Search Console & technical SEO

1. Site side (code)

sitemap.xml

• Only public, indexable, canonical URLs. Never pages with personal data (results, account, checkout). Write a test that asserts those paths are absent.
• <lastmod> = real modification date. Faking "today" on every URL teaches Google to ignore it.
• Served as application/xml, valid XML (test with a parser).

robots.txt

• Disallow: private paths (/account, /checkout, result pages with query data).
• Sitemap: https://domain/sitemap.xml.
• Blocking AI crawlers (GPTBot, CCBot, Google-Extended…) is a policy choice; it does not affect Google Search or Ads.
• User-agent: * rules do not apply to AdsBot; landing pages stay checkable by Ads.

Canonical — default to the URL without query string, so ?utm_source=… and filter variants don't split into many URLs.

noindex — private pages get <meta name="robots" content="noindex">. Reuse that flag elsewhere: it's the right switch for "don't send this page's title to analytics" too (see conversion-tracking).

JSON-LD — structured data must describe what the visitor can see:

• FAQPage: build the visible FAQ and the JSON-LD from the same array in code, so they can never disagree.
• AggregateRating: only when the page visibly shows the same rating and count, and only above a minimum count (e.g. ≥ 3). "5.0 from 1 review" looks bought, and marking up ratings the reader can't see is a manual-action risk.

Reviews that build trust (the honest version of "show testimonials"):

• Only logged-in users who actually used that feature can review (check against a server-side record of usage, not a client flag).
• One review per user per feature (unique index in the DB, not just app code).
• Moderation queue: new reviews are pending; an admin approves/hides with a reason that is logged. Notify the admin immediately so reviewers don't wait for days.
• Show abbreviated names ("Nguyen Van D."). Never seed fake reviews to fill the block — an empty state saying "no reviews yet" is better than six identical five-star quotes.

2. Search Console

1. Add a Domain property (sc-domain:example.com, DNS TXT verification) — covers http/https/www/subdomains in one.
2. Sitemaps → submit https://example.com/sitemap.xml. Status must be Success with a discovered-page count close to the number of <loc> entries.
3. Pages (Page indexing) report — how to read it for a new domain:
   • "Discovered – currently not indexed": Google knows the URL and hasn't crawled it. Normal for weeks on a young domain. Not a config error.
   • "Duplicate, Google chose different canonical" on sitemap.xml itself: harmless.
   • "Crawled – not indexed": content quality/thinness signal; improve the page.
4. URL inspection → Request indexing for the 5–10 most important landing pages (quota is roughly 10/day). The top search box needs a click, a short wait, then typing; dismiss the "Indexing requested" toast before inspecting the next URL.

3. Links

• GA4 ↔ Search Console: from GA4 Admin → Product links → Search Console links → Link → choose property → choose web stream → Submit. Requires being a verified owner in GSC.
• Google Ads ↔ Search Console: from Ads → Tools → Data manager → Search Console tile → Continue → enter site URL → Link. Links instantly if the same Google account owns the GSC property; otherwise it sends a request the owner approves in GSC → Settings → Associations. Search Console itself has no "link to Ads" button.
• Verify in GSC → Settings → Associations: both GA4 and Ads should be listed.

4. Before you call it done

Run ${CLAUDE_PLUGIN_ROOT}/scripts/audit_site.py https://example.com — it fetches with a browser user-agent and checks robots, sitemap, canonical, noindex on the private paths you pass with --private, and JSON-LD presence.