Run an audit

Sample report for a made-up bakery

www.fernhillbakery.example

Invented data, so you can see everything a report covers.

  • 2 critical
  • 5 worth fixing
  • 3 minor
  • 5 quick wins
C+
SEOCan search engines find and rank you?LowNeeds work
D
AEOCan answer engines quote you directly?PoorFixes necessary
F
GEOWill AI assistants recommend you?PoorFixes necessary
C-
PerformanceDoes your page load quickly?PoorFixes necessary
B-
Security & EmailIs the site hardened, and is your mail trusted?FairImprovements could be made
B-
AccessibilityCan everyone use your page?FairImprovements could be made
What do these grades mean?
How grades work
A+ A95–100Excellent
A- B+85–94Good
B B-75–84Fair
C+ C65–74Low
C- D FUnder 65Poor

SEOSearch engine optimisation

The classic search fundamentals that Google and Bing still rely on: whether the page can be crawled and indexed, whether its title, description and headings say what it's about, and whether it's fast and works on mobile. A strong SEO score means the page can show up in ordinary search results.

AEOAnswer engine optimisation

Answer engines such as Google's AI Overviews and featured snippets don't send people to a list of links; they lift a direct answer from a page. This score looks at whether your page states plainly what you do, where and for whom, uses structured data that machines can read, and answers real questions. A strong AEO score means your words can appear as the answer itself.

GEOGenerative engine optimisation

AI assistants like ChatGPT, Claude and Perplexity write their own answers and choose which sites to mention. This score checks whether their crawlers are allowed in by robots.txt, whether the site offers an llms.txt summary, and whether a live query to Perplexity actually cites you. A strong GEO score means AI tools can reach your site and are likely to recommend it.

PerformanceLoading speed on a phone

Not an AI judgement either: it's Google Lighthouse's performance score for the mobile page, the same number PageSpeed Insights shows. It weighs how soon the main content appears, how long the page is too busy to respond, and whether things jump around as it loads. Slow pages lose visitors, and speed is one of the signals Google ranks on.

Security & EmailBrowser security and email authentication

Unlike the other three, this score isn't an AI judgement: it's added up from the checks. HTTPS and the security headers protect visitors in the browser. SPF, DKIM and DMARC let receivers tell your real mail from fakes, so it reaches inboxes and nobody can easily send mail as you. It doesn't affect how search engines or AI tools rank you.

  • HTTPS15 / 15
  • Strict-Transport-Security8 / 8
  • Content-Security-Policy0 / 8
  • X-Content-Type-Options5 / 5
  • Frame protection0 / 5
  • Referrer-Policy4 / 4
  • SPF18 / 18
  • DKIM17 / 17
  • DMARC8 / 20

AccessibilityWCAG 2.2 AA automated checks

Also worked out from the checks rather than judged by AI: it's Google Lighthouse's accessibility score, from the axe-core rules it runs on the mobile page. They test WCAG 2.2 AA requirements a machine can confirm, such as text contrast, alt text, labels and tap target size. Automated checks find only some problems, so a high score isn't proof of conformance; keyboard and screen reader use still need testing by hand. It doesn't affect the SEO, AEO or GEO scores.

The weakest area is GEO (F, 38/100): AI assistants like ChatGPT and Perplexity are unlikely to recommend it. Start with the 2 critical issues below.

What to fix

Fix these first 2

These stop engines crawling, indexing or citing the page.

  1. Perplexity's crawler is blocked, so it can't cite you

    GEOQuick fix
    Your robots.txt gives PerplexityBot a Disallow: / rule, so Perplexity can't read any page on the site. The live check matches: asked about bakeries like yours, Perplexity cited four other sites and not yours.
    How to fix it
    Remove PerplexityBot from the blocked group in robots.txt. If you only want to opt out of AI training, keep GPTBot and CCBot blocked but let search-facing bots in.

  2. No structured data describing the bakery

    AEOQuick fix
    The only JSON-LD on the page is a WebSite block. There's no Bakery markup (a type of LocalBusiness), so engines have to guess your address, opening hours and what you sell.
    How to fix it
    Add a Bakery JSON-LD block with name, address, telephone, openingHoursSpecification, url, image, and sameAs links to your Instagram and Google Business Profile.

Worth fixing 5

Each one holds the page back.

  1. Claude and ChatGPT training bots are blocked

    GEOQuick fix
    GPTBot and ClaudeBot are disallowed site-wide. That's a legitimate choice, but future models will learn less about your bakery, and may describe it from third-party reviews instead of your own pages.
    How to fix it
    Decide deliberately. To be well represented, allow them with User-agent: GPTBot followed by Allow: /. Either way, keep OAI-SearchBot and Claude-SearchBot allowed, as they are now.

  2. Location and opening hours sit below the fold

    AEOQuick fix
    The first 150 words are a welcome message about the team. Where you are and when you're open only appear in the footer, which answer engines weight less than the opening lines.
    How to fix it
    Open the page with one plain sentence covering what, where and when, such as "Fernhill is an independent sourdough bakery on Gloucester Road, Bristol, open Tuesday to Sunday from 8am."

  3. No question-and-answer content

    AEOSome work
    None of the headings is phrased as a question and there's no FAQ. Answer engines favour short, self-contained answers to the questions people actually ask.
    How to fix it
    Add an FAQ with four to six real customer questions (do you take cake orders, is there vegan bread, can I pre-order for collection) and mark it up with FAQPage schema.

  4. Hero image makes the page slow on mobile

    SEOSome work
    Largest Contentful Paint is 4.1 s on mobile, well past Google's 2.5 s threshold for good. The full-width hero photo is the largest element and it loads late.
    How to fix it
    Serve the hero as WebP or AVIF under 200 KB, give it explicit width and height, and add fetchpriority="high" so the browser loads it first.

  5. Two H1 headings compete for the page topic

    SEOQuick fix
    "Welcome to Fernhill" and "Baked fresh every morning" are both <h1> elements, and neither says what the business is or where. That weakens the page's main topic signal.
    How to fix it
    Keep one <h1> that names the business and place, such as "Sourdough bakery in Bristol", and change the other to an <h2>.

Minor improvements 3

Nice to have once the rest is done.

  1. 9 of 24 images have no alt text

    SEOQuick fix
    Images without an alt attribute give search engines and screen readers nothing to go on. Product photos are a missed chance to reinforce what you sell.
    How to fix it
    Add short, specific alt text such as alt="Seeded sourdough loaf", and use alt="" for purely decorative images.

  2. One internal link is broken

    SEOQuick fix
    The link to /wholesale returns a 404. Broken links waste crawl budget and send visitors to a dead end.
    How to fix it
    Point the link at the current wholesale page, or add a 301 redirect from /wholesale to it.

  3. No llms.txt file

    GEOQuick fix
    /llms.txt returns a 404. It's an emerging convention that gives AI tools a short, curated summary of your site. Few engines rely on it yet, so this is low priority.
    How to fix it
    Add a plain-text llms.txt at the site root with a one-paragraph description of the bakery, your address and hours, and links to your menu and ordering pages.

What we checked

AI crawler access

5 of 16 AI crawlers are blocked.

How robots.txt treats each crawler, and whether your server let our test fetches as AI bots through. One is allowed by robots.txt but turned away by your server, so check your firewall or CDN's bot settings.

View all 16 crawlers
CrawlerWhat it doesAccess
Search and AI answersThese decide whether you can appear in results and answers.
GooglebotGoogle
Google Search, including AI OverviewsAllowedFollows the * rules
BingbotMicrosoft
Bing Search, which also feeds CopilotAllowedFollows the * rules
OAI-SearchBotOpenAI
Surfaces sites in ChatGPT searchAllowedFollows the * rules, test fetch OK
Claude-SearchBotAnthropic
Surfaces sites in Claude's search resultsAllowedFollows the * rules, test fetch OK
PerplexityBotPerplexity
Builds Perplexity's search indexBlockedNamed in robots.txt
ApplebotApple
Siri, Spotlight and Safari searchAllowedFollows the * rules
Fetched when someone asksAn assistant reading your page because a person asked it to.
ChatGPT-UserOpenAI
Fetches a page when someone asks ChatGPT toAllowedFollows the * rules, test fetch OK
Claude-UserAnthropic
Fetches a page when someone asks Claude toAllowedFollows the * rules, test fetch OK
Perplexity-UserPerplexity
Fetches a page when someone asks Perplexity toRefusedrobots.txt allows it, but your server returned 403
Model trainingBlocking these is a business choice, not a fault.
GPTBotOpenAI
Collects training data for OpenAI modelsBlockedNamed in robots.txt
ClaudeBotAnthropic
Collects training data for ClaudeBlockedNamed in robots.txt
Google-ExtendedGoogle
Controls use in Gemini and AI groundingAllowedFollows the * rules
Applebot-ExtendedApple
Controls use in training Apple's AI modelsAllowedFollows the * rules
meta-externalagentMeta
Collects training data for Meta's AI modelsAllowedFollows the * rules
AmazonbotAmazon
Improves Amazon services, including its AI modelsAllowedFollows the * rules
CCBotCommon Crawl
Open web dataset used to train many modelsBlockedNamed in robots.txt
View robots.txt
User-agent: *
Disallow: /basket

User-agent: GPTBot
User-agent: ClaudeBot
User-agent: PerplexityBot
User-agent: CCBot
Disallow: /

Sitemap: https://www.fernhillbakery.example/sitemap.xml

Performance

Mobile

Performance score
58 / 100
Largest Contentful Paint
4.1 s
Cumulative Layout Shift
0.04
Total Blocking Time
310 ms

Desktop

Performance score
86 / 100
Largest Contentful Paint
1.7 s
Cumulative Layout Shift
0.02
Total Blocking Time
80 ms

Google doesn't have enough real-visitor data for this site, so these are lab measurements.

Perplexity citation check

We asked Perplexity:

I'm looking for this: "Sourdough bread, pastries and celebration cakes, baked daily at our Bristol bakery on Gloucester Road". Which specific companies or websites would you recommend, and why?

The question comes from your meta description, with your name and domain taken out, so it asks the way someone who hasn't heard of you would. The more plainly that text says what you offer, for whom and where, the easier you are to match.

Cited your site
No
Named you in the answer
No

Sources it cited instead

  • tripadvisor.co.uk
  • timeout.com
  • reddit.com
  • yelp.co.uk
What Perplexity said
For sourdough and pastries around Gloucester Road, reviewers most often point to a handful of independent bakeries. 1. Hart's Bakery at Temple Meads is the one most guides lead with for sourdough and morning pastries. 2. Farro Bakery in Redland and Clifton comes up for laminated pastries and celebration cakes. 3. Bakers & Co on Gloucester Road itself is cited for brunch and bread to take home. Tripadvisor and Time Out both rank Hart's first, and several Reddit threads recommend arriving early at weekends because it sells out.

Security headers

3 of 5 in place

Response headers that harden the page in browsers. They count towards the Security & Email score, not SEO, AEO or GEO.

Strict-Transport-SecurityMakes browsers always use HTTPS for your site, so a connection can't be quietly downgraded and read on public Wi-Fi.
Set, 365 days
Content-Security-PolicyLimits which scripts and resources can load, so code injected into your pages (cross-site scripting) can't run.
Missing
X-Content-Type-OptionsStops browsers guessing a file's type, so an uploaded or mislabelled file can't be run as a script.
nosniff
Frame protectionStops other sites showing your pages in a hidden frame to trick visitors into clicking things (clickjacking).
Missing
Referrer-PolicyControls how much of a page's address is passed to other sites when visitors follow a link, keeping private URLs private.
strict-origin-when-cross-origin
How to add them
Content-Security-Policy-Report-Only: default-src 'self'; frame-ancestors 'self'
X-Frame-Options: SAMEORIGIN

Start the policy in Report-Only mode and watch the browser console: a strict policy can block your own scripts, fonts and analytics. Switch to Content-Security-Policy once nothing you need is reported.

Email authentication

2 of 3 in place

DNS records for fernhillbakery.example that let receivers check mail really comes from you, so your own mail reaches inboxes and fakes don't. They count towards the Security & Email score, not SEO, AEO or GEO.

Mail handled byWhere mail sent to your domain goes, from its MX records.
Google Workspace
SPFLists the servers allowed to send mail as your domain. Receivers check it on every message.
Covers Google Workspace
Also allowed to sendBesides Google Workspace, each of these can send mail as your domain. Remove any service you no longer use.
servers.mcsv.net (Mailchimp)
DKIMSigns outgoing mail, so receivers can tell it really came from you and wasn't altered. We can only try the usual key names, so a key under a custom name won't show here.
Signed by Google Workspace and Mailchimp
DMARCTells receivers what to do with mail that fails both SPF and DKIM: deliver it, send it to spam (quarantine) or refuse it (reject).
Monitoring only (p=none)
DMARC reports go toReceivers send daily summaries of mail sent as your domain here, which is how you'd spot a fake or a broken setup.
fernhillbakery.example
Current records
fernhillbakery.example  TXT  "v=spf1 include:_spf.google.com include:servers.mcsv.net ~all"
_dmarc.fernhillbakery.example  TXT  "v=DMARC1; p=none; rua=mailto:[email protected]"
How to fix it

Accessibility

3 WCAG failures

Google Lighthouse ran the axe-core accessibility rules on the mobile page, and 27 of the 31 that applied passed. Each failure is matched to the WCAG 2.2 level A or AA success criterion it breaks. They count towards the Accessibility score, not SEO, AEO or GEO.

Image elements do not have [alt] attributesWCAG 1.1.1 Non-text Content, level A
9 elements
Background and foreground colors do not have a sufficient contrast ratio.WCAG 1.4.3 Contrast (Minimum), level AA
6 elements
Touch targets do not have sufficient size or spacing.WCAG 2.5.8 Target Size (Minimum), level AA
4 elements
Heading elements are not in a sequentially-descending orderGood practice, not a WCAG requirement
1 element
How to fix them

Image elements do not have [alt] attributes

Informative elements should aim for short, descriptive alternate text. Decorative elements can be ignored with an empty alt attribute. How to fix it
<img src="/images/sourdough-loaf.jpg" class="product-photo">
<img src="/images/croissants.jpg" class="product-photo">
<img src="/images/wedding-cake.jpg" class="product-photo">

And 6 more elements.

Background and foreground colors do not have a sufficient contrast ratio.

Low-contrast text is difficult or impossible for many users to read. How to fix it
<p class="hero-note">Baked fresh every morning from 7am</p>
<a href="/visit" class="btn btn-ghost">
<span class="price">

And 3 more elements.

Touch targets do not have sufficient size or spacing.

Touch targets with sufficient size and spacing help users who may have difficulty targeting small controls to activate the targets. How to fix it
<a href="https://instagram.example/fernhill" class="social-icon">
<a href="https://facebook.example/fernhill" class="social-icon">

And 2 more elements.

Heading elements are not in a sequentially-descending order

Properly ordered headings that do not skip levels convey the semantic structure of the page, making it easier to navigate and understand when using assistive technologies. How to fix it
<h4>Opening hours</h4>

Automated checks find only some accessibility problems. To meet WCAG 2.2 AA, also check by hand that everything works with a keyboard alone, focus is always visible and moves in a sensible order, and a screen reader announces each control properly.

See how your own site does

Enter your domain, or any page on your site, and get this report for it in about a minute.

Run your audit