THE SHORT ANSWER
An AI visibility audit works through five layers in a fixed order, because each one gates the next. First, can the crawlers reach you. Second, do external sources describe you consistently. Third, can a single passage on your page stand alone. Fourth, what do assistants currently say about you and how wrong is it. Fifth, a citation baseline you can compare against later. A first pass takes about a day and needs no paid tooling.
Audits fail when they start in the wrong place. A team spends three weeks rewriting content for extractability, publishes it, sees no change, and only then discovers that a bot-mitigation rule has been returning a challenge page to every non-Google crawler since a security review two years ago. The layers have a dependency order and working out of order wastes quarters.
The sequence below is that order. Access first, because nothing downstream matters if the page cannot be fetched. Then identity, because a system that is not sure who you are will not name you. Then the writing. Then what is actually being said right now. Then a baseline, so that in three months you can tell whether any of it worked.
The numbers, at a glance
Layer order: access, then entity consistency, then extractability, then answer accuracy, then baseline; each layer gates the ones after it
Time for a first pass: roughly one working day for a site under two hundred pages, with no paid tooling required
Most common blocking fault: a bot-mitigation or firewall rule challenging non-Google crawlers, which nobody notices because nobody watches those logs
Most common identity fault: three or more different one-line company descriptions across the website, the mapping profile and the main directories
Layer one: can the crawlers actually fetch you
Fetch your own pages the way a crawler would, using a request with each relevant user-agent string, and compare the returned HTML with what a browser sees. You are looking for three failure modes: a robots directive blocking the agent, a firewall or bot-mitigation service returning a challenge, and a page whose meaningful content only exists after script execution.
The third is the quiet one. A page that renders perfectly in a browser and returns a near-empty shell to a plain fetch is invisible to any retrieval system that does not run a full browser, and several do not. Check the raw HTML for your actual headings and body text before assuming anything.
Also read your robots file as a decision rather than an inheritance. Somebody chose those directives, possibly a developer copying a template in 2021, and if you cannot say why each AI-related agent is allowed or disallowed, nobody has actually made that call yet.
Layer two: does the web agree on who you are
Collect every public one-line description of your business you can find: the website, the mapping profile, the main sector directories, your social profiles, your registration record, any partner or manufacturer listing. Put them in a column next to each other. The audit finding writes itself.
Name. Legal entity, trading name and how customers write it. Pick one for public use and accept the legal form only where required.
Category. A single primary category. Businesses claiming to be four things across four directories are recommended for none of them.
Coverage. Countries, regions or municipalities, stated identically everywhere and matching reality rather than ambition.
Contact details. One phone number and one address, formatted the same way, including the country code.
Fixing this is unglamorous administration with an unusually high return, because every other signal is evaluated against a background question of whether the system is confident it knows which business is being discussed.
Layer three: can any single passage stand alone
Take five of your commercially important pages and read one middle section from each in isolation, as though it arrived with no page around it. Does it name its own subject, or does it say this or that or the above. Does it state a conclusion, or build towards one that lands two sections later. Would a reader who saw only that block know which company produced it.
Score each section pass or fail on those three tests. Most sites fail the majority of sections on the first pass, and the fix is editorial rather than technical: repeat the noun instead of using a pronoun, move the conclusion to the opening sentence, and add the qualifying condition inside the same paragraph as the claim rather than in a footnote.
Layers four and five: what is said now, and the baseline you will compare against
Ask each major assistant six direct questions about your business: what it does, what it charges, where it operates, who it serves, who its competitors are, and whether it is any good. Record the answers verbatim. This is your accuracy snapshot and it usually contains at least one error that has been costing money quietly.
Then run a short prompt set of buyer questions where you would want to be mentioned, three repeats each, and record your mention rate. That number is your baseline. It has no meaning against anyone else's number, because it depends entirely on how contested your prompts are, and complete meaning against your own figure three months later.
Store both artefacts somewhere permanent with the date on them. The most common failure of an audit is that nobody can find the original measurements when the time comes to check whether the work paid off.
The one-day audit, in order
Fetch ten key pages with each relevant crawler user-agent and diff the HTML against the browser view.
List every public description of your business side by side and force name, category, coverage and contact into agreement.
Read five middle sections in isolation and score them on subject, conclusion and attribution.
Ask four assistants the same six direct questions and record the answers verbatim with the date.
Run a short prompt set with three repeats, save the mention rate as your baseline, and diary a re-run for ninety days out.
Want leads like this in your pipeline?
Flock runs the campaigns, screens the enquiries and hands you only the ones that match your service area, job size and capacity. You pay per lead, not per month.
Book a 15-minute fit check | See lead package pricing
Related answers
Frequently asked questions
Do I need a tool to run this?
No. The whole first pass runs on a command-line fetch tool, a spreadsheet and an hour with four assistants. Paid platforms save time on the repeated prompt runs once the programme is established, but they add nothing to a first audit and often obscure the access-layer problems that matter most.
How often should the audit repeat?
Layers one and two annually, or immediately after any infrastructure or rebranding change. Layers four and five monthly, since those are the moving parts. Layer three is continuous rather than periodic: it belongs in your editorial standard, not in an audit cycle.
What if the audit finds nothing wrong?
That is rare, and usually means the access check was not done properly. Retry with a plain fetch rather than a browser-based tool, and check the raw HTML for your headings. If the site genuinely passes all five layers, your constraint is content volume rather than technical readiness.
Who should own this internally?
Whoever owns organic search, because four of the five layers are ordinary technical and editorial SEO work. The exception is the accuracy layer, which needs someone commercial in the room, since only they can tell whether a stated price or coverage claim is actually wrong.
NEED A CLEARER PLAN?
Let’s turn your next move into momentum.
Talk to us →