AEO Audit: How to Run an AI Visibility Audit (Free Checklist)

The short answer

An AEO audit tells you three things: whether AI engines name you when your buyers ask for help, which pages those engines cite instead of yours, and whether anything on your site stops them from reading you. You can run one yourself with a spreadsheet and a terminal.

The method in one paragraph: write 50 prompts (40 unbranded across 10 buying topics, plus 10 branded), freeze and date them, then run each one 3 times in ChatGPT, Perplexity, Gemini and Google AI Overviews, logged out and from your target market. Log mention, citation, the exact cited URL, position and competitors named as separate columns. Sort every cited URL by who owns it. Check the branded answers against a sheet of your official facts. Then test crawler access three ways: robots.txt, a curl fetch as each bot, and a raw HTML check.

A disclosure before the detail: we sell an AI visibility audit. This page is the version you can run on your own, and we have tried to leave nothing out. If you only want a fast first look, our guide to checking whether ChatGPT recommends your brand takes an afternoon. This page is the fuller audit you act on and rerun.

What an AEO audit measures, and how it differs from an SEO audit

An SEO audit asks where your pages rank. An AEO audit asks what the answer says. A brand can do well on one and badly on the other.

The audit measures five things:

1. Mention. Does the answer name your brand?
2. Citation. Does the answer link one of your pages as a source?
3. Cited URLs. Which exact pages does the engine cite, whoever owns them?
4. Position and competitors. Where are you in the list, and who is named ahead of you?
5. Accuracy and access. Are the facts about you right, and can the engine's crawlers fetch and read your pages?

Mention and citation are separate, and the audit falls apart if you merge them. An engine can name you and cite a competitor's comparison page as its source. It can also cite your page for a definition and never recommend you. Each case points to a different fix.

The cited URL column matters most. When you sort the cited URLs, expect your own site to be a small share. Most citations go to third-party editorial, community and reference pages, and those are the pages your plan has to reach.

An audit that only checks your own site misses most of what drives the answer.

Step 1: build the prompt set, then freeze it

The prompt set is the measuring tape. If it changes between runs, your numbers stop meaning anything.

Our recommendation: 50 prompts. Pick the 10 buying topics you most want to win. A topic is a job a buyer is trying to get done, like "choose payroll software for a 20-person company" or "find a dermatologist-recommended retinol." Write 4 phrasings for each topic, which gives you 40 unbranded prompts. Add 10 branded prompts: your name plus "reviews", "pricing", "vs [competitor]", "is [brand] legit", "alternatives to [brand]" and similar.

The logic behind those numbers:

• 10 topics covers most of what a focused company sells into without turning into a research project. Fewer and one topic can swing the whole score.
• 4 phrasings per topic because buyers ask the same thing in different words, and engines often answer them differently. One phrasing per topic tells you about that sentence. Four tell you about the topic.
• An 80/20 unbranded to branded split because unbranded prompts are where new buyers find you, while branded prompts are where the accuracy problems hide.
• 3 runs per prompt per engine because answers vary from run to run. With 4 phrasings and 3 runs, each topic gets 12 answers per engine, so a single odd answer cannot decide the result.

That totals 600 answers across four engines, which is why we do not go bigger by hand.

Where the prompts come from. Do not invent them at your desk. Pull them from four places:

• Sales and support calls. The questions prospects ask before they buy, in their words. These are your best prompts.
• Search Console. Filter queries containing "how", "what", "best", "vs" or "which" to see the questions people already type.
• People Also Ask boxes on Google for your main terms.
• Reddit and community threads in your category. Copy how people phrase the request, including the context they give ("for a small team", "on a budget", "in Canada").

Write each prompt as a full sentence with the context a real buyer adds. "Best CRM" is a keyword. "What's the best CRM for a 10-person B2B sales team that already uses Gmail" is a prompt.

Freeze it. Give every prompt an ID, save the list with today's date, and do not edit it during the audit. If you think of a better prompt halfway through, add it to a list for the next version.

Step 2: run the prompts the same way every time

Run conditions change answers. Control them and write them down.

• Engines. ChatGPT with search on, Perplexity, Gemini, and Google AI Overviews (a Google search for the prompt, reading the AI Overview when one appears). Note when an AI Overview does not show. That is a result too.
• Logged out, or a fresh session. A logged-in account with chat memory and personalization on can shape the answer around you. Use a private window, or a fresh account with memory off.
• Location. Run from the market you sell into. An IP address in another country changes which brands, shops and sources appear. If you use a VPN, record the region on every row.
• Repeat runs. Three runs per prompt per engine, each in a new chat. Spread them over at least two days so one day's quirks do not decide the result.
• Save the evidence. Copy the full answer text, or take a screenshot. Save a share link when the engine offers one: anyone can open the original answer on the engine's own domain.

Step 3: score every answer on one sheet

Use one row per answer: one prompt, one engine, one run. Copy these columns into a spreadsheet:

A few rules keep the sheet honest:

• Mentioned and Cited are separate columns. Never fill one from the other.
• Exact cited URL means the full page address, not the domain. "yoursite.com" tells you nothing. "yoursite.com/blog/old-guide-2023" tells you which page the engine trusts.
• Position is your rank among the brands named, counting from the top. Leave it blank if you were not named.
• Competitors named lists every other brand in the answer, in order.

Three numbers come out of it. Mention rate is the share of answers that name you. Citation rate is the share that cite one of your pages. Average position is your mean rank where you appear. Work them out per topic and per engine, as well as overall. "We are named in most ChatGPT answers on topic 3 and almost none on Perplexity" is something you can act on. One blended score is not.

Step 4: find the exact pages the engines cite, and sort them

Fill the "All cited URLs" column for every answer. Perplexity and ChatGPT search show sources with the answer, Google AI Overviews show linked source cards, and Gemini shows sources on some answers. Open each source and copy the full URL.

Then make a second tab with one row per unique URL, how many answers cited it, and which prompts. Sort it by count. The top 20 URLs on that list are usually where the work is.

Tag each URL with one of four labels:

The third bucket is often where the quickest wins are. If one roundup is cited in a dozen answers and you are not on it, that page is worth more to you than another post on your own blog. Our AI citation checklist covers how to earn those placements.

Step 5: check accuracy against your official facts

Before you read the branded answers, write a one-page facts sheet: current pricing and plans, product names, features you have and features you do not, locations and service areas, founding year, leadership, and any compliance or regulatory statements. This is the answer key.

Read every branded answer against it and log each error in the "Fact errors" column: old prices, discontinued products, features you never had, a wrong headquarters, confusion with a similarly named company.

For each error, check the cited URLs on that answer. The wrong fact usually comes from a specific page: an old page of yours, an outdated review or a directory listing. Fix or update your own page first, then ask the owner of the third-party page for a correction.

Add three or four brand-safety prompts to the branded set too: "is [brand] a scam", "[brand] complaints", "[brand] lawsuit", "problems with [brand]". You want to know what an engine tells a nervous buyer before that buyer asks.

Step 6: check that the engines can reach and read you

Access problems produce the most dramatic audit results and the easiest fixes. One of our clients, Cortico Health, had GPTBot, PerplexityBot, ChatGPT-User and Google-Extended blocked at the robots.txt and CDN level for months. Nobody knew until an AI visibility audit came back with zero citations on every tracked prompt. A zero that complete points to access, not content.

robots.txt: search crawlers and training crawlers are separate

The major AI companies document separate tokens for search and for training. Blocking a training crawler is a business decision. Blocking a search crawler removes you from that engine's search answers. Here is what each vendor's own documentation says, checked October 13, 2026:

Google-Extended needs care. Google says it does not affect a site's inclusion in Google Search and is not a ranking signal there. Google's page does not mention AI Overviews by name. Its affected products are Gemini Apps and Vertex AI. If you care about AI Overviews, the token to check is Googlebot.

A robots.txt that keeps you in AI search answers while opting out of training looks like this:

User-agent: OAI-SearchBot
Allow: /

User-agent: Claude-SearchBot
Allow: /

User-agent: PerplexityBot
Allow: /

User-agent: GPTBot
Disallow: /

User-agent: ClaudeBot
Disallow: /

Blocking training crawlers is your call. The audit checks that the file is deliberate and that no broad User-agent: * rule blocks the search bots by accident.

curl as each bot: catch CDN and firewall blocks

robots.txt can say "allow" while your CDN or firewall returns a 403. Fetch your key pages with each bot's user agent string, as published in the vendor docs, and look at the status code:

curl -s -o /dev/null -w "%{http_code}\n" \
  -A "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; GPTBot/1.4; +https://openai.com/gptbot" \
  https://yoursite.com/pricing

curl -s -o /dev/null -w "%{http_code}\n" \
  -A "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot)" \
  https://yoursite.com/pricing

A 200 is a pass. A 403, 429 or a challenge page means something between the bot and your site is turning it away. One caveat: some firewalls check that a request claiming to be a bot comes from the vendor's published IP ranges, so a block here can be the firewall correctly catching a fake bot. Check your CDN's bot settings and logs to see what happens to the real crawler.

Raw HTML: is the answer in the source?

Some crawlers do not run JavaScript, so content that only appears after scripts load may be invisible to them. Pick a sentence that answers one of your prompts on a key page, and check that it is in the raw HTML:

curl -s https://yoursite.com/pricing | grep -i "plans start at"

If grep prints nothing but the sentence shows in a browser, the page is rendered client side and some engines may never see it. We have watched a category leader hit this after rebuilding its site as an application. Pages were rendered client side, so to a crawler the site had almost nothing on it to read.

These checks are preconditions. Passing them makes your pages possible to fetch and quote. It does not make an engine cite you. The same is true of schema markup, and llms.txt is unproven and optional. Neither is a fix for a low citation rate.

The self-audit checklist

Run down this table when you finish. Each row has a pass bar, so there is no "sort of."

What to fix first, by finding

Fix in this order. Each step makes the next one count.

1. Zero citations everywhere, or a failed curl. Fix access before anything else. Nothing else matters while the door is shut.
2. Answer text missing from raw HTML. Server-render the pages that answer your priority prompts.
3. Wrong facts in branded answers. Correct your own pages, then contact the owners of the third-party pages the engine cited for the wrong fact.
4. Competitors named, you missing, and the cited pages are reachable third parties. This is the outreach list. Start with the URLs cited most often across your highest-value topics.
5. Mentioned but not cited. The engine knows you but prefers another page as its source. Compare your page to the one it cited: usually the cited page answers the question in its first lines and yours does not.
6. Competitors' own pages cited. They have published a page that answers the question, such as a comparison or an "alternatives" page, and you have not. Write the honest version.

Then rerun the same 50 prompts and compare the sheets.

Key takeaways

• An AEO audit measures mention, citation, exact cited URLs, position, accuracy and crawler access. An SEO audit covers part of the last one.
• Use 50 prompts (40 unbranded across 10 topics, 10 branded), run 3 times per engine, logged out, from your target market. Freeze and date the list.
• Log mention and citation in separate columns, and capture full cited URLs, not domains.
• Sort every cited URL into ours, competitor, reachable third party, or unreachable. The reachable third parties are usually the fastest wins.
• Check search crawlers separately from training crawlers. Google-Extended does not affect inclusion in Google Search, according to Google.
• Crawl access and server-rendered HTML are preconditions for being quoted. They are not citation levers, and neither is schema or llms.txt.

Want it done for you?

If you would rather not read 600 answers yourself, that is what our AI visibility audit is for. It includes a demand-weighted map of your category prompts, citation and mention share across ChatGPT, Perplexity, Gemini and Google AI Overviews, a competitor benchmark on the same prompts, a technical retrievability check covering crawlability, structured data and rendering, and a prioritized 90-day action plan delivered up front.

If you are weighing who to hire for the fixes after the audit, see our list of the best AEO agencies. And if you want to start smaller, run the quick check in how to check if ChatGPT recommends your brand this week.