WooCommerce · Self-hosted (WordPress)

WooCommerce SEO audit: the issues built into WooCommerce — and how to fix them

A WooCommerce SEO audit checks your store across search, AI visibility, accessibility and security — with a fix for each issue we find.

The most popular ecommerce platform by store count — a WordPress plugin that gives you total control, and total responsibility for performance, security, and crawl hygiene.

Common WooCommerce stacks SEOLZ recognizes

WooCommerce + Stripe·WooCommerce + WooPayments·WooCommerce Headless·WooCommerce + Elementor

Your platform & cart configuration is auto-detected during your audit. Linked stacks have fix guides.

How does WooCommerce's architecture shape your SEO?

WooCommerce runs on your own WordPress hosting, so unlike hosted platforms you control the server, robots.txt, .htaccess, and every plugin — but you also own every problem. Its SEO profile is dominated by three things: plugin-and-theme bloat that hurts Core Web Vitals, the layered-navigation and archive URLs WordPress generates automatically, and the fact that it's the single most-attacked CMS on the web. Most fixes are concrete and in your hands: a caching/CDN layer, an SEO plugin configured for products, tightened security headers, and disciplined plugin management.

Reference: WooCommerce developer docs →

What issues show up most on WooCommerce sites?

Why these happen on WooCommerce

Specific to how WooCommerce is built — not generic checklist advice.

SEO

Plugin and theme bloat kills Core Web Vitals

A typical WooCommerce store stacks a page builder, a slider, several Woo extensions, and a heavy theme — each loading its own CSS/JS on every page. Without caching and a CDN, TTFB and LCP suffer badly on mobile. Add full-page caching, defer non-critical scripts, and audit for plugins loading assets store-wide when they're only needed on one page.

SEO

Layered navigation creates crawlable filter URLs

WooCommerce filter widgets and attribute archives generate parameterised URLs (?filter_color=, ?orderby=, ?min_price=) and thin attribute/tag archive pages. Left open, these bloat the crawl and create duplicate-content clusters. Noindex the low-value archives and control filter parameters in robots.txt.

OWASP

Outdated plugins are the #1 security exposure

WordPress/WooCommerce is the most-targeted stack on the web, and the usual entry point is an outdated plugin or theme. Stores frequently run months-behind components, expose /wp-admin and xmlrpc.php, and ship without basic security headers (CSP, X-Frame-Options, HSTS). Keep core and plugins current, add headers at the server, and lock down login.

AEO

Product schema depends on your SEO plugin config

WooCommerce themes don't reliably emit valid Product/Offer JSON-LD on their own. Unless Yoast WooCommerce SEO or Rank Math is installed and configured, your products may have no structured data — invisible to rich results and AI shopping answers. Verify the JSON-LD actually rendered, not just that a plugin is active.

Full fix guide →

Fixes written for WooCommerce

We catalog 182 WooCommerce fixes — exact steps for WooCommerce's admin and theme, each with a link to the official docs.

Catalog coverageSEO

Audit your XML sitemap and internal linking so that every product and category page is discoverable and crawlable by Google — not hidden behind JavaScript, pagination, or missing links.

On WooCommerce
  1. 1Install Yoast SEO or Rank Math (free): both auto-generate an XML sitemap at yourstore.com/sitemap_index.xml that includes WooCommerce Products and Product Categories as separate sitemap files.
  2. 2Yoast: Settings › Yoast SEO › General › Features — ensure XML Sitemaps is toggled ON. Then go to Yoast SEO › Search Appearance › Content Types and confirm Products is set to 'Show in search results'.
  3. 3Rank Math: Rank Math › Sitemap Settings — enable the Sitemap module, then check the Products and Product Categories boxes under 'Include in Sitemap'.
  4. 4WordPress Admin › Appearance › Menus: verify every Product Category is reachable from at least one navigation menu or homepage link.
  5. 5Check for accidental noindex: in Yoast, open any product edit screen and look for the Yoast meta box at the bottom. Confirm 'Allow search engines to show this Post in search results' is set to Yes.
  6. 6Submit yourstore.com/sitemap_index.xml in Google Search Console › Indexing › Sitemaps.
Code · WooCommercephp
<?php
/**
 * Ensure WooCommerce product and product category pages are indexable.
 * Add to child theme's functions.php.
 */
add_action( 'wp_head', 'ensure_products_indexable', 1 );
function ensure_products_indexable() {
    if ( is_product() || is_product_category() || is_shop() ) {
        // Remove any noindex added by other plugins/code
        remove_action( 'wp_head', 'noindex', 1 );
    }
}

Add to your child theme's functions.php to force product and product category pages to be indexable (safety net; Yoast/Rank Math handles this in their UI but this confirms it at the WordPress level).

WooCommerce docs →
Cwv clsSEO

Eliminate unexpected layout shifts by reserving space for every image, video, embed, and dynamically injected element so nothing jumps when the page loads.

On WooCommerce
  1. 1Images: Install the 'Specify Image Dimensions' plugin (free, WordPress.org) to automatically add missing width/height attributes to all images output by WordPress and WooCommerce. Alternatively, use the 'Perfmatters' plugin → Image tab → 'Add Missing Image Dimensions'.
  2. 2Theme: In your child theme's functions.php, ensure add_theme_support('html5', ['img']) is present so WordPress outputs modern image markup. For block themes, check theme.json for any layout that may cause reflow.
  3. 3Fonts: In Appearance → Customize → Additional CSS (or your child theme's style.css), add font-display: swap (with override descriptors if needed) to all @font-face rules. If using Google Fonts via a plugin, switch to 'Local Google Fonts' plugin which gives you control over font-display.
  4. 4Cookie / GDPR banners: In your cookie consent plugin settings (e.g. Complianz, CookieYes), set the banner display style to 'bottom bar' or 'modal overlay' rather than a top push-down banner.
  5. 5Caching / optimisation plugin: In WP Rocket, LiteSpeed Cache, or W3 Total Cache → Media settings, enable 'Add missing image dimensions' and 'Lazy load images'. These tools also defer non-critical JS that may inject shifting content.
  6. 6Verify: Run PageSpeed Insights or use the Chrome Web Vitals extension on your site; target CLS < 0.1.
Code · WooCommercephp
<?php
/**
 * Automatically add width and height attributes to images
 * that are missing them, to prevent Cumulative Layout Shift.
 * Add to: wp-content/themes/your-child-theme/functions.php
 */
add_filter( 'the_content', 'mytheme_add_image_dimensions', 99 );
add_filter( 'post_thumbnail_html', 'mytheme_add_image_dimensions', 99 );

function mytheme_add_image_dimensions( $html ) {
    // Match img tags that are missing width or height attributes
    $pattern = '/<img(?![^>]*(?:width|height))[^>]*>/i';
    preg_match_all( $pattern, $html, $matches );

    foreach ( $matches[0] as $img_tag ) {
        // Extract src
        preg_match( '/src=["\']([^"\']+)["\']/i', $img_tag, $src_match );
        if ( empty( $src_match[1] ) ) continue;

        $src        = $src_match[1];
        $attach_id  = attachment_url_to_postid( $src );
        if ( ! $attach_id ) continue;

        $meta = wp_get_attachment_metadata( $attach_id );
        if ( empty( $meta['width'] ) || empty( $meta['height'] ) ) continue;

        $new_tag = str_replace(
            '<img ',
            '<img width="' . esc_attr( $meta['width'] ) . '" height="' . esc_attr( $meta['height'] ) . '" ',
            $img_tag
        );
        $html = str_replace( $img_tag, $new_tag, $html );
    }
    return $html;
}

Add to your child theme's functions.php to automatically inject missing width/height attributes on all WordPress images, eliminating the most common CLS source.

WooCommerce docs →
Cwv inpSEO

Reduce Interaction to Next Paint (INP) to under 200 ms by breaking up long JavaScript tasks, deferring non-critical third-party scripts, and lightening event handlers so the page feels fast and responsive after every tap or click.

On WooCommerce
  1. 1Install a performance plugin such as WP Rocket, Perfmatters, or Asset CleanUp Pro. In its settings, enable 'Delay JavaScript execution' or 'Load JS deferred' for third-party scripts (chat, CRM pixels, review widgets).
  2. 2Go to WP Admin → Plugins and deactivate any plugin whose frontend script you don't actively need. Each deactivated plugin typically removes one or more scripts from the page.
  3. 3In WP Rocket (or equivalent), use the 'Delay JavaScript' feature to defer specific scripts (e.g., Facebook Pixel, Intercom) until after first user interaction.
  4. 4If using a page builder (Elementor, Divi, etc.), go to its performance settings and enable 'Improved Asset Loading' or 'Script Loading Optimizations' — these defer builder-injected JS.
  5. 5For custom code, open your child theme's functions.php or a custom plugin and change `wp_enqueue_script` calls to use `'in_footer' => true` and add the `defer` strategy via the `$args` array (WP 6.3+): `wp_enqueue_script('my-script', $src, $deps, $ver, ['strategy' => 'defer'])`.
  6. 6Verify with PageSpeed Insights and the Chrome DevTools Performance panel; monitor Google Search Console → Core Web Vitals report.
WooCommerce docs →
Cwv lcpSEO

Reduce Largest Contentful Paint (LCP) to under 2.5 seconds by serving the hero image in a next-gen format (WebP/AVIF), preloading it, and eliminating render-blocking resources.

On WooCommerce
  1. 1IDENTIFY LCP IMAGE: Run PageSpeed Insights on your homepage and key product/category pages. The LCP element is usually the hero image set in your theme's Customizer or a page-builder block.
  2. 2CONVERT TO WEBP: Install the free plugin 'WebP Express' or 'Imagify' (freemium). Activate and run a bulk conversion. Imagify: Plugins › Add New › search 'Imagify' › Install & Activate › Settings › choose WebP format › Bulk Optimize.
  3. 3PRELOAD: Install 'WP Rocket' (paid) or 'LiteSpeed Cache' (free). In WP Rocket: Settings › WP Rocket › Media tab › enable 'Preload LCP Image'. In LiteSpeed Cache: Settings › LiteSpeed Cache › Page Optimization › enable 'Preload Hero Image'.
  4. 4DEFER JS & REMOVE RENDER-BLOCKING: In WP Rocket: Settings › WP Rocket › File Optimization › enable 'Defer JavaScript Execution' and 'Delay JavaScript Execution'. In LiteSpeed Cache: Page Optimization › JS Deferred/Delayed.
  5. 5NO LAZY-LOAD ON HERO: In your theme's Customizer or code, ensure the hero/banner img tag has loading='eager' and fetchpriority='high'. Most caching plugins have an option to exclude the LCP image from lazy-loading — use it.
  6. 6VERIFY: Re-run PageSpeed Insights; check Google Search Console › Core Web Vitals report.
Code · WooCommercehtml
<!-- WooCommerce / WordPress hero block — paste in Custom HTML block or theme template -->
<img
  src="/wp-content/uploads/hero-banner.webp"
  srcset="/wp-content/uploads/hero-banner-768.webp 768w,
          /wp-content/uploads/hero-banner-1200.webp 1200w,
          /wp-content/uploads/hero-banner.webp 1920w"
  sizes="100vw"
  alt="[Describe your hero image here]"
  width="1920"
  height="700"
  loading="eager"
  fetchpriority="high"
>

If using a page builder for the hero, switch to the HTML/Custom HTML block and use this markup. Otherwise apply via functions.php (see WordPress snippet above).

WooCommerce docs →

Browse all 182 WooCommerce fixes →

WooCommerce on the open web

6.4% of the crawled web runs WooCommerce

987,340
live WooCommerce sites
#1
of 6 ecommerce platforms
6.4%
share of all crawled sites

Losing share — -6.2% over the last 6 monthly crawls

Source: HTTP Archive — a real-Chrome crawl of 15.5M origins (2026-09-01). Share of all crawled sites, not just ecommerce.

Software currency · OWASP A06

67% of WooCommerce sites run an outdated version

Across the open web, only 33% of WooCommerce sites are on 11.1.0, the current release — out of 1,677,222 versioned WooCommerce sites. Outdated software is the single most common source of exploitable vulnerabilities (OWASP A06). SEOLZ flags exactly which of your components are behind — and the version to update to.

67%
run an outdated version
11.1.0
current release
1,677,222
versioned sites tracked

Source: HTTP Archive — version strings from a real-Chrome crawl of the open web. A major.minor behind the current line counts as outdated.

How AI reads WooCommerce sites · AEO

76% of WooCommerce sites publish structured data

JSON-LD is the schema.org markup AI answer engines read to understand — and cite — a page. But 0.7% of WooCommerce sites add it only after JavaScript runs, so non-JS AI crawlers never see it. SEOLZ checks whether your structured data is present, valid, and visible to AI.

76%
publish JSON-LD
77%
have Open Graph
0.7%
JSON-LD only via JS

Source: HTTP Archive — structured-data probes on static + rendered HTML across 986,946 WooCommerce sites.

The typical WooCommerce site · HTTP Archive

How WooCommerce sites measure up

Performance — median

3.1 MB
page weight
110
requests
10.4s
load time

Accessibility gaps — share of sites

88%
empty image alt
36%
unlabelled fields
48%
non-semantic controls

Source: HTTP Archive lab performance + accessibility probes across 986,946 WooCommerce sites. SEOLZ measures your site against these.

Based on 7 WooCommerce sites swept on SEOLZ

vs all-platform average

Avg SEO89
+8 above average
Avg AEO50
+9 above average
Avg WCAG86
-4 below average
Avg Security73
≈ average
Avg GEO53
+5 above average
Avg Composite73
+5 above average

WooCommerce sites score near the all-platform average. AEO is the most common area for improvement.

Data as of July 2026 · SEOLZ audits

⚠ What SEOLZ can't modify on WooCommerce

We still flag these issues — but the fix lives outside what WooCommerce lets you change.

Hosted vs self-hosted

WooCommerce is self-hosted, giving you full control. However, on managed WooCommerce hosting, server-level configurations (PHP, server headers) may be restricted by your host.

Every scan checks all six pillars

You can't rank what AI can't read. SEO, AEO, and GEO tell you where you rank; WCAG, OWASP, and Lifecycle determine whether search and AI can read and trust you at all. SEOLZ scores all six as one system.

🔍
SEO

Your catalog pages may be invisible to Google right now and you'd have no way to know. Indexability gaps, canonical conflicts, and faceted navigation issues silently kill organic traffic — we surface every one and tell you which to fix first.

Learn how to fix SEO issues →
✨
Answer Engine (AEO)

When someone asks ChatGPT to recommend a product in your category, is your store in the answer? Often it isn't. We check the structured data, page structure, and brand signals that help search and AI understand your products and describe them accurately — and we measure whether they actually cite you, or a competitor.

Learn how to fix Answer Engine (AEO) issues →
🌐
AI Visibility (GEO)

AI search is eating traditional organic traffic. We track your actual brand mentions across ChatGPT, Perplexity, and other AI engines — and tell you what's pushing you down in the results.

Learn how to fix AI Visibility (GEO) issues →
♿
Accessibility (WCAG)

Ecommerce stores are among the most frequent recipients of ADA accessibility demand letters. We run WCAG 2.1 AA checks across your catalog, surface the barriers that most often appear in demand letters, and track each one through to a verified fix.

Learn how to fix Accessibility (WCAG) issues →
🛡️
Security (OWASP)

A missing security header exposes your customers, and a compromised or flagged site loses search visibility fast. We check the server configuration, HTTPS setup, and email authentication issues that erode trust — before they become an incident.

Learn how to fix Security (OWASP) issues →
⏳
Site Lifecycle

SSL expires. Plugin versions fall behind. GTM containers go unverified. These aren't hypothetical risks — they're the operational failures that cause outages, ranking drops, and security incidents. We catch them before they happen.

Learn how to fix Site Lifecycle issues →

Start free. Upgrade when ready.

Scout
Free
1 site · 50 pages/audit · monthly audits
6-pillar welcome scan
  • ✓Composite + pillar scores
  • ✓Issue counts
  • ✓Recurring five-pillar re-scan
  • ✓Free forever
Start free
Starter
$49/mo
1 site · 500 pages/audit · weekly audits
All 6 pillars
  • ✓Every finding across all 6 pillars, with step-by-step fixes for your platform
  • ✓Template fixes: fix it once, clear it on every page built from that template
  • ✓Fix tracking: mark it fixed and the next audit confirms it
  • ✓Email alerts for score drops, new security issues, and SSL / domain expiry
  • ✓Report builder with PDF, HTML and Markdown export
  • ✓GTM & tracking audit, plus Search Console topic gaps
Choose Starter

Questions about WooCommerce audits

Does SEOLZ work with WooCommerce?+

Yes — we crawl your live WooCommerce store from the outside. Because WooCommerce is self-hosted, most of our fixes are things fully under your control: server config, plugins, and theme files.

Why is my WooCommerce store slow?+

Usually plugin/theme bloat plus no caching layer. WooCommerce runs PHP on every uncached request; without full-page caching and a CDN, product and shop pages are slow. We flag the specific Core Web Vitals failures and what's causing them.

Do I need Yoast or Rank Math?+

You need something emitting valid Product schema and managing canonicals/archives — Yoast WooCommerce SEO or Rank Math both do. We check whether the structured data is actually present in your rendered HTML, regardless of which plugin you use.

How do I fix WooCommerce security issues?+

Keep WordPress core, WooCommerce, and every plugin/theme updated; add security headers at your server or via a plugin; and restrict access to wp-admin and xmlrpc. We list each missing header and outdated component specifically.

See what's holding back your WooCommerce site

Free scan, no credit card, results in minutes. We've got you.

Scan My WooCommerce Site Free