WordPress · Self-hosted CMS

WordPress SEO audit: the issues built into WordPress — and how to fix them

A WordPress SEO audit checks your store across search, AI visibility, accessibility and security — with a fix for each issue we find.

The CMS behind a huge share of the web. Endlessly flexible and SEO-capable — but its automatic archives, plugin sprawl, and self-hosted security are where sites go wrong.

How does WordPress's architecture shape your SEO?

Self-hosted WordPress (WordPress.org) gives you complete control of the server, permalinks, robots, and every plugin — and complete responsibility for them. Out of the box it auto-generates a lot of URLs: category, tag, author, date, and attachment archives, plus paginated lists, many of which are thin or duplicative. It emits no structured data on its own, leans on a caching layer for performance, and — like anything self-hosted — needs disciplined updates to stay secure. Most fixes run through an SEO plugin (Yoast or Rank Math), a caching/CDN setup, and server-level hardening.

Reference: WordPress SEO documentation →

What issues show up most on WordPress sites?

Most common in our WordPress audit data

Measured across the 7 WordPress siteswe've audited — this list re-ranks itself as we scan more.

Data as of July 2026

Why these happen on WordPress

Specific to how WordPress is built — not generic checklist advice.

SEO

Auto-generated archives create thin, duplicate pages

WordPress spins up archive pages for every tag, category, author, and date — plus attachment pages for each uploaded image. Left unmanaged these are thin, near-duplicate, and dilute your crawl. Noindex the low-value archives (most date/author/tag archives) and disable attachment pages.

AEO

No structured data without a plugin

Core WordPress doesn't output Article, FAQ, or breadcrumb schema. Unless your theme or SEO plugin adds it, your content has no structured data for rich results or AI answers. Confirm the schema is actually present in the rendered HTML, not just that a plugin is active.

OWASP

Plugin sprawl: performance and security

The flexibility that makes WordPress powerful also makes it heavy and exposed. Too many plugins slow the site and widen the attack surface, and outdated plugins are the leading WordPress breach vector. Keep core/plugins/themes current, add security headers, and remove what you don't use.

Fixes written for WordPress

We catalog 66 WordPress fixes — exact steps for WordPress's admin and theme, each with a link to the official docs.

Cwv lcpSEO

Reduce Largest Contentful Paint (LCP) to under 2.5 seconds by serving the hero image in a next-gen format (WebP/AVIF), preloading it, and eliminating render-blocking resources.

On WordPress.org
  1. 1Install WP Rocket or Perfmatters (Plugins → Add New → search) for an all-in-one performance plugin that handles preloading, CSS/JS deferral, and lazy-load exclusions.
  2. 2Install Imagify or ShortPixel to auto-convert existing and newly uploaded images to WebP with automatic <picture> tag fallback — no manual image re-export needed.
  3. 3In WP Rocket → Media: find 'Exclude from LazyLoad' and add the CSS selector or filename of your hero image (e.g., .hero-image, hero-banner.jpg) so it loads eagerly.
  4. 4In WP Rocket → Preload: enable 'Preload Links' and use the 'Prefetch DNS Requests' field to add your CDN domain.
  5. 5Manually add a preload tag for maximum control: Appearance → Theme File Editor → header.php → inside <head> add: <link rel='preload' as='image' href='/wp-content/uploads/hero.webp' fetchpriority='high'>.
  6. 6Verify with PageSpeed Insights mobile score and WP Rocket's Cache Lifespan settings to ensure the optimized page is served from cache to all visitors.
Code · WordPress.orgphp
<?php
/**
 * Preload the LCP hero image.
 * Add to child theme's functions.php
 */
add_action( 'wp_head', 'my_preload_lcp_image', 1 );
function my_preload_lcp_image() {
    // Replace with your actual WebP hero image URL
    $hero_url = get_template_directory_uri() . '/assets/images/hero-banner.webp';
    echo '<link rel="preload" as="image" href="' . esc_url( $hero_url ) . '" fetchpriority="high">' . "\n";
}

/**
 * Remove lazy-loading from the first (LCP) image.
 * Works in WordPress 5.9+
 */
add_filter( 'wp_lazy_loading_enabled', function( $default, $tag_name, $context ) {
    // Disable lazy-load for images in the hero/banner context if you control the context name
    return $default;
}, 10, 3 );
// Alternatively, add fetchpriority="high" and loading="eager" directly in your template's hero <img> tag.

Add to your child theme's functions.php to preload the LCP image. Replace the image URL with your actual hero image path.

WordPress.org docs →
Duplicate meta descriptionSEO

Write a unique, page-specific meta description for every page on your store so Google can display a compelling, accurate snippet for each one in search results.

On WordPress.org
  1. 1Install Yoast SEO or Rank Math if not already active (Plugins → Add New → search → Install → Activate).
  2. 2For any post or page: open the editor → scroll to the Yoast SEO / Rank Math panel → click 'Edit snippet' (Yoast) or expand 'General' (Rank Math) → type your unique description in the Meta Description field → Update/Publish.
  3. 3For bulk editing: Yoast SEO → Tools → Bulk editor → Descriptions tab — edit descriptions for all content in a single table.
  4. 4For archive/author pages: Yoast → Settings → Content types → Authors/Archives → Meta description template.
  5. 5For paginated archives (/page/2 etc.): Yoast and Rank Math automatically add `rel=canonical` to page 1 by default, preventing duplicate description penalties for pagination.
Code · Generic HTMLhtml
<head>
  <meta charset="UTF-8">
  <meta name="description" content="Shop women's running shoes at Acme Store — lightweight, cushioned designs for road and trail. Free shipping on orders over $50.">
  <title>Women's Running Shoes | Acme Store</title>
</head>

Place inside the <head> element of every page. Replace the content value with a unique 120–160 character description for that specific page.

WordPress.org docs →
Duplicate titleSEO

Give every page a unique, descriptive title tag that accurately reflects that page's specific content.

On WordPress.org
  1. 1Install Yoast SEO or Rank Math if not already active.
  2. 2For individual posts/pages: open the editor, scroll to the Yoast SEO / Rank Math panel, click 'Edit snippet', and type a unique SEO title.
  3. 3For sitewide templates: Yoast SEO → Search Appearance → Content Types / Taxonomies; set patterns with %%title%% %%sep%% %%sitename%% so every page outputs a distinct title.
  4. 4Use Yoast's Bulk Editor (Yoast SEO → Tools → Bulk Editor → Titles) to review and edit all page titles in one place without opening each post.
  5. 5If using a theme that outputs its own <title> tag and conflicts with the SEO plugin, ensure the theme declares add_theme_support('title-tag') in functions.php and removes any hardcoded <title> in header.php.
Code · Generic HTMLhtml
<head>
  <title>Merino Wool Running Socks – Free UK Shipping | BrandName</title>
</head>

Place inside <head>. Make the title unique per page — include the specific item name and brand.

WordPress.org docs →
Images missing altSEO

Add descriptive alt text to every product and content image so search engines and screen readers can understand what the image shows.

On WordPress.org
  1. 1Media Library: Admin → Media → Library → click any image → fill in the 'Alt Text' field in the right sidebar → Update.
  2. 2Gutenberg block editor: Click an Image block in a post or page → in the Block settings sidebar (right panel) → find 'Alt text (alternative text)' → fill it in. Mark as decorative via the toggle if purely ornamental.
  3. 3Classic editor: Click an image in the editor → click the pencil (Edit) icon → fill the 'Alternative Text' field in the Image Details dialog → Update.
  4. 4For bulk alt text: Install the free 'SEO Optimized Images' or 'Bulk Auto Image Alt Text' plugin → configure auto-fill rules using product/post title or custom templates → run bulk update.
Code · Generic HTMLhtml
<!-- BEFORE (missing alt — bad) -->
<img src="/images/red-leather-bag.jpg">

<!-- AFTER (descriptive alt — correct) -->
<img src="/images/red-leather-bag.jpg" alt="Red leather crossbody bag with gold buckle clasp">

<!-- Decorative image (intentionally empty alt — correct) -->
<img src="/images/divider-line.png" alt="">

Place this wherever an <img> tag appears in your HTML. Replace the placeholder text with your real description.

WordPress.org docs →

Browse all 66 WordPress fixes →

Software currency · OWASP A06

44% of WordPress sites run an outdated version

Across the open web, only 56% of WordPress sites are on 7.1, the current release — out of 6,242,704 versioned WordPress sites. Outdated software is the single most common source of exploitable vulnerabilities (OWASP A06). SEOLZ flags exactly which of your components are behind — and the version to update to.

44%
run an outdated version
7.1
current release
6,242,704
versioned sites tracked

Source: HTTP Archive — version strings from a real-Chrome crawl of the open web. A major.minor behind the current line counts as outdated.

How AI reads WordPress sites · AEO

70% of WordPress sites publish structured data

JSON-LD is the schema.org markup AI answer engines read to understand — and cite — a page. But 0.7% of WordPress sites add it only after JavaScript runs, so non-JS AI crawlers never see it. SEOLZ checks whether your structured data is present, valid, and visible to AI.

70%
publish JSON-LD
76%
have Open Graph
0.7%
JSON-LD only via JS

Source: HTTP Archive — structured-data probes on static + rendered HTML across 4,968,702 WordPress sites.

The typical WordPress site · HTTP Archive

How WordPress sites measure up

Performance — median

2.8 MB
page weight
80
requests
9s
load time

Accessibility gaps — share of sites

82%
empty image alt
28%
unlabelled fields
41%
non-semantic controls

Source: HTTP Archive lab performance + accessibility probes across 4,968,702 WordPress sites. SEOLZ measures your site against these.

Based on 7 WordPress sites swept on SEOLZ

vs all-platform average

Avg SEO89
+8 above average
Avg AEO50
+9 above average
Avg WCAG86
-4 below average
Avg Security73
≈ average
Avg GEO53
+5 above average
Avg Composite73
+5 above average

WordPress sites score near the all-platform average. AEO is the most common area for improvement.

Data as of July 2026 · SEOLZ audits

Every scan checks all six pillars

You can't rank what AI can't read. SEO, AEO, and GEO tell you where you rank; WCAG, OWASP, and Lifecycle determine whether search and AI can read and trust you at all. SEOLZ scores all six as one system.

🔍
SEO

Your catalog pages may be invisible to Google right now and you'd have no way to know. Indexability gaps, canonical conflicts, and faceted navigation issues silently kill organic traffic — we surface every one and tell you which to fix first.

Learn how to fix SEO issues →
✨
Answer Engine (AEO)

When someone asks ChatGPT to recommend a product in your category, is your store in the answer? Often it isn't. We check the structured data, page structure, and brand signals that help search and AI understand your products and describe them accurately — and we measure whether they actually cite you, or a competitor.

Learn how to fix Answer Engine (AEO) issues →
🌐
AI Visibility (GEO)

AI search is eating traditional organic traffic. We track your actual brand mentions across ChatGPT, Perplexity, and other AI engines — and tell you what's pushing you down in the results.

Learn how to fix AI Visibility (GEO) issues →
♿
Accessibility (WCAG)

Ecommerce stores are among the most frequent recipients of ADA accessibility demand letters. We run WCAG 2.1 AA checks across your catalog, surface the barriers that most often appear in demand letters, and track each one through to a verified fix.

Learn how to fix Accessibility (WCAG) issues →
🛡️
Security (OWASP)

A missing security header exposes your customers, and a compromised or flagged site loses search visibility fast. We check the server configuration, HTTPS setup, and email authentication issues that erode trust — before they become an incident.

Learn how to fix Security (OWASP) issues →
⏳
Site Lifecycle

SSL expires. Plugin versions fall behind. GTM containers go unverified. These aren't hypothetical risks — they're the operational failures that cause outages, ranking drops, and security incidents. We catch them before they happen.

Learn how to fix Site Lifecycle issues →

Start free. Upgrade when ready.

Scout
Free
1 site · 50 pages/audit · monthly audits
6-pillar welcome scan
  • ✓Composite + pillar scores
  • ✓Issue counts
  • ✓Recurring five-pillar re-scan
  • ✓Free forever
Start free
Starter
$49/mo
1 site · 500 pages/audit · weekly audits
All 6 pillars
  • ✓Every finding across all 6 pillars, with step-by-step fixes for your platform
  • ✓Template fixes: fix it once, clear it on every page built from that template
  • ✓Fix tracking: mark it fixed and the next audit confirms it
  • ✓Email alerts for score drops, new security issues, and SSL / domain expiry
  • ✓Report builder with PDF, HTML and Markdown export
  • ✓GTM & tracking audit, plus Search Console topic gaps
Choose Starter

Questions about WordPress audits

Does SEOLZ work with WordPress?+

Yes — we crawl your live WordPress site. Because it's self-hosted, most fixes are fully in your control: permalinks, archives, an SEO plugin's settings, caching, and server hardening.

Should I noindex WordPress tag and category pages?+

Usually the low-value ones — date, author, and most tag archives — yes, because they're thin and duplicative. Well-curated category pages can stay indexed. We flag which archives are hurting you.

Why is my WordPress site slow?+

Typically theme/plugin bloat with no caching layer. WordPress runs PHP per uncached request; add full-page caching and a CDN, and trim plugins loading assets site-wide. We pinpoint the specific Core Web Vitals failures.

See what's holding back your WordPress site

Free scan, no credit card, results in minutes. We've got you.

Scan My WordPress Site Free