Great question. For me, the absolute first step is always diving into Google Search Console. Before jumping to backlinks or content rewrites, I check the "Pages" report to see if there’s a sudden drop in indexed pages or a spike in "Discovered – currently not indexed" / "Crawled – currently not indexed" statuses.
If indexing looks stable, I look at the Performance report to pinpoint exactly which queries and pages took the hit. 9 times out of 10, it’s either a minor technical glitch (like an accidental noindex tag or a broken internal linking structure after a site update) or a SERP intent shift where Google suddenly started favoring a different content format (e.g., pushing video carousels or a competitor who just updated their guide). Backlinks are usually the last thing I audit unless I see a massive, unnatural spike in toxic referrals.