A Technical SEO Checklist for Malaysian Business Websites
A practical checklist covering crawlability, canonicals, sitemaps, hreflang, structured data and Core Web Vitals — with no ranking guarantees.
Why technical SEO is a maintenance job, not a one-time project
Most guides to search engine optimisation in Malaysia focus on keywords and content. Fewer explain the technical layer underneath: whether Google can actually find, read, and trust your pages in the first place. A blog full of good writing sitting behind a broken sitemap or an accidental noindex tag will not rank, no matter how well it is written. This checklist covers the technical fundamentals every Malaysian business website should have in place, in plain terms, without promising a result no one can control.
One thing to be clear about before the checklist: nobody — not Google, not an SEO agency, not a freelancer — can guarantee a ranking position. Google's own algorithm weighs hundreds of signals and changes constantly. What technical SEO can do is remove the obstacles that stop a page from being properly considered. That is a meaningfully different promise, and it is the only honest one to make.
1. Crawlability: can Google's bots actually reach your pages?
Search engines discover pages by following links and reading sitemaps, then request each page with an automated crawler (Googlebot, for Google). If a server blocks the crawler, times out, or returns errors instead of content, the page cannot be indexed no matter how good it is.
Practical checks:
- Confirm your hosting doesn't rate-limit or block crawler user agents.
- Watch server response codes for pages that matter — a 5xx error on a category page during a crawl is invisible to a human visitor but very visible to Google.
- Use Google Search Console's URL Inspection tool to check how Googlebot actually sees a given URL, rather than guessing from what a browser shows you.
2. robots.txt: a gate, not a lock
robots.txt sits at the root of your domain (e.g. yoursite.com/robots.txt) and tells well-behaved crawlers which paths they should not request. It is a courtesy instruction, not a security control — anyone can still read a page you've disallowed if they have the direct URL, and some crawlers ignore it outright. Its real job is to stop search engines wasting crawl effort on admin panels, internal search results, cart pages, or staging directories that add no search value.
A common and costly mistake: a Disallow: / line left over from a staging environment, deployed to production by accident. This single line can de-index an entire site. Check your live robots.txt after every deployment, not just once.
3. Canonical tags: telling Google which version is "real"
Most CMS platforms generate multiple URLs for the same content — with and without trailing slashes, with tracking parameters, with different capitalisation, or duplicated across a product filter. Without a canonical tag (<link rel="canonical" href="..."> in the page <head>), Google has to guess which version to treat as authoritative, and sometimes it guesses in ways you wouldn't choose. Every indexable page should carry a self-referencing or deliberately pointed canonical tag. Get this wrong at scale — for instance on an e-commerce catalogue with faceted filters — and you can accidentally tell Google to ignore your best pages in favour of thin filtered ones.
4. XML sitemaps: a map, not a magic wand
A sitemap lists the URLs you want indexed and can include metadata like last-modified dates. Submitting one through Google Search Console helps discovery, particularly for larger or newer sites, but it does not force indexing and it is not a ranking signal by itself. Keep it accurate: a sitemap full of 404s, redirects, or non-canonical URLs actively wastes the crawl budget Google allocates to your site and can slow discovery of genuinely new pages.
5. Hreflang: getting it right for Bahasa Malaysia / English sites
Many Malaysian business sites run parallel Bahasa Malaysia and English versions of the same pages. Without hreflang annotations, Google may show the wrong language version to the wrong searcher, or treat the two versions as duplicate content competing against each other. Hreflang tags (either in the HTML <head> or in the sitemap) tell Google which URL serves which language, so ms-MY and en-MY variants of a page reinforce rather than cannibalise each other. Every hreflang set needs to be reciprocal — if the English page points to the Malay page, the Malay page must point back — and each page needs a self-referencing hreflang entry, or the whole set can be ignored.
6. Structured data: helping Google understand what a page is
Structured data (usually JSON-LD, following schema.org vocabulary) doesn't change what your page says to a human visitor, but it labels the content for machines — this is a product with this price, this is an article by this author, this is a local business with these opening hours. It can make a page eligible for enhanced search result features, but eligibility isn't a guarantee of display, and adding schema to content that isn't actually visible on the page can be treated as manipulative by Google's own guidelines. Only mark up what a visitor can genuinely see and verify.
7. Core Web Vitals: the current thresholds, correctly stated
Core Web Vitals are three specific, measured metrics that Google uses as part of page experience signals:
- Largest Contentful Paint (LCP) — how quickly the main content loads. Good: 2.5 seconds or less.
- Interaction to Next Paint (INP) — how responsive the page is to a click, tap, or keypress. Good: 200 milliseconds or less.
- Cumulative Layout Shift (CLS) — how much content jumps around as the page loads. Good: 0.1 or less.
A common point of confusion: Time to First Byte (TTFB) is often mentioned alongside these three, but it is not a Core Web Vital itself — Google's own documentation classifies it as a diagnostic metric that helps explain a slow LCP, not a target you're scored against directly. Chasing TTFB in isolation without checking whether it improves LCP is wasted effort.
These thresholds are measured at the 75th percentile of real visitor data (field data), not a single lab test, which is why a site can look fast in a one-off test tool and still fail Core Web Vitals for actual visitors on slower connections or older phones — a meaningful consideration for a Malaysian audience with a wide spread of device and network quality.
8. Internal linking: distributing authority and helping discovery
Internal links — links from one page on your site to another — help Google find new pages faster and help distribute authority from your strongest pages to ones that need it. Practical habits: link to new content from existing relevant pages as soon as it's published, use descriptive anchor text instead of "click here," and avoid orphan pages that no other page on your site links to. An orphan page can still be indexed if it's in the sitemap, but it's working with one hand tied behind its back.
Putting it together
None of these fixes guarantee a ranking outcome, and any article or agency that promises one is not being straight with you. What technical SEO buys you is a fair shot: a site Google can crawl, understand, and evaluate on its actual merits, rather than one hiding behind an accidental robots.txt block or a Core Web Vitals failure nobody noticed.
If you'd rather have someone qualified check your site against this list than work through it line by line yourself, JagaWeb's Essential System Review (RM1,500, currently RM999 until 16 September 2026) covers exactly this ground — crawlability, canonicals, sitemaps, structured data, and Core Web Vitals — and gives you a written report of what's actually wrong, not a promise of what rank you'll get. Reach us at sales@jagaweb.my or WhatsApp jagaweb.my.
Ready to verify who owns your website?
Replace uncertainty with a decision-ready ownership and access report. The fixed Ownership & Access Review is RM1,500 before SST and includes a 30-day action plan.