GEO audit: a 24-point checklist for AI search

What is a GEO audit?

A GEO audit is a check of a website against what AI assistants need to use it: whether their bots can get in and read the text, whether they can tell which business the site belongs to, and whether the pages hold answers clear enough to quote. GEO stands for generative engine optimization, the work of making a site useful to assistants that write answers rather than list links.

An audit looks at the inputs, the things on and around your site that you control. It does not measure whether ChatGPT or Perplexity actually names you; that is a separate question, answered by asking the assistants over several weeks, as explained in our guide to checking AI visibility. The two go together. The audit tells you what to fix; the measurement tells you whether the fixes are reaching the answers.

The checklist below has 24 items in three groups, eight in each. They are the same 24 items the MWY checker scores, written out so you can run the audit by hand or check what a tool tells you.

What you need before you start

A manual audit takes an afternoon for a small site. You need:

• A browser, to open robots.txt, view page source and follow links.
• A list of the pages to audit: the home page, the About and Contact pages, two or three main service or product pages, and one or two blog posts if you have them. These are the pages an assistant is most likely to read about your business.
• Google’s Rich Results Test or the Schema Markup Validator, to read your structured data.
• Google Search Console and Bing Webmaster Tools, if the site is verified there, to see which pages are indexed.
• Access to server or CDN logs, or someone who has it, for the firewall item.

Work through the groups in order and note each item as pass, partial or fail, with what you saw. A note like “robots.txt blocks PerplexityBot” is more useful later than a red mark.

Group 1: can AI read the site?

These items decide whether the bots get in and find text. A failure here can hide a site completely, so they carry the most weight.

The firewall item is the hardest to check from outside. A site can allow every bot in robots.txt while its bot protection answers those same bots with a block page, and nobody sees it, because the block only hits bots. Our guide to how AI assistants find pages covers each bot and the robots.txt lines that close a site by accident.

Group 2: does AI know who you are?

An assistant joins facts about a business from many sources. These items decide whether it can tell that your site, your profiles and your listings are one business, and what that business is.

The name item is the easiest to overlook. “Northgate Plumbing”, “Northgate Plumbing & Heating LLC” and “Northgate Plumbers” can read as three businesses to a machine. Choose one official form and use it in every place you control.

Group 3: can AI quote the site?

Once an assistant can read your pages and knows who you are, these items decide whether it finds something to quote.

The llms.txt item carries the least weight in the whole list: none of the big assistants has said it reads the file. Our llms.txt guide explains what it is and how to write one in an hour.

Not every item applies to every site. A business with no posts has nothing to score on dates and authors, and an online-only business needs no Maps link. Mark those items as not applicable rather than failed.

How to decide what to fix first

Twenty-four items is too many to fix at once, and they are not equal. Sort what failed by two questions: how much does it block, and how much work is it?

Fix the blockers now. A robots.txt line that closes the site to AI search bots, a firewall that refuses them, a noindex tag on a main page: each one can make every other item worthless, and each is usually an hour of work or less.

Then the quick identity items. Organization schema, one spelling of the name, contact details as text, links to your profiles: an afternoon of work, and the base an assistant needs to recognize you.

Then content, over months. Questions and answers, public prices, a page per service, an About page worth reading. This is writing work, and it never quite ends. It is also where the evidence on what makes pages more quotable applies.

Content in the HTML is the exception. If your page source is nearly empty because the site is built by JavaScript in the browser, that is a blocker, but fixing it is a developer’s job that can take days. Start it early, and do the quick items while it runs.

Each item also has an owner. robots.txt, schema and redirects are for the web developer. The name, the prices and the About page need the owner’s decisions. Questions and answers and service pages are work for whoever writes your content. Splitting the list by owner turns one long audit into three short to-do lists.

A worked example: one audit, three to-do lists

Here is how the results of an audit might turn into work for an invented neighborhood bakery with a small website: a home page, a menu page, an About page, a Contact page and a few blog posts. The bakery and its findings are illustrative.

The audit found seven items that did not pass:

• robots.txt disallowed every bot under “User-agent: *“, left over from the site’s launch.
• There was no Organization or LocalBusiness schema.
• The name appeared as “Rise Bakery” in the titles and “Rise Bakehouse” in the footer and on the social profiles.
• The address and opening hours were only in an image at the top of the Contact page.
• The menu page listed products with no prices.
• The blog posts had no dates.
• There was no FAQ anywhere, although customers asked the same questions every day: gluten-free options, custom cake lead times, parking.

Sorted by owner and by what each item blocks, the seven items became three short lists.

The web developer, this week: remove the “Disallow: /“ line from robots.txt (fifteen minutes, and the most important change of all), add LocalBusiness schema with the address, hours, phone and logo, and show dates on the blog posts.

The owner, this week: choose “Rise Bakery” or “Rise Bakehouse” and use it everywhere, including the social profiles and the Google Business Profile; write the address and hours as text on the Contact page; add prices to the menu.

The owner and whoever writes, this month: write the eight questions customers ask most, each with a short answer and real numbers (custom cakes need five days’ notice; two gluten-free loaves are baked daily), and put them on the menu and Contact pages with FAQPage schema.

None of these needed a new website or an agency. The first list took an afternoon, and the robots.txt line alone had been hiding the whole site from AI search since launch.

When to run the audit again

A GEO audit is not a one-time project, because the things it checks change without anyone deciding to change them.

• After a redesign or a move to a new platform. robots.txt, redirects and structured data are often lost or reset in a migration.
• After any change to hosting, CDN or security settings. A new firewall rule or bot setting can close the site to AI bots overnight.
• After editing robots.txt, whoever did it and for whatever reason.
• After each fix, to confirm the item now passes, rather than assuming it does.
• Every three months otherwise, to catch slow drift: a new page without a title, a price that changed in one place and not another.

Keep each audit’s notes. Comparing two audits is the quickest way to see what broke and when.

Run the audit with the MWY checker

The MWY checker runs these 24 items for you. It reads your home page and up to seven inner pages, plus robots.txt, sitemap.xml and llms.txt, the way the AI search bots do: raw HTML, no JavaScript, and nothing that your robots.txt closes to its bot. The rules are fixed, so the same site gets the same result every time, and each item says whether its result is certain or only a signal. The “How it scores” page, in the menu of every page, explains how each item is detected and weighted.

The free check gives your score, the score of each group and the five items that matter most on your site, in a few seconds and with no sign-up. Pro shows all 24 with the fix for your platform, snippets filled in with your details, a plan ordered by impact and effort that says who does each step, rescans whenever you change something, and the change since your last scan. See what Pro includes.

Some things the checker cannot see from outside. The firewall item is a signal, because the real bots come from their own network addresses. It reads the pages a visitor can open, not your server settings or your profiles on other sites. And it does not promise that an assistant will name your business: it shows what stands between your site and the assistants, and how to remove it.