How to audit a website for AI citation (2026 guide + free checklist)

Why "AI citation" is the new SEO

Over the past 18 months, ChatGPT, Claude, Perplexity, and Google AI Overviews have moved from novelty to default search interface for a meaningful share of buyers - especially in B2B, professional services, and SaaS categories. Buyer behaviour shifted faster than the SEO industry's vocabulary caught up.

Two things to internalise before you touch your site:

• Citation ≠ ranking. A page can rank #1 organic and never be cited by ChatGPT, because AI engines pull from a smaller candidate pool curated by different signals than Google's blue-link algorithm.
• Citation is binary. When an AI engine writes an answer, your URL is either in the source list or it isn't. There's no "page 2 of AI results." If you're not cited, the answer goes to someone who is - usually your competitor.

The work below is the audit you run now, before that buyer asks ChatGPT about your category. Twelve months from now, a site that fails most of these signals is invisible to AI-mediated search.

The 9 signals AI engines look for

1. AI crawler access - robots.txt explicitly allows the AI bots

The single fastest way to remove yourself from the AI candidate pool: forget to allow the crawlers.

Most sites have a robots.txt written for Googlebot and not updated since 2023. AI engines run their own crawlers - GPTBot (OpenAI), ClaudeBot (Anthropic), PerplexityBot (Perplexity), Google-Extended (Google's AI training/AI Overview crawl). If you don't explicitly allow them, the conservative default for many sites (especially behind security suites) is to block them.

What to check:

# robots.txt - recommended minimum
User-agent: GPTBot
Allow: /

User-agent: ClaudeBot
Allow: /

User-agent: PerplexityBot
Allow: /

User-agent: Google-Extended
Allow: /

User-agent: ChatGPT-User
Allow: /

If you want to keep app routes (/dashboard, /auth, etc.) out of AI training while still letting public pages in, add explicit Disallow: lines for those paths under each bot.

What most tools miss: Screaming Frog, Sitebulb, and Lighthouse don't flag missing AI-crawler allows. They flag missing Googlebot allow. The AI bots are a 2024-2026 concern and most audit tools haven't caught up.

2. llms.txt exists and is current

llms.txt is the AI-era equivalent of robots.txt plus a friendly briefing memo. It lives at the site root, declares what the site is about, and points AI engines at the most useful pages.

Sites that have one are easier for AI engines to understand and faster to cite from. Sites without one are interpreted from raw HTML - which works, but loses fidelity.

What to check:

• File exists at https://yoursite.com/llms.txt and returns 200
• File starts with the site name + a one-line description
• Sections are listed (About, Pricing, FAQ, Blog, etc.) with their URLs
• Updated within the last 90 days

What most tools miss: Almost nobody flags this yet. AuditHQ's GEO suite checks llms.txt presence, format, and freshness - and the deterministic engine surfaces it as a finding when it's missing or stale. For the full AI-tooling layer that complements citation work (chatbots, MCP endpoints, LLM observability), see the AI readiness audit guide.

3. Schema completeness - the 5 schemas AI engines lean on

Schema.org structured data is the highest-leverage AI-citation signal that most sites get half-right. AI engines prefer pages that explicitly say "I'm an Article about X by author Y published on date Z" over pages that imply it.

The 5 schemas to ship:

• Organization - your company entity, with name, url, logo, sameAs (LinkedIn, X, GitHub, etc.)
• Person - for author bylines on articles, with name, url, sameAs, knowsAbout
• WebSite - site-level identity
• FAQPage - if you have any FAQ-shaped content, this schema is the citation goldmine for AI Overviews
• BreadcrumbList - gives AI engines navigation context and improves snippet quality

Skip SoftwareApplication until you have ≥3 real customer reviews - without aggregateRating, Google ignores it and SEO auditors flag it as broken.

4. E-E-A-T signals - Experience, Expertise, Authoritativeness, Trustworthiness

Google's E-E-A-T framework is now baked into AI-citation ranking too. AI engines preferentially cite content that demonstrates the author did the thing they're writing about and can be verified externally.

What to check on every meaningful page:

• Author byline visible to humans, not just in schema (a "Written by [name]" block at the top of articles)
• Date published + date updated visible
• Author bio below the article with a one-sentence credential ("17 years building digital products," not "AI content writer")
• Citations in the article to authoritative external sources
• sameAs in the Person schema linking to a real LinkedIn, real X profile, real GitHub - AI engines de-rank ghost authors with no verifiable identity

A great article from a verifiable author beats a great article from an anonymous one. AI engines explicitly model this.

5. Semantic HTML hierarchy

This is the simplest signal and the most ignored. AI engines parse HTML structure to understand what's a heading, what's a list, what's a table, what's body text.

What to check:

• Exactly one <h1> per page, semantically the page's main topic
• <h2> and <h3> used as actual subsection headers, not for styling
• Lists rendered as <ul>/<ol>, not <div> stacks
• Tables rendered as <table>, not as CSS grids

Sites that render visual content with semantic emptiness (every block is a <div>) are illegible to AI engines.

6. Passage citability - declarative, sourced, named

AI engines extract passages, not paragraphs. A passage is citable when it:

• Makes a declarative claim (not a question, not hedging)
• Names a specific entity (a company, person, product, version, date)
• Carries a timestamp or citation when claiming a fact

Rewrite example:

The "after" passage cites cleanly. The "before" gets paraphrased away.

7. Internal anchor text in natural language

When you link to your own pricing page, the anchor text matters. "Click here" is invisible to AI engines. "See AuditHQ pricing" tells them what the destination is about.

What to check:

• Internal links use the destination's natural-language topic, not generic CTAs
• "Read more" and "Learn more" are anchor anti-patterns - replace with the actual topic

8. Page speed + accessibility

AI engines preferentially cite pages they can actually load. Two specific bars matter:

• Core Web Vitals in the "good" range (LCP < 2.5s, CLS < 0.1, INP < 200ms)
• No accessibility violations that prevent the crawler from parsing - missing alt text, contrast failures, keyboard traps

A page that fails Lighthouse mobile below 50 gets dropped from candidate pools. A page that fails axe-core's accessibility checks gets de-prioritised. The detailed breakdown of Core Web Vitals, WCAG 2.2, and resource-loading patterns lives in the technical-health audit guide.

9. Outbound citations to authoritative sources

Counterintuitive but real: pages that cite authoritative external sources are more likely to be cited themselves. AI engines model "is this author engaging with the wider conversation?" as a quality signal.

What to check:

• Every claim of fact has a citation (a real URL, not "studies show")
• At least 2-3 outbound links per long-form article to recognised authorities (.edu, .gov, recognised industry sources, primary research)

This is the opposite of the early-SEO instinct to hoard link equity. Cite to be cited.

Worked example: a real SMB audit

A typical Australian small-business website. Public-facing services site. Here's what an AuditHQ review can surface:

• AI crawler access: Mixed pass - robots.txt allows Googlebot but is silent on GPTBot, ClaudeBot, PerplexityBot. Most AI bots default to crawling, but explicit allow is recommended.
• llms.txt: Missing on roughly 9 out of 10 SMB sites we've scanned. AI engines parse the homepage HTML cold.
• Schema: Partial pass on most. Organization and WebSite common. FAQPage missing despite obvious FAQ content. BreadcrumbList missing on services pages. Person schema absent - founder name appears in copy but has no schema anchor.
• E-E-A-T: Author bylines absent on blog posts. Founder bio thin and unverifiable.
• Semantic HTML: Strong on most sites. Real <h1>/<h2>/<h3> hierarchy.
• Passage citability: Mixed. Services pages make specific claims but don't cite or date them.
• Internal anchor text: Weak. Multiple "Learn more" links.
• Page speed: Typically Lighthouse mobile 60-80 - passable, room to improve.
• Outbound citations: Few. Hoarded link equity is the SMB default.

Net AI citation likelihood: low to medium. Two easy fixes (ship llms.txt, add FAQPage schema) lift it to medium-high in 2-3 hours of work. The deeper Person + author byline work is a one-day investment.

This is the kind of clarity an AI-aware audit gives you. For the security-header and email-auth side of the same checklist (HSTS, SPF, DMARC, CSP, security.txt), see the security audit guide.

Run it on your site automatically

Checking these signals manually takes time. A Full Audit brings public website findings and supporting evidence together so you can prioritise improvements.

Create an account to start a Full Audit, choose your audit scope, and turn observed issues into a prioritised action plan.

FAQ