Audit Methodology: How We Score AI and Search Visibility

By Muntazir · Published 15 January 2026 · Updated 27 September 2026

Most website scores are a black box: a number, a colour, and no way to check the work. Most SEO audit methodology pages are not much better — a list of four or five categories, and no arithmetic.

This page is the opposite. It sets out exactly what the free AI visibility audit looks at, where every piece of evidence comes from, and the arithmetic that turns those findings into a score — including the parts that make the number look worse than a more flattering method would.

If you would rather read the numbers than the prose, the short version is: 273 checks, 21 data sources, penalties weighted 22 / 9 / 3 / 1 by severity, and a free scan that is explicitly capped below 100 because it did not look everywhere.

What the audit actually checks

The checklist holds 273 individual checks. They are organised into 45 report sections, and those sections sit under five questions written the way a business owner would ask them:

Underneath those headings sit the specifics: robots.txt rules and AI-crawler access, noindex and canonical tags, redirect chains, broken internal links, JSON-LD validity and the links between entities in it, heading structure and answer-first phrasing, hreflang, Core Web Vitals, image weight, accessibility, HTTPS and transport security, email authentication (SPF, DKIM, DMARC), review presence, company-register records, and backlink authority.

A handful of checks are conditional. E-commerce checks only run on shops, publisher checks only on publishers, and change-over-time checks need a previous run to compare against. Because their absence says nothing about the scan, they are excluded from the coverage maths described below rather than counted as gaps.

Where the evidence comes from

Nothing in the report is asserted from a model’s general impression of your brand. Every finding traces to something we fetched. There are 21 collectors, plus DNS resolution and a headless browser render supplied by the platform the audit runs on.

Every scan, free or full:

• Your pages over plain HTTP, fetched the way a simple crawler would — and again with a browser user agent, to catch sites that only open for real browsers
• DNS records
• robots.txt and the AI-crawler directives in it
• XML sitemaps
• /.well-known/ files, including llms.txt — see what llms.txt is and whether it does anything
• Wikidata, for an independently verified business identity
• Google Safe Browsing
• Ahrefs Domain Rating

Full scan only:

• A multi-page crawl of your most important pages, rather than the homepage alone
• A headless browser render, so we can compare what a bot sees with what a person sees
• PageSpeed Insights and the Chrome UX Report for real-world field data
• Google Business Profile data via the Places API
• Trustpilot
• Companies House, for UK businesses
• Brave Search and DataForSEO, for how you appear in results today
• Common Crawl, which is a common ingredient in AI training data
• Tranco for site popularity, Mozilla Observatory for security posture, crt.sh for certificate history, and the Wayback Machine for how long the business has been visible online

Where AI models are used, and where they are not

Language models feed one part of the checklist, not all of it. They produce the AI-visibility section outright, and contribute to four others: competitor share of voice, topic coverage, keyword gaps, and presence in AI training data. Within that part they work in two roles, deliberately never blended.

As an analyst, a model reads evidence we already collected — your page text — and judges things like whether your category is stated clearly. It never invents facts about you; it only interprets what was retrieved.

As a subject, a model is asked what it already knows about your brand, with no context supplied at all. Supplying context would defeat the purpose. This is the actual AI-visibility measurement, and because model output varies between calls, it is not treated as a single answer: every model is asked twice, and the result is reported as a hit rate rather than a yes or no. A single lucky mention is not visibility.

Two different questions: recall and recommendation

Being known and being recommended are not the same thing, and a business can have one without the other. The audit measures them separately.

The recall probes ask what a model already holds about you. Three questions, with nothing else supplied:

• What is {brand}?
• Where is {brand} based?
• What does {brand} sell or provide?

The recommendation probes ask the question a buyer actually types — and your brand name is deliberately absent from it:

• Best {category} in {location}? List the top options.
• Who are the best {category} providers? List the top options.
• I need a {category} in {location}. Which would you recommend and why?

German audits ask the same six in German, phrased the way the query is really typed rather than translated word for word.

The category is not something you fill in. It is derived by the analyst from your own page text, so the question asked is the one your customers would ask — not the one you would like to be asked. Anything that named your brand in the prompt would be answering a different question entirely.

That inversion is the point of the exercise. A business can score perfectly on recall and never once be recommended, and recommendation is what produces customers. Every company named in those answers is extracted, which is also where the competitor list in your report comes from: the competitors are whoever the models named instead of you.

The panel is fixed on purpose

Both sets of probes run against a fixed panel — three models from three different vendors, OpenAI, Google and Anthropic, each asked every question twice. That is 36 model responses per full audit.

Two things about that are deliberate.

The audit measures models, not assistant products. A chat assistant is a wrapper: it adds its own retrieval, its own system prompt and its own release schedule on top of a model. The model underneath is the part that either holds a picture of your business or does not, and it is the part that the wrappers have in common.

The panel does not rotate between runs. If the models changed each time, your hit rate would move for reasons that had nothing to do with your website, and two audits of the same site would not be comparable — which would make the number worthless for the thing it is for, namely watching it change after you fix something. A stable panel is what lets “2 of 6 became 5 of 6” mean anything.

The panel may widen later. When it does, this page will say so, and your report names the models that answered it, so you can always check which panel produced your number.

The rest of the audit is deterministic code over fetched evidence. If you re-run it against unchanged inputs, you get the same answer.

How the score is calculated

The score starts at 100 and subtracts for problems found. Each finding carries one severity, and each severity has a weight:

The weights are steep at the top on purpose. “AI crawlers are blocked” should visibly dominate a dozen cosmetic warnings, because in practice it does.

The ceilings matter for a subtler reason. Without a limit, a site with sixteen medium findings and a site with six both bottom out, and the number stops distinguishing “needs work” from “unusable”. But a hard cap creates a worse problem: we tested one, and past a certain point a site could fix eight genuine issues and watch the score not move. That is technically true under a hard cap and useless as a report.

So each severity’s penalty saturates towards its ceiling instead of hitting it:

penalty = cap × (1 − 1 / (1 + count × weight / cap))

The curve is strictly decreasing in the number of findings everywhere, with a long tail rather than a cliff. Every individual fix moves the number, even on a site with a great many problems. The four ceilings sum to 80, so a site where everything is wrong approaches 20 rather than 0. Zero is reserved for the one case that honestly describes: nothing could be measured at all.

The report shows a score ladder — how far the number climbs as each area is cleared — and every rung is recomputed through the same function as the headline score, so the two can never drift apart.

Why a free scan is capped below 100

This is the part most audit tools get wrong, and we got wrong ourselves before we fixed it.

A score that starts at 100 and subtracts for problems quietly rewards a scan for the checks it never ran. A free scan skips the crawl, the render, PageSpeed and most off-site sources, finds fewer problems as a direct result, and lands above the full scan of the same site. That is not a theoretical worry. On one German site, the free scan returned 72 and the full scan of the same homepage on the same day returned 64.

The fix is to stop treating “we did not look” as “nothing wrong there”. A free scan can only award the share of the 100 points it actually verified:

score = earned × (checks verified ÷ checks on the list)

The remaining points are unearned rather than assumed clean. A free report therefore shows a provisional ceiling — worded like “Provisional — 71 of 100 verified”, with the actual figure computed from that run — instead of a settled score, lists which areas went unchecked and how many checks each holds, and carries no letter grade, because a letter grade reads as a verdict and part of that one would be guesswork.

Full scans are not discounted this way. We do not credit a site for work we skipped, and we do not charge it for our own outages either: if a source fails on us during a paid scan, that is our problem, not a mark against your site.

What the number means

The headline score measures readiness, not popularity. It is a composite of everything on the checklist — whether bots can reach you, whether your pages are understandable, whether the site is fast and usable, whether there is independent evidence the business is real, and the technical housekeeping underneath. It is not the share of AI answers that recommend you, and it should not be read as one.

That second figure exists too, and it is reported separately: the AI hit rate, shown with its own denominator — how many of the model responses named your brand, out of how many were asked. The two numbers answer different questions. A site can be highly ready and barely known, which is the normal state of a business that has just fixed its website; and a well-known brand can sit on a site that machines struggle to read.

On a full scan, the score maps to a band and a grade at the same thresholds:

• 85 and above — Ready for AI search (A)
• 70–84 — Mostly ready (B)
• 55–69 — Some real gaps (C)
• 40–54 — Losing visibility (D)
• Below 40 — Needs urgent work (F)

If too much of the site was unreadable for the number to mean much — where unmeasured checks outnumber measured ones — the report says so and marks the score provisional rather than presenting it as a verdict.

Not measured is not the same as failed

Sources fail. They time out, rate-limit us, break their own API, or answer perfectly while holding nothing about you. Collapsing all of that into one “failed” state has caused real defects in this audit more than once, so the engine records the difference explicitly: whether a source answered with data, answered authoritatively with nothing, timed out, was never reached, returned a 5xx, or rejected the request outright.

That distinction drives everything downstream — whether we retry, how long the answer is cached, and what the report says about it.

In your report it comes out as three different statements, which need three different responses:

• A failed check is a confirmed problem, with the evidence attached. Fix it.
• Not measured means we reached no conclusion. Investigate it manually if it matters to you; on a full scan it is excluded from the score rather than counted against you.
• Does not apply means the check is not relevant to your site — shop checks on a site that sells nothing. Ignore it.

When the whole run is given a deadline and passes it, sources that have not started are abandoned and reported as “not measured, ran out of time”. They are never reported as a zero. A chart plotting zero for “we did not look” is a lie with a shape.

What this audit does not claim

It does not predict rankings, and it does not promise that fixing everything will put you in an AI answer. Nobody can promise that; see AI search versus Google rankings for why the two behave differently.

It does not reward keyword density. Repetition makes information harder to read, and nothing in the scoring gives credit for it.

It does not confirm claims that no public source supports. If your business genuinely has 400 five-star reviews but none of them are anywhere we can reach, the audit will report what the public record shows, not what you tell it.

Working through a low score

Start at the top of the list. Critical and high-severity findings are weighted as heavily as they are because they are usually the ones actually costing you visibility, and the report ranks them by impact rather than by section order.

Then look at what went unmeasured, and decide whether a manual check is worth your time. After that, medium and low findings — but do not hold up an important fix to chase a perfect number. The goal is being found and understood, not a decorative score.

If you want to see the method applied to your own site, the free audit runs in about a minute and does not ask for an email address. Questions about any of the above are welcome — the author of this page is Muntazir, and the contact page reaches a person.