What we measure, and what we will not

Evidence grades

Seed scale works / mixed / weak / unknown maps to supported / mixed / unproven. Weak means studies found little or no citation lift — not that the tactic is “secretly strong.”

• supported

  Best study is at least large-n observational or controlled, with some replication. Outcome data is still mostly correlational — not a guarantee.

• mixed

  Real evidence that depends on platform or context, or sources conflict. Worth doing as hygiene; not a settled lever.

• unproven

  Little or no measured citation lift, only thin support, or a mechanism without outcome data. Fine as hygiene — not weighted in the free check.

Vs spec-only audits

The closest tool to ours that we've found is Pyralis Labs' free GEO Audit. Its page (read 20 Oct 2026) says there is no score, names an official source for every check, reads robots.txt crawler by crawler under RFC 9309, and probes the page with crawler user-agents. Of the six free URL auditors we compared on 20 Oct 2026, it was the only one besides us that gives no overall score. Our difference is outcome-evidence grades (Supported, Mixed, Unproven) plus a buyer-question match, not only spec validity. Schema, FAQ and llms.txt can be valid and still get weight 0 when studies show no citation lift. AutoGEO (arXiv 2510.11438) is a GEO-methods cite, not a free-check signal.

Evidence strength (E)

• E3 — controlled experiment / peer-reviewed (GEO KDD 2024; C-SEO Bench).
• E2 — large-n observational, method disclosed (Ahrefs 75k brands, 17M citations, 1,885-page schema before/after study; SE Ranking 300k; Profound 680M; Toronto 2610.15033 preprint).
• E1 — small test, vendor statement, platform docs.
• E0 — anecdote or untested advice.

Platform docs count as E3 for mechanism (does the bot fetch or render this?) and only E1 for outcome (does this increase citations?).

How results are graded: gates, then rungs

There is no overall score out of 100. A total would mix strong and weak evidence into one number and reward files no AI agent is known to read. Google's own Lighthouse “Agentic Browsing” audits report a pass fraction instead, and we do the same.

1. 1. Gates. We check three gates first: access (crawlers allowed, server lets them in, page indexable), main content in the HTML, and match to buyer questions. A gate shows Pass only when every graded check in it passes. Fix a failed gate first.
2. 2. One card per ladder rung we can measure.Each card shows how many of its graded checks pass, for example “Read 2/3”, with the reason for every check. Watch and Fail count as not passing. “Couldn't check” counts as not passing. Info rows and weight-0 hygiene rows don't count at all. The cards are never added together.
3. 3. Weights only order the fixes.The fix list puts fails before watches, then higher weight first. Weights don't turn into points.

• Seen public ladder: Retrieved

  Can AI agents reach the page, and is it allowed in search and AI answers?

  Checks: AI search/retrieval bots can fetch this URL · Firewall lets AI crawler user-agents through · Indexable and snippet-eligible

• Read public ladder: Retrieved

  Is the main text in the HTML, with a clear description and a date?

  Checks: Main content is in the HTML response · Snippet-ready title, meta description and first paragraph · Published or modified dates are detectable

• Cited public ladder: Cited

  Is the page easy to match to a buyer question and quote? On-page proxies only.

  Checks: Title and paragraphs match the buyer prompts · Answer-first structure with question headings · Citations, statistics, and quotations in the copy · Avoid keyword stuffing · FAQ markup matches the visible Q&A

Not graded:Used (AI agents acting on your site: the standards are early, so they sit in a separate panel), Recommended (depends on reviews, comparisons, forums and press, which we can't see from your page), and Picked & purchased (agent checkout and payments mostly happen off your page). Seen and Read together are the “Retrieved” rung of the Visibility Ladder.

Free check weights

Priority: the gates — crawler access, indexable and snippet-eligible, main content in the raw HTML, and query-matching titles/paragraphs vs buyer prompts (weight 5 each). Mixed-evidence rules carry weight 1–2 and only warn, never fail. We show no overall score. Off-site tactics are guidance only. AI agents that cannot fetch your page cannot use it.

• AI search/retrieval bots can fetch this URL 5 · hard blocker

  Gate. robots.txt is parsed per RFC 9309 for every AI search and agent-fetch bot in the ai.robots.txt list (plus Googlebot and Bingbot). Blocking OAI-SearchBot, Claude-SearchBot, Claude-User, PerplexityBot, Googlebot or Bingbot fails. Blocking ChatGPT-User or Perplexity-User only warns: OpenAI says robots.txt "may not apply" to ChatGPT-User and it isn't used for Search inclusion; Perplexity says Perplexity-User "generally ignores" robots.txt. Blocking smaller bots warns. A robots.txt 4xx (except 429) means no restrictions; a 5xx means crawlers assume full disallow, so it fails. noindex, nosnippet and max-snippet are graded separately ("Indexable and snippet-eligible"), because they live in the page, not in robots.txt. Training-bot blocks (GPTBot, ClaudeBot, Google-Extended) are informational. Tactic

• Indexable and snippet-eligible 5 · hard blocker

  Gate (part of Access). noindex (or none) in <meta name="robots">, <meta name="googlebot"> or the X-Robots-Tag header fails: Google's AI Overviews and AI Mode only use indexed pages. nosnippet or max-snippet:0 fails: Google won't show text from the page as a snippet or use it as a direct input to AI features. data-nosnippet covering half or more of the main text warns, and so does max-snippet under 50 characters. Directives scoped to other crawlers ("bingbot: noindex") are ignored. Source: Google's AI features and robots meta tag docs (vendor-documented). Tactic

• Main content is in the HTML response 5 · hard blocker

  Gate. Substantial text in main/article/body of the raw HTML (under 180 characters or a bare JS app shell fails; under 800 warns — our heuristic, not a vendor threshold). Vercel's crawler logs (Dec 2024) showed the major AI crawlers fetch but don't run JavaScript; Toronto 2610.15033 found JavaScript-dependent pages got fewer Gemini citations. Since late September 2026, two site owners have logged OAI-SearchBot rendering JavaScript on some pages; OpenAI hasn't confirmed it. Don't rely on it: put the main text in the first HTML response. Tactic

• Firewall lets AI crawler user-agents through 3

  We fetch the page as OAI-SearchBot, PerplexityBot, Claude-SearchBot, Claude-User and Google-Agent and look for 401/403/406/429/451/503 responses or challenge pages (Cloudflare, Akamai, Imperva, DataDome, PerimeterX, Vercel). HTTP 402 is reported as paid crawling (pay per crawl), not a block; it warns because that AI agent can't read the page unless its operator pays. robots.txt can allow a bot while a CDN or WAF still blocks it. Probes come from our servers, not vendor IPs, so a block is likely, not certain. Crawl Readiness (Oct 2026): 14.2% of responding Tranco top-1,000 sites block an AI crawler at the server while robots.txt allows it. If you allow bots, verify them against the vendors' published IP lists; allowing by user-agent name alone lets fakes in. Tactic

• Title and paragraphs match the buyer prompts 5

  Lexical overlap of title, H1 and paragraphs vs the buyer prompts (yours, or 10 generated ones). The brand name alone never counts as a match. Toronto 2610.15033: title match and best-paragraph match were the only page properties to survive all five within-site robustness tests (for ChatGPT the paragraph match carried the effect). Pass at 70% of prompts matched, warn at 40% — our thresholds. With our generated example prompts a low match only warns; with your own questions it fails. This is a proxy, not the engine's own retrieval. Tactic

• FAQ markup matches the visible Q&A 1

  Warn only, and only when FAQPage JSON-LD is present: each marked-up question must appear on the page. Google's structured data guidelines forbid marking up content readers can't see. In our Oct 2026 benchmark, seven tools scored FAQ markup that isn't on the page the same as valid markup. Valid FAQ markup earns nothing here (info): schema has no measured AI citation effect. Tactic

• Published or modified dates are detectable 2

  Low weight, evidence Mixed. datePublished / dateModified in JSON-LD, Open Graph article times, or time[datetime]. Missing dates warn (never fail); a date older than 12 months warns. Ahrefs (17M citations): AI-cited URLs averaged 25.7% fresher than organic results (correlational). Toronto 2610.15033: page age was not a consistent within-site predictor. Tactic

• Citations, statistics, and quotations in the copy 1

  Low weight, evidence Mixed, warns at most. Outbound links to authoritative domains, numeric stats, and quotes (a rough proxy: any number counts). Princeton GEO (KDD 2024) ~40% is position-adjusted word count in a GPT-3.5 lab engine on five fixed Google results, not a ChatGPT citation rate; C-SEO Bench found most rewrite methods ineffective or harmful. AutoGEO (arXiv 2510.11438) is a GEO-methods paper, not a free-check signal. Tactic

• Snippet-ready title, meta description and first paragraph 1

  Low weight, evidence Mixed. Title present; meta description present, not a copy of the title and at least 50 characters (50–160 is a display guideline — Google sets no length limit); first paragraph not empty or boilerplate; and at least one of the three states plainly what the brand is or offers. Why: arXiv 2610.21731 (preprint) found GPT-5.6's lightest tier answered 53.6% of episodes from search snippets without opening a page, and across seven configurations snippet-only answers were stale more often (6.4% vs 1.3%). arXiv 2610.15382 (preprint) links longer retrieval snippets with citation (observational). The effect of fixing your snippet on citations is unproven. Tactic

• Comparison phrasing in the title when accurate 1

  Info only. Title/H1 terms such as best, vs, alternatives, top, review. Ahrefs: 'best X' lists were 43.8% of page types ChatGPT cited for 750 recommendation prompts (descriptive). We suggest, we never penalize absence. Tactic

• Answer-first structure with question headings 1

  Low weight, evidence Mixed, warns at most. Question-style H2/H3 and a direct answer near the top. A Growth Memo/Search Engine Land study found 44.2% of ChatGPT citations came from the top 30% of a page (correlational, across sites); Toronto found headings and FAQ blocks null within a site, and the best-matching paragraph at a median 45% down the page. Tactic

• Avoid keyword stuffing 1

  Low weight, warns at most. Flags when one non-stopword, non-brand word is over 8% of the words on a page of 150+ words — our heuristic; no search engine publishes a density threshold. Google's spam policies define keyword stuffing as unnatural repetition. GEO-bench: keyword stuffing did not beat the unedited baseline. Tactic

Crawler rules, sourced

• Which robots.txt blocks fail the gate.Blocking OAI-SearchBot, Claude-SearchBot, Claude-User, PerplexityBot, Googlebot or Bingbot fails. Blocking ChatGPT-User or Perplexity-User only warns: OpenAI says robots.txt “may not apply” to ChatGPT-User and that it isn't used to decide Search inclusion (OpenAI crawler docs), and Perplexity says Perplexity-User “generally ignores” robots.txt (Perplexity crawler docs). Block or allow those two at your firewall.
• How robots.txt is read. We follow RFC 9309: the most specific user-agent group wins (case-insensitive) and groups for the same agent merge; the longest matching path wins, with Allow winning a tie; * and $ work as wildcards; only the first 500 KiB is read. A 4xx (except 429) means no restrictions. A 5xx means crawlers must assume everything is disallowed, so the gate fails (Google pauses crawling for 12 hours, then uses its last cached copy). A 429 or a network error only warns, since it may be our fetch that was refused.
• robots.txt is a request, not a wall. Toronto found 7.1% of pages ChatGPT cited disallowed OAI-SearchBot, and BuzzStream found most news sites blocking AI bots still appeared in AI answers. Use firewall rules if you need enforcement.
• JavaScript.Most AI crawlers read only the raw HTML. Since late September 2026, two site owners have logged OpenAI's OAI-SearchBot rendering JavaScript on some pages; OpenAI hasn't confirmed it (Hisashi Space, Create With Logic). Don't rely on it: put the main text in the first HTML response. The HTML gate stays.
• Firewalls. robots.txt is one layer. Crawl Readiness (Oct 2026, vendor, open data) found 14.2% of responding Tranco top-1,000 sites block an AI crawler at the server while robots.txt allows it. Allowing bots by user-agent name alone lets fakes in, so verify them against the vendors' published IP lists.
• llms.txt. Counted as present only when a real text file comes back, not an HTML page served with a 200. Still weight 0.

Hygiene / info (weight 0)

• Training crawler policy is explicit

  Info only. GPTBot, ClaudeBot and Google-Extended blocks are a policy choice. Google-Extended controls Gemini training and grounding in Gemini Apps/Vertex AI, not Google Search or AI Overviews. BuzzStream (top-50 news sites, 2025): 88.2% of sites blocking GPTBot still appeared in AI citations — but so did 70.6% of sites blocking ChatGPT-User, so the study doesn't show which blocks matter. Tactic

• FAQPage / HowTo structured data (hygiene)

  Hygiene only, weight 0. Ahrefs' matched before/after study of 1,885 pages found no meaningful AI citation uplift from adding schema; Toronto found FAQ blocks and schema null within a site. Google limited FAQ rich results (2023). Do not treat presence as an AI boost or claim schema → 3× citations. Tactic

• llms.txt at the site root (info only)

  Weight 0. Counted as present only when a real text/markdown file comes back, not an HTML page served with 200 (soft 404). Google's John Mueller (June 2025): no AI system currently uses llms.txt. Google AI features docs: you don't need new machine-readable files. SE Ranking (~300k domains): no link to citations. Presence is reported, never scored. Tactic

• Organization / entity markup (hygiene)

  Hygiene only, weight 0. Google says Organization markup helps it understand and disambiguate your organization. No study shows citation lift: Ahrefs' schema study found none; Bing saying schema helps Copilot understand content is not citation lift. Tactic

Early agent standards (info only)

Results include a separate panel, labelled “early standard”, for new files and signals aimed at AI agents. Weight 0: they never change a gate or a rung card, because no AI search engine has said any of them affects being found or cited. A file counts only when a real file comes back. An HTML page served at the address with HTTP 200 (a soft 404) is reported as “not valid”. All fetches are small, time-limited and free.

• Content Signals in robots.txt

  Content-Signal: search=, ai-input=, ai-train= lines; we show what you declared. Spec: contentsignals.org

• IETF AI preferences (Content-Usage)

  Content-Usage lines in robots.txt or the Content-Usage response header. Spec: draft-ietf-aipref-attach

• RSL licence

  License: lines in robots.txt (global or per group) and Link headers with type application/rsl+xml. We show the licence URL; the XML isn't fetched. Spec: RSL 1.0

• Markdown for AI agents

  One request with Accept: text/markdown; found only if a text/markdown response comes back. Spec: Cloudflare docs

• MCP server card

  Both /.well-known/mcp/server-card.json (older draft) and /server-card (final SEP), plus an AI Catalog that lists one. Spec: SEP-2127

• Agent Skills index

  /.well-known/agent-skills/index.json with a skills array. Spec: Discovery RFC (draft)

• API catalog

  /.well-known/api-catalog with a linkset. Spec: RFC 9727

• A2A agent card

  /.well-known/agent-card.json with a name and an endpoint. Spec: A2A protocol

• UCP profile

  /.well-known/ucp, shown only when the page looks like a shop (Product/Offer markup or cart links). Spec: ucp.dev

• ARD manifest

  /.well-known/ard.json first; only if it's missing, the predecessor /.well-known/ai-catalog.json, then a robots.txt Agentmap: pointer. Spec: ARD v0.91

• WebMCP tools

  <form toolname> in the HTML, and modelContext.registerTool in inline scripts and up to 3 same-origin script files. Spec: W3C CG draft

• Personal Agent Protocol (poppy.json)

  /.well-known/poppy.json: whether it exists and its version. Missing shows as not applicable. Spec: PAP 0.1

How each rule is sourced

Every rule in the free check, the evidence it rests on, and its label. Thresholds we chose ourselves are marked as ours. Last audited against the primary sources on 20 October 2026.

Numbers we will not repeat wrong

• Princeton's ~40% is Aggarwal lab position-adjusted word count on a GPT-3.5 engine reading a fixed set of five Google results — not a ChatGPT citation rate. Rank-1 sources lost ~30% with Cite Sources. The author is Aggarwal, not Agrawal.
• Ahrefs' “76% of AI Overview citations come from the top 10” is outdated. Their own update is ~38% (Mar 2026, 4M URLs). Ahrefs suggests fan-out as the reason; that is a hypothesis, not a measured cause.
• Profound's 47.9% Wikipedia figure is Wikipedia's share within ChatGPT's top-10 domains. Across all citations it is 7.8%.
• Never claim schema → 3× citations. Ahrefs' before/after study of 1,885 pages that added schema found no meaningful uplift (an observational match, not a randomized test). Bing using schema so Copilot can understand content is not citation lift.
• BuzzStream's 88.2% (news sites blocking GPTBot still cited) does not show that only retrieval-bot blocks matter: 70.6% of sites blocking ChatGPT-User were still cited too. It shows blocks are leaky.
• The 6.4% vs 1.3% stale-answer gap in arXiv 2610.21731 is pooled over seven model configurations, not the 53.6% snippet-only model alone.

Honesty rules

• Say correlation when the study is correlational.
• No magic overall score as a citation forecast.
• Keep URL-unverified flags visible until a human has opened the citation.
• AI citations churn. In a small 15-prompt 2026 preprint (the author sells AI-visibility tooling), each engine's cited URL set changed by about 67% on average from one day to the next, and engines shared under 1% of cited URLs. Toronto found only about 40% of the within-site pattern of ChatGPT citations still held two weeks later, and 14% after ten weeks. Re-review verdicts on a schedule.