AEO Audit Checklist (2026): 20 Checks and a Scoring Table

An AEO audit checks whether AI engines name and cite your brand when buyers ask category questions. Four layers decide the answer: what engines say, whether crawlers reach you, whether your pages are quotable, and whether other sites back you up. Run the 20 pass/fail checks below, count only what you can prove, and fix access first.

What is an AEO audit, and how is it different from an SEO audit?

An AEO audit measures whether AI engines name and cite your brand, and why they do or don't. An SEO audit inspects your site and rankings; an AEO audit starts from what ChatGPT, Claude, Gemini, Google AI and Perplexity say, then works back to the cause.

AEO, GEO and "AI SEO" name one practice, so this page replaces our GEO audit and AI SEO checklist pages. In customs, AEO means Authorized Economic Operator, a different subject.

Google says its generative AI features are rooted in core Search systems, so SEO best practices still apply. Our free SEO audit covers that foundation: crawl errors, speed and mobile.

Layer 1: what do AI engines say about you today?

Layer 1 is your baseline: ask the engines your buyers' questions, several times each, and record exactly what they say. Layers 2 to 4 diagnose against that record.

1. Prompt set. You have 30 unbranded buyer questions across four types (category, comparison, persona or constraint, brand), taken from sales calls, support tickets and Reddit, plus paraphrases of the top ten.
2. Engines. You tested ChatGPT, Claude, Gemini, Google AI and Perplexity in clean sessions, at the default tier a free user gets.
3. Repeats. You ran each prompt three times per engine and counted every run. SparkToro's study (2,961 runs, January 2026) found under a 1-in-100 chance that ChatGPT or Google AI gave the same brand list in any two responses.
4. Log and rate. Every answer logs named or not, position, tone, link to you, accuracy, competitors, cited URLs and the verbatim sentence about you. You computed mention, citation and accuracy rates per engine and the most-cited third-party domains (formulas).
5. Publisher dashboards. You saved Search Console's generative AI impressions (worldwide since August 2026) and Bing Webmaster Tools' AI Performance report of Copilot and Bing citations.

For scale, AEOeye's audit records (127 audits of self-selected brands, not a market estimate) show the brand named in 17.6% of 892 answers (data).

Layer 2: can AI crawlers reach your pages?

Layer 2 asks whether retrieval bots, which fetch pages to answer questions, can read what you want cited. robots.txt is rarely the culprit: in AEOeye's crawler access study (391 sites, 3 October 2026; a convenience sample), 1 of 193 SaaS sites blocked any AI retrieval bot.

6. robots.txt. It never returns a 5xx, and no bot's group blocks pages you want cited. Under RFC 9309, a 5xx means crawlers assume everything is disallowed, and a bot with its own group ignores your * group.
7. Search bots allowed. OAI-SearchBot, Claude-SearchBot and PerplexityBot may fetch your pages. OpenAI says you can allow OAI-SearchBot while disallowing GPTBot to signal a training opt-out, and Google says Google-Extended doesn't affect inclusion in Google Search.
8. Firewall and CDN. Key pages serve each bot's documented user-agent the same content as a browser, and your CDN or logs show hits from vendors' published IPs. Perplexity says a firewall may need explicit allowlisting. In our study 60 of 375 homepages (16%), and 24 of 88 e-commerce and consumer ones, challenged our self-identified research crawler, so test yours.
9. Indexed in Google and Bing. Google says a page must be indexed and eligible to show with a snippet to appear in AI Overviews or AI Mode. Both consoles show it indexed with a 200 status, no noindex or nosnippet, and a sitemap entry.
10. Facts in server-sent HTML. Vercel's December 2024 analysis found OpenAI's and Anthropic's crawlers fetch JavaScript files but don't run them. Your price and key claims appear with JavaScript off.

Don't score llms.txt: Google says Search doesn't use it, yet 52.4% of the 330 sites we could check publish one. We keep ours because it's cheap.

Layer 3: is your content quotable?

Layer 3 asks whether one passage can stand alone as an answer. A Microsoft Bing product manager advises self-contained phrasing: sentences that survive being pulled out of context. Audit the pages behind your Layer 1 gaps first.

11. Answer-first. Each H2 is the buyer's question and opens with a direct 40 to 60-word answer, then the proof in short paragraphs; comparisons sit in tables. Google says chunking content isn't required, so don't fragment pages.
12. Evidence per claim. A dated, sourced number appears every 150 to 200 words. In the GEO paper, adding citations, quotations or statistics lifted visibility 30 to 40% on its position-adjusted word-count metric and keyword stuffing didn't; the setup was 2023-era, so read it as direction.
13. One intent per page. On 3 October 2026 we merged 165 duplicate-intent and research pages into 42. One strong page per question beats five thin ones.
14. Entity and schema. One brand name everywhere, plus Organization markup with sameAs links to official profiles that match visible text. Google says AI features need no special schema, so this is identity hygiene (guide).
15. Facts and trust. Pricing, features and company details are current, dated and consistent, and an About page says who runs the site. Google calls trust the most important part of E-E-A-T (experience, expertise, authoritativeness, trust).

Layer 4: does the web corroborate you?

Layer 4 checks whether independent sources say what your site says. A 2025 study found AI search leans overwhelmingly on earned media (third-party, authoritative sources) over brand-owned and social content.

16. Roundups. You counted how many best-of and comparison pages your Layer 1 logs cite list you.
17. Review profiles. Your profiles on the review sites those logs cite are claimed and complete.
18. Communities. You searched Reddit and forums for your brand and category questions, noting whether you are named unprompted.
19. Consistent description. Your one-line description, category and pricing model match across your site, LinkedIn, Crunchbase, directories and any Wikidata entry.
20. Readable sources. You checked the robots.txt of sites you depend on: 27 of 38 news publishers and 5 of 20 review and user-generated sites in our study blocked at least one AI retrieval bot, versus 1 of 193 SaaS sites.

How do you score the audit and prioritize fixes?

Give one point per check you can prove with a URL, log line, screenshot or answer text, and fix in layer order: access, content, off-site. Your Layer 1 gap list, the prompts where rivals appear and you don't, picks the pages.

Out of 20: 0 to 9, finish layers 1 and 2; 10 to 15, fix failures in order and re-run Layer 1; 16 to 20, maintain: Layer 1 monthly, layers 2 to 4 quarterly.

Which mistakes make an AEO audit unreliable?

The four below swap measurement for assumption: a branded prompt, a file or a vendor score stands in for what engines did.

• Branded prompts only. They test recognition, not discovery.
• Fixing before measuring. Without a baseline you can't tell which change worked.
• Scoring files, not outcomes. A valid llms.txt or FAQPage block isn't a pass; named, cited and accurate is.
• A score without raw answers. You can't fix what you can't read.

What does an AEO audit cost: DIY, tool or agency?

DIY costs no cash but real time: 30 prompts × 5 engines × 3 runs is 450 answers to read and log. A tool shortens running and logging; an agency adds fixes you can't staff. Pick by who will do the fixing, not who runs the audit.

Neither AEOeye report tracks you daily or guarantees a recommendation; each is a snapshot.