The GEO Audit rubric

Published in full, because a rubric you can't see is just an opinion with an invoice attached.

This is the exact scoring sheet used for every $497 GEO Audit at youforgot.marketing/fix/#geo. Same checks, same weights, same order, every client. You can run most of it yourself in an afternoon - the method is on this page and in How to get cited by ChatGPT. What you're paying for is someone doing it properly, running the citation baseline across the assistants, and telling you which three things to fix first.

Last updated: 2026-08-10.

Two external numbers worth knowing, and they're the only two cited anywhere in this document:

• Ahrefs (December 2025) measured roughly a 58% reduction in click-through rate for the top organic result when an AI Overview is present.
• Over the same period, zero-click searches rose from about 56% to about 69% in a year.

That's the whole argument. The answer is increasingly the destination, and if you're not in the answer you're not in the consideration set. Every other number in your report is first-party: measured from your site, or measured from assistant responses on a dated run.

Three gates, scored in order: RETRIEVABLE → ATTRIBUTABLE → QUOTABLE.

Each check scores full / half / zero. Half means the thing exists but is done badly enough that it doesn't do its job - a sitemap listing 404s, schema that fails validation, an about page that describes a mood rather than a product.

The gates are sequential, and that is the whole point

Not "weighted toward the first one". Sequential. A page nothing can fetch cannot be attributed. An entity nobody can identify cannot be quoted usefully. Most GEO advice starts at gate three, which is why most GEO advice doesn't work.

Two checks are hard stops - R1 (content in raw HTML) and R3 (AI user-agents not blocked):

• If either fails, the total is capped at the RETRIEVABLE subtotal and gates 2 and 3 are reported as not scored - blocked upstream.
• Findings for gates 2 and 3 still get written up, because you'll need them the week after the block clears. They just don't get a number, because a number would be dishonest.
• The fix list for a hard-stop site is retrieval-only until retrieval passes. There is no point writing comparison pages for a site that renders in the browser and nowhere else.

Soft gate: if RETRIEVABLE scores below 24/40 without triggering a hard stop, the top three items on the fix list are still retrieval items regardless of what gates 2 and 3 turn up.

What a total means

The band describes readiness, not outcomes. It is not a prediction that you will be cited.

Can a machine fetch your content and read it without executing your JavaScript?

R1 · Content in the raw HTML - 12 pts · hard stop

• Checked: whether your actual page content - headings, body copy, product claims, prices - exists in the HTML the server returns, as opposed to being assembled in the browser after JavaScript runs.
• How: curl -sL <url> and read what comes back. Cross-checked by loading the page in a browser with JavaScript disabled. Run against the homepage, the main product page, and two content pages.
• Pass: the substantive content of each page is present and readable in the curl output.
• Half: shell renders with some content server-side, key sections (pricing, feature detail, docs) client-only.
• Why it matters: retrieval layers work on fetched HTML. A client-rendered page can be completely invisible to them while looking perfect to you, and it fails silently - there is no error, no warning, no missing-page report. This is the single most common fatal failure on sites built fast, and it is why it's worth 12 points and stops the scoring.

R2 · Crawlable and unblocked - 8 pts

• Checked: HTTP status, noindex directives, canonical sanity, redirect chains, and whether your CDN or WAF challenges non-browser requests.
• How: status and headers on the key URLs; robots.txt read in full; canonical tags compared against actual URLs; repeated fetches with a non-browser user-agent to see whether a bot-protection challenge (403, JS interstitial, CAPTCHA) appears.
• Pass: key pages return 200 to a plain non-browser request, no noindex on pages you want cited, canonicals point at themselves or somewhere deliberate, redirects resolve in one hop.
• Half: one category of page blocked or challenged; canonicals inconsistent.
• Why it matters: "bot fight" settings ship on by default in several popular stacks and block exactly the agents you want reading you. Owners almost never know it's on, because their browser is never challenged.

R3 · AI user-agents allowed in robots.txt - 8 pts · hard stop

• Checked: whether robots.txt permits the assistant crawlers - GPTBot, OAI-SearchBot, ChatGPT-User, PerplexityBot, ClaudeBot, Claude-SearchBot, Google-Extended, Applebot-Extended - and whether the file's syntax actually does what its author intended.
• How: fetch /robots.txt, read every group, check for wildcard Disallow: / blocks inherited by named agents, and check that the paths you care about aren't disallowed under User-agent: *.
• Pass: the agents you want are allowed to reach the pages you want cited, deliberately.
• Half: some allowed, some blocked with no evident reason - usually a copy-pasted block-list from 2024.
• Why it matters: you cannot be quoted from a page nothing is permitted to read. Blocking is a legitimate business decision - plenty of publishers made it on purpose - but then the citation question is answered and there's nothing to audit. If this fails, the report asks whether it was a decision or an accident before it recommends anything.

R4 · Sitemap present and honest - 4 pts

• Checked: a sitemap exists, is referenced from robots.txt, returns 200, contains the URLs you actually want retrieved, and doesn't contain dead or redirecting ones.
• How: fetch the sitemap, sample the URLs for status codes, compare the set against the site's real page inventory.
• Pass: referenced, valid, current, no 404s or redirects in the sample, lastmod dates that correspond to reality.
• Half: present but stale, or missing whole sections of the site.
• Why it matters: it's discovery insurance, not a ranking factor. Cheap to get right and a stale one actively misinforms - lastmod values that never change teach a crawler your site never changes.

R5 · Dates present and meaningful - 4 pts

• Checked: published and updated dates, visible in the page text and in structured data, on content pages.
• How: read the rendered page; read datePublished / dateModified in the JSON-LD; compare both against the git history or CMS record where available.
• Pass: both dates present, both in the HTML text and in schema, and both true.
• Half: dates present in one place only, or an "updated" date that moves on every deploy without the content changing.
• Why it matters: undated content gets discounted, and recency weighs more heavily here than in classic search. A fake rolling "updated today" is worse than no date - it's the kind of thing that gets a source distrusted rather than preferred.

R6 · Page speed not pathological - 4 pts

• Checked: not a performance audit. Only whether anything about delivery is bad enough to interfere with fetching.
• How: time a plain curl to first byte, three times, cold; check HTML document size; count redirect hops; check for rate-limiting on rapid sequential fetches.
• Pass: server responds in roughly under 1.5s to a plain request, HTML document under ~2MB, redirects resolve in one hop, no rate-limit or challenge after a handful of requests.
• Half: slow but functional; oversized documents; two-hop redirects on canonical URLs.
• Why it matters: Be clear about what this threshold is. No assistant publishes its crawler timeout, so 1.5s is our working convention, not a documented limit. The point of the check is to catch the pathological cases - a 12-second TTFB, a 40MB page, a redirect loop - not to chase a Lighthouse score. If your site is merely slow, this costs you 2 points and no fix-list item.

Given your pages, can a model state what you are, who you're for, and which category you belong in - without guessing?

A1 · Category stated plainly - 10 pts

• Checked: whether one declarative sentence, high on the homepage, says what kind of thing this is and who it's for, in the words a buyer would use.
• How: read the first screen of the homepage and the <title> and meta description. The test: could a stranger who has never heard of you complete "It's a ___ for ___" from what is written, without inference from the design, the logos, or the screenshots?
• Pass: yes, in plain language, using the category noun your buyers actually type.
• Half: the category is present but buried below the fold, or stated in invented vocabulary ("a workspace for momentum") that maps to no real search behaviour.
• Why it matters: models answer category questions - "best X for Y". If your page never names X, you are not a candidate for the question, however good the product is. This is the highest-value single sentence on your site and it's usually the one written last, by the person most bored of explaining what they built.

A2 · Entity clarity - 7 pts

• Checked: that there is exactly one canonical name for you, one canonical one-line description, and that you are distinguishable from other things with the same name.
• How: compare the brand string across homepage, <title> tags, footer, schema name, social profiles, and app store listings. Then search the bare brand name and see what else owns it.
• Pass: one spelling, one casing, one description, and a page that disambiguates you from the band / the town / the other SaaS with your name.
• Half: name consistent but description varies wildly between surfaces; or a genuine name collision with nothing on your site that resolves it.
• Why it matters: models are assembling an entity from fragments scattered across the web. Three spellings of your name is three weak entities instead of one strong one, and a name collision means your mentions get credited to someone else.

A3 · Structured data - 6 pts

• Checked: presence and validity of Organization, Product or SoftwareApplication, and FAQPage schema where appropriate - plus sameAs links to your canonical profiles.
• How: extract the JSON-LD from each key template, run it through a schema validator, and check that what it asserts matches what the page actually says.
• Pass: valid schema on the right templates, sameAs pointing at real profiles, and no contradictions between markup and visible content.
• Half: present but invalid, or asserting things the page doesn't support.
• Why it matters: it isn't magic and it isn't a ranking lever. It removes ambiguity - it's the machine-readable version of the sentence in A1, and it makes your sameAs links do the work of tying your scattered profiles into one entity.

A4 · Consistent naming across the web - 7 pts

• Checked: how third-party sources describe you - directories, review sites, social profiles, app stores, any press or roundups - and whether that description matches yours.
• How: locate every off-site profile that exists, record the name, category and one-line description each uses, and compare against the canonical pair from A1 and A2.
• Pass: the web describes you roughly the way you describe yourself, in the same category language.
• Half: profiles exist but are stale, contradictory, or file you under the wrong category.
• Why it matters: the model is synthesising consensus, not reading your homepage in isolation. If four directories say you're a "project management tool" and you say you're an "AI ops platform", consensus wins and it isn't your sentence. Fixing stale profiles is dull, cheap, and one of the few off-site levers you fully control.

A5 · About and product pages that state what and who for - 5 pts

• Checked: that an about page and a product/pricing page exist and answer, in text: what this is, who it's for, who built it, what it costs, what it replaces.
• How: read them. Score against those five questions.
• Pass: all five answered in prose a machine can lift, not implied by a pricing grid or a wall of logos.
• Half: pages exist but answer two or three of the five.
• Why it matters: these are the pages that get retrieved when someone asks "what is X" or "who makes X" or "how much does X cost". A pricing page whose numbers live only inside a JavaScript toggle answers none of those questions.

Have you published anything a model would rather quote than generate itself?

Q1 · Self-contained answer paragraphs - 7 pts

• Checked: whether your content pages answer questions in single paragraphs that survive being lifted out of context.
• How: sample 5–10 paragraphs from your main content pages. For each, ask: does this still make sense with nothing above it? Are the claim and its support in the same place? Does it start with a pronoun pointing backwards?
• Pass: the majority of key paragraphs stand alone, with the answer immediately after the question-shaped heading and elaboration afterwards.
• Half: good content, structured as a build-up - argument spread over six paragraphs with the payoff at the end.
• Why it matters: this is the most actionable item in the entire rubric. Models attach citations to passages they can extract intact. A brilliant argument that only works read in order is nearly unquotable; one tight paragraph that fully answers the question is trivially quotable. Same information, completely different outcome.

Q2 · Original data or statistics - 6 pts

• Checked: whether you publish numbers that exist nowhere else - your own measurements, benchmarks, aggregate customer data, pricing comparisons you ran.
• How: inventory every specific number on the site and sort into first-party (yours, with a method) and second-hand (someone else's, cited or not).
• Pass: at least one page carrying genuine first-party data with the method stated and a date attached.
• Half: numbers present but all borrowed, or first-party numbers with no method given.
• Why it matters: a model needs something specific to attach to a source. "Onboarding matters" is on ten thousand pages and worth citing on none of them. A number only you have is the cheapest citation-earning asset available, and every operating business is sitting on some.

Q3 · Comparison and alternative pages - 5 pts

• Checked: whether "X vs Y" and "alternatives to X" pages exist for your real competitive set, and whether they're honest.
• How: inventory them against the competitor list from intake. Read for whether the page ever admits a case where the competitor is the right choice.
• Pass: pages exist for the main competitors, name real trade-offs, and state at least one scenario where you're the wrong answer.
• Half: pages exist but every row is a win for you.
• Why it matters: buying questions are comparative, so comparison pages are retrieved heavily. A page that only says you win reads as marketing to a model the same way it does to a human, and gets weighted accordingly.

Q4 · Question-and-answer formats - 4 pts

• Checked: whether real buyer questions are addressed as explicit questions, with FAQPage schema where it fits, and whether the answers are complete rather than teasers.
• How: compare the questions on the site against the actual prompt set used in your baseline. Read the answers for completeness.
• Pass: the high-frequency questions from the prompt set are answered on-site, as questions, completely.
• Half: an FAQ exists but answers logistics ("do you offer refunds") rather than the buying question, or answers deflect to a sales call.
• Why it matters: it's the closest possible match between the shape of a question and the shape of your content. It also forces you to write the answer down, which is surprisingly often the actual missing step.

Q5 · Freshness - 3 pts

• Checked: whether the site shows signs of ongoing maintenance - recent publishing, genuinely updated cornerstone pages, no obviously dead content.
• How: date distribution across the content inventory; check whether "updated" claims correspond to real changes; look for abandoned sections.
• Pass: something meaningful published or genuinely revised in the last quarter, and cornerstone pages that reflect the current product.
• Half: publishing has stopped but nothing is actively wrong.
• Why it matters: recency is a live weighting in retrieval. This is 3 points rather than 10 because publishing cadence for its own sake is the trap that turns GEO into a content treadmill - a stale page with unique data beats a fresh page with none.

Stated plainly so nobody has to infer it from a scope document.

• It does not guarantee citations. Nobody can. Clearing all three gates makes you a viable candidate. Whether a given model names you on a given day is not a thing anyone outside the labs controls.
• It does not control model behaviour. There is no submission endpoint, no ranking API, no "index my site" button for an assistant. The retrieval and synthesis mechanics are not published and change without notice.
• The results are probabilistic, not ranks. The same prompt returns different sources on different days. That's why the baseline runs a fixed prompt set repeatedly and reports a distribution. Treat every share-of-voice figure as a sample with real error around it, not a position.
• It is a sample, not a census. 20–40 prompts across the assistants your buyers use. Real coverage of your category, not every phrasing that exists.
• It cannot make people write about you. The largest single factor in citation is whether independent sources discuss you. The audit will tell you plainly when that's your bottleneck, and what the gap looks like - but earning those mentions is months of unglamorous work, not a fix-list item.
• It is a diagnosis, not implementation. You get the baseline, the scored gates, and a prioritised fix list specific enough to hand to a developer. Someone on your side does the work. If you want it executed for you, that's a different engagement and it's on the /fix/ page too.
• The score is not the deliverable. The citation baseline is reported raw - observations, who got named, what got cited - not compressed into a number. The 100 points here exist to order the fix list, not to give you a metric to screenshot.

Every audit includes one recheck at 90 days: the same prompt set, the same engines, the same method, on a stated date. The prompt set is frozen at the first baseline and never edited, because comparability is the only thing that makes the second run mean anything.

If the numbers went down, that gets written down too.

The GEO Audit runs this rubric plus a citation baseline across the major assistants, records who gets named instead of you, and returns the three things to fix first - with a 90-day recheck against the same prompt set.