AI Visibility Checklist
68 checks that decide whether an answer engine can reach, read and attribute your pages, 14 of them critical. Every one is measurable from your published HTML, so you can work through the whole list without any tool.
Run the items on your own site
What this list cannot cover. Every item here is about your own pages. None of it tells you whether an engine actually mentions your brand, whether it means you rather than a company with a similar name, who it recommends instead, or whether what it says about you is true. Those need real questions put to real engines: a different measurement, not a longer checklist.
What you will see
- 68 items, 14 of them marked critical
- Six headings: technical foundation, structure an engine can read, discovery, credibility, AI crawler access and agent readiness
- A one-sentence action for every item
- Why each item matters
- Optional items marked apart: skipping them is not a defect
- A downloadable plain-text copy to share with your team
How to use it
Scan your site first
Type your domain in the box above. The scan runs this list's items on your site and shows which of them fail.
Start with the critical items
Items marked critical are problems that directly stop an engine from reaching or reading your page. Close those first.
Fix and scan again
Once the change is live, run the scan again. It is measured against the same items, so the two results compare directly.
Technical foundation
9 checksWrite a title of roughly 50–60 characters that names the thing and its category.critical
It is the strongest single label an engine has for the page. Past ~60 characters the end gets truncated, and the end is usually the part that distinguishes you.
Bring the server's first response under a second with caching or a faster host.optional
Slow first responses are fetched less often and abandoned more by crawlers. This is one request from our server, not field data.
Send Cache-Control with an ETag or Last-Modified validator.optional
Repeat fetches become cheap for your server and for crawlers, which re-read pages they can validate cheaply.
Send a Strict-Transport-Security header.optional
Browsers and clients then always use HTTPS for your site; a basic security and trust signal.
Write one meta description of 120–158 characters that summarises the page.
Answer engines frequently lift it verbatim as the page summary. Two descriptions means you do not control which is used.
Put exactly one H1 in the HTML the server sends, naming the page's subject. A page that draws its heading with JavaScript needs a server-rendered H1 or one inside <noscript>.critical
Several competing top-level headings make the page's subject ambiguous to anything building an outline. The check reads the raw HTML, as AI crawlers and Bing's site scan do: a heading that appears only after JavaScript runs is not there for them.
Add <meta name="viewport" content="width=device-width, initial-scale=1">.critical
Without it the page lays out to a fixed width, and mobile usability is a ranking input.
Serve over HTTPS and load every sub-resource over HTTPS too.critical
Browsers block mixed active content outright, so those resources may not be loading at all — and several AI crawlers skip insecure origins.
Keep redirects to at most one hop.
Crawlers spend a fixed budget per URL and some abandon long chains before reaching the page.
Structure an engine can read
8 checksAdd width and height attributes to every image.optional
The browser reserves the space before the image loads, so the page does not jump.
Publish schema.org JSON-LD describing what the page is and who publishes it.critical
It ties the page to an entity and drives rich results and knowledge-graph linkage. What it does NOT reliably do is lift citations by itself — a matched difference-in-differences study of 1,885 pages that added JSON-LD (Ahrefs, Aug 2025–Mar 2026) found no uplift, and a small decline in AI Overviews. That study only covered pages already being cited, so it says nothing about a page with no visibility. Malformed JSON is worse than none — it looks handled and reads as nothing.
Nest headings without skipping levels — H2 then H3, never H2 then H4.
Engines quote passages, and the heading outline is how they decide where a passage starts and ends.
Give every image that carries information alt text that describes it; mark decorative ones with an empty alt="".
Alt text is the only part of an image an answer engine can read.
If Bing matters to you, give images marked alt="" a short description of what they show.optional
Bing Webmaster Tools' site scan reports an empty alt as a missing one. alt="" is valid HTML for a decorative image, so this is a Bing preference and not a defect: it is shown with the images it applies to and never lowers the score.
Add license and acquireLicensePage to every ImageObject, both pointing at a page that states your image terms.optional
Search Console's image metadata report warns on ImageObject markup without them, and together they make an image eligible for the Licensable badge in Google Images. An image search feature, not an AI visibility one: it never lowers the score.
Wrap content in <main>, <article>, <header>, <footer> and similar.optional
It lets a parser separate the body from navigation and boilerplate, so quoting picks up your content and not your menu.
Remove the theme's demo content: lorem ipsum, links to the theme vendor's demo site, and the demo's address, phone and email.
An engine reads every page as the company describing itself, so a demo address or a placeholder paragraph becomes a claim about you.
Credibility signals
8 checksLink the privacy notice (KVKK) and the terms from every page, usually in the footer.
A basic trust signal for readers and engines; in Turkey the KVKK notice is also a legal duty.
Name who wrote the page, in schema.org author or a visible byline.
Anonymous content is weighted down by engines trying to assess expertise, and a name is the cheapest credibility signal there is.
Publish datePublished and dateModified.
An undated page reads as unknown age, and engines discount what they cannot date — especially where currency matters.
Add an Organization node with name, url, logo and sameAs.
This is what connects the page to an entity an engine already knows, instead of leaving it an unattributed document.
Link a contact or about page from every page.
No visible way to reach anyone is a long-standing low-trust signal for readers and engines alike.
Put a real phone number, with its country code, in every tel: link and a real address in every mailto: link.optional
A contact link that dials or mails nothing looks like a way to reach you and is not one.
Cite your sources in the sentence — "according to X" with the link.
A page that cites nothing asserts everything on its own authority. Engines assembling an answer prefer pages that show their working.
Give the page enough substance to answer something — a few hundred words at minimum.
Engines quote passages, and a thin page offers none. This is usually the single biggest reason a page is never cited.
Discovery and presentation
7 checksAdd one self-referential canonical URL.
Without it, trailing slashes, query strings and http/https variants each look like a separate page competing with itself.
Set a lang attribute on <html>.
It tells engines and screen readers which language to expect, and it is what makes a multilingual site resolve into separate versions rather than one confused one.
Fill in og:title, og:description, og:image and og:type.
A shared link without them renders as a bare URL, and several answer engines fall back to Open Graph for the page summary.
Add <meta name="twitter:card">.optional
One line. Most platforms fall back to Open Graph, so this is polish rather than a requirement.
Declare a favicon with <link rel="icon">.optional
It is what makes your tab findable among twenty others, and it appears beside your result in several AI answer interfaces.
Compare the addresses Search Console lists as not found or blocked with your sitemap, and 301-redirect each old address to its closest live page, or answer 410 Gone when it has no successor.optional
A previous site leaves addresses that Search Console keeps crawling for months. A 404 there throws away whatever links pointed at the old page; a 301 passes them on, and a 410 tells Google to stop asking. Measured only when a page-indexing export has been imported, and it never lowers the score.
Mark up breadcrumbs with BreadcrumbList JSON-LD on pages below the homepage.optional
It tells an engine what this page is a part of, rather than leaving it as an island.
AI crawler access
26 checksAllow OAI-SearchBot in robots.txt.critical
This is the crawler behind ChatGPT search results specifically — separate from GPTBot.
Allow PerplexityBot in robots.txt.critical
Blocked, the page cannot be cited by Perplexity.
Allow Googlebot in robots.txt.critical
AI Overviews are built on the Search index, so blocking Googlebot removes you from both at once. This is not the same as Google-Extended.
Allow Bingbot in robots.txt.
Bing backs Microsoft Copilot, and ChatGPT search leans on it too.
Allow Claude-SearchBot in robots.txt.critical
This is the crawler behind Claude's search answers — separate from ClaudeBot, which is training-only.
Allow ChatGPT-User in robots.txt.
It fetches a page when a ChatGPT user asks for it. OpenAI documents that it may not honour robots.txt, so the rule states intent rather than enforcing it.
Allow Claude-User in robots.txt.
It fetches a page when a Claude user asks for it; Anthropic states it honours robots.txt.
Allow Perplexity-User in robots.txt.
It fetches a page when a Perplexity user asks for it. Perplexity documents it as an agent that may ignore robots.txt, so the rule states intent rather than enforcing it.
Decide deliberately whether to allow GPTBot for training.optional
GPTBot feeds OpenAI's training corpus only. Blocking it does not affect ChatGPT search (OAI-SearchBot) or user-requested fetches (ChatGPT-User), which are checked separately. Informational: it never lowers the score.
Decide deliberately whether to allow ClaudeBot for training.optional
ClaudeBot feeds Anthropic's training corpus only. Claude's search answers (Claude-SearchBot) and user-requested fetches (Claude-User) are checked separately. Informational: it never lowers the score.
Decide deliberately whether to allow Google-Extended.optional
It governs Gemini and Vertex training only. AI Overviews and AI Mode run on the Search index, which Googlebot gates. Informational: it never lowers the score.
Decide deliberately whether to allow CCBot.optional
Common Crawl is a training corpus many models build on. Blocking it is a policy position about training data, not a search visibility failure. Informational: it never lowers the score.
Optionally publish /llms.txt; never expect Google to read it.optional
Google states it does not use llms.txt, and no public evidence shows the file changes citations on any engine. Its absence is not a finding. What is a finding: an HTML shell served at that path, which looks answered and is not.
Publish a valid XML sitemap and check the body, not just the status code.
A single-page app answers 200 for every path, so a sitemap that 'exists' may be your homepage HTML at a different URL — which looks fine to a status check and like nothing to a crawler.
Add a Sitemap: line to robots.txt.
It is the first place every crawler looks.
Use question-form headings, FAQ blocks and structured lists.
Answer engines lift self-contained passages. Prose with no seams gives them nothing to lift.
Put measurable facts — numbers with units — into the visible text of key pages.
Extractability: a lifted passage carries weight when it carries facts. The GEO founding study measured +32–40% citation lift for statistics; a page whose visible text holds none gives an engine nothing checkable to quote.
Open sections and paragraphs by naming their subject, not with 'this/it/also'.
Extractability: engines lift passages out of context. A paragraph opening with a pronoun loses its subject the moment it is quoted alone.
Add sameAs links to authoritative profiles, and about/mentions for the entities you cover.
This is what ties the page to a known entity instead of a string — and names collide more often than people expect.
Declare your own domain's logo FIRST in Organization markup, before any other.critical
Consumers read logos in document order, so a sibling brand's logo listed first becomes your brand's mark everywhere — and nothing errors, because a logo that loads looks like a logo that is right.
Serve the main content in the initial HTML — server-side rendering or prerendering.critical
Measured at scale: GPTBot, ClaudeBot and PerplexityBot do not execute JavaScript. Content rendered client-side is invisible to them; only Google's surfaces render. A SPA can pass every other check on its empty shell.
Render the page's real, visible content in the initial HTML, server-side or at build time, rather than a visually hidden copy that JavaScript replaces.
AI crawlers do not run JavaScript, so a hidden prerender layer is all they read, while visitors see something else. Text served to crawlers but hidden from visitors is what Google's spam policies call hidden text. Short screen-reader labels and closed menus are fine and are not counted.
Remove nosnippet / max-snippet limits from pages meant to appear in AI answers.critical
Google documents these directives as governing AI Overviews and AI Mode exactly as they govern classic snippets — the directives that actually control AI quoting, unlike noai.
Check the CDN/WAF bot rules if AI bot user agents are refused while browsers pass.critical
Cloudflare blocks AI crawlers by default on newer zones even when robots.txt allows them. The probe is UA-level evidence from one address; IP-verified bots may differ — server logs are the proof.
Know which CDN sits in front of the origin — that is where a silent AI block would live.optional
Being behind a CDN is not a defect; the finding is the layer's name, because its bot settings decide AI access before robots.txt is ever read.
Check the meta robots tag and the X-Robots-Tag header for noindex or noai.critical
A header-level directive overrides robots.txt and is easy to set once during a staging deploy and forget.
Agent readiness (optional)
10 checksSend a Link header such as </sitemap.xml>; rel="sitemap".optional
Lets an agent find canonical resources without parsing HTML.
Consider a Content-Signal directive in robots.txt.optional
It lets you say yes to AI search while saying no to training, instead of the all-or-nothing choice a Disallow forces.
Publish an MCP server card (/.well-known/mcp/server-card.json, or the older /.well-known/mcp.json) only if the site actually runs an MCP server.optional
An invented descriptor is worse than none — it advertises capabilities that do not exist.
Publish /.well-known/agent-card.json only if the site hosts an A2A-compatible agent.optional
Same rule: describe what is there, not what you would like to be there.
Publish /.well-known/api-catalog only if the site exposes APIs.optional
Lets agents discover endpoints without scraping documentation.
Serve a Markdown version of a page when a request sends Accept: text/markdown, only where the page has a clean Markdown source.optional
Cloudflare measured an agent answering from its Markdown-serving docs with 31% fewer tokens and 66% faster. That is cheaper use by agents; it is not shown to make a page more likely to be cited.
Publish /.well-known/agent-skills/index.json only if you maintain skills an agent can load for your site.optional
It points an agent at task instructions written for your site. An index of skills that do not exist sends agents to nothing.
Publish /.well-known/http-message-signatures-directory only if the site operates a bot or agent that signs its requests (Web Bot Auth).optional
It holds the public keys other sites use to verify your bot. A site that only receives visits has nothing to publish here.
Publish /.well-known/oauth-authorization-server (RFC 8414) only if the site issues OAuth tokens for an API.optional
It tells an agent where and how to obtain a token, without reading documentation. Without an OAuth server there is nothing to describe.
Publish /.well-known/oauth-protected-resource (RFC 9728) only if the site has an API protected by OAuth.optional
It tells an agent which authorization server guards the API, so it can ask for the right token. A site without such an API has nothing to declare.
Guide
How to use this list
The list is every check the free readiness scan runs. Both are built from the same source, so an item added to the scan appears here too. The items fall under six headings, each after one question: is the page built properly, can an engine work out what the page is about, how does the page introduce itself to search systems, what does a reader trust, can AI bots get in, and are the new standards for autonomous agents published.
Critical items are problems that cut access or reading outright: a search bot blocked in robots.txt, content that only arrives through JavaScript, directives that restrict quoting in AI Overviews. Optional items need a deliberate decision or are not yet widespread, such as whether to admit training bots. The items about training bots are for information only and never lower the score.
Once you have worked through the list, scan again after every significant release. Readiness is not set up once and forgotten: a CDN setting, a new theme or a plugin update can quietly break an item that used to pass.
Structured data: what it does, and what it does not
Structured data (schema.org markup, usually as JSON-LD) says what a page is in a form machines can read: an organisation, a product or an article; who published it, which logo is theirs, which outside profiles belong to the same organisation.
It is worth knowing what it does not do. Google states plainly that no special schema.org markup is needed to appear in AI features. Structured data is not a guarantee of citation; it is housekeeping that makes your identity clear. For brands that risk being confused with another company of the same name that clarity matters: Organization markup, a logo on your own domain and sameAs links do that job.
A technical note: markup often arrives inside an @graph container, and the root object has no type of its own. That is valid, and most SEO plugins produce it that way. Our scan reads the markup inside the container; a checker that only looks at the root can wrongly call it broken.
Sitemap and robots.txt: a status code is not enough
A sitemap tells bots which pages exist, and the Sitemap line in robots.txt tells them where the sitemap is. Both look simple and both can break quietly.
The most common problem we see is a status code that does not tell the truth. Single-page apps answer 200 even for addresses that do not exist, so sitemap.xml may actually be serving your home page's HTML. A status check passes it; a bot finds no pages there. That is why our scan reads the file's contents, not its status code.
To check for yourself, open your sitemap's address in a browser: you should see XML, not your site's design. The same goes for robots.txt and llms.txt.
Credibility signals: who, when, and on what basis
These items are the signals a reader looks at when deciding whether to believe a page: who wrote it, when it was published and updated, what its claims rest on and how to reach the publisher. How much an answer engine weighs them is not publicly documented, so in the list they are of medium importance, not critical.
In practice: show the author's name and the date on articles and include them in the structured data, publish an about page and a contact page, and link sentences that carry a figure or a claim to their source. These do the same job for a human reader; they are not separate work for AI.
llms.txt: where it stands
llms.txt is a file format Jeremy Howard proposed in September 2024: a plain-text file at the site root that summarises the site's most important pages for language models. It is a proposal, not a standard.
The evidence today is thin. Google writes that you do not need to create new machine-readable files or AI text files to appear in its AI features. Nor do we know of public evidence that the file changes citations on any engine.
So it sits in the list as an optional item, and its absence does not lower your score. The real finding is elsewhere: when an HTML page is served at the llms.txt address (common in single-page apps) the file looks present and is not. We publish an llms.txt on our own site too; we treat it as a cheap summary, not as a promise of visibility.
Frequently asked questions
Is the list free? Do you want my email?
It is free and we do not ask for an email. The whole list is open on this page, and the downloadable copy carries the same content.
Do I have to do every item?
No. Start with the critical items. Optional items are decisions to make deliberately for your site; the agent standards, for instance, only make sense if the site really offers an API or an agent.
Is the list the same as the free scan?
The same items. The list says what to do; the scan runs the items on your site and shows which fail. The item count on this page is read from the scan's own list, so when one changes the other does too.
I have done every item. Will engines name me now?
The list is only about your own pages and does not say whether an engine names you. That needs a measurement in which real questions are put to real engines.
When does the list change?
When a check is added to the scan or the reason behind a check changes. The item count on this page is always the scan's current count.
Ready is not the same as named. Do the engines name you?
The free tools tell you whether your site is ready for AI engines. Whether the engines actually name you, who they recommend instead and whether what they say about you is true, we measure by putting real questions to real engines. That is the paid measurement, and we scope it with you.
Sources
Public documents behind the outside claims on this page. Sentences about how the scan works are read from its code and from the reasons given in the checklist.