How to Conduct an Answer Engine Optimization (AEO) Audit in 2026

Most AEO audit checklists online get the writing half right and thin out elsewhere. Four popular ones, read on 29 September 2026, show it. AirOps' 48-factor list, HubSpot's audit guide and LSEO's 2026 checklist don't mention llms.txt at all. Erlin's checklist does, but it calls GPTBot OpenAI's crawler "for ChatGPT search" and asks you to allow "Claude-Web." OpenAI's crawler docs say GPTBot gathers training data, and Anthropic's bot page lists ClaudeBot, Claude-User and Claude-SearchBot, with no Claude-Web. None of the four looks at how your backlinks spread across your pages.

That last gap matters. In Ahrefs' December 2025 study of 75,000 brands, branded web mentions correlated with ChatGPT visibility at 0.664, well above domain rating at 0.266. Authority still counts in AI search. It shows up as mentions and links around the pages you want quoted.

Below are all 20 points, each with a check, a pass rule, a tool or command, and a link to the Rankbox guide that goes deeper. Then comes a scored AEO audit of Tallyfold, a made-up invoicing app. For software that speeds up each check, see our GEO tools list.

What an AEO Audit Covers, and What to Gather First

A classic SEO audit asks whether Google can crawl, index and rank your pages. An AEO audit asks a narrower question: can an answer engine fetch the page, lift a correct passage out of it, and trust that passage enough to cite it? It's the health check for answer engine optimization.

The two overlap. Google's AI features documentation says a page must be "indexed and eligible to be shown in Google Search with a snippet" to appear in AI Overviews or AI Mode. So an AEO audit keeps the SEO checks that decide eligibility and adds the ones that decide whether you get quoted.

The five inputs to collect

1. A page list: your top 20 URLs, from pricing and product pages to the articles that answer buyer questions.
2. Your robots.txt and 7 to 30 days of access logs from your server or CDN.
3. Access to Google Search Console and Bing Webmaster Tools.
4. At least 30 buyer prompts, written without your brand name.
5. A spreadsheet with one row per point.

Score each point 2 (pass), 1 (partial: it passes for some pages or bots, or only in part) or 0 (fail). Plan a full working day for a first AEO audit of 20 pages. Areas 4 and 5 take longest, because you run prompts by hand and read link reports.

Area 1: Crawl Permissions and Access (Points 1–6)

Access fails in silence. No engine emails you when its crawler gets a 403.

1. Search bots are allowed in robots.txt (gate)

Check: read robots.txt for the five search crawlers that feed answers today. They are OAI-SearchBot for ChatGPT search, Claude-SearchBot for Claude, PerplexityBot for Perplexity, Googlebot for AI Overviews and AI Mode, and Bingbot for Copilot. Watch for User-agent: * with Disallow: /, which catches every bot that has no group of its own.

Pass: all five may fetch every URL on your list. Fail: any one is blocked from a page you want cited. OpenAI says sites that opt out of OAI-SearchBot won't be shown in ChatGPT search answers, apart from navigational links.

Tool: our free robots.txt tester tests each bot against each URL and names the rule that decided.

Go deeper: The AI Crawler Directory lists every documented bot, token and IP list.

2. Training bots are set on purpose

Check: find the rules for GPTBot, ClaudeBot, Google-Extended, Applebot-Extended and CCBot. These gather training data or govern model use; they aren't the search crawlers from point 1. OpenAI says disallowing GPTBot signals your content "should not be used in training." It doesn't take you out of ChatGPT search.

Pass: each rule matches a written decision that someone owns. Fail: rules nobody can explain, or a search bot blocked by accident while aiming at a training bot.

Tool: our AI crawler robots.txt generator groups bots by job.

Go deeper: The AI Bot Crawler Census shows how publishers split training rules from search rules.

3. The firewall lets verified AI bots through (gate)

Check: robots.txt can say yes while your CDN says no. Count the error codes AI bots got in the last 7 days, including the live fetchers ChatGPT-User, Claude-User and Perplexity-User. From 15 September 2026, Cloudflare blocks agent bots by default on ad-carrying pages of new domains, and it names ChatGPT-User as an agent.

Pass: zero 403, 429 or challenge responses to verified AI bots on public pages. Fail: any such response on a page you want cited.

Command: this assumes the common combined log format, where field 9 is the status code.

grep -E "OAI-SearchBot|ChatGPT-User|Claude-SearchBot|Claude-User|PerplexityBot|Perplexity-User" access.log \
  | awk '$9 >= 400 {print $9}' | sort | uniq -c

On Cloudflare, AI Crawl Control is available on all plans and shows which AI services reach your content.

Go deeper: The Cloudflare Challenge Trap covers the settings that block AI fetchers and the rules that let them in.

4. Logs prove each engine visits, from its own IPs

Check: confirm each engine's search crawler fetched pages in the last 30 days. An engine missing for that long usually means a block you haven't found. Then test a sample of IP addresses against the vendors' published lists, because a user-agent string is easy to fake.

Pass: OAI-SearchBot, Claude-SearchBot and PerplexityBot each appear, and the sampled IPs match. Fail: none of the three has a verified hit in 30 days.

Command: replace the IP with one from your logs.

IP=216.73.216.5
for list in openai.com/searchbot.json openai.com/chatgpt-user.json \
  claude.com/crawling/bots.json www.perplexity.com/perplexitybot.json \
  www.perplexity.com/perplexity-user.json; do
  curl -sL "https://$list" | python3 -c "
import sys, json, ipaddress
ip = ipaddress.ip_address('$IP')
nets = [p.get('ipv4Prefix') or p.get('ipv6Prefix') for p in json.load(sys.stdin)['prefixes']]
print('$list', 'MATCH' if any(ip in ipaddress.ip_network(n) for n in nets) else '-')"
done

Tool: our free AI crawler log analyzer counts hits per bot inside your browser.

Go deeper: How to Track GPTBot and ClaudeBot sets up a weekly log routine.

5. The answer is in the raw HTML

Check: fetch each page without a browser and look for its key sentence, price or table. When Vercel studied crawler traffic, it found that "none of the major AI crawlers currently render JavaScript," OpenAI's and Anthropic's included. Bing's webmaster guidelines add that content which "cannot be reliably rendered may not be indexed or selected for grounding results."

Pass: the answer sentence on each page shows up in the raw HTML. Fail: prices, tables or FAQs appear only after JavaScript runs.

Command: curl -sL https://tallyfold.example/pricing | grep -c "per user a month". A result of 0 means the phrase isn't in the HTML.

Tool: our AI search readiness check fetches a page without JavaScript and counts the words it can see.

Go deeper: How to Optimize Your Website for ChatGPT and Perplexity.

6. Pages are indexed and allowed into AI answers (gate)

Check: inspect each URL in Search Console and Bing Webmaster Tools, then look for directives that shut AI features out. Google lists noindex, nosnippet, data-nosnippet and max-snippet as controls that limit its AI features, and Bing says noarchive "prevents content from being used in Copilot responses." Last, open Settings in Search Console and confirm the Search generative AI control reads Include.

Pass: all 20 pages are indexed in both engines, carry none of those directives, and the control says Include. Fail: any one of the three.

Command: curl -sIL URL | grep -i x-robots-tag shows header directives, and curl -sL URL | grep -o -i '<meta name="robots"[^>]*>' shows the meta tag.

Go deeper: Bing Webmaster Tools Is the New Google Search Console.

Area 2: Machine-Readable Structured Summaries (Points 7–10)

This area checks the summaries machines read alongside your prose: llms.txt, your entity graph in JSON-LD, and each page's head tags. Keep the stakes in view. Google's AI optimization guide says "structured data isn't required for generative AI search." These points help engines and agents understand you. They don't buy a citation on their own.

7. llms.txt exists and follows the spec

Check: the llms.txt proposal puts a Markdown file at /llms.txt. Its only required part is an H1 with the site's name. After that come a blockquote summary and H2 sections that list links as [name](url): notes. Serve it as plain text, and make sure every link works.

Pass: a 200 response in plain text, one H1 on the first line, a summary, spec-style links and no broken links. Fail: an HTML page at that path, bare URLs, several H1s, or robots.txt rules pasted in.

Command: this prints the status and counts each part of the file.

SITE=https://tallyfold.example
curl -sL -o /dev/null -w "status %{http_code}, type %{content_type}\n" "$SITE/llms.txt"
curl -sL "$SITE/llms.txt" | python3 -c "
import re, sys
lines = sys.stdin.read().splitlines()
text = [l for l in lines if l.strip()]
links = [l for l in lines if re.match(r'^\s*- \[[^\]]+\]\([^)]+\)(: .*)?$', l)]
print('H1 first:', bool(text) and text[0].startswith('# '), '| H1s:', sum(l.startswith('# ') for l in lines))
print('Summary:', any(l.startswith('> ') for l in lines), '| H2s:', sum(l.startswith('## ') for l in lines))
print('Spec links:', len(links), '| bare URLs:', sum(bool(re.match(r'^\s*-\s+https?://', l)) for l in lines))"

Weight: fix it last in this area. Google's guide says such files "will neither harm nor help" in Search, which ignores them. The file serves agents and tools that choose to read it.

Tool: our llms.txt generator writes a file in the spec's format.

Go deeper: The llms.txt Standard, Explained Line by Line.

8. Your organization is one complete entity node

Check: view the JSON-LD on your homepage or about page. Google recommends placing Organization markup on one of those two pages, and says it has no required properties, so completeness is up to you. Look for a stable @id, name, url, logo, a one-line description and a sameAs list with every official profile.

Pass: one Organization node with those fields, and every sameAs profile links back to your site. Fail: no node, two nodes that disagree, or sameAs links to profiles you don't control.

Tool: our schema generator writes the node, and the Schema Markup Validator parses the markup so you can read each node and its properties.

Go deeper: Building a Knowledge Graph for AI.

9. Page markup links to that node and matches the page

Check: on each key page, the Article, Product or SoftwareApplication node should point to your organization's @id as its publisher, brand or provider, instead of repeating a loose copy. Then compare every price, date and name in the markup with the visible text. Bing's guidelines say markup "must accurately reflect visible content," and that misleading markup "may be ignored."

Pass: markup parses on every key page, references the same @id, and has zero mismatches with the text. Fail: parse errors, orphan copies of your organization, or a single price that differs.

Go deeper: SEO Knowledge Graph for connecting nodes, and Hallucination by Omission for price markup.

10. Every key page has a clear summary layer

Check: each page needs a title, a meta description, one H1 and a canonical that points to itself. They tell any parser what the page is. Bing warns that duplicate URLs "reduce Bing's confidence in selecting a URL for grounding results or citations."

Pass: every page on your list has a unique title, a 120–160-character description, one H1 and a self-referencing canonical. Fail: any tag missing or copied from another page.

Tool: the AI search readiness check grades all four in one run, along with bot access, llms.txt presence and JSON-LD.

Go deeper: How to Optimize Content for LLMs.

Area 3: Citation Readiness (Points 11–14)

A reachable, well-labeled page still has to hold something worth quoting, and this is where most AEO work happens. The research paper that named GEO reported that content changes "can boost visibility by up to 40%" in generative engine answers, and adding quotes, statistics and cited sources ranked among the strongest methods it tested.

11. Sections open with the answer

Check: sample 10 sections across your key pages and read only the first sentence under each heading. Does it answer the heading on its own?

Pass: 8 or more of the 10 do. Fail: 5 or fewer.

Tool: our AI citation readiness checker scores answer-first openings, sentence length and question-style headings.

Go deeper: How to Optimize Content for AI Search, which walks through the Lift Test.

12. Claims carry numbers and named sources

Check: on each key page, mark every statistic, price and claim about another company. Each one should name its source and link to it.

Pass: every such claim is sourced, and each section holds at least one concrete number, date or named source. Fail: unsourced figures across most key pages, or sections made only of adjectives.

Tool: the same checker flags pages short on numbers and named sources.

Go deeper: How to Write Blog Posts for AI Citation.

13. Fact pages show honest dates

Check: look for a visible "Updated" date on pricing, docs and comparison pages, and compare it with dateModified in the markup. Ahrefs' study of 17 million citations found AI assistants cited content 25.7% fresher than Google's organic results, on average. But a date that changes on every deploy tells engines nothing true.

Pass: each fact page shows a date that matches its markup, changed only when the content did, within the last 12 months. Fail: no date, or dates that update on every build.

Go deeper: the freshness section of our guide to optimizing for ChatGPT and Perplexity.

14. An official page exists for each fact buyers check

Check: list the facts buyers ask engines to confirm: price, plans, features, integrations, how you compare with rivals, security and company details. Each one needs a single official URL that states it in plain text.

Pass: every fact has a page, and the page answers in text, not only in an image or a PDF. Fail: pricing or core product facts have no page, which leaves engines to borrow someone else's version.

Go deeper: Hallucination by Omission for pricing, and The Comparison Page Formula for rival comparisons.

Area 4: Prompt Coverage Gaps (Points 15–17)

The first three areas grade pages you have. This one finds the pages you lack, which makes it the part of an AEO audit that turns into a content plan.

15. Buyer prompts map to pages

Check: write 30 or more prompts that buyers would type, without your brand name. Mix problems, "best X for Y" questions, comparisons and alternatives. Map each prompt to the one URL that should win it, or mark it as a gap.

Pass: at least 80% of prompts have a matching page, and every gap has a planned page. Fail: under 60% mapped, or no prompt list at all.

Tool: our free AI Visibility Prompt Kit writes 30 prompts across the buying journey, and the AI question generator finds more.

Go deeper: How to See If AI Mentions Your Brand.

16. A baseline exists, run more than once

Check: run every prompt at least twice in each of three engines, from a clean session, and log whether you were named and whether you were cited. When SparkToro studied 2,961 runs, it found less than a 1-in-100 chance that ChatGPT or Google's AI would return the same brand list twice. One run is a sample of one.

Pass: a log of named and cited rates for each engine, with the number of answers behind each rate. Fail: screenshots, or a single run per prompt.

Add the free first-party data while you're here. Bing's AI Performance report counts citations across Copilot and Bing's AI summaries, with the grounding queries behind them. Search Console's generative AI report counts impressions in AI Overviews and AI Mode.

Go deeper: How to Measure GEO for sample sizes, and How to Benchmark AI Search Performance for a comparison sheet.

17. Answers about your brand are accurate

Check: run six branded prompts, such as "What is Tallyfold?", "Tallyfold pricing" and "Tallyfold vs Brindlework," three times each in three engines. That's 54 answers. Mark every wrong price, feature or company fact.

Pass: 90% or more of answers get your core facts right. Fail: under 75%, or any wrong price.

Go deeper: How to Fix Incorrect Brand Facts in AI Answers.

Area 5: Authority and Backlink Distribution (Points 18–20)

AI answers lean on what other sites say about you. Ahrefs' May 2025 study of AI Overviews found branded web mentions correlated at 0.664 and backlinks at 0.218. The December 2025 study, across ChatGPT, AI Mode and AI Overviews, found YouTube mentions led at about 0.737. These are correlations, not proof of cause, but they point this part of the AEO audit at mentions, anchors and where links land.

18. Links reach the pages you want cited

Check: in Search Console's Links report, open Top linked pages. Compare the linking sites for your homepage with those for your top 10 answer pages. The report shows a sample, capped at 1,000 rows, so treat it as a guide. Ahrefs' webmaster tools, free for sites you verify as of 29 September 2026, add a fuller backlink view.

Pass (our rule of thumb, not a published benchmark): at least half of your top 10 answer pages have links from two or more relevant external sites. Fail: fewer than 3 of the 10 have any external links at all.

Go deeper: Entity Authority in the AI Era explains how links and entities work together now.

19. You're named on the sources engines cite

Check: from your baseline in point 16, list the third-party pages engines cited for category prompts: review sites, "best X" roundups, Reddit threads and YouTube videos. Count how many name you. Look at anchor text as well. In Ahrefs' December data, branded anchors correlated with ChatGPT visibility at 0.511.

Pass: you're named on at least a third of the cited third-party pages. Fail: you're named on fewer than 1 in 10.

Go deeper: How to Rank on ChatGPT and Brand Presence in Perplexity.

20. Your entity facts agree everywhere

Check: compare your name, category, founding year, headquarters, pricing model and founders across your site, LinkedIn, Crunchbase, G2 or Capterra, and Wikidata if you qualify for an item. Look yourself up in Google's Knowledge Graph too, using the method in our Knowledge Graph Search API guide.

Pass: every profile states the same core facts as your site. Fail: two or more profiles disagree with it.

Go deeper: Entity Authority SEO: A 30-Day Plan to Build It.

The Gate-First AEO Audit Scorecard

Add up the 20 scores for a total out of 40, then read the band. The gates come first: points 1, 3 and 6 stop fetching or indexing outright, so a high total means nothing until they pass.

Give each point a row with its score, the evidence you saw, the fix, an owner and a date to check again. The evidence column matters most: when a score moves next quarter, it tells you why.

Worked Example: Tallyfold's First AEO Audit

Tallyfold is a fictional invoicing and payments app for agencies, at tallyfold.example. Its rivals, Brindlework and Kestrelyn, are fictional too. The team audits 20 URLs and 30 prompts. Every finding below is illustrative.

The area totals are 7 of 12, 4 of 8, 3 of 8, 2 of 6 and 2 of 6: 18 of 40, with point 3, a gate, at 0. Tallyfold is Blocked even though its robots.txt is perfect. The file said yes; the firewall said no to one fetch in five.

The fix order

1. Round 1, week one: the gate and cheap fixes. A skip rule for verified AI bots (point 3, +2), the correct price in the markup (point 9, +2), visible dates with an honest dateModified (point 13, +2), a server-rendered pricing table (point 5, +1), a spec-clean llms.txt (point 7, +1) and a full Organization node (point 8, +1). That's +9, for 27 of 40: Readable.
2. Round 2, weeks two to four. A real baseline (point 16, +2), a written training-bot decision (point 2, +1) and sources for the three statistics (point 12, +1). That's +4, for 31.
3. Round 3, the rest of the quarter. The Brindlework comparison (point 14), pages for the nine unmapped prompts (point 15) and three rewritten openings (point 11). If all three land, Tallyfold reaches 34: Citable. Link and mention work (points 18 to 20) starts now but pays out over months.

Rounds 1 and 2 lift Tallyfold from 18 to 31 without one new article. Round 3 decides who gets cited.

How Often to Run an AEO Audit

Run the full AEO audit once a quarter. Re-check area 1 every month, and after any change to robots.txt, your CDN or your firewall, since those break access overnight. Refresh the baseline in point 16 monthly.

This audit covers the whole site. For a check you run on each new article before it goes live, use our 30-minute pre-publish AI SEO checklist.

Once the manual version works, automate parts of it. Trackers can take over points 16 and 17, and log tools points 3 and 4. For options sorted by job, with free ones first, see our GEO tools list. Before you pay for any of them, test whether it moves your numbers with the pilot in how to evaluate a GEO tool before purchasing.

Where Rankbox Fits in an AEO Audit

Rankbox's paid product doesn't run an AEO audit for you. It doesn't crawl sites, manage robots.txt or llms.txt, or track AI citations. Its free tools cover several checks: the AI search readiness check for points 1, 5, 7 and 10, the robots.txt tester for point 1, the llms.txt generator for point 7, the schema generator for points 8 and 9, the citation readiness checker for points 11 and 12, the log analyzer for points 3 and 4, and the Prompt Kit for point 15.

The paid product fits the gaps areas 3 and 4 uncover. Answer-Space Research maps the questions buyers ask ChatGPT, Perplexity and Google. The Citation-Ready Writer then researches the live web and writes 2,000–3,500-word source-backed articles for those gaps, and they reach your site through Rankbox's API. The Business plan is $49.50 a month with a 7-day trial. See pricing.