The GEO Audit Checklist: 20 Things to Check Before You Pay Anyone for AI Visibility

If you’ve searched for help getting your business to show up in ChatGPT, Perplexity, or Google’s AI Overviews, you’ve probably run into a wall of agencies all saying the same thing: “we’ll make AI recommend you.” Almost none of them explain how. That’s usually not because it’s a secret — it’s because most of what actually matters is checkable by you, in about twenty minutes, without hiring anyone.

This is that checklist. It’s the same set of things we look at on every audit we run, written out in plain language so you can go through your own website right now and see where you actually stand. If an agency can’t explain most of these twenty items when you ask them directly, that’s useful information too.

A quick note before the list: AI tools decide who to recommend based on three broad questions — can they reach your site at all, can they understand what you actually do, and do they trust what they find? The twenty checks below are grouped around exactly those three questions, plus one final group on content quality, because trust and quality turn out to be closely related but not quite the same thing.

Group 1: Can AI Even Reach Your Site?

This sounds basic, but it’s the single most common thing we find broken. If an AI tool’s crawler can’t access your site in the first place, nothing else on this list matters — it never even gets to read your content.

Your robots.txt file allows AI crawlers in.

Every website has a small file called robots.txt that tells automated visitors what they’re allowed to look at. Search engines have used this for decades, and AI companies now use their own named crawlers — OpenAI’s GPTBot and OAI-SearchBot, Anthropic’s ClaudeBot and Claude-SearchBot, and PerplexityBot are the main ones. If your robots.txt blocks these (or was never updated and blocks “all bots” by default from an old security setting), AI tools simply can’t read your site.

How to check: type yourdomain.com/robots.txt into your browser. Look for lines mentioning GPTBot, ClaudeBot, or PerplexityBot with “Disallow: /” next to them. If you see that, you’re blocking them.

You have (or don’t need to worry about) an llms.txt file.

This is a newer, simpler idea: a small text file at yourdomain.com/llms.txt that points AI models directly to your most important pages, written in plain language rather than complicated code. It’s not mandatory and not every AI tool uses it yet, but it’s a low-effort way to make your key content easier to find.

How to check: type yourdomain.com/llms.txt into your browser. If it 404s (page not found), you don’t have one yet — not a crisis, but worth adding.

Nothing else is silently blocking AI bots.

A lot of websites use security services (Cloudflare is the most common) that automatically block “bot traffic” to stop spam and scraping. Some of these services now block AI crawlers by default as part of that same protection — which means your site could look fine in robots.txt but still be invisible to AI tools because of a firewall setting somewhere else entirely.

How to check: if your site uses Cloudflare or a similar security/CDN service, log into that dashboard and look for a setting related to “AI bots,” “AI crawlers,” or “bot fight mode,” and confirm it isn’t blocking the AI crawlers you want to allow.

Your key content doesn’t require JavaScript to appear.

Some websites build pages in a way where the actual text only appears after your browser runs a bunch of code (this is common with certain website builders and single-page app frameworks). Many AI crawlers don’t fully run that code — they see a mostly blank page instead of your content.

How to check: right-click any page on your site and choose “View Page Source” (not “Inspect”). If you can’t find your actual text — your headlines, your paragraphs — in that raw source code, a crawler probably can’t either.

Your sitemap is current and submitted.

A sitemap is a simple file listing every page on your site, and it’s one of the clearest signals search engines and AI crawlers use to find everything you’ve published, including new pages.

How to check: type yourdomain.com/sitemap.xml into your browser and confirm your newest pages are actually listed. If you use Google Search Console, confirm the sitemap is submitted there without errors.

Group 2: Can AI Understand What You Actually Offer?

Once a crawler can reach your site, the next question is whether it can actually parse what you do. This is where structured data comes in — a way of labeling your content so machines don’t have to guess.

Your key pages have FAQ schema.

FAQ schema is a bit of code that marks specific questions and answers on your page as, literally, a question and its answer — rather than just a wall of text. It’s one of the highest-value things you can add, because it hands AI tools a ready-made, extractable answer instead of making them guess which paragraph matters.

How to check: use Google’s free Rich Results Test tool, paste in your page URL, and look for “FAQPage” in the results.

Your Organization schema has the correct name, address, and phone number.

This is a structured way of telling machines “this is who we are and how to reach us” in a standard format, separate from whatever’s written in your footer.

How to check: same Rich Results Test tool — check that “Organization” appears and that the details match your actual business information exactly.

Product or Service schema is used where it applies.

If you sell specific products or offer named services, marking each one up individually helps AI tools understand your actual offerings rather than treating your whole site as one blurry topic.

How to check: same tool again, on your main service or product pages specifically.

Your headings are phrased as real questions people actually ask.

AI tools are, at their core, answering questions people type or speak. A page with a heading like “Our Process” is much harder for AI to match to a real question than one titled “How Long Does [Service] Actually Take?”

How to check: scan your own headings (the H1, H2, H3 text) and ask yourself honestly whether any of them match something a real customer would type into ChatGPT.

Each page answers its main question in the first sentence or two.

AI tools tend to pull from the clearest, most direct answer on a page — not the most eloquent one buried three paragraphs in. If your page opens with a story, a mission statement, or a slow build-up before getting to the actual point, you’re making it harder to be quoted.

How to check: read only the first two sentences of your top five pages. Would a stranger understand exactly what you do and offer from just that?

Group 3: Does the Rest of the Internet Back You Up?

AI tools don’t just look at your website — they weigh what everyone else online says about you, too. This is often the group where businesses have the biggest, most fixable gaps, because it has nothing to do with how good your website looks.

Your business name, address, and phone number match everywhere.

This is usually shortened to “NAP consistency.” If your Google Business Profile says one address, your website footer says a slightly different one, and an old directory listing has your previous phone number, that inconsistency makes it harder for any system — human or AI — to confirm you’re a real, stable business.

How to check: search your business name on Google and pull up every listing that appears — Google Business Profile, Yelp, industry directories, your own site. Line them up and check for mismatches.

Your reviews are recent, not just numerous.

A business with 400 reviews from three years ago and nothing since can actually look less trustworthy to an AI system than one with 20 reviews from the last two months. Recency signals that you’re still active and still delivering.

How to check: look at your most recent review date on Google Business Profile. If it’s been months, that’s worth fixing before anything else on this list.

You’re mentioned on other real, relevant websites.

This doesn’t mean a press release nobody read. It means genuine mentions — a local news write-up, an industry association listing, a guest post, a podcast appearance — on sites that are themselves real and relevant to what you do.

How to check: search your business name in quotes on Google and see what comes up beyond your own site and social profiles.

Your backlinks come from real, topically relevant sites.

A backlink is just a link from another website to yours. Quality matters far more than quantity here — one link from a respected, relevant industry site is worth more than fifty from random, unrelated link-farm sites, and low-quality links can actively hurt rather than help.

How to check: free tools like Ahrefs’ Backlink Checker or Google Search Console’s Links report will show you who’s linking to you — skim the list for anything that looks spammy or completely unrelated to your industry.

Your business entity is consistent across knowledge sources, if applicable.

For larger or more established brands, this includes things like Wikidata or Wikipedia. For most small and mid-sized businesses, this simply means your entity — your name, category, and location — shows up the same way across the directories and platforms that do exist for you.

How to check: not every business needs a Wikidata entry. If you don’t have one, don’t chase it artificially — focus on consistency across the directories that are actually realistic for your size.

Group 4: Would AI Actually Trust This Content?

The last group is about content quality specifically — separate from structure or outside signals. This is where a lot of “we post blogs every week” strategies quietly fail.

Your pages show a real, recent last-updated date.

A visible, honest “last updated” date (not just a “published” date frozen in 2022) signals that the information is still current — something both search engines and AI tools weigh when deciding what to trust for a present-day question.

How to check: look at your five most important pages. Do any show a date, and is it recent? If a page hasn’t been touched in two years, it’s due for a refresh, not necessarily a rewrite.

Your content includes original information, not rehashed generic copy.

If your page could have been written by anyone, about any business in your industry, with a find-and-replace of the company name, that’s a real problem. AI tools are trained on an enormous amount of generic content already — they don’t need more of it, and they’re increasingly good at recognizing it.

How to check: ask yourself honestly whether a competitor’s page on the same topic says almost the exact same thing in a different order.

Your articles show a real author name and bio.

This is part of what’s often called E-E-A-T (experience, expertise, authoritativeness, trustworthiness) — a framework search engines use to judge content quality. A named, credentialed author is a trust signal; “Posted by Admin” is not.

How to check: check your blog posts for a byline. If there isn’t one, or it’s generic, that’s a quick, low-cost fix.

No unresolved negative press dominates your brand search.

This is an uncomfortable one, but important: AI models are trained on the open internet, including old negative reviews, complaints, or news coverage. Unlike Google, which can be asked to update or de-index certain content over time, AI models don’t “forget” what they were trained on nearly as easily — a stale negative story can keep shaping how AI describes you long after the actual issue is resolved.

How to check: search your business name and look at what comes up on the first two pages. If there’s a negative story, has it ever been addressed publicly, or does it just sit there unanswered?

You’ve actually tested your visibility yourself.

This is the one step most businesses skip entirely, and it’s the most direct: open ChatGPT, Perplexity, and Gemini, and ask the exact question a real customer would ask — “best [your service] in [your city],” for example. See who gets named. See if you’re one of them.

How to check: just do it, today, in a few different phrasings. It takes five minutes and tells you more than any of the other nineteen items combined about where you actually stand right now.

What to Do If You Failed Several of These

Most businesses fail somewhere between eight and fourteen of these twenty items on a first pass, and that’s normal — almost none of this was a concern eighteen months ago. The good news is that these items aren’t equally hard to fix. Group 1 (crawlability) is usually the fastest to fix and the most urgent, since nothing else matters if it’s broken. Group 3 (outside trust signals) usually takes the longest, because it depends on real reviews and mentions accumulating over time rather than a single afternoon of website edits.

If you’re evaluating whether to hire an agency for this rather than doing it yourself, the honest test is simple: ask them to walk through this exact list for your business, specifically, before you sign anything. A provider that can point to real findings on your actual site is worth trusting a lot more than one offering a vague promise to “get you into ChatGPT.” We’ve written more on exactly how to vet that conversation in how to choose the right Generative Engine Optimization agency.

Frequently Asked Questions

What’s the difference between GEO and regular SEO?

Regular SEO focuses on ranking your page in a list of search results a person then clicks through. GEO (Generative Engine Optimization) focuses on getting your business named directly inside an AI-generated answer, where there’s often no click and no list — just one or two names mentioned. The two overlap heavily, but GEO puts more weight on structured data, off-site trust signals, and direct-answer content formatting.

Can I really check all of this myself without any technical skill?

Most of it, yes. Checking robots.txt, your sitemap, your reviews, and your Google search results just requires typing a URL or a search term. The structured data checks (schema) require a free tool but no coding. The only genuinely technical items are diagnosing a JavaScript rendering issue or a CDN-level bot block, which may need a developer.

How long does it take to fix a failed item?

It varies a lot by item. Fixing a robots.txt file can take minutes. Building up a base of recent, genuine reviews or earning real mentions on relevant sites can take months, because it depends on real customer behavior and outreach, not just a website edit.

Do I need an llms.txt file right now?

It’s optional and not every AI platform uses it yet, but it’s low-effort to add and forward-looking. It’s a “nice to have soon” item, not an emergency, unlike a blocked robots.txt file.

Will fixing this checklist guarantee ChatGPT recommends my business?

No single checklist guarantees a specific outcome, and any provider promising a guarantee should be treated with real caution. What this checklist does is remove the common, concrete reasons AI tools skip a business entirely — it puts you in the pool of businesses that even have a chance to be recommended.

Does having FAQ schema alone make a big difference?

It’s one of the higher-leverage individual items on this list, since it hands AI tools a ready-made, clearly labeled answer instead of requiring them to extract one from plain paragraphs. It works best combined with the other items, not as a single fix on its own.

What if my negative reviews or press are old but still show up?

Because AI models are trained periodically rather than updated in real time the way a search index is, older negative content can keep influencing how a model describes you well after the issue is resolved. Publicly addressing it, generating new positive coverage, and keeping recent reviews flowing are the main ways to gradually shift that balance.

Should local businesses worry about Wikidata and Wikipedia?

For most small and local businesses, no — that’s generally out of reach and not the highest-leverage use of time. Focus first on Google Business Profile accuracy, consistent directory listings, and genuine reviews, which matter far more at that scale.

How often should I redo this audit?

Every few months is reasonable for most businesses, since AI platforms update how they crawl and weigh signals fairly often. It’s also worth rechecking any time you redesign your website, since that’s when robots.txt and schema issues most commonly get accidentally introduced.

Where This Fits Into a Bigger Strategy

This checklist covers the concrete, checkable basics — but it isn’t the whole picture. If you want to go deeper on why AI tools recommend certain businesses and ignore others with seemingly similar websites, we’ve covered that directly in why AI recommends some businesses and ignores others. And if you’re specifically confused about how the same question gets a completely different answer depending on which AI tool you ask, that’s covered in why ChatGPT and Claude recommend different brands for the same query.

None of this requires hiring anyone to start. Go through the twenty items above against your own site this week. and you’ll know more about your real AI visibility than most businesses currently do — including, frankly, some of their marketing agencies.