A forensic SEO checklist is a structured set of checks — timeline, technical, content, backlink, and search-feature — run in order before drawing any conclusion about why a site lost rankings or traffic. The value of a checklist here isn’t ticking boxes; it’s making sure you don’t skip a category of evidence and land on the wrong cause because the right one was never checked.
- 1. Establish the Baseline and the Symptom
- 2. Build and Cross-Reference the Timeline
- 3. Technical and Indexation Checks
- 4. Content Integrity Checks
- 5. Backlink Profile Checks
- 6. Manual Action and Penalty Checks
- 7. AI Search and SERP Feature Checks
- 8. Competitive Movement Checks
- 9. Documentation and Reporting
This isn’t a generic “SEO best practices” checklist — those already exist everywhere and assume you’re improving a healthy site. This is specifically the sequence we run at Salterra when something has gone wrong and the client needs to know why, in order, so nothing gets missed and nothing gets assumed.
1. Establish the Baseline and the Symptom
- Confirm the exact date range of the change using Search Console and analytics data, not memory or gut feel.
- Quantify the change as a percentage, not just “it’s down.”
- Identify which segments are affected: page type, query type, device, geography.
- Confirm the tracking itself is intact — check that Google Analytics and Search Console are still firing correctly and no tag manager, consent banner, or tracking code change coincided with the symptom.
That last item catches more “mystery” traffic drops than any other single check. A broken GA4 tag or a consent management platform blocking analytics scripts can produce a graph that looks identical to a real ranking collapse.
2. Build and Cross-Reference the Timeline
- List every site-side change in the six to twelve months before the symptom: redesigns, migrations, plugin or CMS updates, content publishing or pruning, internal linking changes.
- Overlay confirmed and unconfirmed Google algorithm updates from Google’s own update history and a tracking tool such as Semrush Sensor.
- Overlay external events: backlink losses or gains, competitor content or link campaigns, seasonal patterns, industry news.
- Flag any date where two or more layers intersect — these are your priority hypotheses.
3. Technical and Indexation Checks
- Confirm affected URLs are still indexed using Search Console’s URL Inspection tool and a manual “site:” search as a sanity check.
- Check for accidental noindex tags, canonical tag errors, or robots.txt blocks introduced around the symptom date.
- Review server log files for crawl frequency changes on the affected templates — a sudden drop in Googlebot requests to a section of the site is a strong technical signal.
- Check Core Web Vitals history in Search Console for a degradation that lines up with the timeline, particularly after a redesign or new plugin.
- Verify redirect chains and hreflang tags weren’t broken during a migration or template update.
- Confirm the XML sitemap still accurately reflects live, indexable URLs.
4. Content Integrity Checks
- Diff current page content against Wayback Machine snapshots or CMS revision history for any pages that lost rankings, looking specifically for stripped content, removed headings, or altered structure.
- Check for content cannibalization: multiple pages competing for the same query, which can silently dilute rankings on both over time.
- Look for content decay: pages that haven’t been updated while competitors have published fresher, more comprehensive coverage of the same topic.
- Confirm author bylines, credentials, and any expertise signals weren’t accidentally stripped during a template change — this matters more since E-E-A-T became a stated part of Google’s rater guidelines.
5. Backlink Profile Checks
- Pull historical backlink data from Ahrefs or Semrush and check for a sudden loss of high-authority referring domains around the symptom date.
- Check for a sudden, unnatural spike in low-quality inbound links, which can indicate negative SEO or a forgotten old link campaign catching up with the site.
- Review the disavow file, if one exists, to confirm it hasn’t been overwritten, lost, or left out of date.
- Check whether any previously linking pages were deindexed or the linking domains expired, which silently removes their link equity without triggering an obvious event.
6. Manual Action and Penalty Checks
- Check the Manual Actions report in Search Console directly — don’t assume the absence of an email notification means there’s no action; check the report itself.
- Review Search Console messages for security issues (malware, hacked content) that can silently tank rankings.
- If a manual action is present, identify the specific type listed (unnatural links, thin content, structured data spam, etc.) since each requires a different remediation path.
7. AI Search and SERP Feature Checks
- Manually check whether AI Overviews now appear on the site’s core queries where they previously didn’t — this can explain a click drop with no ranking change.
- Compare impressions to clicks at the query level; stable impressions with falling clicks points to a SERP feature or click-through issue, not a ranking loss.
- Check whether competitors are being cited inside AI Overviews or featured snippets for queries the site used to win outright.
- Sample the same queries in ChatGPT, Perplexity, and Google AI Overviews to see whether the site is being cited, paraphrased without citation, or omitted entirely.
8. Competitive Movement Checks
- Identify which pages now outrank the affected page and audit them for what changed — new content depth, new schema, new backlinks, a redesign.
- Check whether a competitor launched a significant content or digital PR campaign around the symptom date.
- Confirm whether the affected keyword’s SERP itself has structurally changed — new competitors, new content formats winning, or increased ad density pushing organic results down.
9. Documentation and Reporting
- Attach a specific piece of evidence to every finding — a log excerpt, a Search Console export, a Wayback diff — rather than a narrative conclusion alone.
- Separate confirmed findings from open hypotheses that still need more data.
- Prioritize the remediation plan by measurable impact and fix complexity, not just by which finding is most interesting.
Run this checklist top to bottom, and resist the urge to stop as soon as one plausible cause turns up. Many real-world cases have more than one contributing factor, and stopping the investigation early is one of the most common ways a forensic diagnosis turns out to be incomplete.
Frequently Asked Questions
Do I need to run every item on this checklist for every case?
Not necessarily in full depth, but every category should at least be checked, even briefly, before you rule it out. Skipping an entire category — say, never checking log files because the client "probably" doesn't have a technical issue — is exactly how forensic investigations miss the real cause. Depth can scale with the case; coverage shouldn't.
What's the single most-skipped item on this list?
Verifying that tracking itself is intact. It's the least glamorous check and the easiest to assume away, but a broken analytics tag, a misconfigured consent banner, or a Google Tag Manager container error produces a traffic graph that's indistinguishable from a real ranking collapse until someone actually checks.
How is this different from a technical SEO audit checklist?
A technical audit checklist evaluates a site against best practices regardless of whether anything went wrong. This checklist is built specifically to diagnose a known symptom — it includes timeline construction, historical diffing, and evidence-documentation steps that a standard technical audit doesn't need because it isn't trying to explain a specific change.
Should I run this checklist even if I already suspect the cause?
Yes. Confirmation bias is a real risk in forensic work — once you have a leading theory, it's tempting to stop looking. Running the full checklist even when you're fairly confident protects against missing a second, compounding cause that would otherwise go unaddressed in the remediation plan.
What tools do I need to complete this checklist?
At minimum: Google Search Console and Analytics access, a crawler such as Screaming Frog, server log file access, a backlink tool like Ahrefs or Semrush, and the Wayback Machine for historical comparison. None of these are exotic or expensive to access, which is part of why forensic SEO is more about disciplined process than specialized tooling.
Terry has 30+ years in software and SEO. He’s the founder of Salterra Digital Services and SEO Spring Training, host of the Roundtable SEO Mastermind, and lead instructor at SEO University — teaching the exact tactics his team uses on client work.
Continue learning
Ready to master this?
This guide is one lesson from the Forensic SEO course. Get every lesson, framework and checklist — plus the full 38-course catalog — inside SEO University.
Practitioner-focused training across the full digital marketing stack — from technical SEO to conversion optimization and the AI search era. By Salterra Digital Services, since 2011.