AI visibility checklist: access, facts, sources and test logs

The whole checklist on one page

Print the table in this section and tick each line; the sections below explain how to run each check.

No checklist makes ChatGPT, Perplexity or Google name your business. OpenAI's help centre says ChatGPT ranks search results on multiple factors and makes no promise of placement. Google's AI features documentation says a page must be indexed and eligible to show in Search with a snippet, and that AI Overviews and AI Mode have no extra requirements or special optimisations beyond that.

What a checklist can do is remove the reasons you'd be passed over: a crawler blocked by accident, a noindex tag left over from a redesign, a phone number that differs between your website and your Google Business Profile, a claim nobody can check. It also gives you a record, so when an answer changes you can see what changed around it. The wider work behind this list sits under AI SEO. This page is the part you tick off.

Check 1: can AI search crawlers reach and read your pages?

Start here, because every other check depends on it. Each AI product documents which crawler feeds its search answers, and blocking the wrong one quietly takes you out of those answers. The table in this section lists the ones to allow.

Reaching a page is only half the test. The crawler also has to find your facts in what it downloads, so the list below runs from access rules through to rendering, sitemaps and your server logs. Work through it in order:

1. Read your live robots.txt at yourdomain.com.au/robots.txt. Look for a blanket Disallow under User-agent: * and for any line naming the crawlers in the table. If a plugin or developer manages the file, ask what they've added and why.
2. Check the firewall, CDN and host. Robots.txt only states a preference, while a firewall can refuse the request outright. Google's AI features guidance says crawling should be allowed by robots.txt and by any CDN or hosting infrastructure, and Perplexity's crawler documentation says a web application firewall may need an explicit allow rule.
3. Watch security settings. Cloudflare's announcement of 15 September 2026 says its Block settings now apply to mixed-use crawlers, including Googlebot and Bingbot, so a block meant for AI training can hit ordinary search too.
4. Search your templates for page-level controls. Google lists noindex, nosnippet, data-nosnippet and max-snippet as the ways to limit what Search shows from a page, and that includes AI features. One left on a service page template limits every page built from it.
5. Inspect your key URLs in Search Console. The URL Inspection tool shows whether a page is on Google, whether crawling is allowed, whether indexing is allowed, and the HTML Googlebot received. Google notes the tool doesn't account for every requirement, so a pass is a minimum.
6. Put the facts in text. Google recommends making sure important content is available in textual form. Confirm your services, suburbs, phone number and licence details are written as text, rather than only inside images or in content that appears after a visitor clicks.
7. Check what a page says before JavaScript runs. Google's JavaScript SEO guidance says Googlebot renders pages in a headless Chromium browser once its resources allow, and recommends server-side rendering or pre-rendering because not all bots can run JavaScript. Open view-source on a service page and search for your phone number and one of your suburbs. If they only show up in the browser's inspector, ask your developer to render them on the server. URL Inspection's rendered HTML then shows what Google saw after rendering.
8. Submit an XML sitemap to both Search Console and Bing Webmaster Tools. Google calls a sitemap a hint that doesn't guarantee crawling, and Bing's webmaster blog asks that each lastmod date reflect when the page content changed, not when the sitemap file was generated. Bing lets you verify a site by importing it from Search Console, which also opens the Bing report used in Check 4.
9. Read your server logs. Find the crawler names from the table, then check each visiting IP address against the list the provider publishes, because Google warns that a user agent string can be spoofed. A verified visit proves access. Whether the page is then cited is a separate question, covered in why a crawl does not prove an AI citation.

Check 2: do your business facts match everywhere?

AI answers are assembled from several sources. Google says AI Overviews and AI Mode may issue multiple related searches across subtopics and data sources to build a response, and OpenAI's help centre warns ChatGPT users that search results and citations can be incomplete, outdated or incorrect. You can't fix the model. You can fix the sources you control.

Google's Business Profile guidelines ask you to represent your business as it's consistently represented and recognised in the real world, across signage, stationery and other branding, and Google's AI features guidance says to keep Business Profile information up to date. Your website should tell exactly the same story. Check every claim against its evidence too. The ACCC says any information or claim a business provides about its products or services must be accurate, truthful and based on reasonable grounds. If you can't show the proof behind same-day service or licensed across Queensland, rewrite the line until you can. AI answers and accurate company facts goes further on keeping one source of truth.

Then check your markup against the same facts. Google's LocalBusiness documentation lists name and address as required, with telephone, url, openingHoursSpecification and geo among the recommended properties. Schema.org adds areaServed for the geographic area where a service is provided, and sameAs for pages that identify the business, such as its profiles. Use a closer type where one fits, such as Plumber or Electrician. Validate with Google's Rich Results Test. Google says no special schema is needed to appear in AI features, so markup restates the facts on the page; it never replaces them. Business listing accuracy covers the directory clean-up in detail.

Write each fact down once, with the evidence behind it, in the fact sheet table at the end of this section. Then compare it line by line on each of these profiles:

• Google Business Profile: name, primary category, phone, hours, service area and the services list.
• Bing Places for Business: the same fields, which are easy to forget because few people log in after setup.
• Apple Business: Apple's March 2026 announcement says Business Connect data, including claimed locations and place card information, moves across to Apple Business automatically, so confirm the place card still matches after the change.
• Facebook and other social profiles: the phone, address, hours and website link in the About section.
• The main directory for your trade and any industry association listing, where old numbers and former addresses tend to linger.
• ABN Lookup: the business name you trade under, so every profile uses the same spelling.

Check 3: can a reader check your claims, reviews and answers?

Link each fact you didn't create to where it came from, and show who wrote the page and when. Google's guidance on helpful content asks whether a page presents information in a way that makes you want to trust it, such as clear sourcing and evidence of the expertise involved, and whether pages carry a byline where one might be expected.

Hold outside sources to the same standard. OpenAI's help centre tells users to open a cited source and check that it supports the answer, so run that test on every source an AI answer cites about your business. When a directory listing or an old article carries a wrong detail, ask its owner to correct it and log the date you asked. AI source correction and retraction walks through that process.

Then read each service page as a customer would. Google's self-assessment questions ask whether content provides original information or analysis, and whether a reader will leave feeling they've learned enough to achieve their goal. A page that covers five services in one paragraph each fails that test for all five, and an answer engine looking for a passage that answers one question has little to quote.

Reviews are evidence a reader can check too, so collect them within the rules. Google Maps' fake engagement policy prohibits paying for reviews, offering incentives such as discounts or free services in exchange for one, and selectively soliciting positive reviews. The ACCC says it's against the law for a business to create fake reviews or arrange for others to do so, and that offering incentives for positive reviews risks misleading consumers. Ask every customer after the job, not only the happy ones, and reply to what they write. How to get more Google reviews covers the asking process.

On your own service pages, the rules are short:

• Rules and standards: link the regulator or the standard's publisher directly.
• Product details: link the manufacturer's specification page.
• Your own figures: state where they come from and the period they cover, or leave them out.
• Review dates: show when the page was last checked, and check it again when a linked source changes.
• Authors: name the person responsible and the qualification that makes them worth listening to.
• Scope: one service per page, with the direct answer to the main customer question in the first paragraph.
• Structure: real HTML headings, lists and tables, never a screenshot of a price table or text set inside an image.
• FAQs: questions customers have actually asked on the phone or by email, answered in a few sentences each.

Check 4: keep a dated test log and score it

Ask the same questions the same way on a schedule, and record every run. One screenshot proves very little, because answers move. Google says AI Mode and AI Overviews may use different models and techniques, so the responses and links they show will vary, and that AI Overviews often don't appear at all. OpenAI's help centre says ChatGPT may estimate your location from your IP address, that a VPN can change that estimate, and that saved memories can shape how it rewrites a search.

Platform data sits beside the manual log. For Google, open the Generative AI performance report in Search Console, which Google made available to all websites on 31 August 2026. It shows how often your pages appeared in AI Overviews and AI Mode, by page, country, device and date, and how to interpret Google AI impressions explains how to read it. The report shows impressions, not clicks. Clicks on those links still sit in the main Performance report under the Web search type, mixed in with ordinary search results. Bing Webmaster Tools added an AI Performance report in February 2026 that shows how often your pages are cited in Microsoft Copilot, AI-generated summaries in Bing and select partner integrations. Microsoft notes the data doesn't indicate ranking or a page's role within an answer. OpenAI says ChatGPT adds utm_source=chatgpt.com to referral links, so those visits can be separated in analytics, as how to measure ChatGPT referrals explains.

At the end of each month, reduce the rows to two counts per product: runs where your business is named, and runs where one of your own pages is cited. Divide each count by the number of runs for that product and keep the figures beside last month's. No provider or regulator publishes a benchmark for a good AI visibility score, so the only fair comparison is your own trend and the businesses named in the same answers. AI recommendations versus mentions explains why a passing mention and a recommendation belong in separate columns.

Check where AI referrals land while you're in analytics. Filter for the chatgpt.com source and other AI referrers, and look for visits to pages that return a 404. An answer can link to a page you removed or to a URL that never existed. Point each one at the closest live page with a permanent 301 redirect, and if the broken link came from your own site, fix it at the source.

For the manual log itself, record the conditions as well as the answer, one row per run, with the columns in the table below.

Worked example: a Caloundra plumber's first three months

Say a small plumbing business in Caloundra wants to know where it stands in AI answers. The business is hypothetical, and every number below is illustrative, chosen to show the arithmetic rather than to suggest what anyone should expect.

Week one is access. The owner asks the web developer to read robots.txt and the security plugin settings. The plugin blocks unknown bots, and its list includes OAI-SearchBot, so the developer adds an allow rule and notes the date in the log. View-source on the blocked drains page shows the phone number but not the suburb list, which loads inside a JavaScript map widget. The developer adds the suburbs as plain text under the map.

Week two is the fact sheet. Comparing profiles turns up an old mobile number on a trade directory and winter hours still showing on the Apple place card. Both are corrected, and the requests go in the log with their dates. The LocalBusiness markup on the contact page passes the Rich Results Test but still lists the old number, so that is fixed too.

Week three is the prompt list. The owner writes the eight prompts in the table below, one for each kind of question, and runs them on the first Monday of each month in Google AI Mode, ChatGPT with search and Perplexity, signed out, on the office connection. That gives 24 runs a month.

Month one, in this illustration, shows the business named in 3 of 24 runs and one of its pages cited in 1. The cited URLs column is more useful than the count. A regional directory and a competitor's guide to hot water system replacement are cited in most of the hot water runs. The business checks the directory, finds it has no listing there, and claims one with the fact sheet details. It has no page on hot water replacement at all, so it writes one that answers the question customers ask on the phone.

By month three the brand prompts show something the counts don't: ChatGPT gives the old mobile number when asked for the phone number. The cited source is a three-year-old local news story. The owner asks the publisher for a correction and logs the request. If the counts rise over the quarter, the log records what changed around them; it can't prove which change caused it, because answers vary from run to run.

What to fix first, and when to run it again

Run the test log monthly and the full checklist every quarter. Re-run the access checks straight after a website migration, a change of host or CDN, a new security setting or a plugin update, because each can change robots.txt or firewall rules without anyone noticing. Keep the log in a shared spreadsheet and never delete old rows. The history is the evidence.

When the checks turn up problems, fix them in this order. Access comes first, because a blocked search crawler or a stray noindex cancels out every other improvement.

1. Blocked crawlers, firewall rules, page-level controls and facts that only appear after JavaScript runs.
2. Conflicting names, phone numbers and addresses, since they appear in the most places.
3. Unsupported claims on service pages, and pages that try to cover several services at once.
4. AI referrals landing on 404 pages.
5. Gaps the log keeps showing, such as a question where another business's page or a directory you're missing from is cited every month and you never are.