How to Run a GEO Audit: The Six-Gate Method (2026)

A GEO audit answers one question: when a buyer asks ChatGPT or Perplexity about your category, can the engine reach your pages, read them, and cite you — and if not, which gate is closed. I run it as six pass-or-fail gates, in dependency order: access, index, extractability, structured data, entity, citations. Each gate has an exact test, a known passing output, and a fix. The whole pass fits in an afternoon.

A GEO audit is a structured check of whether generative engines can crawl your pages, find them in the index they search, extract a self-contained answer, and resolve who you are — the four things that must be true before any AI quotes you.

Who should run it: anyone on your team who can open a terminal. Everything is on this page — commands, passing output, fixes — because a procedure with held-back steps is a brochure. Run it yourself today. Or read gate one, recognize your own CDN config in it, and decide this is a job to hand off. Both endings are fine with me.

In a March 2026 G2 survey of 1,076 B2B software buyers (reported by Demand Gen Report), 51% said they now start research with an AI chatbot more often than with Google — up from 29% a year earlier. One survey, not a census. But shortlists are being drafted in chat windows now, and nobody sees the brands that didn't make them. An afternoon is cheap against that.

One warning before gate one. Most "GEO audits" in circulation are SEO checklists with AI pasted into the headings. The checks that move citations — does your WAF let AI bots through, do you exist in Bing's index — are exactly the ones they skip. Which is why they're gates one and two here.

Gate 1: Do AI crawlers actually get your pages?

Start at the door. If the bots feeding the answer engines can't fetch your pages, nothing downstream matters — and this is the gate that fails most often, usually without anyone having decided it should. robots.txt is rarely the culprit. The block lives one layer down, in a WAF or CDN rule that 403s anything labeled "scraper", including the bots your robots.txt explicitly welcomes.

In July 2026 I scanned 72 SaaS domains for exactly this failure. writer.com — an AI writing company — allows the AI crawlers in robots.txt while its WAF returns 403 to six of them, GPTBot, ClaudeBot, and PerplexityBot included. OAI-SearchBot alone passes: someone whitelisted one bot and shipped it. beehiiv.com serves 429 to ChatGPT-User — the fetcher OpenAI fires when a user asks ChatGPT to open or read a page mid-conversation, not a click-through bot — so every reader who asks ChatGPT to summarize a beehiiv newsletter watches the fetch die.

A clean robots.txt is not evidence. The curl is.

— Ruslan Kutumbaev

How to test it. Fetch your homepage as each bot and print the status code:

for bot in GPTBot OAI-SearchBot ChatGPT-User ClaudeBot PerplexityBot Googlebot; do
  printf '%-14s ' "$bot"
  curl -sL -A "$bot" -o /dev/null -w '%{http_code}\n' https://yoursite.com/
done

Then run one request with no -A flag as a control. If bare curl also gets a 403, your WAF blocks curl itself, and your server access logs become the ground truth instead.

Pass looks like: a column of 200s, control included. A 403 is a WAF block. A 429 is rate-limiting. A redirect into a challenge page is a closed door with extra steps.

What to fix: not robots.txt — the bot-management rules in your CDN or WAF console. Find the rule producing the 403 and allowlist the verified AI crawlers. There's a date on this one: from September 15, 2026, Cloudflare default-blocks Training and Agent crawlers on ad-monetized pages (announced July 1, 2026), and a multi-purpose bot gets caught wherever its Training use is blocked. If you're behind Cloudflare, know what your zone will do before that morning. Full token list and a copy-paste robots.txt: AI crawlers explained.

Gate 2: Are you in the index ChatGPT reads?

Teams pour quarters into Google and never open Bing Webmaster Tools. ChatGPT's live search leans on Bing's index — in Seer Interactive's February 2025 analysis, about 87% of ChatGPT citations matched Bing's top organic results for the same query (Seer Interactive, February 2025). Rank first on Google while absent from Bing and ChatGPT cannot cite you. Not won't. Can't — an engine doesn't quote pages it never retrieved.

How to test it. Search site:yoursite.com on bing.com and look for your money pages: pricing, docs, the articles that earn you leads. Then register in Bing Webmaster Tools and read the coverage report — the site: query is the spot check, the report is the source of truth.

Pass looks like: key pages indexed, sitemap submitted and read, no mass exclusions in coverage.

What to fix: register, verify, submit the sitemap, turn on IndexNow so updates get pushed instead of waiting for a crawl. Twenty minutes. The best-spent twenty minutes in the whole audit, and almost nobody spends them.

Gate 3: Can an engine lift a clean answer from the page?

Engines quote passages, not pages. If your "what is X" page opens with 200 words of brand story before defining X, the model has nothing self-contained to lift — so it lifts a competitor who got to the point. Position is not a detail: one analysis of ChatGPT citations found about 44% come from the first ~30% of a page (ALM Corp's summary).

How to test it. Two checks per key page. Read the opening cold: do the first two to four sentences answer the head question with zero setup? Then confirm the answer exists in raw HTML, because most AI crawlers don't execute JavaScript:

curl -s https://yoursite.com/your-page/ | grep -c "the exact sentence you want quoted"

Zero means the sentence only exists after your framework hydrates. That's a rendering failure disguised as a content one, and the status code will never tell you.

Pass looks like: every high-intent page front-loads a direct, quotable answer — a lede that would survive being pasted into a chat reply verbatim — and the grep comes back nonzero.

What to fix: rewrite ledes to answer first and elaborate second. Add a bolded one-line definition near the top. Put comparisons in real tables. If the grep failed, the fix is server-side rendering or prerendering — the mechanics are in why your SaaS is invisible in ChatGPT.

Gate 4: Does your structured data validate — and tell the truth?

Structured data tells engines what a page is: an Article, an FAQ, an Organization, a named author. It won't buy a citation on its own, but it removes ambiguity, and ambiguity is where you lose ties.

How to test it. Run each key URL through Google's Rich Results Test and the Schema.org validator. Confirm Article with a real author, FAQPage on any visible Q&A block, Organization and Person joined by stable IDs. Then do the check no tool runs for you: put the markup next to the rendered page and confirm they describe the same thing.

Pass looks like: clean validation on all four types, author and publisher referenced by ID rather than re-described inline, and every marked-up question and answer visible on the page, verbatim.

What to fix: syntax errors are the easy half — the validators point at the line. The honest half is deleting or rewriting markup that describes a page that doesn't exist. A FAQPage block can validate perfectly while listing questions that appear nowhere in the visible content, and that mismatch is how structured data gets ignored, or worse. A green checkmark means well-formed. It does not mean true.

Gate 5: Can the model resolve who you are?

When your brand string, your founder's name, and your one-liner drift across your site, LinkedIn, and your docs, the model can't fuse them into one entity. An unsure model hedges — and cites the competitor it understands. The bar is higher than it looks, because engines already lean toward citing independent pages about a brand over the brand's own copy; Semrush's research on which sources AI cites lays out the pattern. To be the exception an engine cites directly, you have to be trivially easy to resolve.

How to test it. Read yourself like a stranger. Open your homepage, footer, /about page, LinkedIn profile, and docs side by side. Compare the brand string byte for byte, the author name and bio, the one-line description. Then check the schema layer: Person and Organization with sameAs links pointing at those exact profiles.

Pass looks like: one canonical brand string and one author identity, identical everywhere, reinforced by linked structured data.

What to fix: pick the canonical strings and enforce them. "Acme" in the logo, "Acme Inc." in the footer, "Acme Software" in the schema — each fine alone, together a blurred entity. The full mechanics are in the GEO guide for technical SaaS.

Gate 6: Who gets cited instead of you?

Gates one through five establish that you can be cited. Gate six measures whether you are — and names who is, when you aren't.

How to test it. Write ten questions a real buyer would ask about your category — buying-intent, no brand names — and run them by hand through ChatGPT, Perplexity, and Google AI Overviews. The prompt shape that works: "best [category] for [specific team or constraint]" — say, "What's the best feature flag platform for a 20-person engineering team?" Record every brand mentioned and every source cited. The prompts where a competitor is named and you aren't are the gap list, and the gap list is this audit's real deliverable.

I ran that scan across dev-tool categories on July 19, 2026 — Perplexity only, one pass, six buying-intent prompts per category, so read it as a snapshot, not a study. Incumbents were losing their own categories: auth answers went to Kinde and PropelAuth over Auth0, feature flags to Statsig over LaunchDarkly, background jobs to Trigger.dev and Inngest over Temporal. Whatever the engines are optimizing for, it isn't funding round.

Run the same prompts on yourself before you fix anything, and write the result down. My own baseline, same date, 24 prompts across engines: 1 mention, 1 citation. Publishing that number stings less than not knowing it — and a baseline is the only way progress ever becomes visible.

Then make the measurement permanent. Add GA4 referral tracking for chatgpt.com, perplexity.ai, and the other assistant domains so AI-driven visits show up in analytics. If you want a running number, paid trackers sample prompts on a schedule and report citation share — compared by budget tier here — but track the right number. SparkToro's Rand Fishkin, whose team ran 2,961 prompts across ChatGPT, Claude, and Google's AI Overviews, is blunt: "any tool that gives a 'ranking position in AI' is full of baloney" (SparkToro). Their runs put the odds of the same prompt returning the same brand list twice at under 1 in 100 — while the consideration set, the handful of brands that keep reappearing, held steady at 55–77% of responses. Appearance share across many runs is signal. A single "AI rank" is noise wearing a dashboard.

Pass looks like: a ranked gap list, a written-down baseline, and appearance share tracked over time.

What to fix: whichever upstream gate explains each gap — and the urge to buy a tracker on day one. A tracker pointed at a site that fails gates one through three is a precision instrument aimed at a closed door.

The scorecard

Six gates, six rows. Any single failed row can be the whole story of why you're not cited.

The copy-paste checklist

Run top to bottom. Stop at the first failure, fix it, re-run — each line maps to the gate with the same number.

[ ] 1. curl -sL -A "GPTBot" -o /dev/null -w '%{http_code}\n' https://yoursite.com/  → 200
[ ] 1. Same check for OAI-SearchBot, ChatGPT-User, ClaudeBot, PerplexityBot, Googlebot — then once with no -A as a control
[ ] 2. Registered + verified in Bing Webmaster Tools; sitemap submitted
[ ] 2. site:yoursite.com on Bing shows your money pages
[ ] 3. Top pages answer the head question in the first 2–4 sentences
[ ] 3. curl -s <page> | grep "<sentence you want quoted>" finds it in raw HTML
[ ] 4. Rich Results Test + Schema.org validator pass for Article / FAQPage / Organization / Person
[ ] 4. Markup matches the rendered page, question for question
[ ] 5. Brand string + author bio byte-identical on site, LinkedIn, docs
[ ] 5. Person + Organization schema joined by stable IDs, with sameAs
[ ] 6. 10 buying-intent prompts through ChatGPT / Perplexity / AI Overviews; gap list written
[ ] 6. Baseline recorded; GA4 tracking chatgpt.com + perplexity.ai referrals

What to do with the results

Fix in gate order. Failures in gates one through three are fast to close and they gate everything else — close them, re-run, and only then spend time on entity work and citation gaps. If all six pass and citations still don't come, the bottleneck has moved to authority and freshness, the longer game the GEO guide for technical SaaS covers.

Then schedule it. Re-run gates one and two after any deploy that touches robots.txt, CDN rules, rendering, or routing — those break silently, overnight, without a diff anyone reviews. Run all six quarterly, because freshness is a citation signal you manufacture by updating: in Seer Interactive's July 2026 study of 47,097 LLM citations, 75% of cited pages had been updated within the past year, and refreshed old pages out-cited genuinely new ones (Seer Interactive, July 2026).

That's the whole audit — the same six gates I run on client domains, and the ones I ran on this site first, which is how I can quote my own baseline instead of a stock screenshot. If you'd rather hand it over, I run it as a fixed-scope service: the full bot-fleet access scan, a citation scan across buying-intent prompts in your category, and a fix list in priority order. While the founding offer runs it's free, in exchange for the right to publish the results as a case study — the GEO audit.

Start with gate one today. Six lines of bash, two minutes, and it's the gate most likely to be quietly failing on your domain right now.

Sources and further reading

• G2 — March 2026 survey of 1,076 B2B software buyers, via Demand Gen Report: 51% now start research with an AI chatbot, up from 29%
• Seer Interactive, February 2025 — 87% of SearchGPT citations match Bing's top results
• Seer Interactive, July 2026 — content recency and AI visibility: 75% of LLM-cited pages updated within the past year
• ALM Corp — 44% of ChatGPT citations come from the first third of content
• Semrush — which sources AI engines cite
• Cloudflare — AI-crawler defaults change September 15, 2026 (published July 1, 2026)
• Google — Rich Results Test and structured data documentation
• Microsoft — Bing Webmaster Tools
• SparkToro (Rand Fishkin) — AI brand recommendations are highly inconsistent; track appearance share, not an "AI rank"