substrate is used as both a build checklist for new sites and an audit framework for existing sites.
How long does a full Starfish site audit take? +
A full audit for a local business website with under 100 pages takes one to two business days. This includes automated scanning (Google Search Console, Screaming Frog or equivalent, PageSpeed Insights, Rich Results Test), manual review of key pages (homepage, top service pages, contact page, blog), and report compilation. For larger sites with 100 to 500 pages, the audit takes two to three days. The deliverable is a prioritized action list, not just a findings report — every item has a priority level and an estimated effort estimate.
What are the most common audit findings? +
In Q1 2026 spring audits across Starfish clients, the five most common findings were: (1) schema markup errors or missing schema on key pages, (2) content that has not been updated in 12 or more months on high-traffic pages, (3) Google Business Profile information that does not match the website (NAP inconsistency), (4) Interaction to Next Paint (INP) scores in the Needs Improvement or Poor range due to third-party scripts, and (5) broken internal links from previous site migrations or content deletions.
Do I need to fix everything the audit finds? +
No. The audit output is a prioritized list, not a to-do list where everything is equally urgent. Each finding is scored on two dimensions: estimated ranking/visibility impact and implementation effort. High-impact, low-effort items go first — schema fixes, content updates, NAP corrections. High-effort items like site migrations or CMS overhauls are scoped separately as project work, not sprint items. Trying to fix everything at once typically results in fixing nothing well.
Can I do a basic version of this audit myself? +
Yes. The five free tools that cover most of the audit surface are: Google Search Console (schema validation, Core Web Vitals, crawl errors, indexing status), Google PageSpeed Insights (Speed layer), Google's Rich Results Test (Schema layer), Screaming Frog SEO Spider free version (up to 500 URLs for Structure layer), and Google Business Profile dashboard (Signal/GBP layer). Running these five tools on your site and reviewing the outputs provides the foundation of a self-conducted audit. The judgment layer — prioritizing findings and identifying root causes — is where experience adds value.
What should I fix first after an audit? +
Fix in this order: (1) Any indexing issues that are blocking Google from seeing your pages — these nullify everything else. (2) Schema errors that are preventing rich result eligibility. (3) Core Web Vitals failures, particularly Poor INP scores. (4) NAP inconsistencies between your website and Google Business Profile. (5) Content freshness issues on your highest-traffic pages. Everything else is second priority. This order reflects impact-to-effort ratio, not arbitrary sequence.
Abel Sanchez · Founder, COO, Partner
Abel founded Starfish Ad Age in Longview, Texas in 2017 and has been building AI-driven marketing systems for East Texas and Shreveport-Bossier small businesses ever since. Now based in Shreveport-Bossier, Louisiana, where he leads the agency's expanded Louisiana territory.
Meet the rest of the crew →
Want your business
cited by AI?
45-minute strategy call. We audit your stack, name the biggest opportunity, and tell you what we would ship first.