← ClickRadius Institute

The Technical GEO Audit Checklist: 40 Points, in Order

Published July 6, 2026 · ClickRadius Institute

This is the capstone of our technical GEO series: a sequenced inventory for documenting public access, rendering, structured data, content, freshness, security, performance, and later answer observations. The order is a review aid, not a universal engine dependency chain. Reprioritize immediately for security, legal, factual, or customer-impact risk.

Customer planning evidence boundary. No eligible closed ClickRadius customer-month cohort establishes a typical setup or maintenance time, labor saving, payback, return on investment, or citation outcome for a small business. Any sequence or cadence on this page is a planning framework, not a measured completion or result window. Measure actual work, accepted site scope, costs, and attributable outcomes before deciding whether a tool is economical.

Why this audit exists

Google's May 19, 2026 announcement described a redesigned Search experience and made Gemini 3.5 Flash the default model inside AI Mode. It did not establish AI Mode as the global default or formally demote ordinary results; normal SEO foundations remain relevant. AI Overview coverage varies by measurement source, query cohort, collection date, locale, device, and feature definition. Google also announced Information Agents, but rollout, referral behavior, source use, and availability must be observed for the relevant account and context. This checklist therefore audits publisher-controlled technical evidence; it does not assert a universal result-surface rate, market-wide absence, or citation outcome.

A technical audit can prove the state of the requests and artifacts it checks. It cannot prove that an engine considered the site, explain a sampled absence, or forecast a citation.— ClickRadius Institute analysis

Section 1 — Crawl access (checks 1–8)

Nothing downstream matters if the fetchers cannot get in. Full treatment: robots.txt for AI crawlers and AI Crawlers Explained.

  1. robots.txt fetches cleanly (200, plain text, at the root) and contains no leftover Disallow: / from staging.
  2. Retrieval and fetch bots are allowed: Googlebot, Bingbot, OAI-SearchBot, ChatGPT-User, PerplexityBot, Perplexity-User, ClaudeBot, Claude-User. Remember RFC 9309's named-group override: a bot with its own group ignores * rules entirely.
  3. Training-bot policy is deliberate (GPTBot, Google-Extended, CCBot, Meta-ExternalAgent) — allowed or blocked on purpose, documented, not by accident.
  4. CDN/WAF bot rules agree with robots.txt. One-click "block AI bots" toggles at the CDN silently override everything; check the security vendor's console, not just the text file.
  5. Server logs show verified AI-bot visits (match user agent and published IP ranges). Absence of an allowed bot is a finding.
  6. No error walls for bots: sample bot requests return 200s, not 403 challenges or JS proof-of-work pages.
  7. XML sitemap is current, referenced in robots.txt, with truthful lastmod values.
  8. IndexNow is implemented (key file hosted, pings wired to publish/update events) for the Bing-side index cluster feeding Copilot — see IndexNow and Instant AI Indexing.

Section 2 — Rendering and retrievability (checks 9–13)

Rendering behavior must be established for the exact provider and request path. Full treatment: Core Web Vitals in AI Search.

  1. The curl test: fetch your ten most important URLs raw; every price, service description and FAQ answer you want cited must appear in the response body, not only after hydration.
  2. TTFB under ~1 second at the origin for bot-path requests (bots often bypass edge caches users hit).
  3. Status-code hygiene per user agent: no 5xx clusters or timeout patterns served specifically to crawlers.
  4. Core Web Vitals recorded against the current CrUX thresholds — preserve LCP, INP, and CLS evidence for the relevant origin or URL cohort without converting those measurements into a citation or conversion promise.
  5. Clean URL health: no redirect chains deeper than one hop on key pages; canonicals consistent and self-referencing.

Section 3 — Entity and structured data (checks 14–22)

Entity facts and structured data are inspectable inputs; engine use remains a separate observation. Full treatment: Structured Data and AI Search and Industry Schema: Valid Types, Service Areas, and Product Limits.

  1. One canonical Organization/LocalBusiness node with a stable @id, referenced — not redeclared — across the site.
  2. Most specific true type for your industry (Dentist, Plumber, SoftwareApplication…), not bare Organization.
  3. sameAs array triangulating your entity across LinkedIn, Google Business Profile, directories, registries — plus registry identifiers (license, NPI, DUNS) where they exist.
  4. Every page is typed (Article, Service, Product, FAQPage, BreadcrumbList) via JSON-LD generated from CMS data, not hand-pasted.
  5. Article markup carries real provenance: author as Person with URL and credentials or honest Organization, truthful dates — see Article Schema Done Right.
  6. FAQ markup mirrors visible Q&A on the pages where questions genuinely live — see FAQPage Schema and AI Answers.
  7. Zero validator errors (Schema.org validator + Rich Results Test), zero duplicate/contradictory blocks from plugin overlap.
  8. Markup matches page content — no invisible claims, no ratings without displayed reviews.
  9. NAP consistency: name, address, phone identical across site, schema and major external profiles.

Section 4 — Content signals (checks 23–29)

The layer research has actually measured. The Princeton-led GEO study (Aggarwal et al., KDD 2024) found that quotations, statistics and source citations raised source visibility in generative answers by up to roughly 40% in benchmarks — the three signals ClickRadius's content scoring weights directly. The benchmark began with the top five Google sources, randomly selected one source for optimization, and measured that source's relative visibility/impression in generated responses; it did not measure retrieval or citation-inclusion probability, and reported effects varied by domain.

  1. Priority pages carry inline statistics — specific, current, attributed numbers, not adjectives.
  2. Attributed quotations with named sources appear where genuinely available.
  3. Source citations: claims link to authoritative references ("According to Google's documentation…"), making passages verifiable at extraction time.
  4. Answer-first structure: H2/H3 sections that open with the direct answer, self-contained passages that survive being pulled out of context.
  5. Question-shaped coverage: the questions customers actually ask assistants have pages or FAQ entries that answer them directly.
  6. No internal contradictions: old pages do not dispute current pages on prices, claims or recommendations.
  7. Topical consolidation: one strong page per topic rather than three thin overlapping ones.

Section 5 — Freshness (checks 30–33)

Keep time-sensitive public facts and their provenance current; do not assume which copy an engine used. Full treatment: Content Freshness and Decay for AI.

  1. Volatility-based review calendar exists (fast topics quarterly, evergreen annually) and is actually running.
  2. dateModified is honest — updated on real revisions, never bumped cosmetically.
  3. Stale liabilities handled: superseded content refreshed, merged with 301s, or retired — after checking AI-crawler fetches, not just analytics.
  4. Change notification wired: sitemap lastmod plus IndexNow fire on every meaningful update.

Section 6 — Trust and security (checks 34–37)

Subtraction of catastrophic risk. Full treatment: Security Headers as a Trust Signal.

  1. HTTPS everywhere: valid auto-renewing certificate, single-hop HTTP→HTTPS redirects, zero mixed content.
  2. Applicable baseline headers reviewed: assess HSTS, X-Content-Type-Options: nosniff, Referrer-Policy, and CSP frame-ancestors against the site's actual architecture and security policy.
  3. No Safe Browsing flags, no injected spam pages in a site: search — the compromise that silently becomes your machine-visible content.
  4. llms.txt published and synchronized — a curated, honest site map for token-limited readers. Unproven consumption, near-zero cost; the reasoning is in What Is llms.txt and Do You Need It?

Section 7 — Verification loop (checks 38–40)

Delivery verification and external-engine observations are separate evidence stages.

  1. Citation observations are dated: ClickRadius records a monthly sample of selected questions across ChatGPT, Gemini, Perplexity, Claude, and Grok. Each result remains a bounded observation; it does not represent continuous monitoring or predict the next response.
  2. Accuracy check: where the business appears, compare material statements with their authoritative sources and classify any conflict without guessing its cause.
  3. Re-audit trigger defined. Use material factual change, site releases, provider changes, evidence staleness, incidents, and decision need to set the next review.

Running the audit: logistics that make it stick

Use these process controls when running the list:

  1. Scope the first pass before estimating it. Count URLs, templates, render paths, crawler policies, schema variants, and evidence requirements. Record pass, fail, not applicable, and unknown with supporting artifacts before converting findings into authorized work.
  2. Score it simply. Pass = 1, fail = 0, not-applicable = excluded. The resulting fraction per section tells you where the systemic problem lives — a site at 2/8 on crawl access and 7/9 on structured data has a very different situation from the reverse, even at the same total.
  3. Convert accepted defects to tickets with owners. Assign each item by actual authority and capability: security, infrastructure, content, legal or policy review, CMS templates, third-party providers, or customer approval.
  4. Fix proven dependencies first, then test each evidence state. A public fetch may precede a page read, but a later citation is not an end-to-end integration test for every technical layer and its absence does not prove the stack failed.
  5. Keep the evidence file. A later re-audit can compare exact observations, revisions, provider receipts, and public readbacks. Choose the next audit time based on staleness and decision need, not an assumed quarterly regression cycle.

Reading your results

Read the results by check and evidence, not against an unsupported “typical site” pass rate. A failed public fetch and invalid schema can coexist without sharing a cause; investigate each. Do not convert a zero-mention estimate into an early-mover opportunity.

Technical checks produce technical evidence. They do not create a binary reward or prove that an answer engine will cite the site.— ClickRadius Institute measurement rule

Keep the technical and off-site evidence planes separate. This checklist can identify crawler-policy, public-render, structured-data, source, and other setup states. Directories and third-party mentions require their own public verification, and neither plane makes a site citable or chosen without an observed engine output.

Frequently asked questions

How long does a technical GEO audit take?

Audit time depends on URL count, render paths, templates, crawler controls, schema variants, provider records, and evidence depth. Estimate from the scoped inventory and record what was actually tested; do not publish a universal two-to-four-hour range or promise that automation compresses an unspecified audit to minutes.

How is a GEO audit different from a normal technical SEO audit?

They may share public fetch, rendering, structured-data, performance, and security observations. An AI Readiness audit adds its defined five-family setup evidence, while SEO Health and monthly AI Presence remain separate. Crawler purpose and rendering support must be evaluated per provider rather than assuming every classic audit omits them.

What should I fix first if I fail many checks?

Prioritize security and legal risk immediately, then proven blockers for the exact provider path, factual errors, and high-value page defects. A crawler block matters only to the crawler and purpose it governs; raw HTML, client rendering, structured data, content, freshness, and performance do not form one universal dependency chain or compounding order.

Or start with ClickRadius: it measures the five weighted AI Readiness evidence families and surfaces the observed findings. Eligible on-site corrections can be prepared, but application requires current authorization for the exact revision and a connection proven capable of that effect; otherwise the work remains for review. Start with your free AI Readiness Score — plans are on the pricing page.

Related from the Institute