The audit passed. The AI engines still can't see you.
Here's a scenario playing out in agencies and in-house teams everywhere right now. The site gets a clean bill of health from a classic technical audit: crawlable, indexable, fast, mobile-friendly, no broken links. Rankings are stable. And yet, when someone asks ChatGPT or Perplexity a question the site answers better than anyone, the brand doesn't appear. Competitors get cited. The site doesn't.
The instinct is to blame content. It's almost never just content. In most cases we see, the site is failing technical checks that no classic audit ever ran — because those audits were designed to answer one question: can Googlebot crawl and index this page? Generative Engine Optimization (GEO) asks a harder one: can an AI system access, render, extract, understand and confidently quote this page?
Those are different questions, and the second one has its own checklist. This article walks through it — and explains why the order you work through it matters more than the checklist itself.
Why old-school technical audits miss the GEO layer
Classic technical audits are not wrong. They're incomplete. They were built for a crawler-and-index world, and they carry three blind spots into the AI-search era.
Blind spot 1: They only test one bot
A traditional audit checks robots.txt against Googlebot, maybe Bingbot. But the bots that matter for AI visibility are GPTBot, OAI-SearchBot, ClaudeBot, PerplexityBot, Google-Extended and a growing list of others — each with its own user agent, its own rendering behavior and its own tolerance for friction. Many sites block these bots without knowing it: a CDN's default bot-protection rule, a WAF challenge page, a consent banner that swallows the main content, a rate limit tuned for human traffic. None of that shows up in an audit that only impersonates Googlebot. The site looks open; to the AI crawlers it's a locked door.
Blind spot 2: They test crawlability, not extractability
Googlebot renders JavaScript and has two decades of practice reconstructing messy pages. Most AI crawlers don't render JavaScript at all, or do so unreliably — they work with the raw HTML response. A React site that hydrates content client-side can rank fine in Google and be an empty shell to GPTBot. Classic audits report "page indexed, no issues." A GEO audit asks: what does the HTML actually contain before any script runs? Is the main content in the source, or does it arrive three seconds later via API call?
And extraction goes beyond rendering. LLMs don't consume pages — they consume chunks. Retrieval systems split content into passages, embed them, and pull the most relevant ones into the answer context. A page wins citations when its passages survive that process: self-contained sections under clear headings, answers stated up front, lists and tables where structure helps, entities named explicitly instead of pronoun soup. "Chunkability" isn't a content nicety; it's a technical property of the document structure — heading hierarchy, semantic HTML, content-to-boilerplate ratio — and no legacy audit measures it.
Blind spot 3: They treat structured data as a rich-snippet feature
In classic SEO, schema markup earned you review stars and FAQ dropdowns. In GEO, structured data does a more fundamental job: it's the machine-readable statement of what things are. Organization and Person entities with sameAs links disambiguate who is speaking. Article schema with real dates tells retrieval systems the content is fresh. Product schema gives an LLM the exact attributes it needs to include you in a comparison answer. An audit that checks "schema present: yes/no" misses whether the schema actually builds an unambiguous entity graph an AI system can trust — and trust is what gets you cited by name instead of paraphrased anonymously.
The technical GEO checklist
Here is the checklist, organized the way it should be worked: as a pipeline. Content flows from bot access → rendering → extraction → understanding → trust. A failure early in the pipeline makes everything downstream irrelevant.
Tier 1 — Access: can the bots get in at all?
This tier is non-negotiable and comes first. A single blocker here zeroes out every other investment.
- AI bot access in robots.txt — explicit or accidental disallows for GPTBot, ClaudeBot, PerplexityBot, OAI-SearchBot, Google-Extended and friends
- Edge/CDN bot handling — firewall rules, bot-score challenges and rate limits that silently 403 AI crawlers while humans and Googlebot sail through
- HTTP status and redirect hygiene — chains and soft-404s that low-patience crawlers abandon
- Meta robots and X-Robots-Tag headers — including header-level directives most audits never inspect
- Consistent content across user agents — serving AI bots a different (or empty) page than browsers get
- Consent banners and interstitials — overlays that replace the content in the raw HTML response
Tier 2 — Rendering & retrieval: is the content actually in the response?
- JavaScript dependency / SSR — is the main content present in the initial HTML, or client-rendered?
- Main content extractability — content-to-boilerplate ratio; can a parser isolate the article from nav, footer and widget noise?
- Lazy-loaded critical content — text and data that only exist after scroll or interaction
- TTFB and response speed — AI crawlers time out faster than Googlebot ever did
Tier 3 — Chunkability: will passages survive retrieval?
- Heading hierarchy and semantic HTML — one H1, logical H2/H3 nesting, real section, table and list elements
- Content chunking — self-contained sections that make sense when read in isolation
- Answer-first structure — the direct answer in the first sentences of a section, not after 300 words of wind-up
- Lists and tables for extraction — structured formats LLMs quote almost verbatim
- Citable, self-contained passages — statistics, definitions and claims that stand alone with their source
Tier 4 — Understanding & trust: will the engine cite you by name?
- Valid JSON-LD structured data — not just present, but parseable and consistent with the visible page
- Organization/Person entities with sameAs — the disambiguation layer that connects your pages to a known entity
- Article, FAQ, Product and Breadcrumb schema — matched to the actual page type
- Machine-readable freshness signals — dateModified that reflects reality
- Author and E-E-A-T signals — visible expertise that generative engines increasingly weigh
- Entity clarity and consistency — the same names for the same things, everywhere
A word on llms.txt, since it comes up in every GEO conversation: it's a proposed convention for giving LLMs a curated, markdown map of your site. Publishing one is cheap and can't hurt. But it remains a recommendation, not a standard — adoption by the major AI platforms is unconfirmed, and there's no solid evidence yet that it moves citations. Treat it as a low-effort, low-priority item at the bottom of Tier 4, not as the centerpiece some checklists make it. The unglamorous work above it is what actually decides visibility.
Prioritization: fix what blocks the pipe before polishing what flows through it
If there's one thing to take away from this article, it's the ordering logic. Teams routinely spend a quarter on schema markup and answer-first rewrites while their WAF is 403-ing GPTBot on every request. That's optimizing the paint job on a car with no engine.
Work tech-first, blocker-first. Anything that prevents a bot — search or AI — from accessing or processing content gets fixed before anything else, because it silently multiplies every other effort by zero. Only when the pipe is open does it make sense to invest in extractability, then chunkability, then the trust layer. This is also the honest answer to "should we do SEO or GEO first?" — at the technical foundation, they're the same work. A site that's clean for Googlebot and open to AI crawlers serves both channels from one fix list.
How bubbles1 runs this checklist — all of it, automatically
This pipeline is exactly how the bubbles1 Technical SEO/GEO Audit is built. Instead of a classic crawl report with GEO bolted on, the platform checks 80+ technical items spanning both worlds — crawlability and indexability, performance, structured data, security and infrastructure — with a dedicated focus on GEO and content retrieval: AI bot access, edge/CDN bot handling, JavaScript dependency, content chunking and extractability, citable passages, entity clarity and the full structured-data layer.
Three things separate it from running a legacy tool plus a spreadsheet of manual checks:
Verified bot access, not assumed access. The audit tests how the site responds to AI crawlers specifically — robots.txt directives, header-level blocks, firewall friction, user-agent-dependent content — instead of inferring from a Googlebot crawl that "bots are fine."
A log file analyzer that shows what's really happening. Configuration tells you what should happen; server logs tell you what does. The bubbles1 log file analyzer surfaces which AI bots actually visit, which URLs they request, where they hit 403s and 429s, and which sections of the site they never reach. It's the difference between "we don't block GPTBot" and "GPTBot fetched 1,400 URLs last month and got errors on a third of them."
Prioritization built into the output. Every finding is ranked by the pipeline logic above: access blockers first, processing failures second, optimization opportunities after. The report doesn't hand you 80 findings of equal weight — it tells you which three items are silently zeroing out the rest, and which twenty can wait.
When you want a senior human on top of the machine
An automated audit gets the data collection and first-pass prioritization down from weeks to minutes. But every site has context a scanner can't know: a migration in flight, a CMS you can't change until Q3, a legal requirement behind that consent banner, one product line that matters more than the other five.
That's why bubbles1 customers can book an expert audit review as an additional service: an experienced SEO/GEO technical consultant goes through your generated audit, validates and re-weights the findings against your stack and constraints, and fine-tunes the output into an action plan addressed to your specific pain points — what to fix this week, what to hand to which team, and what to deliberately ignore. You get the speed of the machine and the judgment of a senior tech SEO, without paying senior rates for the data collection.
The takeaway
The technical audit isn't dead — it's grown a second half that most tools haven't caught up with. Crawlable and indexable is table stakes; accessible, renderable, chunkable and citable is where AI visibility is decided. Run the full checklist, fix in pipeline order, and let the log files — not assumptions — tell you whether the machines can actually read what you publish.