I Ran a Real SEO Audit On My Own Live Site — Here's a Free SEO Audit Report Sample
# I Ran a Real SEO Audit On My Own Live Site — Here's a Free SEO Audit Report Sample
Four days ago, my site was invisible to Google. Not slow. Not penalized. Invisible — `robots.txt` was telling every crawler `Disallow: /`, and nothing about the site _looked_ broken. No 500s, no console errors, no drop-everything alert. Just a CDN quietly serving a stale, wrong file to every bot that asked for it.
I found it while running a full technical SEO audit on my own portfolio site, voixoff-fr.surge.sh — a one-page static portfolio, four pages total, zero JavaScript, 4-13KB per page. I do SEO audits as a service, and I wanted a real, embarrassing, unedited example to show what one actually looks like before I ask anyone to pay for it. So instead of a mocked-up PDF, I published the whole thing: **seo-audit-sample.surge.sh** , a free SEO audit report sample built from a live site with real bugs in it.
This post walks through how I ran the audit, what it found, and the one mistake that almost made me miss the worst bug on the site.
## The method: no paid tools, just curl and patience
I didn't run this through a $99/month SaaS dashboard. The whole audit stack was:
* `curl -I` and `curl -v` for raw response headers
* Manual HTML parsing for title/meta/heading structure
* Direct inspection of CDN cache headers (`surge-cache`, `age`, `etag`)
* The PageSpeed Insights API for performance (when it wasn't rate-limited — more on that below)
Nothing exotic. The point of the exercise was to show that most of the value in a technical audit comes from actually reading the raw response the way Googlebot sees it, not from a dashboard with colored gauges.
## The bug: robots.txt lied, and the cache made sure nobody noticed
Here's the sequence. I requested `https://voixoff-fr.surge.sh/robots.txt` and got:
Disallow: /
Full site, blocked. But the file in my deploy folder said `Allow: /`. So either I'd deployed the wrong file, or something was serving a stale copy.
I checked the response headers:
surge-cache: HIT
age: 35619
Age of nearly 36,000 seconds — almost 10 hours old, and climbing, because nothing was invalidating it. The root cause: surge.sh serves its _own_ default `robots.txt` with `Disallow: /` on new sites, and its CDN had cached that default on the bare path. I had since deployed my corrected file (`Allow: /` + Sitemap directive) — the deploy succeeded, the origin file was correct — and yet the CDN kept serving the cached default to every bot. Googlebot had been reading `Disallow: /` for four days straight, with no error surfaced anywhere.
That's the finding that anchors this whole SEO audit report sample: a bug with zero visible symptoms that can silently deindex a site.
## The trap: cache-busters hide the bug they're supposed to catch
My first instinct when I suspected caching was to check `robots.txt?cb=12345` to force a fresh fetch. It worked — I got the correct, up-to-date file. Which meant, for about ten minutes, I thought everything was fine.
It wasn't. Googlebot doesn't request `robots.txt?cb=12345`. It requests the bare path, `/robots.txt`, with no query string — and that's exactly the URL the CDN was serving stale. Adding a cache-buster proved the _correct file existed_ , but it completely masked the fact that the _real_ URL Google actually hits was still broken.
The lesson, and the reason I'm calling it out explicitly in the report: **always test`robots.txt` with the bare path, no query string, no cache-busting parameter.** Anything else tells you what you want to hear.
## What else the audit found
The robots.txt issue was the critical one, but a real audit checks the whole surface. Summary table:
Area | Finding | Severity
---|---|---
Indexability | `robots.txt` serving `Disallow: /` via stale CDN cache (age 35619s) | Critical
Title tag | Homepage title is 75 characters — over the ~60 char limit, gets truncated in SERPs | Medium
Meta description | 209 characters — over 160, also truncated | Medium
Headings | Satellite pages have an H1 but no H2 structure | Medium
Structured data | Valid JSON-LD `Product` schema on the index page, but missing on satellite pages | Low-Medium
Security | No HSTS header (platform limitation on surge.sh's free tier) | Low
Performance | PageSpeed Insights API returned 429 (quota exhausted, shared key) | Info
Images | 0 images missing `alt` text | Pass
Canonicals / OG | Present and correct on all four pages | Pass
Sitemap | `sitemap.xml` present, 4 URLs, matches live pages | Pass
Mobile | 0 horizontal overflow at 375px viewport | Pass
Load times | 50-214ms across all pages | Pass
Accessibility | Contrast ratios meet WCAG AA | Pass
The strong points are genuinely strong — this is a hand-built, zero-JS static site, so there's very little surface area for bugs. Which is exactly why the `robots.txt` cache issue stood out: it's the one failure mode that has nothing to do with code quality and everything to do with infrastructure you don't fully control.
## The full sample report
I didn't want to just describe this in a blog post — the actual report, with headers, timestamps, and the full findings list, is published here: **seo-audit-sample.surge.sh**. It's the same format I'd hand to a paying client, evidence and all, minus the client's name. If you want to see what an "SEO audit report sample" looks like when it's built from a real site instead of a template with placeholder text, that's it.
## Quick wins if you're checking your own site
* Fetch `robots.txt` and `sitemap.xml` with a bare `curl`, no browser, no query string. Compare against what's on disk.
* Check `age` and `*-cache` headers on anything served through a CDN — a `HIT` with a large `age` on a file you recently changed is a red flag.
* Keep titles under ~60 characters and meta descriptions under ~160 — both of mine were over, and both get silently truncated in search results with no warning from anything.
* Don't assume "it deployed successfully" means "it's serving correctly." Those are two different claims.
## If you want one done on your site
This is genuinely my own site, audited with the same process I use for clients — no fabricated numbers, no invented scores. If you want a similar evidence-backed audit (headers, raw responses, no guessing) run on your own site, I'm doing these as a paid service, launch pricing starting at $0.10: **alexcarter.privacy@proton.me**.
Otherwise, go check your `robots.txt` right now, without the `?cb=`.