AI SEO Audit: What a Real Audit Checks, and in What Order

An AI answer passes through four stages, and an audit is only useful where you have control.

• Parametric: what the model knows with no web access, frozen at a training cutoff. Nobody changes this quickly.
• Access: whether a crawler may fetch and store your page. You and your CDN control this.
• Retrieval: whether your page enters the model's context for a given question. The engine controls this, partly through its index.
• Generation: which retrieved pages the model uses and cites. The model controls this.

A real AI SEO audit spends most of its effort on access and index status, because those are mechanical, checkable and in your hands. It then measures accuracy, because that tells you what the engines are saying today. If you want the contrast with a classic technical audit, see how an AI visibility audit differs from an SEO audit.

Every later stage depends on access. An engine can't retrieve a page it was never allowed to fetch, and it can't cite a page it never retrieved.

Google states the rule plainly for its own AI surfaces: to appear as a supporting link in AI Overviews or AI Mode, a page must be indexed and eligible to be shown in Search with a snippet, and "there are no additional technical requirements." There is no separate GEO path into Google.

The research points the same way. A 2026 critical survey of 45 GEO studies (arXiv 2607.14035) found that no reviewed technique shows a stable, cross-platform causal effect on discoverability. Nearly every published GEO effect size was measured on pages already sitting inside the model's context, which tells you little about getting there. That gap is covered in what lab GEO studies do and don't transfer to live engines.

So the order is simple: confirm nothing is blocking you, then confirm you're indexed, then look at what the answers say.

robots.txt, bot by bot

AI companies run separate crawlers for training, search and user-triggered fetches. OpenAI's crawler documentation says "each setting is independent of the others." GPTBot governs training use only. OAI-SearchBot governs ChatGPT search, and sites that block it won't be shown in ChatGPT search answers. The common mistake is a blanket AI block that removes search eligibility along with training. A site that wants search visibility but no training use looks like this:

User-agent: OAI-SearchBot
Allow: /

User-agent: GPTBot
Disallow: /

Check PerplexityBot, Claude-SearchBot, Meta-WebIndexer, bingbot and Googlebot the same way. There is no robots.txt token for AI Overviews or AI Mode: Googlebot's rules apply to all Google surfaces.

CDN and firewall reachability

robots.txt is a statement. Your firewall is the enforcement. OpenAI's help centre says eligibility means allowing OAI-SearchBot and confirming your host or CDN allows traffic from its published IP addresses. Request a page as each AI crawler and record the status code. A 403 or a challenge page is a silent failure. Also note that since 15 September 2026, Cloudflare blocks Training and Agent crawlers by default on ad-displaying pages for new domains and existing free-tier customers, so access can change without anyone on your team editing a thing. The AI crawler access audit playbook walks through this step by step, and the AI Crawler Checker requests a page as each crawler and shows which ones get turned away.

Rendering

Vercel's crawler study found that ChatGPT and Claude crawlers fetch JavaScript files (11.50% and 23.84% of their requests) but don't execute them. Content that only appears after JavaScript runs may be invisible to them. Googlebot does render. Fetch each key page with JavaScript off and compare it to the rendered page. Prices, product names and core claims should be in the raw HTML.

Snippet controls

noindex, nosnippet, max-snippet:0 and data-nosnippet keep content out of AI answers on Google and Bing. They often arrive by accident, inherited from a template. Scan for them and confirm each one is intentional.

Google's generative AI inclusion setting

Inclusion in AI Overviews and AI Mode is the default. Search Console has an opt-out control, still rolling out to some property owners, and child properties inherit it from the parent. It can't be seen from outside, so whoever owns Search Console has to check it.

Once crawlers can reach you, check that each engine's index actually holds your pages. Use Google Search Console for Google and Bing Webmaster Tools for Bing. One being healthy tells you nothing about the other.

Otterly's 2026 experiment shows why. Google deindexed both of its 1,000-post AI-generated test sites, and Google's AI surfaces almost stopped citing them. Bing kept them, and Otterly reported that Microsoft Copilot produced 2,718 of the 3,934 citations it tracked for one site. It's one pair of sites on a low-stakes topic, so treat it as an illustration, not a law. The mechanism it illustrates is documented: an engine can't cite what its index no longer holds.

Two first-party reports are worth pulling into the audit. Google's generative AI report in Search Console shows impressions only, with no clicks or position. Bing's AI Performance report shows grounding queries, the searches the AI actually ran. That is the only window anywhere onto real retrieval input, which matters because, as covered in whether tools can see the prompts people actually type, prompt trackers test questions they chose themselves.

Access and indexing tell you whether engines can use your site. Accuracy tells you what they actually say. AI platforms get specific facts wrong about specific brands: prices, plan names, founding dates, locations, features that no longer exist.

An accuracy check works like this:

1. Write the buyer questions a real prospect would ask.
2. Ask each engine separately and record every factual claim about your brand.
3. Compare each claim against a list of facts you've verified.
4. Note whether the answer cited sources. An answer with no citations may come from training data with an older cutoff, not your current site.

Then look at your own site. If your pricing page, about page and footer state the same fact differently, fix that first. Stating a specific fact (a price, a number, a one-line definition) on a page crawlers can fetch gives an engine a sentence it can quote. When engines cite other sites instead of yours, being named accurately on those sites is associated with appearing in the answer, though nobody can promise the effect.

The free checker on this site runs up to three buyer questions and shows how engines answer them. It's a snapshot, not continuous tracking.

Be honest about where an audit ends. Some things are fully yours, some are partly yours, and some belong to the engine.

An audit fixes what blocks you. It can't promise a citation, a ranking or a score, and any vendor that does is selling something the evidence doesn't support.

Run the audit in the same order the engines work.

1. robots.txt: list every AI crawler and its rule. Separate training bots from search bots.
2. Reachability: request a key page as each crawler. Fix any 403, rate limit or challenge page at the CDN or firewall.
3. Rendering: compare raw and rendered HTML on your pricing, product and about pages. Move anything critical into the server response.
4. Suppression: scan for noindex, nosnippet, max-snippet and data-nosnippet. Remove the ones nobody meant to set.
5. Google inclusion setting: confirm in Search Console, including inherited settings on child properties.
6. Index status: check Google and Bing separately for your key pages.
7. Accuracy: ask buyer questions on each engine, log wrong facts, fix contradictions on your own site.
8. Re-check: repeat after deploys, CDN changes and platform updates.

Steps one to six are pass or fail. Step seven is where you'll find the problems customers notice. For an ongoing rhythm, the quarterly AI visibility review checklist turns this into a repeatable routine.

Many audits still score things the evidence has ruled out or never supported.

• Treating schema as a quick win. Google says structured data isn't required for generative AI search. Ahrefs' matched-control test found AI Overview citations fell 4.6% after pages added schema. Existing markup does no harm, but it isn't a lever for AI answers.
• Reporting an E-E-A-T score. Google says E-E-A-T isn't a specific ranking factor. There is no score to measure.
• Scoring domain authority. It's a third-party metric. No engine computes it.
• Recommending llms.txt. Google says Search ignores it, and no engine documents reading it.
• Telling you to allow GPTBot for visibility. GPTBot governs training. ChatGPT search uses OAI-SearchBot.
• Reporting an AI rank. Google exposes impressions only. There's no position data to check a rank against.
• Trusting robots.txt alone. Without a reachability test, the audit misses firewall blocks.
• One blended score. Engines behave differently, so measure each one on its own.

Audits should also flag tactics that create risk, such as hidden text or content cloaked for AI crawlers. See auditing your site for risky GEO tactics.