Forensic SEO metrics answer a narrower question than standard SEO KPIs: not “is the site doing well,” but “what changed, exactly when, and by how much.” That means the metrics that matter most are the ones that can be plotted against a timeline and correlated with a specific event, rather than broad health indicators viewed in isolation.
- Clicks and Impressions, Split — Not Combined
- Average Position, Tracked Weekly
- Crawl Stats and Indexation Ratio
- Referring Domains and Link Velocity
- Core Web Vitals and Page Experience Signals
- Manual Actions and Security Issues Status
- Local-Specific Metrics: Local Pack Visibility and GBP Insights
- Turning Metrics Into Evidence, Not Just Numbers
Below is the metric set we actually pull at Salterra during an investigation, in the order we check them, along with why each one earns its place.
Clicks and Impressions, Split — Not Combined
Google Search Console’s Performance report is the backbone of any forensic investigation, but it needs to be read as two separate metrics, not one blended “traffic” number. Clicks falling while impressions hold steady points toward a CTR problem — a changed title tag, a new AI Overview eating the click, or a SERP feature pushing the listing down visually even at the same rank. Both falling together points toward an actual visibility or indexing loss. Impressions falling alone, with clicks proportional, usually means demand itself shifted (seasonality, a declining search trend) rather than anything the site did.
We always pull this by page and by query, not just site-wide, since a site-wide average can hide a severe drop on ten important pages beneath healthy performance on hundreds of unimportant ones.
Average Position, Tracked Weekly
Position data is noisy day to day but becomes useful when tracked weekly across a defined set of priority queries — not every keyword the site happens to rank for. A slip from position 4 to position 9 on the site’s five highest-value queries is a meaningful forensic signal. The same slip on fifty low-intent long-tail queries usually isn’t worth chasing.
We deliberately avoid daily rank-tracker obsession here; algorithmic noise at the daily level creates false signals that waste investigative time. Weekly aggregation smooths that out while still catching real movement fast enough to act on.
Crawl Stats and Indexation Ratio
Google Search Console’s Crawl Stats report and the Pages report under Indexing show how many of a site’s URLs are actually indexed versus excluded, and why. A rising count of pages marked “Crawled – currently not indexed” or “Discovered – currently not indexed” is one of the clearest early-warning metrics available, often showing up before any visible traffic decline, because it signals Google’s own assessment of content quality or crawl priority shifting before rankings fully reflect it.
This metric is chronically under-monitored. Most teams check it only after a drop has already happened, when in a real forensic strategy it should be part of the standing baseline review.
Referring Domains and Link Velocity
Pulled from Ahrefs or Semrush, tracking new and lost referring domains over time serves two forensic purposes. A sudden, unexplained spike in low-quality referring domains can indicate a negative SEO attempt. A sudden loss of previously earned high-authority links — often from an acquisition, a redesign on the linking site, or a content removal — can quietly erode the ranking signal a page relied on, with no action taken on the affected site itself.
Link velocity should always be checked alongside the timeline of the site’s own changes, since correlation with an external event (a competitor’s negative SEO campaign, a partner site’s redesign) is what turns this metric from a curiosity into evidence.
Core Web Vitals and Page Experience Signals
Pulled from Google Search Console’s Core Web Vitals report and cross-checked in PageSpeed Insights or Chrome DevTools’ Lighthouse panel, these metrics matter forensically when a technical change — a new script, an image-heavy redesign, a third-party tracking tag — coincides with a performance drop. They’re rarely the sole cause of a major ranking collapse on their own, but they’re frequently a contributing factor that compounds a bigger underlying issue, and they’re easy to rule in or out quickly.
The forensic value here is comparative, not absolute. A site sitting in the “Needs Improvement” band for months without a ranking problem tells you Core Web Vitals probably isn’t your active cause. The same score, newly arrived at after a deploy that coincides with a drop, is a different story entirely — the number matters far less than whether it changed at the right moment.
Engagement signals from Google Analytics 4 — bounce rate, average engagement time, pages-per-session — rarely prove a root cause on their own, but they corroborate one. If a page’s rankings held steady while engagement time collapsed, that points toward a content or user-experience problem that may eventually drag rankings down even though it hasn’t yet, a leading indicator worth flagging before it becomes a lagging one. Conversely, stable engagement alongside a ranking drop reinforces that the cause is likely external or technical, not a content-quality issue users are reacting to. We treat engagement metrics as a tiebreaker rather than a primary signal, since GA4’s session definitions vary enough across platforms that cross-site comparisons are unreliable — within a single site’s own history, though, a sharp shift is still meaningful.
Manual Actions and Security Issues Status
This isn’t a graph-based metric, but it’s a binary status check that should happen first in every investigation, every time, without exception: does Search Console show an active manual action or a security issue? It takes under a minute to check and immediately rules out (or confirms) an entire category of possible causes before any other metric is even pulled.
Local-Specific Metrics: Local Pack Visibility and GBP Insights
For location-based businesses, standard organic metrics aren’t enough. Google Business Profile’s own Insights data — views, calls, direction requests, and how the listing was found (direct, discovery, or branded search) — needs to be tracked alongside organic Search Console data. A drop confined to local pack visibility with organic rankings holding steady is a strong signal pointing at the GBP listing itself — a suspension, an edit, or a review-related issue — rather than at the website.
- GBP views and actions, tracked monthly at minimum, to catch listing-level problems separately from site-level ones.
- Local pack presence for priority “near me” and service+city queries, checked via manual search or a local rank tracker, since local pack results aren’t fully captured in standard Search Console data.
Turning Metrics Into Evidence, Not Just Numbers
The discipline that separates forensic metric use from ordinary reporting is insisting that no single metric stands alone as proof. A drop in average position is a data point. A drop in average position that lines up with a crawl diff showing a canonical tag change, confirmed by a matching pattern in server logs, is evidence. The goal of every metric pulled during an investigation is to either strengthen or weaken a specific hypothesis about root cause — not to fill out a dashboard.
Frequently Asked Questions
What's the single most important metric to check first in a forensic SEO investigation?
Whether Google Search Console shows an active manual action or security issue. It takes under a minute and immediately rules an entire category of causes in or out.
Why split clicks and impressions instead of just looking at total traffic?
Because the pattern of which one moved, and by how much, tells you what kind of problem you're dealing with — a visibility loss, a CTR problem, or a genuine demand shift — long before you dig into technical causes.
Should daily rank tracking data be trusted for forensic investigations?
Not on its own. Daily position data is noisy and prone to algorithmic fluctuation; weekly aggregation across a defined set of priority queries gives a more reliable forensic signal.
How do referring domain metrics help diagnose a ranking drop?
They can reveal either a negative SEO attempt (a spike in low-quality new links) or a quiet loss of valuable earned links, both of which can affect rankings independent of anything that changed on the site itself.
Are Core Web Vitals usually the main cause of a major ranking drop?
Rarely on their own, but they're worth checking early because they're quick to rule in or out and frequently compound a larger underlying issue when a technical change coincides with a performance decline.
What local-specific metrics matter that standard SEO metrics miss?
Google Business Profile Insights (views, calls, direction requests) and local pack visibility for priority queries, since a local pack-specific drop with stable organic rankings usually points at the listing itself rather than the website.
Terry has 30+ years in software and SEO. He’s the founder of Salterra Digital Services and SEO Spring Training, host of the Roundtable SEO Mastermind, and lead instructor at SEO University — teaching the exact tactics his team uses on client work.
Continue learning
Ready to master this?
This guide is one lesson from the Forensic SEO course. Get every lesson, framework and checklist — plus the full 38-course catalog — inside SEO University.
Practitioner-focused training across the full digital marketing stack — from technical SEO to conversion optimization and the AI search era. By Salterra Digital Services, since 2011.