Blog · Diagnosis

A self-audit checklist for AI visibility

Published 9 March 2026 · Updated 8 October 2026 · 9 min read

A self-audit checklist for AI visibility
Photograph: Isaac Davis / unsplash

The short answer: Work in three passes and do not skip ahead. Pass one is access: can each engine's named user agent fetch and read your pages. Pass two is identity: does your company resolve to one entity across your own site and the places that describe you. Pass three is the sentence: when an engine does name you, is the claim next to your name true. Most teams start at pass three and spend a quarter fixing nothing.

The order is the whole trick. An access fault makes every downstream measurement meaningless, because a page nobody can fetch cannot be cited no matter how well it is written. Run the passes in sequence and the first failure you hit is usually the only one worth fixing this month.

Pass one: access, and the four checks almost everyone gets wrong

Start in your robots.txt, with a text editor, not a crawler tool.

Check 1. Name the agents individually. Three engines document their agents in enough detail to audit this way, and in each of them the tokens do not share a rule. OpenAI documents four: OAI-SearchBot for the search index behind ChatGPT answers, ChatGPT-User for pages fetched because a user asked, GPTBot for model training, and OAI-AdsBot for ad landing pages. Anthropic documents three on the same pattern, Claude-SearchBot, Claude-User and ClaudeBot. Google splits it differently: its crawler documentation says Google-Extended is a robots.txt token with no user agent string of its own, that it covers Gemini training and grounding, and that it does not affect a site's inclusion in Google Search. Engines that publish no agent documentation cannot be checked this way at all, and this list says nothing about them.

The failure mode that follows is specific. A legal review a year ago said block the AI crawlers, somebody wrote a blanket rule, and the search agent went out with the training agent. OpenAI's crawler documentation states that a site opted out of OAI-SearchBot is kept out of the answers ChatGPT's search features write, while remaining reachable as a navigational link, and that disallowing GPTBot is a separate setting covering training. Those are two different business decisions wearing the same label. We have found the search agent blocked by a rule written for training crawlers more than once in our own audits; we cannot say how often it happens across the web, because we only see the sites that hire us. If your brand is invisible in one engine and fine in another, read why AI never mentions your brand alongside this check, because the asymmetry is the clue.

Check 2. Read past the 500 kibibyte line. Google's robots.txt specification sets a file size limit of 500 kibibytes and says content past it is ignored. That is Google's published limit; the other engines do not publish one, so do not assume the same number elsewhere. Large sites with generated disallow lists can push an Allow rule past that boundary without anyone noticing. Check the byte count, not the line count.

Check 3. Wait before you re-test. Google's documentation says it generally caches robots.txt for up to 24 hours, and may hold a cached copy longer when a refresh fails. OpenAI's crawler documentation gives roughly the same figure for its search systems to pick up a robots.txt change. A fix pushed at 10am and tested at 10:05 tells you nothing. Note the change time and re-test the next day, and for engines that publish no cache window, wait longer rather than concluding anything from a fast re-test.

Check 4. Fetch your own page as a bot and read what comes back. Request your top page with the engine's user agent string and no JavaScript, then read the raw HTML. If the answer you want quoted only exists after hydration, it is not there for the fetcher. Same request, from an IP outside your office: a WAF rule that treats unfamiliar agents as hostile will return a 403 to the engine and a clean page to you. OpenAI publishes a JSON file of IP addresses for each of its agents, linked from its crawler documentation, so your security team can allow the documented ones and keep blocking forgeries. Where an engine publishes no ranges, the user agent string is all you have, and it can be spoofed.

Pass two: identity, and whether you are one company or four

An engine assembles a brand from fragments. Your job in this pass is to remove the contradictions it would otherwise have to pick between.

Check 5. One definition sentence, repeated. Write a single sentence that says what the company is, in the form of a category plus a function, and put the same sentence on the home page, the about page and every profile you control. In our own prompt runs, when the public descriptions of a company disagreed about its category, the answers we got back tended to hedge or to name nobody. We cannot see inside the models, so treat that as a pattern in the transcripts we have collected, not a documented mechanism.

Check 6. Markup that matches the words. Your Organization schema should name the same entity the visible page names, with the same URL. Google's guidance on AI features says a page must be indexed and eligible to be shown in Search with a snippet, and that there is no special schema.org structured data you need to add for those features. That is Google's statement about Google's surfaces; the other engines we checked publish neither a contrary requirement nor a special format of their own. The work here is accuracy rather than a new format.

Check 7. Volatile facts in one place. Pricing, headcount, funding and office location change, and stale copies of them survive on pages you forgot. List every URL you control that states a number about your company. If the list has more than a dozen entries, you have a maintenance problem, not a visibility problem.

Check 8. Check your redirects before, not after. Every URL change is a chance for a citation to break. We have watched cited URLs keep turning up in answers after they stopped resolving, which is an observation from client migrations rather than something the engines document. If a replatform is anywhere in the next two quarters, run the inventory described in migrating a site without losing citations now, while the old URLs still work.

Pass three: the sentence, which is the only output that matters

Now, and only now, start prompting.

Check 9. Write the questions a buyer asks, not the ones you would like to win. Twenty to forty prompts, phrased the way a person types them, with the branded and unbranded versions kept apart. Branded prompts test whether your facts are right. Unbranded prompts test whether you are in the running at all.

Check 10. Run each prompt at least five times. A single run is an anecdote. In our own runs the same question, asked twice ten minutes apart, has returned different sources, and treating one transcript as evidence is how teams end up chasing noise.

Check 11. Record three fields, every time. Were you named. Was the claim true. Which sources did the engine lean on. The third field is the one people skip and the one that tells you where to work, because a competitor's name sitting in a review site you have never updated is a different problem from a competitor's name sitting in their own docs.

Check 12. Run it with retrieval off. Ask the same question without web access. What comes back is what the model holds about you from training, and the gap between the two answers tells you whether your problem is retrieval or memory. The second kind is slower to fix and worth knowing about before you commit a budget.

Check 13. Count citation sources by domain. Tally the domains the engines actually cited across all runs. In the categories we have audited, those tallies have concentrated on a handful of third-party sources, and seeing which ones is more useful than any aggregate score. What an AEO audit should contain goes further into how that tally turns into work.

Check 14. Write the one-line finding before you fix anything. If you cannot state the failure in a sentence with a transcript attached, you have not found it yet. The self-check is a shorter version of this list for an afternoon rather than a fortnight.

Honest limits

It will not tell you revenue. The assistant surfaces we have checked send either no referrer or none we can attribute, so a mention in an answer and a signup an hour later are two facts with no line between them. It will not tell you how durable a fix is: we have watched an access fix appear within a crawl cycle and then watched the same page stop appearing weeks later, and we do not know why, because we can see the answers and not the retrieval system behind them. The behaviours in pass one are taken from what OpenAI, Anthropic and Google publish about their own agents, and we have not tested whether undocumented engines behave the same way. Everything here framed as something we have seen comes from prompt runs and audits for our own clients, which is a sample of the sites that hire us and not a census of the web. Where this post says we cannot see a thing, that is the literal position: absence from our logs and transcripts is not evidence that nothing happened.

Doing it by hand

It will also not scale by hand. Fourteen checks across forty prompts and five engines has taken about a week of one person's attention each time we have worked through it manually, and repeating it monthly is more than most teams will sustain. That is the honest argument for buying the work rather than doing it, and how to buy an AEO audit without being sold a dashboard covers what to demand when you do. Our own audit is the compressed version: about 45 prompts across five engines, retrieval on and off, evidence attached to each finding, and one deliverable, the report.

FAQ

Which check should I run first if I only have an hour? Check 1 and check 4. Open robots.txt, look for a blanket AI rule, then fetch your main page with a bot user agent and see whether the answer text is in the raw HTML. In our own audits those two have surfaced more recoverable loss than the rest of the list.

Do I need a tool for any of this? No. Checks 1 to 8 need curl and a text editor. Checks 9 to 14 need a spreadsheet and the patience to repeat prompts. Tooling becomes worth paying for when the repetition gets expensive, not before.

Should I block AI crawlers to protect my content? It is a business decision, not a technical default. For the engines that document the two agents separately, blocking the search agent removes you from the answers those systems write, while blocking only the training agent leaves you citable. Decide the two separately and write down which one you chose.

How often should the checklist be re-run? Pass one when infrastructure changes, which in practice means after any deploy that touches robots.txt, the CDN or the rendering path. Passes two and three monthly, with the same prompt set, because the comparison is the point.

Sources

Related reading

Why AI never mentions your brandMigrating a site without losing citationsWhat an AEO audit should containHow to buy an AEO audit without being sold a dashboardThe small-site authority problem