how many checks are in a GEO audit?

Forty in ours, grouped into ten passes: recon, technical, crawler reality check, content and E-E-A-T, schema, entity, SXO, market data, performance, and the AI visibility panel. The count matters less than the order. A failure in the crawler pass makes every later check moot, which is why the list runs readable first, verifiable second, quotable third.

can I run this checklist myself?

Most of it, yes. Sections 02 to 07 are documented work: request your pages with an AI user-agent, validate your JSON-LD, check your entity records, read your own about page as a stranger would. The part that is hard to do alone is section 10, the prompt panel, because it has to be run across several engines, logged verbatim with sources, and repeated on a schedule for the result to mean anything. That is the part the audit exists for.

what is a good result on this checklist?

Sixty out of 100 on the health score is the practical line, and in the 100 audits published in our report (April to July 2026) not one site reached it; the average was 35. Below 40 a brand is effectively invisible to the models. On the panel, the number that matters is category recall: whether an engine names you when a buyer asks who to pick. The market figure is 4.5%, so any consistent presence on your own category prompts already puts you ahead of most of your neighbours.

how is this different from an SEO audit checklist?

Roughly a third overlaps: one canonical host, clean redirects, valid markup, pages that return their content, Core Web Vitals. The rest has no SEO equivalent. An SEO checklist does not request your pages as GPTBot, does not check whether a model can verify you are a specific company, does not compare the competitors that rank with the competitors the models name, and has no prompt panel. It passes sites that six AI crawlers cannot read; we have watched it happen.

GEO audit checklist: 40 checks and benchmarks

A GEO audit checks whether AI engines can read your site, verify that you are a real and specific company, and find something on it worth quoting when a buyer asks who to pick. This is the full list of checks behind our manual audit: 40 of them, grouped by the ten passes the audit runs in. Where the published dataset of 100 audits states a benchmark for a check, it is next to the check, dated; where it does not, there is no number.

The order is not cosmetic: each pass depends on what the previous one found, and a failure early in the list makes everything after it moot. The benchmarks are grim on purpose: the average health score across the 100 audits was 35 out of 100, 58% of sites scored 35 or below, and not one cleared 60 (the report, published 17 July 2026). The engines knew 93% of the brands by name and named 4.5% in category answers; the checklist is the anatomy of that gap.

01 · recon

What the domain is, what it was before, and what the open web already says about it.

Domain history. Previous owners, brands and reputations. A model can still be answering with the last owner's story; ours was a betting brand on similar domains, hence the disambiguation section in our llms.txt.
What the open web says. Search the brand with “legit” and “scam”; that is the corpus an engine reads when a buyer asks whether you are trustworthy.
Name collisions. Everything else that shares your name. In the INC4 case Google's AI Overview resolved the firm's name to an IEEE conference and a UN committee first (snapshot 27 July 2026, the case).

02 · technical

The layer that decides whether anything else is reachable at all.

One canonical host. www and non-www, http and https, trailing slashes: one of each resolves, the rest redirect once.
Redirect chains and dead URLs. Every historical URL lands on content. In the INC4 audit 177 of 549 backlinks pointed at dead pages (baseline 14 May 2026); 41 redirect rules closed them.
robots.txt and sitemap.xml return 200. In the same audit both returned 404, as did two pages in the main menu.
Canonicals, duplicates and hreflang. One URL per page, one language per URL, and the tags that say so.
Security headers and cache policy. The boring set; a marketer never sees a missing header, a trust heuristic does.

03 · crawler reality check

Requesting your pages the way the engines do, and reading what comes back. Benchmark: 50% of audited sites were unreadable to AI crawlers through client-side rendering, blocked bots or outright 403s (n = 100, April to July 2026).

Fetch as each AI user-agent. GPTBot, ClaudeBot, PerplexityBot and the rest, on home, services, pricing and about. Log the status and the actual bytes of text served.
Compare with what a browser sees. One site in the dataset scored 100/100 for SEO in Lighthouse while the same URL returned 1,133 bytes of empty shell to GPTBot. Both were true at the same moment.
Find where the block lives. Often a CDN rule nobody can see from the repository; one licensed operator in the dataset served 403 to every AI crawler from the edge.
robots.txt names the AI crawlers explicitly. Allow or disallow is a decision, not a default; blocking removes your version of the story, not the story.

04 · content and E-E-A-T

Whether there is anything worth quoting, and whether a named human stands behind it. Benchmark: 89% of audited sites published anonymous content, with no about or team pages and no article authors (n = 100).

A named author on every article, with credentials that can be checked outside your site.
Dates and sources on claims. An undated, unsourced number is the profile a model discounts when choosing whom to quote.
/about and /team exist, return 200, and say who you are. Founding year, legal entity, where you operate from.
Numbers agree across pages. Client counts, years in business, team size: one fact set. Three versions of you means a model trusts none of them.
Trust signals are text, not images. A licence that exists only as a badge or a PDF does not exist for the model; the complaint thread about you is perfectly readable.

05 · schema

The machine-readable version of your company, and whether it agrees with the human-readable one. Benchmark: 94% of audited sites had no JSON-LD at all; the typical schema score we record is 0 to 4 out of 100, and a full stack is typically one of the two largest single lifts to a health score, +15 to +25 points (how the score works).

JSON-LD is present and validates. Broken FAQ markup and a generic Organization with no business type count as absent.
The full stack. Organization, WebSite, Service or Product, Person, FAQPage, BreadcrumbList, and Article on the posts.
One organisation node with a stable identifier, referenced by everything else rather than re-described on every page. Disconnected markup reads as two weak entities instead of one strong one.
Markup matches the page. FAQ answers identical to the visible text, ratings only where reviews exist, sameAs pointing at your own profiles. Contradicting markup is worse than none.

06 · entity

Your name across the open web, and whether a model can confirm you are one specific company. Benchmark: close to 100% of audited sites had no entity anchor; not one had a Wikidata record (n = 100).

A Wikidata item, and for mature brands a Wikipedia article. These are the sources models verify entities against.
One fact set on Crunchbase, LinkedIn and the directories. Same name, founding year and description; a Crunchbase entry describing last year's product becomes last year's story told as fact.
Google Knowledge Graph and AI Overview resolve the name to you. Ask for the company by name and check every fact in the answer.
Location and identifiers agree. Directory listings with a different city each get repeated by engines as offices. Ours did; the correction lives in llms.txt and on the about page.

07 · SXO

The page types that win your money queries today, and the gap between those and what you have. On-page and SXO carries 20% of the health score; citability is the largest dimension of the GEO block at 25%.

Page-type match. For each money query, the page type the engines quote (comparison, pricing, list, definition), and whether you have one.
Answer-shaped blocks. A definition near the top that can be lifted in one paragraph, a table, a price signal, an FAQ whose markup matches the text word for word.
Structural readability. Headings, lists and tables rather than prose a model has to summarise; 20% of the GEO block.
Internal links that describe the structure. Hubs link to spokes in body copy, not only in the footer; siblings link to each other.

08 · market data

Demand by market, and where the value currently sits.

Demand per market and language. Which queries and prompts are real in each geo you sell into; the audit covers one to five languages per brand (methodology, the report).
Competitor traffic value. What each rival's organic visibility would cost as ads; $62 a month next to a competitor's $3,342 is donating the category (example from the report).
The two competitor sets. Who ranks for the keyword, and who the models name in the answer. Frequently different lists; the second one matters here.

09 · performance

Core Web Vitals and the render chain that explains them; 10% of the health score, and never the reason a brand is missing from an answer on its own.

Core Web Vitals on mobile and desktop, from field data where it exists, and marked as inferred where it does not.
The render chain. What blocks first paint, and whether the content buyers read exists only after JavaScript runs.
Page weight as a crawler sees it. A page a crawler abandons before the content is a readability failure, not a speed one.

10 · AI visibility panel

The part no tool report hands over: your buyers' real prompts, run live, logged verbatim, per engine, per market. Benchmark: 93% brand recall, 4.5% category recall; 87 of the 100 audited brands were known to the engines by name and recommended someone else.

A fixed panel of branded probes (“tell me about X”, “is X legit”) and category prompts (“who should we pick for Y”), worded once and never edited; 2 to 14 live prompts per brand in the published audits.
Six engines: ChatGPT, Claude, Gemini, Perplexity, Grok and DeepSeek, each measured separately, because they answer differently.
Every answer logged verbatim with its sources. Who was named, in what position, from which source, and whether the source was yours.
Tone. Whether an engine describes you neutrally, hedges, or warns the buyer to verify you before paying. In iGaming, 2 of 3 audited brands were described as high-risk or a possible scam (n = 100 dataset, iGaming subset).
A series, not a run. The same panel re-run on a schedule and reported as a delta against the baseline; one screenshot proves nothing.

the benchmarks in one table

100 GEO audits, april to july 2026 · 009 Agency, published 17 july 2026
metric	value	checklist section
average health score	35 / 100	all
scoring 35 or lower	58%	all
scoring above 60	0%	all
score distribution	8% at 0 to 20 · 50% at 21 to 35 · 34% at 36 to 50 · 8% at 51 to 60	all
no entity anchor	~100%	06 entity
no JSON-LD	94%	05 schema
anonymous content	89%	04 content
llms.txt missing or 404	87%	03 crawlers
unreadable to AI crawlers	50%	03 crawlers
brand recall	93%	10 panel
category recall	4.5%	10 panel
known, never recommended	87 of 100	10 panel
web3 and crypto: average score	37 / 100 · llms.txt present ~20% · Wikidata 0 of audited brands	niche
iGaming: average score	24 / 100 · category recall 0 of 10 prompts · crawlers blocked 2 of 3 brands	niche
agencies and B2B: score range	28 to 45 · category recall 0 of 13 prompts	niche

Download the CSV: 100-geo-audits-2026.csv (also as JSON). The file is the fixed study, n = 100, and its numbers are not restated as the sample grows; the wider dataset behind the method now covers 160+ manual audits, 2,800+ companies and 67,200+ AI answers (August 2026). Reuse is fine with attribution to 009 Agency, per the licence.

how to read your own result

Count the checks you fail in sections 03, 05 and 06 first. They are the mechanical half of GEO, they move fastest, and a site that passes them is already ahead of roughly nine in ten audited companies. Then look at section 10 on its own: a clean site with zero category recall is the common case, and it means the remaining work is on pages you do not own, the directories, roundups and lists the engines cite. That is slower, and no checklist shortens it.

If you would rather have the 40 run properly, that is the audit: manual, five to ten working days, complimentary for the requests we take on, and yours to keep whether or not we work together. Vocabulary is in the glossary; the technical checks are expanded in technical GEO.

GEO audit checklist: the 40 checks we run, and the benchmarks from 100 audits