The Complete AI Visibility Audit: 280 Checks Across 18 Layers (With Free Template)

There is no single universal AI ranking factor. OpenAI, Google, Anthropic, Perplexity, and Microsoft each expose a different slice of how their systems find, evaluate, and cite a source, and none of them publish a complete formula. What their public documentation does reveal, taken together, translates into a practical set of checks spanning access, retrieval, structure, entity clarity, authority, and machine-agent readiness. This guide walks through all 18 of those layers and includes a free 280-check workbook built to score every one of them.

Get the free 280-check template

The kit built for this guide is a six-tab Excel workbook plus a designed PDF edition of the same checklist. The workbook has a Start Here guide, a single Audit Checklist tab holding all 280 checks grouped by layer, an auto-calculating Scorecard that scores every layer and rolls up one overall percentage, a Citation Research tab, a 90-Day Plan, and a Notes tab. Each check gets a Done, In Progress, or N/A status and space for the evidence or URL you verified. Fourteen of the eighteen layers are core and apply to essentially any business. Three cover emerging agent infrastructure, MCP, WebMCP, and agent security, that matters most for API-driven or developer-facing products. One covers agentic commerce specifically for teams selling through an agent-accessible checkout. Enter your email below and we’ll send the workbook and the PDF straight to your inbox, then work through the sections in order and let the Scorecard tell you where to focus first.

Foundation: technical, crawler access, and architecture

Nothing else in this audit matters if a page returns a soft 404, sits behind a JavaScript wall a crawler cannot render, or gets caught in a redirect chain. The technical foundation layer checks status codes, canonical tags, sitemap accuracy, and Core Web Vitals regressions, the same fundamentals classic SEO has always required, because Google's own generative AI guidance confirms that pages still need to be indexed and eligible for normal Search results before any AI feature can use them.

Crawler access deserves its own separate layer because the crawlers themselves are not interchangeable. OpenAI's publisher documentation explicitly distinguishes OAI-SearchBot, which helps ChatGPT discover and cite content, from GPTBot, which serves a different purpose entirely. A single wildcard disallow rule that lumps every bot together, or a CDN and WAF configuration that challenges a legitimate AI crawler as if it were abusive traffic, can quietly remove a site from consideration with no error message to flag it. Review Google, Anthropic, and Perplexity crawler access the same way, deliberately rather than by default, and recheck the policy after any CDN, WAF, or migration change.

Information architecture is the third foundation layer, and it is the one most often skipped because it feels like a design decision rather than an AI visibility one. A retrieval system can only place a page correctly within your topic structure if that structure is coherent: parent and child topics connected, breadcrumbs reflecting the real hierarchy, and important pages reachable within a reasonable click depth rather than buried three navigation layers down or hidden behind site search.

Content: structure, quality, and topical authority

Content structure is about extractability: one clear H1 per page, direct answers before long explanations, definitions that are easy to locate, and comparisons presented as tables rather than paragraphs when a table is genuinely what the reader needs. Google and Bing both point to clear, structured presentation as part of what makes a page useful to their generative features, and a fact buried under three paragraphs of marketing introduction is a fact an AI system is less likely to surface correctly.

Content quality runs alongside structure and asks a harder question: is there anything here worth citing at all? Unique, non-commodity information, visible first-hand experience, statistics with dates and sources attached, and case studies with concrete outcomes all separate a page that gets cited from one that gets ignored. We go deeper on the mechanics of building that kind of content in our GEO explainer, where adding sourced statistics alone measured a real lift in citation rate.

Topical authority turns one strong page into a trusted source for an entire category. A single well-written article rarely earns repeat citations in isolation. It is the surrounding cluster, supporting pages that link back to a clear pillar, consistent terminology across the group, and adjacent questions answered before and after the main one, that convinces a retrieval system the site actually knows the subject.

Machine understanding: entities and structured data

Entity optimization is about making sure a machine can tell who you are without guessing. Organization name consistency, sameAs references pointing to authoritative external profiles, and explicit relationships between the company, its products, its people, and its categories all reduce the ambiguity a retrieval system has to resolve on its own. Google's Organization structured-data guidance supports this kind of entity clarity directly, though it is worth being precise about what that buys you: it is a disambiguation signal, not a guaranteed generative-AI ranking factor.

Structured data and semantic HTML give that entity information a machine-readable form. Organization, WebPage, BreadcrumbList, Article, Product, and Person markup all matter individually, but the layer that gets missed most is validation after change: schema that once matched the page can silently drift out of sync after a template update, and contradictory markup is arguably worse than no markup, since it hands a retrieval system two conflicting answers about the same page.

Brand, video, and visual presence

Brand and digital identity checks whether your name, tagline, founding details, and product naming stay consistent everywhere a system might look, your site, your review profiles, your social accounts, and any directory listing that has ever mentioned you. An AI system builds its answer about your brand from all of these sources at once, so a stale description on one platform can quietly contradict the accurate, current one sitting on your own homepage.

Video and image visibility are the layers most sites treat as an afterthought, yet Google specifically recommends supporting textual content with high-quality video and maintaining its structured data. An accurate transcript is frequently the only way a crawler ever reads what was actually said on camera, and a chart with no accessible text summary hands a crawler a picture it cannot interpret, meaning the data inside it is functionally invisible.

Agent-ready infrastructure (emerging)

Machine-readable delivery, MCP and WebMCP tooling, and agent identity and security make up the three emerging layers of this audit, and they matter most for API-driven and developer-facing products rather than every site equally. Google has been explicit that no special AI-only file is required to appear in AI Overviews or AI Mode, so treat an llms.txt file or Markdown delivery as an interoperability convenience layered on top of the fundamentals, not a shortcut around them.

Where agents genuinely need direct access to business data or actions, MCP and WebMCP tools should have clear names, deterministic schemas, and separated read-only versus write-capable permissions. As agents move from reading a site to acting on it, security gaps that were once minor, trusting a user-agent string, skipping input validation on a tool call, become a real attack surface rather than a theoretical one. Prompt injection from untrusted third-party content, including reviews and comments, deserves the same scrutiny you would give any other untrusted input.

Businesses selling through an agent-accessible checkout have a fifteenth layer worth evaluating on its own: agentic commerce readiness. Consistent product data, machine-readable catalog feeds, and clear shipping and returns policies matter regardless of whether an agent ever completes the purchase. Standards like the Universal Commerce Protocol are worth mapping against actual workflows before implementation, and payment credentials should never be exposed to an agent beyond what its provider's security model requires.

Authority, off-site evidence, and AI citation sources

Authority and off-site evidence extend past your own domain into everywhere else your brand gets described: review sites, industry publications, community forums, and Reddit threads that influence how customers decide. Perplexity's source-review system labels domains by characteristics like authorship and correction practices, which makes the accuracy of that off-site footprint, beyond its raw size, the thing genuinely worth auditing. Community platforms shape more of that footprint than most teams assume, a topic we cover in more depth in our Reddit monitoring guide.

AI citation source optimization is the layer that turns everything above into evidence instead of theory. Build a prompt set covering brand, category, comparison, and use-case queries, run it consistently across ChatGPT Search, Google's AI features, Claude, Perplexity, and Bing, and record which specific URLs get cited, beyond simply whether your brand gets mentioned. Classify those cited domains by type, first-party, editorial, review, or community, and audit what the winning pages actually do: do they answer one sub-question directly, cite evidence rather than generic claims, and carry a visible author and update date. Whatever pattern shows up repeatedly is worth replicating on your own underperforming pages.

Measurement and continuous monitoring

A Technical audit for AI Optimization run once and never revisited tells you where you stood on the day you checked, not where you stand now. Track brand mention rate, recommendation rate, and competitor visibility across the same fixed prompt set every cycle, and log citation context alongside citation count, since being cited favorably and being cited as a cautionary example are very different outcomes that a simple tally misses. AI visibility tracking automates this specific piece, since running the same 20 to 30 prompts by hand across five engines every month is a real time cost most teams cannot sustain indefinitely.

Google Search Console now exposes dedicated generative AI performance reporting, and Bing Webmaster Tools' AI Performance panel shows actual cited URLs inside Microsoft's Copilot and AI-generated experiences. Both are stronger first-party inputs than any third-party GEO score, and checking them after a content, technical, or authority change is the fastest way to see whether that change actually moved the needle.

Scoring your audit

The template scores each of the 18 pillars independently, marks N/A items out of the denominator so an irrelevant emerging or commerce check does not drag down a section that genuinely does not apply, and rolls everything into one overall percentage. Ninety to one hundred percent indicates a strong readiness foundation. Seventy-five to eighty-nine percent is a good foundation with meaningful gaps still worth closing. Fifty to seventy-four percent is a real visibility risk, and the fix should start with core discoverability and content quality before anything else. Below fifty percent, the honest move is foundation work first, since advanced agent tooling built on top of a shaky base will not move the needle.

One caveat matters more than any single check on this list: do not use the total score as a claim about your probability of being cited by a specific AI system. Treat it as a readiness score that exposes gaps, then measure actual citation performance separately with the repeatable prompt set described above. Agencies running this audit across several client sites benefit from consistent reporting frameworks here too, since a standardized scoring interpretation makes it far easier to show a client real before-and-after progress.

Common mistakes

• Treating every AI crawler as interchangeable. OAI-SearchBot, GPTBot, ClaudeBot, and PerplexityBot serve different purposes, and a single blanket rule in robots.txt often blocks one without anyone noticing.
• Chasing emerging agent standards before the foundation is solid. MCP tooling and llms.txt files add little on top of a site with broken canonical tags or missing schema.
• Auditing only your own domain. Perplexity and other systems weigh off-site accuracy heavily, and an outdated third-party listing can contradict the correct facts sitting on your own homepage.
• Reading the total score as a citation guarantee. A high readiness percentage means the foundation is solid, not that any specific engine will cite you for any specific query.
• Running this audit once and calling it finished. Crawler policies, schema standards, and citation behavior all shift quickly enough that a two-quarter-old audit rarely still reflects reality.

Frequently asked questions

AI visibility is bigger than traditional SEO, and most sites have not caught up to what these 18 layers actually require. Download the template, work through the core sections this week, and use the section-level scores to prioritize whichever gap is costing the most visibility first.