SEO & GEO Audit Checklist: What to Check in 2026

Key takeaways

• A page must be indexed and eligible for a snippet to appear in Google's AI Overviews or AI Mode, so every audit starts with indexing.
• Core Web Vitals pass when 75% of real visits get LCP within 2.5 s, INP within 200 ms and CLS within 0.1, on mobile and desktop.
• Allow OAI-SearchBot to appear in ChatGPT search; OpenAI says a robots.txt change takes about 24 hours to apply.
• Search Console counts AI Overviews and AI Mode clicks inside the Web search type; the Generative AI report, live for all sites since 31 August 2026, shows impressions only.
• llms.txt is optional: Google Search ignores it, and SE Ranking found it on 10.13% of about 300,000 domains with no link to AI citations.

An SEO & GEO audit is a check of whether search engines and AI assistants can find, read and trust your site. It covers crawling and indexing, AI crawler access, speed, markup, content quality, local signals, AI visibility and llms.txt. Indexing comes first: to appear in AI Overviews or AI Mode, a page must be indexed and eligible to show with a snippet, per Google's guide to generative AI search, updated July 2026.

This checklist is for founders and marketing leads who want to audit their own site before paying anyone, or to sanity-check an agency's report. GEO, generative engine optimization, is the work of getting named and linked in AI answers. Google treats it as SEO, which is why one audit covers both.

The table gives each check a tool and a pass mark. The sections explain them, and the last one fits the work into a single day. The tactics behind GEO, from crawler choices to earning mentions, are in our GEO guide; here we stay with what an audit verifies.

SEO & GEO audit checklist. Thresholds from Google Search Central, web.dev and OpenAI documentation, checked October 2026.

Can search engines crawl and index your key pages?

Start here: a page that isn't indexed can't rank in classic results or be cited in AI answers. Google's page on AI features and your website (December 2025) names no technical requirement beyond indexing and snippet eligibility. The July 2026 guide adds one switch: the site must be included in Search generative AI features in Search Console, which it is by default.

What to check:

• robots.txt. The file returns 200 and doesn't disallow pages you want found. A leftover "Disallow: /" from staging is the classic mistake.
• noindex. No stray robots meta tag or X-Robots-Tag header on service, product or category pages.
• Status codes. Key URLs return 200. Moved pages redirect once, with a 301, to the closest match rather than the home page.
• Canonicals. One rel=canonical per page, pointing to itself or the true original, on HTTPS and one host version.
• Sitemap. The XML sitemap lists only canonical URLs that return 200, and it is submitted in Search Console.
• Search Console. In the Page indexing report, read the reasons pages aren't indexed for the pages you care about, then run URL Inspection on your top 10.
• Language versions. On a multilingual site, hreflang links point both ways and include x-default.

On a site built from templates, the unit of the audit is the template. Gastro.News, the Austrian restaurant guide we built, has 2,633 venue pages from one template and 32 ranked hubs, from Wien with 842 restaurants to Burgenland with 89. A wrong canonical in that template would repeat on every venue page, so an audit of a site like this samples each page type, then checks that the XML sitemaps list every venue and hub. The full build is in our programmatic SEO case study.

Case study · Gastro.NewsA restaurant guide that ranks on Google30K+organic visitors a year

Our own site runs in English and Russian, and every page that exists in both languages carries hreflang links to both versions plus x-default. On bilingual client sites, a missing or one-way hreflang pair is among the first things we look for.

Which AI crawlers should your robots.txt allow?

Allow the search crawlers of the AI tools your buyers use, and decide on training crawlers separately. OpenAI's crawler documentation says sites opted out of OAI-SearchBot "will not be shown in ChatGPT search answers, though can still appear as navigational links." GPTBot only collects content that may train OpenAI's models, so blocking it doesn't remove you from ChatGPT search.

After you fix robots.txt, OpenAI says it "can take ~24 hours" for its search systems to adjust, so recheck the next day, not the next hour.

What to check:

• robots.txt groups. OAI-SearchBot, PerplexityBot and Googlebot aren't disallowed, either by name or by a catch-all "User-agent: *" rule.
• CDN and firewall. Google lists crawling allowed "by any CDN or hosting infrastructure" next to robots.txt, and OpenAI asks sites to allow its published IP ranges. Bot protection can block a crawler that robots.txt lets in, so look for OAI-SearchBot visits in your server logs.
• Training crawlers. Blocking GPTBot or Google-Extended is a business decision. The audit records it so nobody mistakes it for a bug.
• Content in the HTML. Google processes JavaScript "as long as it isn't blocked". We also check that the main text sits in the HTML response, because we can't assume every AI crawler renders scripts the way Googlebot does.

What blocking each crawler does is laid out in a table in our GEO guide. Our own robots.txt allows all crawlers on public pages, disallows one utility path and points to the sitemap.

What Core Web Vitals scores pass in 2026?

A page passes when 75% of real visits get LCP ≤ 2.5 s, INP ≤ 200 ms and CLS ≤ 0.1, measured separately on mobile and desktop. These thresholds come from web.dev's Web Vitals page (updated October 2024), which says a tool should count a page as passing only if it meets all three at the 75th percentile.

• LCP, Largest Contentful Paint: when the main content appears.
• INP, Interaction to Next Paint: how fast the page responds to a tap, click or key press.
• CLS, Cumulative Layout Shift: how much the layout jumps while loading.

Judge by field data from real Chrome users: Search Console's Core Web Vitals report and the top block of PageSpeed Insights. Lighthouse lab scores help find the cause but aren't the pass mark. A small site may have no field data; then test the main templates in the lab on a throttled mobile profile.

Google's AI guide asks for the same thing in plain words: a site that "displays well across all devices, reducing latency". Images are the usual LCP problem. In the Barber & Co store we rebuilt in Minsk, catalog photos went from 26 MB of originals to 0.8 MB live, 30× lighter. An audit looks at the same levers: image weight and format, the LCP element on mobile, web fonts and third-party scripts that hold up rendering.

Case study · Barber & CoA faster, mobile-first store for a barber brand30×lighter catalog images

Does structured data help you show up in AI answers?

Not directly, and Google says so in its July 2026 guide:

"Structured data isn't required for generative AI search, and there's no special schema.org markup you need to add. However, it's a good idea to continue using it as part of your overall SEO strategy, as it helps with being eligible for rich results on Google Search." — Google Search Central, Optimizing your website for generative AI features on Google Search

So audit markup for correctness and rich results, not as an AI lever. Google's AI features page adds one rule worth checking on every template: structured data must match the visible text on the page.

What to check:

• Title and description. Unique per page; the title names the topic the way people search for it.
• Headings. One H1 that matches the search intent, then H2s in a logical order.
• Schema type. It fits the page: Organization, LocalBusiness, Product, Article, BreadcrumbList.
• Schema values. Prices, ratings, hours and addresses in the markup equal what the visitor sees. The Rich Results Test shows errors and warnings.
• Internal links. Every key page is linked from other pages, not only from the sitemap.
• Link previews. Open Graph tags give clean cards in Telegram, WhatsApp and LinkedIn. That helps clicks from shares, not rankings.

Gastro.News is a working example. Venue pages carry Restaurant markup with awards, address and ratings, hubs carry ItemList and BreadcrumbList, and hub pages score 100 in Lighthouse's SEO audit. Read that 100 as a floor: it says the basics are in place, not that the content will rank.

How do you audit content quality and E-E-A-T?

Read your money pages as a buyer and ask what on them nobody else could write. E-E-A-T, experience, expertise, authoritativeness and trust, is how Google's quality guidelines describe content people can rely on. The AI guide puts it as "non-commodity" content and defines the opposite: commodity content "is often based on common knowledge, which could originate from anyone".

What to check:

• Answer first. Each service or product page answers its main question in the first lines.
• First-hand proof. Your own figures, process, cases and photos, not stock claims.
• Named people. Authors and experts with real names, roles and a short bio.
• Company facts. Legal name, address and contacts easy to find.
• Near-duplicates. Pages for every city or phrasing that differ only in a word. Google says creating separate content for every variation of a query, fan-out queries included, to manipulate rankings or AI responses violates its scaled content abuse policy.
• Dates. Facts and figures updated when they change, with the date shown.

Are your Business Profile and Merchant Center details in order?

For local businesses and stores, these are direct inputs to AI answers. Google's guide says Merchant Center feeds and Google Business Profiles "can help your products and services to be visible in both AI responses and other Google Search results", and its AI features page asks you to check that this information is up to date.

What to check:

• Google Business Profile. Category, hours, address, phone and website URL match the site.
• Merchant Center. No feed errors; prices and stock match product pages.
• One identity. The same company name, services and cities on the site, profiles and directories.
• Markup. Organization or LocalBusiness schema matches the profile.

Mentions on other sites belong to this area too. Audit what exists, such as reviews, directories and press, but don't buy more: Google writes that seeking inauthentic "mentions" "isn't as helpful as it might seem".

How do you measure visibility in AI answers?

Combine Google's reports with a prompt panel you run yourself. Search Console doesn't split out AI clicks, and ChatGPT and Perplexity give site owners no report.

• Clicks. Google's AI features page says traffic from AI Overviews and AI Mode is counted in the Performance report under the "Web" search type, mixed with other search clicks.
• Impressions. The Generative AI performance report shows how often links to your site appeared in AI Overviews and AI Mode, by page, country and device. Google says it rolled out to all websites worldwide as of August 31, 2026. If you can't see it, the site may have too few impressions or be excluded from generative AI features.
• ChatGPT and Perplexity. Ask the same 20–30 buyer questions each month, in a fresh session, and log who gets named and linked. The method is in our GEO guide.
• Analytics. Watch visits referred by AI assistants as their own sources, and the pages they land on.

An honest note: we have no AI-citation figures from client projects to show you, so this section describes the method, not our results. The audit's job is a baseline you can compare against in three months.

Is llms.txt worth checking in an audit?

Check that it doesn't break, not that it exists. llms.txt is a Markdown file at the site root that summarizes the site for AI tools, and the evidence on it is split.

• Google Search ignores it. Creating one "will neither harm nor help your site's visibility or rankings in Google Search", per Google's AI guide.
• Chrome checks it. Lighthouse's llms.txt audit (updated May 2026) calls the file an "emerging convention" for agents. It flags a server error and marks a missing file as not applicable.
• No measured effect on citations. SE Ranking's study of nearly 300,000 domains (November 2025) found the file on 10.13% of them and no correlation with how often AI cited a domain. That is a vendor study of correlations, not an experiment.

Our own site publishes an llms.txt because it costs nothing and agents may read it. We don't expect citations from it, and an audit that treats a missing file as a critical issue is overselling.

How to run an SEO & GEO audit yourself in one day

Work from access to quality: first what hides your site from everyone, then what makes it slow or unclear, then what makes it worth citing.

1. Hour 1: indexing. Search Console Page indexing, URL Inspection on your top 10 pages, robots.txt, the sitemap and the generative AI features setting.
2. Hour 2: AI crawlers. robots.txt groups for OAI-SearchBot, PerplexityBot and Googlebot, CDN bot rules and a search of server logs.
3. Hours 3–4: speed. The Core Web Vitals report, then PageSpeed Insights on three templates: home, a service or product page, an article.
4. Hour 5: markup. Rich Results Test, titles and H1s on the same templates.
5. Hour 6: content. Read five money pages as a buyer; run the logo test.
6. Hour 7: profiles. Business Profile and Merchant Center against the site.
7. Hour 8: baseline. Export Search Console data and run the first round of your prompt panel.

What can wait: llms.txt, Open Graph polish, schema types that earn no rich result and CLS fixes on low-traffic pages. Content rewrites are a project, not a one-day fix. Write every issue down with the number of pages it affects, what it costs the business, the fix and who owns it.

If the list points to a rebuild rather than fixes, our breakdown of website costs in 2026 shows what that involves. If a redesign or platform move is already planned, run the audit before and after launch, using our guide to redesigning without losing SEO. If you'd rather hand the fixes to an agency, what SEO costs in the US and UAE breaks down retainers, projects and hourly rates.

If you'd rather have it done, our SEO & GEO audit checks the same four areas, indexing, speed and mobile, markup and AI search, the way Google, Bing and AI crawlers see your pages. The audit report gives a fix for every issue, and the full audit adds content and money pages. If you want the fixes made too, our SEO and GEO services start with an audit like this one and carry on with monthly measurement.

Questions we get asked

How often should you audit a website for SEO?

Run a full audit once a year and after any redesign, platform move or large content change. Between audits, look at Search Console once a month: indexing errors, Core Web Vitals and the Generative AI report. Recheck robots.txt and CDN bot rules after every release that touches them, because one wrong line can hide a whole site from crawlers.

Can I audit a website for free with Google's tools?

Mostly. Search Console, PageSpeed Insights, the Rich Results Test and Lighthouse are free and cover most of this checklist. They don't crawl the whole site in one pass, rank issues by business impact or show how your CDN treats AI crawlers; a site crawler and server logs fill those gaps. Google also says no third-party tool has access to its internal ranking or AI systems.

What is the difference between a technical audit and a full SEO audit?

A technical audit asks if pages can be crawled, indexed, loaded fast and read: robots.txt, status codes, canonicals, sitemaps, speed and markup. A full audit adds the content and money pages: whether they answer buyer questions, show first-hand proof and named people, and how the site shows up in AI answers, ending with a prioritized plan of fixes.

How long until audit fixes show results?

Crawler access changes apply fastest: OpenAI says about 24 hours after a robots.txt update. Indexing fixes show once the pages are recrawled, usually days to weeks. Speed fixes appear in field data only after enough real visits on the new version. Content rewrites and new mentions take months, and nobody can promise a date for rankings or AI citations.

Does an auditor need admin access to my website?

Not to find most issues. robots.txt, HTML, status codes, speed and markup can be checked from outside, the way a crawler sees the site. Read access to Search Console adds indexing and performance data, and server or CDN logs show which bots actually visit. Admin access to the CMS is needed to fix issues, not to find them.

Sources

1. Optimizing your website for generative AI features on Google Search · Google Search Central, 2026
2. AI features and your website · Google Search Central, 2025
3. Overview of OpenAI Crawlers · OpenAI
4. Web Vitals · web.dev, 2024
5. Generative AI performance report · Search Console Help, 2026
6. LLMs.txt: Why Brands Rely On It and Why It Doesn't Work · SE Ranking, 2025
7. llms.txt audit · Chrome for Developers, 2026

Share this article

About the author

Artsiom Yankovich

Head of Design & Strategy

Leads design and strategy, from product logic to brand. 9+ years, 150+ projects.

Meet the leadership