AEO Audit
A site can rank well in classic search and still be missing from the answers AI assistants give. We built a tool that shows agencies how ready a client's site is for those assistants, and what to fix first.
Testing
Node.js · Express 5 · MongoDB
Redis · BullMQ · Playwright
Perplexity · Gemini
Is the site ready for AI assistants, and do they mention it today? AEO Audit answers both questions for each client website, then brings the results together in one report that can be downloaded as a PDF or Word document.
The product in numbers
in 17 suites
The problem
People increasingly ask AI assistants for recommendations instead of searching and clicking through links. Agencies that want to help clients with this run into three gaps.
- Readiness is hard to assess. The signals that matter are spread across robots.txt rules for AI crawlers, structured data, how content is written, trust signals and technical basics.
- Visibility is hard to measure. AI answers change from one ask to the next, so asking a question once proves little.
- Findings don't turn into action. A client needs a clear order of work, not a long list of problems.
The audit engine
A crawl of one page or a whole site produces a score out of 100, a letter grade and a prioritised fix list. There are 31 on-site checks across five categories, plus five AI visibility checks.
| Category | Weight | What it covers |
|---|---|---|
| AI Crawler Access | 25 | AI bots in robots.txt, indexability, content visible without JavaScript, sitemap, llms.txt |
| Structured Data | 20 | JSON-LD validity, Organization and LocalBusiness schema, required fields, dates, breadcrumbs |
| Answer-Ready Content | 25 | Direct answers under headings, question-style headings, lists and tables, depth, freshness, readability |
| Trust & Authority | 15 | Author bylines, About and Contact pages, reviews, outbound citations, privacy policy |
| Technical Basics | 15 | HTTPS, redirects, meta tags, Core Web Vitals, canonical tags, Open Graph |
| AI Visibility | 20 | Mention rate, citation rate, assistant coverage, share of voice, sentiment |
AI Visibility only counts when the project has a recent visibility test. Checks that don't apply to a page are excluded from its score instead of counting against it.
AI visibility testing
Target prompts such as "best dentist in Ludhiana" are asked several times, three by default, with web search on, the way a customer would ask them. Every answer is analysed for brand mentions, list position, citations of the client's domain, competitor mentions and sentiment. Results are reported as rates over repeated asks rather than a yes or no, and every answer is stored so it can be read in the UI.
Built for how agencies work
- Accounts, with one project per client website
- Single-page audits and site crawls, with live progress
- Fixes ranked by impact versus effort and labelled as quick wins, major projects, fill-ins or low priority
- Audit history, score trends and side-by-side comparison
- Per-page results for site crawls, worst pages first
- PDF and Word report downloads
Trying it on ourselves
The screenshot above is a real report. A single-page audit of our own home page on 5 November 2026 scored 89 out of 100, grade B, in 6 seconds. AI Crawler Access and Technical Basics both scored 100, and the weakest area was Trust & Authority at 71, with author bylines as the top fix. That run did not include an AI visibility test, and it is one page of one site, not a client result.
Key engineering decisions
An audit runs in three stages. Gather does all the network work: robots.txt, the page, the sitemap, llms.txt, a headless Chromium render and PageSpeed Insights. Check runs each check as a pure function of the gathered data. Score produces weighted category scores, an overall grade, the fix list and a plain-English summary.
| Decision | Why it matters |
|---|---|
| Checks are pure functions, separate from network code | Each check can be unit-tested against an HTML fixture, with no live site involved |
| Scoring weights live in a config file | Weights and grade bands can be tuned without touching code |
| Audits run as queued jobs, with an in-process fallback | Jobs survive restarts, crashed jobs retry once, and local development works without Redis |
| Progress streams over Server-Sent Events, read from MongoDB | Live updates work wherever the worker runs, and the client falls back to polling if a proxy blocks the stream |
| AI providers sit behind one interface | Adding an assistant takes one class and one line in the registry |
| Answer analysis is deterministic | It needs no second model call, so it costs less and is easy to test |
Security and responsible crawling
A tool that fetches user-supplied URLs is an obvious SSRF target, so protection was designed in from the start. Private and reserved addresses are refused on every connection, including each redirect hop, which also blocks DNS rebinding, and headless browser subrequests pass through the same guard. The crawler uses a clear User-Agent, respects robots.txt and Crawl-delay, and works within request, size and concurrency limits. Every query is scoped to its owner, so another user's project returns a 404.
Limitations we're upfront about
- Scores are a readiness estimate. The checks and weights reflect best-practice judgement. A high score doesn't guarantee that AI assistants will cite a site.
- Visibility results are samples. Rates are only as reliable as the number of prompts and repeats behind them.
- Text analysis is simple. Unusual brand names or subtle wording can be misread.
- Visibility tests cost money. Each request uses web search, so the run dialog shows the request count first and a per-run cap applies.
Competitor comparison, white-label reports and scheduled re-audits are next on the list.