What the scan checks

This is the complete catalog of every check the free scan runs against a site. It is the answer to “what are all these checks?” For any single failing check, the fix guides tell you exactly how to resolve it; this page is the map of the whole territory.

Two vocabularies describe the same 93 check codes, and it helps to know which is which. Ninety-two of them run on a scan today: S14 was retired in July 2026 (it was a backlink check with no data source behind it), and its code is kept reserved so older reports still render their S14 row.

The ten layers are what your scan report drills into: Bot Wall, Crawler Gate, Ghost Content, and so on. They name what is actually failing, in plain language. The report’s scorecard groups them under five parent categories (Crawl Access, Structured Data & Context, Entity & Reputation, Answer Liftability, Site Foundation), each with a severity-weighted score and a named band; expanding a category shows its layers, and each layer its checks.
The codes (T1, C16, E3…) are the stable identity of each check. They never change, and they are what the fix guides, the evidence and the API are keyed by. This catalog is ordered by code, because that makes it a reference you can look things up in.

The ten layers your report shows

The scorecard shows the categories in a fixed order (the same order as the score dials at the top of the report) and every layer keeps its own pass count. Every check below belongs to exactly one layer.

Parent category	The buyer question	Nested layers	Weight
Crawl Access	Can AI reach and render your pages?	Bot Wall · Crawler Gate · Ghost Content	30
Structured Data & Context	Does AI know what this page is?	Schema Trust Layer · llms.txt Handshake · Agent Interface	20
Entity & Reputation	Does AI know who you are?	Entity Fingerprint	15
Answer Liftability	Can AI quote a clean answer from you?	Answer Liftability	20
Site Foundation	Do your site and page basics hold?	Site Floor · Page Floor	20

The weights are relative units (105 in total) and decide how much each category moves the single Readiness score (a severity-weighted index, 0–100). Crawl Access carries the most because nothing further down the list can matter if an engine cannot reach the page in the first place.

Layer	What it claims	Checks
Bot Wall	Your CDN or WAF is challenging AI crawlers, and you never knew.	R5, A4
Crawler Gate	Whether GPTBot, ClaudeBot and PerplexityBot are allowed in at all.	R1–R8, S2, T6, A1, A14
Ghost Content	Your page renders for humans and is blank to crawlers that do not run JavaScript.	S1, T1, T2
llms.txt Handshake	The files and headers that hand curated context to the engines that read it.	L1, L2, T11, A2, A3
Schema Trust Layer	The structured data engines lean on to know what your page is.	T3, S13, S16, S17
Answer Liftability	Whether an engine can lift a clean, quotable answer out of your prose.	C1–C20
Entity Fingerprint	Who the AI thinks you are, and whether that matches who you are.	E1–E16, S15
Site Floor	The domain-level basics that decide whether any single page can win.	S3, S6–S12, S14 (retired)
Page Floor	The page-level basics that decide whether this page can be read and attributed.	T4, T5, T7–T10, T12–T15, S4, S5
Agent Interface	The emerging agent-web standards that let AI agents discover and operate you. Not-applicable when absent, so they can only add to your score.	A5–A13, A15

Two things about that table look odd and are deliberate. Some concerns appear in two layers (HTTPS is S8 in Site Floor and T9 in Page Floor) because the scan genuinely measures them twice and the answers can differ: Site Floor is what is true of your domain, Page Floor is what is true of the page we audited. And a layer is not the code prefix (S4 and S5 sit in Page Floor) because the layers name the scope of the measurement, not the letter the check happens to start with.

How the scan works through them

Site pre-flight (S1–S17) looks at your domain as a whole: can engines reach it, index it, and trust its shape?
Crawler access (R1–R5, L1–L2) reads your robots.txt and llms.txt: are you letting the right AI bots in, and are you helping them?
The page audit grades an individual page across three layers: Technical (T1–T15), Content (C1–C20), and Entity (E1–E16).
Schema validates your structured data against the schema.org types AI engines actually lean on.

How to read a result

Every check returns one of four states:

Pass the check is satisfied.
Fail a real problem the scan is confident about.
Warn something to look at, or a check the scan could not fully verify from its vantage point (for example, a page behind a bot-management challenge). A warn is never a fake pass.
N/A not applicable to this page (for example, author checks on a homepage, or hreflang on a single-locale site).

Checks are also tagged OBSERVED or INFERRED. Observed checks are mechanical: the scan read the HTML, the header, or the JSON-LD and saw the fact directly. Inferred checks are an AI judgment reading your content (for example, “does the page open with a real answer?”), and the evidence carries the model’s reasoning. Some entity and brand-mention checks light up only on a deep scan, because they need branded-search data the free scan does not pull.

Site pre-flight (S1–S17)

The domain-level floor. If the site cannot be reached, indexed, or parsed, nothing a single page does can rescue it, so these run first. S14 is absent from the list below on purpose: it was retired in July 2026 because it could only ever tell you it had not checked anything, and its code stays reserved rather than reused.

Check	What we check	Why it matters for AI search	Fix guide
S1	The homepage, fetched as an AI crawler, carries real content in the raw HTML without needing JavaScript.	Most AI crawlers do not run JavaScript. Content that only appears after render is invisible to them.	S1
S2	`robots.txt` is free of the four never-dos: a blanket `Disallow: /`, blocked search or user bots, and a `Crawl-delay` of 30 or more on an AI crawler. A `Crawl-delay` aimed at other bots (SEO or scraper tools) is deliberate on most sites and does not fail this check.	One stray line can remove your entire site from every AI engine, silently.	S2
S3	A sample of your sitemap URLs (up to 15) mostly return HTTP 200 (95% or better), and the sampled URLs are final, canonical and indexable: we report sitemap entries that redirect, that canonicalise to a different URL, or that carry a `noindex`/`nosnippet`. We also sanity-check `<lastmod>` (a single build timestamp on every URL, or a future date, is reported), and probe one URL that cannot exist so a site that answers 200 for everything cannot pass on a meaningless sample. We only call a sitemap missing on a clean 404: a challenged, timed-out or 5xx fetch is reported as unverified instead, and we never fail this on a sample of fewer than five URLs.	Dead URLs in a sitemap waste an engine’s crawl budget and erode its trust in the file. A listed redirect costs a crawler a request it did not need to spend, and a listed `noindex` page contradicts the sitemap itself.	inline
S4	The homepage declares a `rel="canonical"` URL. We verify this on the homepage; the fix is a site-wide one.	Without a canonical, engines can index duplicate variants of a page and split the authority between them.	inline
S5	The homepage is indexable and quotable: no `noindex`, and no `nosnippet` or `max-snippet:0`, across the meta robots tag, the meta googlebot tag and every `X-Robots-Tag` header value (including repeated and user-agent-scoped ones). We also count `data-nosnippet` spans and flag any that sit inside the opening content.	A `noindex` tells engines to drop the page entirely. `nosnippet` and `max-snippet:0` are subtler and just as costly: the page stays indexed while Google’s own documentation says the content is removed from AI Overviews and AI Mode as direct input.	S5
S6	Lab Largest Contentful Paint is under 2.5 seconds. This is PageSpeed’s synthetic run, not field data from your real visitors, so the two can differ. The same run also reports INP and CLS: those do not decide the status, but we flag an INP over 200ms or a CLS over 0.1. When the largest element is text (an image-less hero) the simulation is known to overstate webfont impact, so a failing simulated number alone never fails the check: real-user (CrUX) data decides when Google has it, and otherwise the check reports the limitation instead of a fail. The evidence always names which measurement produced the deciding number.	Slow pages get crawled less and rank lower in the SEO layer that still feeds AI answers.	inline
S7	A `viewport` meta tag is present. We check for the tag only; we do not compare your mobile and desktop content.	Engines evaluate the mobile version of your page; a missing viewport signals a non-responsive experience.	inline
S8	The site answers over HTTPS with a certificate we accept. When the scan has a fetch slot for it, we also send a plain `http://` request and check that it is upgraded with a 301: a 302, 307 or 308 upgrade is reported as a temporary redirect, because it tells engines the http URL is still the real one. HSTS is not tested.	Insecure pages are distrusted and are far less likely to be cited, and a temporary redirect splits your signals across two schemes.	inline
S9	The homepage has at least three contextual internal links. Absolute, root-relative and relative links all count (we resolve each link and compare hosts); links to other hosts, including protocol-relative CDN links, do not.	Internal links spread crawl paths and pass topical context between your pages.	inline
S10	Informational: whether `hreflang` tags are declared, whether their language and region codes are real ISO codes, and whether the set includes a self-referencing entry. We do not verify reciprocity (that needs fetching every locale variant), and a site with no hreflang is never counted against.	Broken hreflang serves the wrong language version to engines and users, and a set with no self-reference is discarded whole. No AI engine documents hreflang support, so this matters via Google and Bing-grounded surfaces. N/A for single-locale sites.	inline
S11	Title length is 30–60 characters and the description is 120–160.	Over-long metadata gets truncated in the snippet an engine actually reads.	inline
S12	Exactly one H1 on the homepage. The status is based on the H1 count alone; alongside it we now walk the heading order and report skipped levels (an H2 followed by an H4) and pages where more than a fifth of headings are H4 or deeper.	Clean hierarchy maps your structure for extraction; 68.7% of cited pages have it.	inline
S13	The homepage’s JSON-LD parses as valid JSON.	Invalid JSON-LD is silently ignored by every consumer, so broken markup does nothing at all.	inline
S16	The structured data is not just present, it is complete and clean: enough of the recommended properties are populated, every entity clears the six-property floor, and there are no duplicate Organization/WebSite nodes. Graded against your schema’s overall completeness score.	Present-but-thin or duplicated schema underperforms — measured citation rates put thin generic markup below no markup at all, and duplicate entities give engines competing definitions they cannot reconcile. Presence alone (T3, S13) is not enough.	inline
S17	You have the schema types your kind of business needs. The scan works out what kind of business the site belongs to (from its own markup where it declares one, otherwise a labeled best-fit judgment — the reasoning is shown) and checks the expected set for that kind: a financial advisory is expected to carry Organization, FinancialService and Person; a home-services company HomeAndConstructionBusiness and Service; a product brand Product. A missing required type fails the check; a missing recommended type warns; the missing types are named with what each would do for you.	A business missing its entity spine can otherwise look good on paper — one small-but-complete schema block used to outscore a site with no Organization at all. Engines can only answer “who does X” with your name if the types that say what you are exist. S16 grades the schemas you have; this check asks whether you have the right ones.	inline
S15	Third-party brand-mention volume is stable or growing (deep scan).	Brand mentions out-predict backlinks for AI citations (0.664 vs 0.218 correlation), so a declining mention footprint is an early warning.	inline

Crawler access: robots.txt and llms.txt (R1–R8, L1–L2)

A closer read of the two files that govern how AI bots treat your site. robots.txt decides who gets in; llms.txt is the optional file that hands curated context to the engines that read it.

Every verdict below is produced by a single RFC 9309 parser (longest-match, with same-token groups merged), the same one that decides which URLs our own auditor may fetch. That matters for two shapes that a simpler reading gets wrong: a Disallow: / softened by one narrow Allow: is still a block, and a CDN that appends a second block for the same bot is merged with the first rather than evaluated on its own.

Check	What we check	Why it matters for AI search	Fix guide
R1	No production `User-agent: * / Disallow: /` wipeout.	A staging `robots.txt` accidentally shipped to production removes the whole site from every crawler at once.	R1
R2	What share of your published URLs each search-grounding and user-triggered AI bot may actually fetch. We evaluate your homepage plus up to 200 sitemap URLs against the rules governing each crawler, and fail below 80% fetchable, naming the disallowed path prefixes.	The 2026 pattern is not a blanket block: it is allowing the crawler and then disallowing the paths your content lives on (`Disallow: /blog/`). That reads as “allowed” if you only look at the site root, and it removes exactly the pages you want cited.	R2
R3	Training bots are not panic-blocked. A bot our own registry recommends blocking by default (an unverifiable crawler such as Bytespider) is reported as compliance, not as a finding.	Blocking training bots is a licensing or IP decision, not an AEO lever. It is legitimate only when that rationale genuinely applies, and should never be extended to search or user bots.	R3
R4	No `Crawl-delay` of 30 or more governing an AI crawler. A delay aimed at other bots (SEO or scraper tools) does not count against you.	Googlebot ignores `Crawl-delay`, but most AI bots honor it. A value of 30+ caps a bot under 3,000 pages a day.	R4
R5	The CDN or WAF lets verified AI crawlers through, matching what `robots.txt` promises. We now also request `/robots.txt` itself with an AI-crawler user agent and compare it to the browser fetch.	If `robots.txt` says “allow” but the edge challenges the bot’s user agent, the file is a promise the WAF is quietly breaking. If the wall covers `/robots.txt` too, the permission itself is unreadable to the crawlers it was written for.	R5
R6	`robots.txt` is served correctly: status class, size, content type and redirect hops.	The load-bearing case is a 5xx. While `robots.txt` returns server errors, well-behaved crawlers treat your entire site as disallowed (RFC 9309, and Google documents the same behaviour), which is worse than any rule the file could contain. A clean 404 is the opposite: absent means allow-all, and is fine. Over 500 KiB, crawlers stop parsing.	—
R7	`robots.txt` declares your sitemap with a `Sitemap:` line.	AI crawlers have no Search Console. `robots.txt` is their only sitemap discovery path, so an undeclared sitemap is found only if a crawler guesses the conventional filename.	—
R8	Training opt-out tokens (`Google-Extended`, `Applebot-Extended`) declared in `robots.txt`. Informational: reported, never scored.	These are robots tokens, not crawlers, so they block nothing from fetching you. They opt your content out of model training while leaving search and answer citation untouched, which makes them a legitimate choice rather than a defect in either direction.	—
L1	An `llms.txt` file is present.	A low-cost hedge that hands curated context to engines that read it. Adoption is still early, but the cost of publishing is near zero.	L1
L2	The `llms.txt` follows the full authoring rule set: one H1 + pitch, 20–60 described links in absolute URLs under H2 sections, production-only, not robots-blocked.	Every violated rule is reported separately; curation and quoteability are what make the file useful to an engine, not a raw URL export.	L2

Page audit, Technical layer (T1–T15)

The render-time floor for a single page. T1 to T3 gate the rest of the page audit: if an engine cannot fetch the page, read its content in raw HTML, or find its schema, the content and entity checks cannot mean anything.

Check	What we check	Why it matters for AI search	Fix guide
T1	The page returns HTTP 200 to AI-crawler user agents (GPTBot, ClaudeBot, PerplexityBot, bingbot).	If the bot gets a block or a challenge instead of the page, you are invisible regardless of how good the content is.	T1
T2	The answer content is present in the raw HTML, with no JavaScript required. We measure two ratios: how much of the page’s opening content is in the raw HTML (this decides the status) and how much of the whole rendered document is (this is reported, and warns when the two diverge). We also flag raw HTML over 1.5MB.	Non-rendering crawlers see only the raw HTML. Lead content injected by JS is content they never read, and a page that server-renders its hero while building the body in JavaScript looks fine on the opening ratio alone.	T2
T3	JSON-LD is present in the raw HTML (not client-injected). We also parse the rendered DOM, so schema that only appears after JavaScript runs is diagnosed as client-side injection rather than reported as “no schema”.	Schema added by JavaScript after load is invisible to crawlers that do not render, so it cannot help attribution. The two cases need opposite fixes, so we tell them apart.	T3
T4	A canonical URL is present and agrees with the other surfaces that name this page’s address: `og:url`, the URL your sitemap lists, and the URL we fetched (query strings are compared separately, so a tracking parameter is not a mismatch). If the canonical points at a page we already hold that canonicalises somewhere else again, we name the chain. We do not fetch the canonical target, so we never claim it points back.	Tells engines which URL is the real one so ranking signals consolidate instead of splitting across variants. When `og:url` and the canonical disagree, the preview surface and the index surface disagree about who you are.	inline
T5	The page is indexable and quotable: no `noindex`, and no `nosnippet` or `max-snippet:0`, across the meta robots tag, the meta googlebot tag and every `X-Robots-Tag` header value (including repeated and user-agent-scoped ones). A small `max-snippet` warns, and we count `data-nosnippet` spans that overlap the first 200 words.	A `noindex` removes the page from consideration entirely. `nosnippet` and `max-snippet:0` leave it indexed while removing your content from AI Overviews and AI Mode as direct input, which is exactly what Google documents them as doing.	T5
T6	Not scored per page. `robots.txt` is one file for the whole site, so its verdict comes from S2 and R2 and is not charged again on every page.	Same reasoning as R2: a disallowed path is a page no engine can cite.	T6
T7	Largest Contentful Paint is under 2.5 seconds. INP and CLS come from the same measurement and are reported alongside it: they do not decide the status, but an INP over 200ms or a CLS over 0.1 is flagged.	Page speed feeds the SEO layer that AEO still depends on.	inline
T8	A `viewport` meta tag makes the page mobile-friendly.	Engines assess the mobile rendering of the page.	inline
T9	Not scored per page on a scan. Every page we scan is fetched over https, so this can only ever pass; HTTPS is scored once at site level (S8). A genuinely `http://` URL still fails here.	Insecure pages are distrusted and rarely cited.	inline
T10	The page’s URL is present in the XML sitemap. We search the full sitemap inventory the scan read (up to 5,000 URLs), not a sample, and the evidence says which set was searched.	A page missing from the sitemap is a page the engine may never discover.	inline
T11	Not scored per page on a scan. `llms.txt` is one file for the whole site, so L1 owns the verdict and it is not charged again on every page.	The site-level hedge, surfaced again in the page context.	T11
T12	The title tag is 30–60 characters.	Longer titles get truncated in the snippet the engine reads, cutting off your query phrasing; under 30 characters there is not enough query surface for an engine to match the page against a real question.	inline
T13	The meta description is 120–160 characters.	Over-long descriptions get cut off mid-sentence; short ones leave the slot half-used.	inline
T14	The four required social tags are present by name: `og:title`, `og:description`, `og:image` and `twitter:card`. Counting tags is not enough, because two OpenGraph tags can be `og:site_name` and `og:type` while the three that carry meaning are absent.	Structured social metadata gives engines a clean title, summary, and image for the page.	inline
T15	Informational: whether `hreflang` tags are declared, whether their language and region codes are real ISO codes, and whether the set includes a self-referencing entry. We do not verify reciprocity, and a page with no hreflang is never counted against.	Wrong hreflang serves the wrong locale, and a set with no self-reference is discarded whole. No AI engine documents hreflang support, so this matters via Google and Bing-grounded surfaces. N/A on single-locale pages.	inline

Page audit, Content layer (C1–C20)

How well the page is written for retrieval. AI engines chunk your page and quote the chunks, so the content checks reward writing that survives being lifted out of context, one section at a time.

Check	What we check	Why it matters for AI search	Fix guide
C1	The page opens with a direct 40–60 word answer block in the first ~180 words, and each major section opens with its own. The block’s length is measured, and we check that no link or pull-quote breaks it up.	The first chunk has the highest semantic density for the page’s query, so it ranks and gets quoted first. Every section is retrieved on its own too, so each one needs its own opening answer.	C1
C2	The H1 matches the title’s query intent.	When the H1 and title target the same question, engines get a consistent signal of what the page answers.	inline
C3	At least half the section headings (H2 and H3) are question-shaped, plus the page’s heading hierarchy: one H1, no skipped levels, no H4-and-deeper overuse. A heading only counts as a question if it is written as one (“How do I cancel” or “Can I cancel?”), not “Is Included In Every Plan”.	Conversational, question-shaped headings mirror how users actually ask, and map cleanly onto the queries engines are answering. A broken outline makes the engine guess where a section starts and ends.	C3
C4	At least one real comparison table: a `<thead>` with headers that name what the column holds (“Starter plan”, not “Tier 1”), three or more data rows, two or more columns. If your comparison is built from `<div>`s instead, we name that.	Tables are high-extraction structures: engines lift them into answers disproportionately often. A CSS grid of divs looks the same to a reader and is invisible as a table to an extractor.	C4
C5	At least three content lists, bulleted or numbered, counted over the main content with the site’s own menus excluded. A list counts once it holds two or more items. We count lists; we do not judge whether the bullets are parallel, and the fix still teaches parallel phrasing because that is what makes a list liftable.	Lists convert enumerable prose into clean, quotable units.	inline
C6	A real, named byline, not “Editorial Team”, linked to an author archive page. On YMYL topics (money, health, law, safety, civics) we also look for a visible “Reviewed by” line and `reviewedBy` in the markup.	A named, credentialed author is an E-E-A-T signal; a generic byline is disqualifying on high-stakes topics, and a name that links nowhere cannot be resolved to a person.	inline
C7	The author bio links out to profile surfaces via Person `sameAs`.	Linked profiles let engines disambiguate the author as a real, trustworthy person.	C7
C8	A visible “last updated” date near the top.	An honest freshness signal readers and engines can both see.	inline
C9	The content’s schema date, in bands: fine inside 90 days (60 on YMYL), a warning past that, a problem past 12 months. An “evergreen” or “last reviewed” marker on the page softens the 12-month verdict.	Roughly half of AI citations point at content under about 13 weeks old, so freshness is a live ranking input, not hygiene. Freshness must be honest, not a fabricated `dateModified`.	C9
C10	At least two outbound citations in the body copy, at least one of them authoritative: government, academic, standards body, Wikipedia/Wikidata, or a publication of record. Footer and nav links do not count.	Citing primary sources inline is a trust signal and gives the engine corroboration to lean on. Two links to other vendors’ blogs is not a citation trail.	C10
C11	At least three internal links in the body copy, with descriptive anchor text. “Click here”, “read more” and bare one- or two-word anchors are flagged.	Internal links pass topical context and keep the crawler moving through related pages. The anchor is the only description of the destination the engine gets from this page.	inline
C12	Content images carry descriptive alt text. Filename-shaped alts (`IMG_2043.jpg`), placeholders (`image1`) and one-to-two-word alts do not count as descriptions.	Alt text is the machine-readable description of an image, and an accessibility baseline. A filename tells an extractor nothing.	inline
C13	No paragraph runs longer than ~150 words, and section lengths sit in a sane band (we flag sections over 400 words or under 40).	Retrieval works on chunks. A wall-of-text paragraph splits awkwardly across chunks and neither half stands alone; an over-long section is split across chunk boundaries so no single chunk holds the answer.	C13
C14	Acronyms are re-defined in each major section.	Chunks are retrieved without their neighbors, so an acronym defined only once, ten paragraphs up, is meaningless in the chunk that gets quoted.	inline
C15	No pronoun coupling across sections, plus the manual’s extractable-chunk test (three ~200-word windows, how many stand alone) and entity anchoring (“Acme’s pricing”, not “our pricing”).	A chunk that opens with an unresolved pronoun cannot stand alone once lifted out of context, and a chunk that says “our pricing” is a chunk about nobody.	inline
C16	At least four FAQ pairs — a pair, so a question heading only counts when at least 20 words of answer follow it. Note that Google withdrew FAQ rich results for most sites in 2023 and retired the last of that reporting in May 2026; the AI-citation value is a separate thing and is unaffected.	Verbatim question-and-answer pairs are the shape answer engines lift most readily. Question headings with nothing under them give an engine a question and no answer to lift.	C16
C17	FAQ schema questions AND answers appear in the visible on-page text, and the schema answers are not truncated versions of them.	If the schema and the page disagree, the markup is discarded. If the schema answer is a shortened version of the page’s answer, you get cited with half a sentence.	C17
C18	Word count over the main content only (navigation, header and footer excluded), against the manual’s per-format bands where we can tell the format (pillar 2,500–4,000, listicle 1,500–2,500, comparison 1,800–2,800, guide 1,200–2,000, glossary 400–800), otherwise against the intent floors.	Informational, transactional, and definitional pages have different depth targets; too thin for the format underperforms. Counting the site’s menu as content flattered thin pages.	inline
C19	No keyword stuffing.	Unnaturally repeated phrasing reads as manipulation to the model and hurts more than it helps. Write for the reader.	inline
C20	At least one cited statistic. We also record whether it is your own first-party data and how many of your numeric claims carry an “as of <date>” qualifier.	Stat-bearing chunks win citations: a concrete, sourced number gives the engine something specific to quote, and a dated number is still true when the chunk is read next year.	inline

Page audit, Entity layer (E1–E16)

Whether AI engines can recognize your brand as a distinct, real-world entity and link you to the knowledge graph. This is the layer that decides whether you get named, not just found.

Check	What we check	Why it matters for AI search	Fix guide
E1	A site-wide Organization schema with six or more populated properties. A `Service` or `Product` node is not a substitute. Identifier properties (`leiCode`, `duns`, `vatID`, `naics`, `legalName`) and `parentOrganization` / `subOrganization` are reported alongside, and a declared `leiCode` is verified against the free GLEIF register.	The entity record for your brand: it is what an engine reads to know who you are. Thin schema measured worse than no schema at all in the 2026 citation studies, so empty properties are not counted. Identifiers are never scored (most companies legitimately have none), but an LEI that resolves to a registered legal entity turns a self-asserted string into a corroborated fact.	E1
E2	A stable canonical `@id` on the Organization — and, across the pages we read, the same `@id` on each.	A stable `@id` (like `{origin}/#org`) lets every other node reference the same entity. An `@id` that varies per page creates one orphan entity per page instead of one brand.	E2
E3	A Wikidata URI in the Organization `sameAs`, in the `/entity/Q…` Linked Data form rather than the human `/wiki/` page.	Wikidata is the spine of LLM entity memory. A Wikidata link is one of the strongest disambiguation signals you can give; the `/entity/` form is the URI a Linked Data consumer resolves.	E3
E4	A LinkedIn URL in the Organization `sameAs`.	A high-authority profile that helps engines confirm you are a real organization.	E4
E5	The `sameAs` mesh covers at least three independent tiers (knowledge graph, professional, citation surfaces, review platforms, public registries), or two when one of them is Wikidata or Wikipedia. Social profiles are listed but do not count toward the mix, and each unique target gets a liveness check.	Eight links to eight social networks are eight copies of one weak signal; Wikidata plus LinkedIn plus G2 are three independent corroborations of different kinds. That is what lets an engine resolve every mention of you to one entity. A `sameAs` pointing back at your own site disambiguates you from nobody, and a profile that 404s corroborates nothing, so both are excluded and named.	E5
E6	The logo is a dimensioned `ImageObject`, not a bare string — and the same shape test is applied to any Article or Product `image` on the page.	An image with `url`, `width`, and `height` is machine-usable in a way a plain URL string is not: a consumer otherwise has to fetch the file to learn its size. The logo is the scored verdict; the other image properties are reported alongside.	inline
E7	A Person schema for the author.	Gives the author a real entity record with `jobTitle` and `sameAs`, anchoring E-E-A-T.	inline
E8	The author’s Person schema has a LinkedIn or professional `sameAs`.	Links the author to a verifiable professional profile.	E8
E9	The `publisher` is referenced by `@id`, not a bare string — and the same is checked for `author`. A `reviewedBy` credit is recorded when present.	Referencing the publisher Organization by `@id` ties the article to your entity graph. An inline author with no `@id` mints a new Person on every article, so one writer becomes twenty unreconcilable people. Publisher stays the scored verdict; author findings ride alongside.	E9
E10	NAP (name, address, phone) matches the Google Business Profile exactly. Scope-excluded rather than pending: Google Business Profile data comes from a connected account, not from fetching a site. We do report whether your schema NAP matches your own visible page. Shown only for businesses with a physical location.	Character-level consistency (“Suite 4B” vs “Ste 4B”) is what lets engines merge your listings into one entity. A site whose schema and footer already disagree cannot match a third surface, so that half is worth telling you.	inline
E11	NAP is consistent across directories (Apple, Bing, Yelp, BBB, Facebook). Scope-excluded: third-party listing data is measured in the platform’s connected-data layer, not by fetching your site. Shown only for businesses with a physical location.	Conflicting listings fracture your local entity across the web.	inline
E12	A Wikidata entity exists for the brand, and it is substantive: statement count, whether its official-website statement (`P856`) points back at this domain, its `P31` class, and whether a Wikipedia article is linked. The evidence names the exact term that was searched and where it came from.	The notability bar is low (registration plus one independent source), and the payoff for entity recognition is large. But a two-statement stub has no measured independent effect, and an entity whose official website is somebody else’s is somebody else’s entity, so neither is reported as a clean pass. A linked Wikipedia article is reported as an observation only: company notability (WP:NCORP) is a high bar and commissioning an article invites the paid-editing rules.	E12
E13	A Google Knowledge Panel is present. Needs branded-SERP data, which the free instant scan does not fetch: it is collected by the brand audit that runs once the domain is tracked as a brand.	The panel is the canary for entity confidence: it appears once the Wikidata to Wikipedia to `sameAs` spine is strong enough.	inline
E14	Three or more substantive third-party mentions on the branded SERP, plus how old the newest one is. Needs branded-SERP data from the brand audit, like E13.	Independent mentions on cited domains are what build the entity’s off-page authority; the digital-PR loop targets them deliberately. Roughly two thirds of the content AI engines cite is under a year old, so a mention footprint whose newest dated item is over six months old is worth less than the count suggests. We report the age and deliberately do not score mention velocity: nothing published supports a threshold for it.	inline
E15	A `knowsAbout` array on the Organization.	Declaring your topical areas of expertise helps engines associate you with the right subjects.	inline
E16	A Google Business Profile map embed (an iframe whose `src` contains `/maps/embed`) on the contact surface, checked on your contact page when we can read one. Shown only for businesses with a physical location; `LocalBusiness` schema presence is recorded alongside.	Embedding the exact GBP map is part of the local trust bundle that ties your site to your physical listing. A hand-built link to a maps URL is a different artefact: the Business Profile embed is the one carrying the place identifier.	inline

Agent readiness (A1–A15)

A second wave of “agent-web” standards is emerging: well-known files, DNS records, and headers that let AI agents (not just crawlers) discover your machine-readable surfaces and, in some cases, operate them. The scan probes each one deterministically and shows you the exact request and status behind every verdict.

Read this honestly. Adoption of these standards is effectively zero today, and there is no evidence any AI engine rewards them for citations yet. They are checked as near-zero-cost future-proofing and a cheap differentiator (few sites pass any of them), never as something that moves your AI visibility now. That is why not publishing any of them costs you nothing. When one of these signals is simply absent, the check returns N/A, which sits outside the score entirely: it is informational, it enters no denominator, and it can only ever add to your Readiness score by passing. A site that runs no agent infrastructure is not accused of a defect it does not have. The one thing these checks will hold against you is an explicit opt-out you declared yourself: A1 and A14 read the values of your stated AI-usage preferences, so asking engines to leave you out of AI answers is reported as a real finding.

These checks split into two groups. Being read by crawlers (A1–A4 and A14) is mildly relevant to AI visibility today, and those checks sit inside the crawler layers because they are the same family as your robots and llms.txt checks. Being operated by agents (A5–A13 and A15, the Agent Interface layer) is agent infrastructure, not visibility: only publish these if you actually run the corresponding service (an MCP server, an OAuth-protected API, an A2A agent).

Check	What we check	Why it matters	Standard
A1	The Content Signals directives in your `robots.txt`, and what their values actually say. We read the directives line by line, so a commented-out example is prose and not a declaration. `search=no` or `ai-input=no` fails: that is an explicit request to be left out of the surface this scan measures. `ai-train=no` is reported as information only, because it opts out of model training without touching crawling, search or citation. No directives at all is N/A, since an absent declaration is the default. This is the one agent-readiness check that carries high severity, because its fail state is a real finding rather than a missing nicety.	The emerging way to state your AI-usage preferences per crawler, inside the file you already publish. Your CDN may have written the line on your behalf, which is exactly why the values are worth reading back to you.	contentsignals.org
A2	The homepage returns `text/markdown` when an agent sends `Accept: text/markdown`.	A clean Markdown representation is cheaper for an agent to read than parsing your HTML. Very few sites serve it.	Markdown for Agents
A3	The homepage sends RFC 8288 `Link:` response headers advertising agent-useful relations (`service-doc`, `llms-txt`, and so on). Sending one passes; sending none, or sending a `Link` header that carries no agent-useful relations, is marked not-applicable rather than failed.	A cheap discoverability signal that points agents at your machine-readable surfaces. No engine is documented to read it, so publishing one can only help and its absence is never counted against you.	RFC 8288
A4	The site publishes a Web Bot Auth verification directory (`/.well-known/http-message-signatures-directory`).	Informational only, and marked not-applicable when absent: it lets you verify signed agents at your edge. Publishing it only ever helps; its absence is never a defect.	RFC 9421
A5	DNS for AI Discovery records exist (SVCB/HTTPS/TXT at `_index._agents`, `_a2a._agents`, `_mcp._agents`).	Points agents at your entrypoints from DNS. A nascent draft with near-zero adoption.	DNS-AID draft
A6	`/.well-known/api-catalog` is served as an RFC 9727 linkset.	Lets agents discover your APIs from one well-known catalog. On fewer than ~15 sites in Cloudflare’s dataset.	RFC 9727
A7	OAuth/OIDC discovery metadata is served (`/.well-known/openid-configuration` or `/oauth-authorization-server`).	Lets agents authenticate against your authorization server. Only relevant if you expose an authenticated API.	RFC 8414 / OIDC
A8	`/.well-known/oauth-protected-resource` is served (RFC 9728).	Tells agents which authorization server protects your resource. Only relevant for authenticated APIs.	RFC 9728
A9	`/auth.md` is served as a real markdown auth guide.	A human and machine-readable guide to authenticating with your service. Emerging convention.	auth.md
A10	A valid MCP Server Card is served. We probe three discovery paths (`/.well-known/mcp/server-card.json`, then `/.well-known/mcp/catalog.json` and `/.well-known/mcp.json`) and check the document’s shape, not just the 200: a client-side `{mcpServers: …}` config parked at one of those paths is not a server card.	Lets agents discover your Model Context Protocol server. Only relevant if you run one.	MCP server-card
A11	A valid A2A Agent Card is served, at either the canonical `/.well-known/agent-card.json` or the pre-1.0 `/.well-known/agent.json` (roughly a quarter of the cards found in the only real-world census are still at the legacy path, so we look there too). We also grade it: a card with a name plus at least one structural field the spec defines (`protocolVersion`, `url`, `skills`) is conformant, while a JSON object carrying nothing but a `name` counts and is reported as name-only, because most JSON on the web would clear that bar.	Describes your agent to other agents. Only relevant if you expose an A2A agent.	A2A protocol
A12	An Agent Skills index is served (`/.well-known/agent-skills/index.json`).	Advertises the agent skills your site offers. Near-zero adoption.	Agent Skills Discovery RFC
A13	The homepage source references the WebMCP API (`document.modelContext.registerTool`). The older `navigator.modelContext` spelling is deprecated, and we match both, so a site on either name is detected.	Lets an in-browser agent call tools your page exposes. Detected by scanning the page source, so tools registered only at runtime by JavaScript are not counted. Experimental browser API.	WebMCP
A14	Whether you declare an AIPREF `Content-Usage` preference, and what its values say. AIPREF is the IETF standards-track successor to Content Signals, and it is expressed both as a `robots.txt` rule and as a response header, both of which the scan already holds, so this costs no extra request. Absent is not-applicable: the standard is unfinished and nobody is required to declare anything. A declaration that opts you out of AI answers (`ai-input`, `genai` or `search` set to no) is read and reported the same way A1’s values are.	The vocabulary your Content Signals preferences are heading toward, on a standards track with an IESG milestone in 2026. Nothing to publish yet; worth knowing what your stack already declares for you.	AIPREF Content-Usage
A15	A Universal Commerce Protocol manifest is served at `/.well-known/ucp`. UCP is the only agent-commerce protocol with a site-level discovery manifest, which is why it is the only one we probe.	Lets shopping agents discover your catalog and checkout endpoints. Brand new and only relevant if you sell online, so its absence is informational, never a defect.	UCP

Every A-check returns an OBSERVED verdict with the exact HTTP or DNS receipt behind it, or an honest not-applicable. None of them changes what an AI engine says about you today; they are a low-cost bet on where the agent web is heading.

Schema validation

Beyond the individual entity checks above, the scan validates your structured data against a curated catalog of the schema.org types AI engines actually rely on. For each type present on your page, it checks the required properties (without which the type is not usable) and flags missing recommended properties that lift citation odds. It also nudges you when a page is missing a type its kind of page should carry — a homepage without an Organization, an article page without an Article and a Person, a product page without a Product. Every audited page gets its own report, not just the homepage.

Five things the validator reports beyond present-vs-missing:

Thin nodes. Every entity is measured against the manual’s six-populated-property floor. Empty strings, empty arrays and the JSON-LD plumbing keys (@type, @context, @id) do not count. This matters more than it sounds: in the 2026 citation studies, pages with thin generic schema were cited less often than pages with no schema at all.
Structural findings that cost something. Lint findings — a sameAs written as a string instead of an array, a Wikidata link using the human /wiki/ page instead of the /entity/ URI, a sameAs pointing back at your own site, a date that is not ISO 8601, an author with no @id, an image without dimensions — are deducted from that node’s completeness score. They used to be displayed and scored nothing.
Schema versus your visible text. Facts your markup claims (name, legal name, founding date, address, phone, price, rating) are compared against the page’s visible prose and reported as in both, markup only, or conflicting. Markup-only is not a defect, it is an unrealised opportunity: the controlled experiment behind this measured a 29.6% accuracy improvement when facts that lived only in markup were also written into prose. A rating declared in markup with no reviews visible anywhere is called out separately, because that is a structured-data policy risk, not an opportunity.
Retired markup. HowTo and speakable are flagged as dead weight to remove. Google removed HowTo rich results in 2023 and now ignores the markup; speakable never left its news-publisher beta. Neither costs you score — an unhelpful property is not the same as a broken one.
Microdata and RDFa. If your HTML carries the older formats we say so and stop there. We do not parse or grade them. The advice is never “strip it” — leave it in place and layer JSON-LD on top; there is no penalty for redundant schema as long as the entities agree.

The types the scan validates

Type	Why it matters for AI search	Expected on homepage
Organization	The entity record for your brand: who you are and how engines link you to a knowledge-graph entity.	Yes
WebSite	Declares the site as one coherent entity and can enable a sitelinks search box.	Yes
WebPage	Describes an individual page and ties it to the site and breadcrumb trail.
Article / BlogPosting	Turns content into a citable, attributed source with an author and honest dates.
BreadcrumbList	Exposes the page’s place in your site hierarchy.
FAQPage	Verbatim Q&A engines lift into answers (a documented 20–44% citation lift). Google withdrew FAQ rich results for most sites in 2023 and retired the last of that reporting in May 2026; the AI-citation value is a separate thing and is unaffected.
Person	The entity record for an author, establishing E-E-A-T and real-person attribution.
Product	Makes a product machine-readable for shopping and answer contexts. The required set is deliberately strict — `name`, `image`, `offers`, a rating (`aggregateRating` or `review`) and `brand` — because a Product with a name and a URL is exactly the thin markup that measured worse than none.
LocalBusiness	The entity record for a physical business; drives local answers and map presence.
Event	Makes events answerable: what, when, where, and how to attend.
Review	Structured social proof engines can quote (rating, reviewer, what was reviewed).
Service	The record of something you do rather than something you are. How an engine extracts your service catalog, and critical for B2B, agencies and professional services. A Service node is not an Organization: you need both.
VideoObject	Describes an embedded video so an engine can read what it contains. The property that carries the weight is `transcript`.
ImageObject	Turns an image into a described, attributed object. The IPTC provenance fields (`creator`, `creditText`, `copyrightNotice`) are what let an engine attribute an image to you.
PodcastEpisode	Describes an episode as text an engine can read. As with video, the transcript is what makes it citable.

The fields people stall on

These are the recommended fields whose meaning is not obvious from the label, ordered roughly by how many people trip on them. The three with a guide are the highest-stall.

Field	On type(s)	What goes in it	Guide
sameAs	Organization, Person	An array of authoritative profile URLs (Wikidata, Wikipedia, LinkedIn, Crunchbase, socials) that engines use to disambiguate you.	Guide
@id	Organization, WebSite, Person, LocalBusiness	A stable canonical id like `{origin}/#org`, referenced by every other node so they all point at one entity.	Guide
primaryImageOfPage	WebPage	The lead image of the page, as a URL or ImageObject.	Guide
knowsAbout	Organization, Person	An array of topical entities you or the author have expertise in.
publisher (as `@id` ref)	Article, BlogPosting, WebSite	A reference to your Organization by `@id`, not the publisher’s name as a plain string.
mainEntityOfPage	Article, BlogPosting	The canonical page URL this content is the main entity of.
acceptedAnswer / mainEntity	FAQPage	The FAQ answers, taken verbatim from the visible page text (schema must equal on-page text).
logo (as ImageObject)	Organization	A `url` plus `width` and `height`, not a bare string. The same shape is expected of any `image` on an Article or Product.
founder	Organization	The founder(s), ideally referencing a Person node. Both `founder` and `founders` are accepted — schema.org carries the doublet and our own reference template emits the plural.
alternateName / legalName	Organization	The trade name people actually use, and the registered legal entity name. Google lists both among its recommended Organization properties, and they are what disambiguate you from a similarly-named brand.
provider / areaServed	Service	The Organization providing the service (by `@id` — this is what ties it to your brand) and the geography or market it covers.
transcript	VideoObject, PodcastEpisode	The spoken text. It is the single property that turns a media file into content an answer engine can read and quote.
geo / openingHoursSpecification	LocalBusiness	GeoCoordinates (lat/long) and structured opening hours for local answers.
offers / aggregateRating	Product, Event	Price and rating data, but only if the page genuinely shows it. Never fabricate.

Every one of these checks maps to a state you will see in a scan result. When something fails and you want the step-by-step fix, start at the fix guides; when a term is unfamiliar, the glossary defines it.