Most audits are sold as a black box: you pay, you get a report, and you have no way to judge whether the checks behind it were real. We would rather show the checklist. Everything below is something you can run on your own site this afternoon, with no tool and no account.

An audit is a list of verifiable checks, and every check here can be re-run by anyone.

What the checklist covers

  • Crawler access. Read your own robots.txt and check whether the search engines and AI agents you care about are explicitly allowed, explicitly blocked, or simply unmentioned.
  • Policy agreement. If you publish an llms.txt, compare its AI training statement with the one in robots.txt. Two files that disagree are worse than one file that is blunt.
  • Machine-readable content. Fetch the page without JavaScript and confirm the text you want quoted is actually in the HTML, not rendered later by a script.
  • Structured data. Parse every JSON-LD block on the page. A block that fails to parse is invisible to any engine that reads it.
  • Dated freshness. Check that a visible date exists and that it matches the date in the structured data. A mismatch is a small lie that scales.
  • Sitemap integrity. Confirm the URLs return 200, that lastmod is present, and that it only changes when the page does.
  • Edge hygiene. Confirm that scanner paths (credential files, admin panels, CMS probes) are refused, so the access log stays readable.
  • Honesty surface. Check that the site states what it cannot prove. Every credible audit ends with that list.

How to run it yourself

  • Fetch robots.txt and llms.txt and read them side by side, line by line.
  • Request a page with a plain HTTP client and look for the headline text in the raw response.
  • Validate the JSON-LD (copy it into a parser, or use a generator to see what correct output looks like).
  • Compare the visible date with datePublished and dateModified in the structured data.
  • Ask your access log the only question that matters: which named crawlers actually came, and did they get a 200?

What the checklist cannot tell you

Access is not attendance and attendance is not citation. The checklist can show that an engine can read you; it cannot show that it chose to, that it kept your text, or that a model will quote you next month. Anyone who claims otherwise is guessing at a system that does not publish its reasons.

Why we publish it

Because a method you cannot inspect is just a price. The same logic drives the tools on this site: each one performs part of this checklist in the browser, and none of them asks you to send your data anywhere. When we quote work, this is the work.

Source: this checklist is the one we run on this site itself before every publish; the results are published at /verify/ and the raw numbers at /live/.

Do I need to pay for an audit to get this?

No. Every check above uses files your site already serves. A paid audit buys time and interpretation, not access to secret data.

How long does the checklist take?

About an hour for a small site, most of it spent reading the access log rather than running checks.

What if my site fails several items?

That is normal, and it is useful. Fix the two that block crawlers first: robots.txt agreement and server-rendered text.

Related reading: Five Layers of Scanner Defence, Tested on Our Own Site · Layer 5: Closing the Loop in Public

More on this site: live signals · dated reports · how to verify us