An AI visibility audit is not a ranking report. It is a set of binary checks you can run this week, most of them without paid tools. The 30 items below are grouped by the layer they test: access, entity clarity, content that answers, off-site mentions, and measurement. Each item has a pass/fail test so two people auditing the same site reach the same conclusion.
Work top to bottom. Access failures make everything below them irrelevant, because if a crawler cannot read the page, nothing else on this list matters.
Access: can the crawlers that matter read you?
1. Robots.txt allows OAI-SearchBot. Pass: the file does not disallow OAI-SearchBot. Sites opted out of OAI-SearchBot are not shown in ChatGPT search answers, so this is a visibility decision, not a training decision. Fail: any Disallow: / rule naming OAI-SearchBot.
2. Robots.txt allows ClaudeBot. Pass: no disallow rule. Blocking ClaudeBot excludes future content from model training. If that is your intent, fine, but record it as a deliberate choice rather than an accident.
3. Robots.txt allows Claude-User. Pass: not blocked. Claude-User fetches pages when a user asks Claude a question, and blocking it prevents retrieval for those queries.
4. Robots.txt allows Claude-SearchBot. Pass: not blocked. Blocking it prevents indexing for Claude search.
5. Robots.txt allows PerplexityBot. Pass: not blocked. PerplexityBot surfaces and links sites in Perplexity search results and is not used to crawl content for foundation models.
6. Robots.txt allows Google-Extended if you want Gemini grounding. Pass: no disallow. Fail: disallowed, with the understanding that Google-Extended controls training and grounding for Gemini, does not affect Google Search inclusion, and is not a ranking signal.
7. You have not confused GPTBot with search visibility. Pass: you can state, in one sentence, that GPTBot collects content for foundation models and that blocking it does not affect ChatGPT search. Fail: your robots.txt blocks GPTBot and you assume ChatGPT stopped citing you.
8. You understand that Perplexity-User generally ignores robots.txt. Pass: you have stopped counting it as a blocked bot. It fetches pages for user questions, and because the user requested the fetch, robots.txt generally does not apply.
9. You know robots.txt is intent, not access control. Pass: you can name at least one other layer (CDN, WAF, bot management) that could still block a crawler you allow in robots.txt. RFC 9309 describes robots.txt as expressing intent; it is not access control.
10. Your rules are written the way crawlers parse them. Pass: the most specific group naming a bot wins, and the * group is ignored for that bot. Within a group, the longest matching rule wins. Fail: you rely on a * disallow to override a named allow.
11. You have verified access bot by bot, not by assumption. Our free AI crawler checker reads a site's robots.txt and reports, bot by bot, whether 16 crawlers such as GPTBot, OAI-SearchBot, ClaudeBot and PerplexityBot are allowed, partly restricted or blocked, and whether /llms.txt exists. It does not see server logs, traffic, visits or CDN/firewall blocks, so treat it as one layer, not the whole answer.
12. Changes are dated and rechecked. Pass: your last robots.txt edit is logged, and you rechecked after roughly 24 hours. OpenAI and Perplexity both note that robots.txt changes can take about 24 hours to take effect. Anthropic says its bots honor robots.txt, support Crawl-delay, and publishes its IP ranges, which gives you a second way to confirm traffic is really from those bots.
13. Key pages render without JavaScript. Pass: you can load a product or pricing page with JS disabled and read the main copy. Fail: the page is a shell that only fills in client-side.
14. No critical content sits behind an interaction. Pass: tabs, accordions and lazy-loaded blocks are either server-rendered or duplicated in the HTML. Fail: your differentiators only appear after a click.
15. Canonicals and redirects resolve to one URL per page. Pass: one canonical, one 200 response, no chains. Fail: www and non-www both serve full pages.
Entity clarity: can a system tell who you are?
16. One canonical description of the company. Pass: your homepage, About page, LinkedIn and any directory listing use the same one-sentence description. Fail: four slightly different versions.
17. Organization schema is present and matches the visible page. Pass: name, URL, logo and sameAs fields are filled and consistent with what a reader sees. Fail: schema says one thing, the page says another.
18. Product or service pages carry their own schema. Pass: each major offering has a distinct page with matching markup. Fail: everything funnels to the homepage.
19. You are unambiguous about category. Pass: a stranger can tell what you sell, to whom, and what you replace. Fail: the homepage leads with a slogan that could describe any company in the sector.
20. Named people are attached to the brand. Pass: founder or team names appear on the site with roles, and those names exist elsewhere. Fail: the site is anonymous.
21. Your terminology is stable. Pass: you use one term for your category across the site. Fail: three synonyms used interchangeably, which splits the entity you are trying to build.
Content that answers: do you give a system something to quote?
22. Every key page answers a question in the first two paragraphs. Pass: the answer is stated plainly, before the pitch. Fail: the reader scrolls to find it.
23. Headings are questions or claims, not labels. Pass: ## How pricing works or ## Pricing scales with seats. Fail: ## Pricing with no further signal.
24. Numbers and specifics appear in the body text. Pass: concrete figures, limits, timeframes and ranges are written out. Fail: adjectives doing the work numbers should do.
25. Comparison content exists. Pass: at least one page that honestly positions you against alternatives, including cases where you are not the right fit. Fail: only self-description.
26. Definitions and glossaries are on-site. Pass: the terms your buyers search are defined on your own pages. Fail: you rely on third parties to define your category.
27. Freshness signals are real. Pass: pages show a genuine update date and the content actually changed. Fail: dates bumped without edits.
28. Each page has one job. Pass: a page about onboarding does not also try to sell the enterprise plan. Fail: pages that answer six questions badly.
Off-site mentions and measurement
29. Third-party mentions are tracked as a list, not a feeling. Pass: you maintain a simple sheet of where the brand appears, who wrote it, and when. Fail: you cannot name five sources outside your own domain. Off-site mentions are a major input to whether a system has any reason to name you, and the only way to manage them is to inventory them.
30. You measure AI answers on a fixed question set, on a schedule. Pass: you have 10 to 20 questions buyers actually ask, you run them across ChatGPT, Gemini and Perplexity on a set cadence, and you log whether you were mentioned, cited, or absent. Fail: you check occasionally and remember impressions rather than results.
How to run this without fooling yourself
Three habits keep an AI visibility audit honest.
First, separate access from outcomes. A blocked crawler is a fact you can fix in an afternoon. A missing mention is a signal that may take months of content and off-site work. Mixing them produces panic and bad decisions.
Second, write down what you cannot see. Our checker reads robots.txt and /llms.txt only. It does not see server logs, traffic, visits or CDN/firewall blocks. If your CDN blocks a crawler that robots.txt allows, the checker will report it as allowed and you will be wrong. Confirm with logs or your CDN configuration before you conclude a bot is getting through.
Third, treat every result as a snapshot. AI answers vary by user, phrasing, location and time, and no vendor guarantees that a given site will be cited. What you control is whether you are readable, clearly described, and quoted somewhere. For example, suppose you fix items 1 through 15 and change nothing else. You have removed the reasons a system could not read you, but you have not yet given it a reason to choose you over a competitor. That is what the rest of the list is for.
Start with item 11 today: run your domain through the AI crawler checker, fix any blocked bot that should be allowed, and note the date. Then pick one page and run items 22 through 28 against it before touching anything else.