SEO Expert Lists 11 CMS Features Most Platforms Still Fail to Ship

Sixteen years after Google, Microsoft and Yahoo jointly announced the canonical tag, SEO consultant Sally Mills says she watched three different CMS platforms this year require a developer just to implement it. Her verdict: the content management system industry still fails at base-level SEO.

"Every week I continue to find out about often well-known platforms missing what I would consider a baseline standard," writes Mills, an in-house SEO, consultant and web developer writing on Search Engine Journal. Her article lays out 11 requirements every CMS should ship with — and most, in her experience, do not.

What are the 11 baseline requirements?

Mills's list covers the fundamentals that, she argues, should require no plugin and no developer ticket:

• Clean semantic HTML — correct elements for each component; data in HTML tables, lists in list tags. This also improves screen-reader accessibility.
• Server-side rendered content — Google queues every 200-status page for rendering, but that rendering happens after the crawl and can be delayed. Most AI crawlers, including OpenAI's and Anthropic's, do not execute JavaScript at all.
• Sitemap with controls — she cites Shopify, which prevents removing pages from sitemaps when using an additional market because sitemaps "are generated automatically and include all market-specific URLs."
• Editable robots.txt — 85% of robots.txt requests return a 200 status, meaning roughly 15% of sites still have no file at all.
• Canonical tags on by default — she saw WordPress, SilverStripe and Webflow sites missing them this year; Squarespace canonicalizes product subcategories back to the main category (credited to Tom Stefanou).
• Meta robots control — including nosnippet, indexifembedded and max-snippet.
• Metadata and OG tags — WordPress includes page titles but no meta descriptions or Open Graph tags out of the box.
• Error pages with correct status codes — the recurring trap is a 404 template that returns a 200: "The page says 'not found,' the server says 'all good,' and Google indexes your error page."
• Single enforced host — 301 redirects to one HTTPS, www or non-www version, without chains.
• Trailing slash and capitalization redirects — even Shopify, she notes, won't redirect to remove a trailing slash.
• Customizable URL structure — no forced duplicate index URLs or locked templates, a dig she aims directly at Shopify.

The takeaway in plain words: the same basic tickets keep getting filed because the platforms never fixed the defaults.

Which failures sting the most?

WordPress, the market leader, cannot edit robots.txt, exclude pages from the sitemap, or noindex a single page without a developer or source-file access, according to Mills. That gap, she says, is what forces users toward what she calls "bloated SEO plugins" to manage basics.

On Webflow, she had to hardcode HTML tables into pages because the editor lacks built-in table support — a problem for bots that rely on semantic structure to understand content.

Her credibility rests on practice, not theory: after migrating tens of thousands of URLs from an old .NET platform, every internal link on the site still pointed at old URLs and hopped through redirects. She wrote a Python script against the CMS API to rewrite each link to its final destination, because no one could fix them by hand.

What should go beyond the minimum?

Mills also lists advanced functionality that speeds up marketing teams:

• Automated tables of contents built from H2 headings, with options to exclude headings and include H3s and H4s. Even WordPress needs a plugin like Rank Math to do this.
• Automatic 301 redirects on URL change, plus a scheduled cleanup script for internal links pointing at old URLs.
• 404 internal link reports with bulk updates, instead of editing broken links one by one.
• 410 status code support — still "incredibly rare," she writes, so SEOs fall back on redirects or leaving pages as 404s.
• A redirect manager offering 301, 302, 307/308 and 410 codes, regex rules, query-string control, scheduled expiry and guardrails against loops. Guardrails top her list: one stray pipe character in a regex rule once matched every URL on a site and, she admits, took the entire website down.

Image handling is her persistent gripe. She wants one clean, stable URL per image, automatic resizing, compression and WebP or AVIF conversion, width and height attributes to prevent CLS (cumulative layout shift), lazy loading except for the first image, and custom OG images per page. One enterprise system she worked with generated multiple URLs per image — with and without an ID — risking duplication for sites that depend on image search.

She also calls for MCP, CLI or API connections, or at minimum CSV bulk upload. "As of this year, I'm finding myself making fewer changes directly in a CMS and instead connecting to MCPs or CLI," she writes, noting she now updates content and development work on some sites directly from Claude. The caveat follows the promise: always set up testing processes and guardrails before connecting AI agents to a public website. Manual header and body script fields save developer time, she adds, but require trust, code validation and a release process.

Where does that leave marketers?

Asked for a CMS recommendation, Mills gives the SEO-standard answer: "It depends." Often, she notes, SEOs don't even get to make that decision. Her practical advice is to audit which tickets recur, automate what can be automated, and build solutions with developers that scale — because platform vendors, on this evidence, will not close the gap for you.