AEO Audit Checklist: 25 Checks You Can Finish in a Morning

Long AEO checklists tend to die half-finished. AirOps published one in January 2026 that promises 48 factors; its numbering runs from 1 to 38 and then 45 to 47, so the version we read lists 41, and few teams would complete either number. This shorter audit has 25 checks grouped into five gates. Each test fits in five minutes and costs nothing.

Marketing and SEO leads who want a starting point are the audience. We sell content software and so are not neutral, yet the checks work with any tools. Schema-heavy and tool-heavy items are omitted, so two people can finish in a morning.

How to score it, and why the order matters

Mark each check 0 for a pass, 1 for partly and 2 for a fail. Work through the gates in order, because a failure at an early gate makes the later ones moot: if a bot cannot reach your page, it cannot read, trust or cite it. AirOps sorts its factors into technical crawlability, content extraction, brand entity and E-E-A-T, schema, freshness and measurement. Our five gates merge those groups, and the order of the gates takes the place of its prioritisation step.

Gate 1: Can the bots get in?

Access problems are the cheapest to fix and the most expensive to miss, because every later gate depends on them. Check these five first.

1. Search bots are welcome in robots.txt. Read the file for OAI-SearchBot, PerplexityBot, Claude-SearchBot and Googlebot, and make sure no wildcard disallow overrides them. OpenAI states that a site opted out of OAI-SearchBot will not be shown in ChatGPT search answers, with the other vendors in which AI crawlers to allow.
2. The security layer does not contradict robots.txt. Review CDN and firewall bot rules and grep logs for 403s served to those agents.
3. Money pages return a clean status and can be indexed. Fetch ten key URLs and inspect the response code and any noindex directive. Per Google, eligibility means being indexed and snippet-eligible, and there are no additional requirements for AI Overviews or AI Mode.
4. The answer text ships in the first HTML response. Open the page source and look for a sentence you know is live. Google states that script-built content is processed as long as it isn't blocked; the vendor Profound claims most AI crawlers cannot parse JavaScript. Rather than pick a side, test your own pages.
5. Crawlers show up in your logs. Look back thirty days for those user agents; reading server logs explains where to look.

Gate 2: Can they read it?

These checks ask whether a system hunting for a passage can find a clean one. Treat them as editing tasks.

6. The opening gives the answer. Cover everything after the first sixty words. Does the page still make sense?
7. Headings promise something. List the H2s on their own. Each should read as a claim or as something a buyer might search.
8. The outline has no gaps. Look for an H3 with no parent or a jump from H2 to H4. Google calls semantic HTML helpful and says perfect code isn't required, so aim for tidy, not flawless.
9. Key facts are typed, not pictured. Prices, steps and comparison tables belong in HTML. Try copying them out of the page.
10. A paragraph survives alone. Choose one at random and read it with no page around it. AirOps quotes Aleyda Solis describing relevance in AI search at passage level, while Google's guide says nothing requires cutting content into tiny pieces. Work on clarity and leave the chopping.

Gate 3: Can they trust it?

Evidence checks are about named sources and honest labels. They cost editorial time, not tools.

11. Each statistic links out. Highlight every number on the page and see which lack a source.
12. Quotations trace back. Pick three and find the original words.
13. Vendor figures say so. Search for "study", "survey" and "report" and confirm who ran each one.
14. Original research shows its working. Sample, date and limits should be visible near the headline number.
15. A sceptical editor finds nothing made up. Ask someone outside the team to verify three claims.

Gate 4: Do they know who you are?

Entity checks look at how consistently the web describes you.

16. Your company has one description. Set your homepage, LinkedIn page and one directory listing side by side and compare the wording.
17. Bylines lead to people. Open five articles and click the author. Google's guidance asks whether visitors can tell who created the content.
18. Independent pages mention you. Search for your brand name without the domain and count outside descriptions. In a 75,000-brand sample, Ahrefs found branded web mentions tracking AI Overview visibility at 0.664, which shows correlation and nothing more.
19. Markup mirrors what readers see. Google's structured data policies tie markup to what is visible, so run the Rich Results Test on three pages.
20. The basics are findable. A stranger should locate your about page, contact route and pricing in under a minute.

Gate 5: Do you know what happens?

The last gate covers feedback. Without it, the first four cannot be tested.

21. Updated dates are honest. Show them on key pages, and change them only when facts change.
22. A prompt list exists. A sheet of twenty buyer prompts, built the way prompt research describes.
23. Each prompt runs repeatedly. Three attempts per prompt per round.
24. Wrong answers are recorded. Add an errors column and review it monthly.
25. One person owns the report. Attach a name and a date. Bing's AI Performance report offers a free first-party input.

Our call: stop at the first failing gate

The usual scoring method adds the numbers and reads the total. We would not. A total of fifteen made of scattered partial marks is a different situation from fifteen made of three access failures, and only the second explains why you are absent. So treat the gates as a sequence: fix the first gate with a fail before you polish later ones.

The cost is that this feels slow. You may leave obvious editorial weaknesses alone for a few weeks while a developer clears a firewall rule. Once Gate 1 is clean the order stops mattering, and you can work on any gate in parallel. After you have a score, the seven-blocker audit helps diagnose the cause.

False alarms to expect

Three results look like failures and often are not. A missing bot in your logs may only mean your site is small or new, so compare with the robots.txt result before panicking. A heading that is a label rather than a claim is a weak point, not a block. And a tidy outline with poor content still fails Gate 3. Record what you find as an observation, note the date and move on; the point of the morning is to find the first real blocker, not to produce a perfect scorecard.

What we left out

AirOps adds further schema types, a review schedule for freshness, version tracking and a phased roadmap. We skipped detailed schema checks, since Google says its AI features need no special markup and no type has proven value. We omitted llms.txt for a similar reason; see our llms.txt explainer.

Running it with two people

Person one handles Gates 1 and 2, which need technical access and page review. Person two handles Gates 3 to 5, which need editorial judgment and the prompt sheet. After twenty minutes together, name the first gate with a fail and choose up to five fixes for the month, each with an owner and a date. Repeat only the failed checks in four weeks, and the full list each quarter.

If a check needs a developer, state the problem plainly and attach the test. A request naming the exact line that blocks a bot gets fixed faster than a vague plea to improve AI crawlability. The wider plan sits in the GEO guide.