The Complete AI SEO Audit Checklist for 2026

The Complete AI SEO Audit Checklist for 2026

A normal SEO audit asks one question: can Google rank this page? An AI SEO audit asks three more. Can AI crawlers even reach it? Can they understand it? And is it the kind of page an AI answer would want to cite?

Most sites I look at fail the first question without knowing it. A security plugin, a CDN setting or one old line in robots.txt quietly blocks the bots, and the site looks perfectly healthy in Google. So here's the checklist I actually run, in the order I run it. Work top to bottom, because the early steps decide whether the later ones matter.

Step 1: Check Crawler Access First

This is the cheapest fix with the biggest downside if you get it wrong. The key is knowing that AI companies run two kinds of bots, and they do different jobs.

Blocking a training bot means your content stays out of model training. Blocking a search bot means that engine can't cite you in answers. Many sites block both by accident. Google-Extended doesn't affect Google Search at all, and AI Overviews rely on Googlebot.

• Open yourdomain.com/robots.txt and look for GPTBot, OAI-SearchBot, ClaudeBot, Claude-SearchBot and PerplexityBot.
• Decide on purpose: allow the search bots if you want citations, and treat training bots as a separate choice.
• Check your CDN and firewall. A "block AI bots" toggle can block search bots too, and robots.txt won't show it.
• Test it. Run curl -I -A "OAI-SearchBot" https://yoursite.com/ and look for a 200 instead of a 403. Some firewalls also verify IP addresses, so treat a pass as a good sign, not proof.
• On WordPress, check Settings → Reading to make sure "Discourage search engines" is off, and review what your security plugin blocks.

A simple setup that welcomes answer engines but opts out of training looks like this:

User-agent: OAI-SearchBot
Allow: /

User-agent: PerplexityBot
Allow: /

User-agent: GPTBot
Disallow: /

Step 2: Make Sure the Technical Basics Hold Up

AI answers lean on the same indexes that classic search uses, so the boring work still counts.

• Your important pages are indexed in Google and Bing, with no stray noindex or nosnippet tags.
• Your sitemap is clean, listed in robots.txt, and free of dead URLs.
• Your main content appears in the raw HTML. Research from Vercel and MERJ found about 69% of AI crawlers can't run JavaScript, so a client-side-rendered page can look blank to them. Quick test: view source, then search for a sentence from your page. If it's missing, bots probably can't see it either.
• Pages load fast and pass Core Web Vitals. If yours don't, start with my guide to fixing a slow WordPress site.
• Your server software is patched. An unpatched PHP version is a serious risk, as I explained in the PHP2Shell vulnerability post.

Step 3: Audit Your Content for Answers, Not Just Keywords

AI tools pull out short, self-contained answers. If your page buries the point under a long intro, you make that job harder.

• Each page targets one clear question, and the answer shows up in the first few lines.
• Headings read like real questions or plain topic labels, not clever puns.
• Key facts, definitions and steps are written as short, standalone statements that still make sense if quoted alone.
• Numbers have a named source and a date. Vague claims rarely get cited.
• You publish something original: your own data, tests or experience. This is the hardest thing to copy and the most likely thing to be referenced.
• A short FAQ answers the follow-up questions people actually ask.
• Old posts are refreshed with a real "updated" date, not just a changed timestamp.

Step 4: Check Your Entity and Trust Signals

AI systems favor sources they can verify. That means your brand, your authors and your claims should be easy to confirm elsewhere.

• Every post has a named author with a real bio page.
• Your About page clearly says who you are, what you do and where you operate.
• Your business name, logo and description match across your site, LinkedIn, Google Business Profile and directories.
• Other reputable sites mention or link to you. Authority still predicts both rankings and AI citations, a pattern I covered in my WordPress SEO statistics report.
• Your site is secure and clean of hacked or spammy pages. SEO spam is one of the most common results of a compromised WordPress site.

Step 5: Validate Your Structured Data

Schema is still worth doing, just keep your expectations honest.

• Article, Organization and Person schema are present and valid (test with Google's Rich Results Test).
• FAQ schema only appears where the questions are visible on the page.
• You aren't running two plugins that output duplicate schema. This happens a lot with Yoast plus a theme.
• Schema matches what's actually on the page.

One caution: a controlled 2026 experiment found major AI engines treated JSON-LD like plain text, not a citation trigger. Schema helps classic search and entity clarity. Don't expect it to get you cited on its own.

Step 6: Treat llms.txt as Optional

Right now, llms.txt is a low priority. Research I covered in my SEO report found only about 10% of sites use one, and one large analysis found 97% of those files got zero visits. If you have spare time, add one. If you don't, skip it and fix Steps 1 to 3 first.

Step 7: Set Up AI Traffic Measurement

You can't improve what you can't see.

• In GA4, check the "AI Assistant" channel. It recognizes sources like ChatGPT and Gemini, but not every assistant, so build a custom channel group for the rest (Perplexity, Claude and others).
• ChatGPT Search links include utm_source=chatgpt.com, which makes them easy to filter.
• Google's own AI Overviews and AI Mode clicks stay inside Organic Search in GA4. For those, use Search Console.
• Mobile app clicks often arrive without referrer data and show up as Direct, so your real AI traffic is probably higher than GA4 says.
• Once a month, ask ChatGPT, Gemini and Perplexity the 10 questions your customers ask most. Write down whether you're cited, who is, and what they did differently.

Frequently Asked Questions