An XML sitemap gives search engines and AI crawlers an explicit, machine-readable list of the URLs you want indexed, along with metadata such as last-modified dates. Fixing this issue means generating a valid sitemap, publishing it at a stable URL, and pointing crawlers to it via robots.txt and Search Console. This is especially important for large sites, sites with weak internal linking, or sites where new content needs to be discovered quickly.

Example

<?xml version="1.0" encoding="UTF-8"?>
<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
  <url>
    <loc>https://example.com/</loc>
    <lastmod>2026-04-15</lastmod>
  </url>
  <url>
    <loc>https://example.com/blog/getting-started</loc>
    <lastmod>2026-03-22</lastmod>
  </url>
</urlset>

Where to make the change

• Raw HTML or static site: generate the XML at build time and publish it at /sitemap.xml. Many static-site generators have a built-in sitemap option.
• WordPress: a dedicated SEO plugin will generate and update the sitemap automatically, typically at /sitemap_index.xml.
• Shopify: Shopify generates /sitemap.xml automatically and updates it as products and collections change.
• Wix or Squarespace: both platforms generate the sitemap automatically and serve it at the standard root path.
• Headless or framework sites: use the framework's built-in sitemap module (for example next-sitemap for Next.js or the @astrojs/sitemap integration) so the file is regenerated on every build.

Common causes and how to resolve them

• No sitemap published: generate one and publish it at the site root. Reference it from robots.txt with a Sitemap: line.
• Sitemap lists URLs that 404 or redirect: stale entries waste crawl budget and trigger Search Console warnings. Regenerate the sitemap from current published URLs only.
• Mixed canonical and non-canonical URLs: the sitemap should list canonical URLs only. Listing both http and https, or trailing-slash variants, splits crawl signals.
• Sitemap exceeds size limits: a single sitemap may contain at most 50,000 URLs and 50 MB uncompressed. Split larger sites into multiple sitemaps and reference them from a sitemap index file.

Best practices

• Submit to Search Console: add the sitemap URL in Google Search Console (and Bing Webmaster Tools) so the platform tracks coverage and surfaces errors.
• Keep lastmod accurate: Google uses lastmod as a hint when prioritizing crawls. Update it whenever the page content meaningfully changes; do not bump it on every build.
• Exclude noindex and disallowed URLs: the sitemap should describe what you want indexed. Listing pages that are blocked from crawling sends mixed signals.
• Use sitemap index files for multi-sitemap setups: a sitemap index aggregates child sitemaps (for example one per content type) and is the single URL you submit to search engines.

Google Analytics 4 is a free measurement platform that records visitor behavior, traffic sources, and conversion data. Installing it does not directly affect rankings, but the data it produces is essential for measuring SEO performance, identifying high-value pages, and prioritizing future optimization work. Fixing this issue means installing the GA4 tag site-wide and confirming events appear in your reports.

Example

<!-- Place inside <head> on every page -->
<script async src="https://www.googletagmanager.com/gtag/js?id=G-XXXXXXXXXX"></script>
<script>
  window.dataLayer = window.dataLayer || [];
  function gtag(){dataLayer.push(arguments);}
  gtag('js', new Date());
  gtag('config', 'G-XXXXXXXXXX');
</script>

Where to make the change

• Raw HTML: paste the GA4 snippet into the <head> of every page. A shared layout file is the cleanest place.
• WordPress: use a site-kit or analytics plugin, or paste the snippet into your theme's header file. Avoid duplicating the tag across multiple plugins.
• Shopify: add the GA4 measurement ID under Online Store, Preferences, Google Analytics, or install the official Google channel app.
• Wix or Squarespace: both platforms offer a GA4 measurement ID field in their analytics settings panel.
• Headless or framework sites: install via Google Tag Manager or use the framework's analytics integration so the tag fires on every route change.

Common causes and how to resolve them

• Tag not installed at all: install GA4 using the snippet above or the platform-specific path.
• Universal Analytics tag still in place: Universal Analytics stopped processing data on July 1, 2024. Replace any UA tag (UA-...) with a GA4 measurement ID (G-...).
• Tag fires only on the homepage: ensure the snippet is in a shared template loaded by every page, not pasted into one post.
• Cookie banner blocks the tag before consent: integrate Consent Mode v2 so GA4 receives anonymized signals before consent and full data after.
• Tag duplicated: two snippets on the same page double-count sessions. Audit with the Tag Assistant browser extension and remove duplicates.

Best practices

• Verify with real-time reports: after installing, open GA4's Realtime view and load the site to confirm events arrive.
• Use Google Tag Manager: for any site beyond the simplest, GTM gives you a single place to manage analytics, conversion tags, and third-party scripts without code changes.
• Configure key events: mark conversions (purchase, lead, signup) as key events so reports highlight what matters for SEO ROI.
• Link to Search Console: connecting GA4 to Search Console surfaces organic queries alongside on-site behavior in the same reports.

This test fails when an HTTPS page loads any sub-resources (images, scripts, stylesheets, or fonts) over insecure HTTP. Mixed content weakens the security guarantees of HTTPS, and modern browsers either block the resources outright or warn the user, often breaking the page in the process. Fixing this issue means updating every HTTP resource URL to HTTPS.

Where to make the change

• Application code or templates: search the codebase for http:// URLs in src, href, and inline styles; replace each with https:// or with a protocol-relative path.
• WordPress: use a search-and-replace plugin to update http:// URLs in the database after enabling HTTPS, or rely on a dedicated SSL plugin to handle it.
• CDN: most CDNs offer "Automatic HTTPS Rewrites" or similar features that upgrade insecure asset references on the fly.

Common causes and how to resolve them

• Hard-coded HTTP image URLs in content: rewrite stored URLs to HTTPS or use a relative path that inherits the page protocol.
• Third-party scripts that only support HTTP: drop the script (it should not be on a modern site) or contact the vendor for an HTTPS endpoint.
• Hot-linked images from HTTP sources: host the images yourself or proxy them through your own HTTPS-enabled CDN.
• Mixed content in CSS background images: update the URL inside the stylesheet, then bust the cache.

Best practices

• Add Content Security Policy: the upgrade-insecure-requests directive automatically rewrites HTTP requests to HTTPS, which is a useful safety net.
• Use the browser console to find offenders: mixed content warnings include the file and line of the offending request.
• Audit periodically: new content can reintroduce mixed content. Add an automated check to your CI or monitoring pipeline.

This test fails when the site does not serve a branded, helpful page for missing URLs. A custom 404 keeps users on the site by offering navigation, search, and suggested links rather than dropping them at the browser's generic error screen. Fixing this issue means designing a 404 template, ensuring it returns the correct HTTP 404 status, and pointing your server at it.

Where to make the change

• Server configuration: point your web server at a custom 404 page. In Nginx, use error_page 404 /404.html;. In Apache, use ErrorDocument 404 /404.html.
• WordPress: create a 404.php template in your theme. WordPress invokes it automatically for missing URLs.
• Shopify: edit the 404.liquid template in the theme code editor.
• Wix or Squarespace: use the platform's built-in 404 page editor in site settings.
• Headless or framework sites: Next.js uses not-found.js, Astro uses 404.astro, and similar frameworks all have a convention for the missing-route page.

Common causes and how to resolve them

• No custom 404 at all: create one. The minimum is the site header, navigation, a clear "page not found" message, and links to popular sections.
• 404 page returns HTTP 200: a "soft 404" confuses search engines. Verify the response status with DevTools or curl, and configure the server to return 404 for missing routes.
• 404 page redirects to homepage: redirecting users to the homepage hides broken URLs from analytics and search engines. Show a real 404 instead.
• Generic browser error visible: the server is not invoking the custom template. Check the configuration directive.

Best practices

• Keep the site chrome: show the header, footer, and navigation so users do not feel lost.
• Offer next steps: a search box, popular links, or category navigation help users get back on track.
• Track 404s: log missing-URL hits in analytics so you can spot broken inbound links worth fixing or redirecting.
• Be clear about the error: "Sorry, that page does not exist" is better than vague messaging that confuses users.

This test reports on whether the page applies a nofollow directive that tells search engines not to follow outbound links. The nofollow attribute (and the related sponsored and ugc values) controls how link equity flows from your page. Fixing this issue means using the right rel value on each external link based on its purpose so signals are passed only where you intend.

Where to make the change

• Raw HTML: add rel="nofollow", rel="sponsored", or rel="ugc" to specific outbound links rather than blanket-applying them site-wide.
• WordPress: the block editor offers a "mark as nofollow" option per link, and SEO plugins can auto-tag external links by domain.
• Shopify, Wix, Squarespace: editor-generated links allow rel attribute toggles; manual HTML embeds need them set explicitly.
• Headless or framework sites: wrap external links in a component that decides the rel based on the link's classification.

Common causes and how to resolve them

• Site-wide nofollow on every external link: overly aggressive. Reserve nofollow for sponsored, untrusted, or user-generated content.
• Sponsored content not labeled: use rel="sponsored" on paid placements and affiliate links to comply with Google's link spam policy.
• User-generated content unmarked: comments, forum posts, and review user submissions should use rel="ugc".
• Trusted editorial links nofollowed: these should pass equity. Remove the nofollow.

Best practices

• Use the most specific value: sponsored for paid links, ugc for user content, nofollow for everything else you want to disclaim. They can be combined: rel="sponsored noopener".
• Do not nofollow internal links: "PageRank sculpting" with internal nofollow no longer works and just wastes crawl signal.
• Audit periodically: as content ages, sponsored relationships change. Review affiliate and partner links once a year.