September 21, 2026

How to Audit a Client Site for AI Visibility in 30 Minutes

Most AI visibility audits fail in the same way. They spend twenty minutes on content structure and never check whether the AI systems in question can fetch the page at all. The result is a deck full of recommendations for a site that has been invisible to ChatGPT since someone ticked a box at the CDN eighteen months ago.

This is a seven-stage framework built the other way round. It starts with the binary questions, moves to the diagnostic ones, and ends with three prioritised fixes rather than a list of forty. It runs in thirty minutes, it works without access to the client's consoles, and it gets sharper when you have them.

What you need before you start

A browser with developer tools. That is the minimum. Everything else is optional and free:

Google Search Console and Bing Webmaster Tools, if the client has granted access
A crawler such as Screaming Frog or Sitebulb for anything above fifty pages
The Schema.org validator and Google's Rich Results Test
PageSpeed Insights
Accounts on ChatGPT, Gemini, Claude and Perplexity for the prompt panel
Server log access, if you can get it, which is rare in thirty minutes and valuable in thirty days

Before the clock starts, write down the client's ten most commercially important questions in the customer's own words. Not keywords. Questions. "Who does white-label Webflow production for agencies in Europe" rather than "white label webflow agency". You will use them in stage six, and defining them badly ruins the whole audit.

Stage 1 (0 to 3 min): Scope and entity baseline

What to check. The exact legal and trading name. Any name ambiguity: a common word, a shared name with a larger company, a recent rebrand. The site's language and market architecture. Whether the business sells online.

Why it matters. Retrieval systems have to resolve who a company is before they can decide whether to cite it. An entity that cannot be distinguished from a larger namesake will lose every ambiguous query, and no on-page work fixes that.

Audit questions. What does this company call itself on its own site, on LinkedIn, and in the last three press mentions? Are those three the same string? If I ask an assistant who this company is, does it describe the right company?

Red flag. Three different descriptors for the same business across three properties.

Stage 2 (3 to 8 min): Machine access

This is the highest-yield block in the audit, and the one most commonly skipped.

What to check.

Fetch /robots.txt directly and read it in full. Not a summary from a tool.
Identify which AI user agents are allowed and which are blocked, separating them by purpose:

Check for a CDN-level block. Cloudflare and similar providers offer one-click AI bot blocking that never appears in robots.txt. If the client is behind a proxy, ask, or test with a user-agent-spoofed request.
Confirm /sitemap.xml exists, returns 200, and is current.
Check that Google-Extended has not been confused with Googlebot. Blocking Google-Extended affects Gemini model training. It does not remove a site from Google Search or AI Overviews. People get this backwards constantly.

Why it matters. OpenAI and Anthropic both document these controls as independent. A site can be excluded from training while remaining fully eligible for citation, and vice versa. Most sites that blocked "AI bots" in 2024 or 2025 did so with a blunt instrument and blocked both.

Red flags. A blanket Disallow: / for any search or user-fetch agent. A robots.txt written by someone who treated all AI bots as one category. A Cloudflare AI blocking toggle enabled without a documented decision behind it.

Quick win. If search and user-fetch bots are blocked and nobody can name the business reason, this is a same-day fix with no downside. It is usually the single most valuable thing in the audit and it costs one deployment.

Audit questions. Who decided to block these, when, and what were they trying to achieve? Is the training decision separate from the citation decision, and does the file reflect that? Does anyone own this file?

Stage 3 (8 to 13 min): Rendering and indexability

What to check.

View the raw HTML response, not the rendered DOM. In Chrome DevTools, disable JavaScript and reload, or simply use view-source. Is the main content present?
Check for accidental noindex in meta tags or HTTP headers.
Check canonical tags on three template types: homepage, a service page, an article. Are they self-referencing and absolute?
If the site is multilingual, check hreflang reciprocity on one page pair.
Spot-check HTTP status codes. Soft 404s on a single-page application are a classic failure.
Run PageSpeed Insights on one representative page.

Why it matters. Google processes JavaScript with an evergreen version of Chromium, but Google's own documentation notes that server-side rendering or pre-rendering remains preferable, partly because not every bot executes JavaScript. Assistant crawlers are generally less capable here than Googlebot. If the main content only appears after client-side hydration, the site is betting everything on the most generous crawler in the set.

Red flags. An empty <body> in view-source with content injected by script. Canonicals pointing at a staging domain. noindex left on a page after a migration. Content loaded only on scroll or on click.

Quick win. Any page where the primary answer text sits behind an accordion that only populates on click. Render it in the HTML and keep the accordion as a display behaviour.

With console access. URL Inspection in Search Console shows exactly what Google rendered. Use it on the two pages that matter commercially.

Stage 4 (13 to 18 min): Entity and brand signals

What to check.

Is there an Organization node in JSON-LD on the homepage? Validate it with the Schema.org validator.
Does it carry accurate name, url, description, sameAs and address?
Do the sameAs links point to profiles that are live and actually controlled by the company?
Is the company name, descriptor and service vocabulary consistent across the site, LinkedIn and any directory listings?
Is there an author entity anywhere, and if so, is it a real person with a verifiable public profile?

Why it matters. Structured data is not required for generative AI search, and Google states there is no special schema.org markup needed for it. What structured data does is help machines connect records that belong to the same entity. That is a real benefit and a modest one. Consistency of naming across properties does more work than the markup does.

Red flags. No Organization schema at all. sameAs pointing at a dead Twitter account. An invented author persona with no external footprint. Three different company descriptions across three properties.

Quick win. A correct Organization node is twenty minutes of work and it is the only structured data most B2B sites genuinely need alongside Article or BlogPosting and BreadcrumbList.

A note on FAQ schema. If the audit finds FAQPage markup, do not flag it as a win. Google deprecated FAQ rich results on 7 May 2026. The markup remains valid Schema.org and causes no harm, but it no longer produces any Google search appearance, and no platform documents it as an AI citation factor. If the previous agency presented it as an AI visibility tactic, that is worth knowing about them.

Stage 5 (18 to 23 min): Content answerability

What to check.

Take the three most commercially important pages. For each, does a direct answer to the page's core question appear in the first hundred words, or is it buried after four paragraphs of context?
Heading hierarchy: one H1, logical H2 and H3, headings that describe content rather than chase keywords.
Self-containment: pick one H2 section at random. Read it alone. Does it make sense without the three sections above it?
The commodity test: could a language model produce this page from general knowledge without the client's site existing? If yes, the page has no reason to be retrieved.
Freshness: are publication and update dates present, accurate and visible? Do pages covering prices, versions or regulation carry a recent date?
First-party evidence: does the site contain any number, benchmark, method or case detail that exists nowhere else?

Why it matters. Google's May 2026 generative AI guidance is unusually direct on this point: creating content people find unique, compelling and useful will likely influence presence in generative AI search more than any other suggestion in its guide. It contrasts commodity content with content carrying genuine expertise or lived experience. A system summarising common knowledge does not need the client. It needs the client when the client holds something it cannot generate.

Red flags. Every page answers a question the model already knows. No original data anywhere on the site. Headings written as keyword strings. A "2024 guide" still published in 2026. Answers that only make sense after reading the preceding section.

Quick win. Add a two-sentence direct answer immediately under the H1 of the three most important pages. This is an hour of work across the site and it is the highest-leverage content change available.

What not to recommend. Do not recommend chopping content into fragments for AI parsing, rewriting pages in a special style for AI systems, or creating a page per query variation. Google states none of these are required, and the last one falls under its scaled content abuse spam policy.

Stage 6 (23 to 28 min): Measurement surfaces and live testing

Without console access. Run your ten prompts. Use at least three surfaces: ChatGPT, Google AI Mode and one of Perplexity or Claude. Record for each prompt whether the client appears, whether a competitor appears, and which domains are cited. Screenshot the results. Ten prompts across three engines is roughly five minutes if you are disciplined and do not read the answers in full.

What you are looking for is not a score. It is a pattern: which competitor keeps appearing, and what is on their site that is not on the client's.

With console access. This stage becomes much stronger.

Bing Webmaster Tools, AI Performance. The most useful free tool in this category. It reports total citations, cited pages, grounding queries and page-level citation activity across Microsoft Copilot, Bing AI summaries and select partner experiences, with Intents, Topics, Citation Share and Compare added in June 2026. Grounding queries are the internal retrieval phrases the model constructs, which tells you what the system thinks the client is for. That is information no third-party tool can infer. Scope boundary to state clearly: it covers Microsoft surfaces, not ChatGPT, not Perplexity, not Google AI Overviews.
Google Search Console, generative AI performance report. Impressions in AI Overviews, AI Mode and generative features in Discover, broken down by page, country, device and date. It does not include click data. Also check the Search generative AI control setting, because a site excluded there is ineligible for display in those features.

Red flags. No Search Console property at all. The generative AI inclusion setting turned off without anyone knowing why. Bing Webmaster Tools never set up, which is common and now costs real information.

On third-party AI visibility trackers. They are useful for trend direction. Google states directly that no third-party tool has access to its internal ranking or AI systems and warns against tools claiming to use internal metrics. Present their output as directional, never as measurement.

Stage 7 (28 to 30 min): Three fixes, ranked

Two minutes. Three fixes. Not a list of forty.

Rank by this order, which reflects how binary the constraint is:

Anything blocking access. A blocked search or user-fetch crawler, a CDN toggle, a noindex, content that only exists after hydration. These are absolute. Nothing downstream works until they are fixed.
Anything blocking comprehension. Missing or wrong Organization data, name inconsistency across properties, no measurement property configured.
Anything blocking citation-worthiness. Commodity content, no direct answers, no first-party evidence, stale dates.

Give each fix an owner, an effort estimate and a verification method. A recommendation with no verification step is an opinion.

What this audit will not tell you

Worth saying to a client before they ask.

It will not produce a citation score, because no such number exists with a defensible methodology. It will not tell you why a competitor is cited, because off-site presence and training-data history are not visible from the outside. It will not predict results, because citation behaviour is volatile and varies enormously between engines. And it will not fix the hardest problem, which is that a site with nothing original on it has no structural reason to be cited no matter how clean the markup is.

What it does is remove every mechanical reason a site cannot be cited, in thirty minutes, with free tools. That is a smaller claim than the market usually makes, and it is one you can actually deliver.