Drupal SEO Audit: the issues built into Drupal — and how to fix them

Add HowTo and BreadcrumbList structured data (JSON-LD) to pages that contain step-by-step instructions so Google can display them as rich results and answer-engine snippets.

1. 1Install the 'Schema.org Metatag' module or 'Metatag' module with the JSON-LD submodule from drupal.org.
2. 2Configure schema mappings for the relevant content type (e.g. 'How-to Guide') under Configuration › Search and Metadata › Metatag.
3. 3For HowTo, you may need a custom module or a preprocess hook in your theme's .theme file to build the JSON-LD array and attach it via #attached['html_head'] on the relevant node type.
4. 4BreadcrumbList is handled by the 'Simple XML Sitemap' or Metatag modules, or via a custom hook_preprocess_page().
5. 5Validate with Google's Rich Results Test.

Add a discernible, screen-reader-accessible name to every button, link, and menuitem that uses an ARIA command role so assistive technology can announce what it does.

1. 1In Drupal admin, go to Appearance and identify your active theme.
2. 2In your custom or sub-theme, locate the Twig template file responsible for the unlabelled element (e.g., button.html.twig, menu.html.twig).
3. 3Add `aria-label="{{ 'Descriptive action'|t }}"` to the element tag (using Drupal's translation function for internationalisation). Add `aria-hidden="true"` to decorative SVGs.
4. 4Rebuild the Twig cache (Configuration → Development → Performance → Clear all caches, or `drush cr`) and verify with axe DevTools.

Fix all HTML list elements so that `<ul>` and `<ol>` contain only valid `<li>` children, and `<li>` elements appear only inside a proper list container, ensuring correct semantic list structure throughout your store.

1. 1Broken list markup in Drupal usually originates in a Twig template. Find the relevant template in your theme's 'templates/' folder (e.g. 'menu.html.twig', 'item-list.html.twig').
2. 2Open the template and verify that any <ul> or <ol> loop outputs <li> wrappers correctly: {% for item in items %}<li>{{ item.content }}</li>{% endfor %}.
3. 3If the issue is in a contributed module's template, copy the template into your theme's templates directory (Drupal's template override system), then fix it there.
4. 4Run 'drush cr' (cache rebuild) or go to Configuration → Performance → Clear all caches, then re-audit the page.

Remove or mask the X-Powered-By HTTP response header to stop advertising your server technology stack to attackers.

1. 1In your sites/default/settings.php or a custom module's hook_boot(), call `header_remove('X-Powered-By');` or use `drupal_add_http_header('X-Powered-By', '');`
2. 2Install the 'Security Kit' (seckit) module from drupal.org: Admin → Configuration → System → Security Kit — it provides options to strip information-disclosure headers.
3. 3For Apache: Add `Header unset X-Powered-By` to your .htaccess or VirtualHost config.
4. 4For Nginx: Add `more_clear_headers 'X-Powered-By';` to the server block.