AI Visibility Audit: A Five-Day Plan and Scorecard

An AI visibility audit is a recorded check of how ChatGPT, Perplexity and Gemini describe and recommend your brand, run on a fixed set of buyer questions. A useful first one fits in five working days: access on Monday, a fact sheet and frozen prompts on Tuesday, capture midweek, scoring on Friday. Most of what you act on comes from the accuracy checks.

What the guides ranking for this query skip

They agree on the outline: buyer prompts, a few engines, a log, a fix list. Their effort estimates differ by more than an order of magnitude, mostly because they assume different prompt counts, engine counts and minutes per answer. None asks you to write down what a correct answer looks like first.

GEO Toolbox budgets "about half a day" for a focused site and is the only one of the seven we read that asks for three to five runs per prompt. Parse counts its first step alone, 20 prompts on four platforms with two reruns, as 160 manual queries, and spreads the audit over a week. LLM Pulse also asks for two runs and has an accuracy column, but nothing to check accuracy against. Prose uses a single 0-2 score per answer, from "not visible or clearly misrepresented" to "clearly visible, accurately framed, and supported", with no run count.

Two runs have a flaw: when they disagree, there is no majority. Our measurement protocol says: "Each prompt runs three times per engine. The majority result becomes the dominant score for that prompt and engine." For a yes/no result such as "brand named", three is the smallest number that always gives a majority.

Day 1: access, and the data Google already gives you

Spend the morning confirming that engines are allowed to reach the store and the afternoon exporting what Google already reports. GEO Toolbox budgets an hour for the access check; on the 42 sites in our sample below, it rarely found anything. Do it anyway, so that access is ruled out before you judge the answers.

Read robots.txt crawler by crawler, because search and training are separate switches. OpenAI says "each setting is independent of the others", and that sites opted out of OAI-SearchBot "will not be shown in ChatGPT search answers", except as navigational links. Allowing GPTBot and assuming the site is eligible for ChatGPT Search is, in our protocol's words, "the most common technical error we find". Check PerplexityBot, which Perplexity's crawler documentation says is designed to surface and link websites in its results. Check Google-Extended too: a robots.txt token, not a separate crawler, that Google's documentation says controls grounding in Gemini Apps and "does not impact a site's inclusion in Google Search".

Then test what robots.txt cannot show. From a terminal, run curl -I -A "OAI-SearchBot" https://yourstore.com/products/your-best-seller. A 403 is only a warning: some bot-management tools block a faked bot name from your IP while letting the real crawler through. The logs settle it. Look in your CDN or server logs for OAI-SearchBot and PerplexityBot requests over the last 30 days before you change any firewall rule.

Then export two baselines from Google:

• Search Console. The generative AI performance report shows impressions, pages, countries, devices and dates for AI features in Search, such as AI Overviews and AI Mode, and in Discover. Google's note on the post says that as of August 31, 2026 it reached "all websites worldwide". Export everything it holds, by page.
• GA4. The default channel group has an AI Assistant channel for visits from ChatGPT, Gemini, Copilot and others. Google's definition adds: "It excludes Google’s AI Overviews and AI Mode". Those visits sit in Organic Search, so the two reports do not overlap. Our GA4 guide for AI traffic covers the custom channel if you built one before Google's existed.

What the access check found on 42 Shopify-featured sites

On 9 October 2026 we ran Day 1's robots.txt and llms.txt checks on 42 brand websites and found little to fix. The sample is every brand storefront linked from the case studies on page 2 of Shopify's case-study listing that day.

These are mostly established Shopify merchants, many larger than a typical DTC store, so read the results as Shopify defaults, not a cross-platform survey.

Two sites show the mistakes Day 1 is looking for. The one blocking GPTBot leaves OAI-SearchBot open, the separation OpenAI documents, but it also blocks Google-Extended: still eligible for ChatGPT search, opted out of grounding in the Gemini app. The one blocking PerplexityBot also blocks ClaudeBot and Google-Extended. If either was meant as a training opt-out, it also took the store out of answers its buyers may be reading.

If an audit checklist gives you points for having an llms.txt, ignore that line. Thirty-four of the files open with the same "Agent Instructions" heading and ask AI shopping agents to recommend that their user install Shop's skill from shop.app. On these sites it looks like something the platform supplies, so having the file says nothing about a brand's choices. If you are on Shopify, open yourstore.com/llms.txt; you may well have one you never wrote. Our claims audit rated llms.txt "harmless and unproven" anyway.

One homepage returned a 403 to our single fetch from a cloud server, although its robots.txt blocked nothing. From outside we cannot tell whether OpenAI's or Perplexity's own crawlers get through; the site owner can, from the logs. We keep the per-site results on file. Robots.txt rules can change daily, so treat the table as a dated reading.

Day 2: write the fact sheet, then freeze the prompts

Before you run anything, write down what a correct answer says about your store, and split the prompts into identity and commercial sets. Without the fact sheet, accuracy becomes a feeling. Without the split, one blended rate hides whether engines do not know you or simply do not pick you.

The fact sheet is one page: legal and trading name, founder, where you are based, the price of your three best sellers, shipping countries and thresholds, return window, and the brand you are most often confused with. Our €950 integrity report (excl. VAT) scores answers "against a written reference document you approve first" on 11 binary checks, including pricing and entity collision. A store can do a lighter version in a spreadsheet.

Our protocol keeps the two prompt types apart: "Identity prompts measure whether you exist to the model. Commercial prompts measure whether you are chosen." For a hypothetical Dutch merino-sock brand selling in the Netherlands, Germany and Belgium, a set of 30 might look like this:

Write the wording once, date it and leave it alone. A baseline is only valid, in our protocol's terms, if "the prompt wording is fixed and recorded" and the denominator is stated.

Days 3 and 4: capture under the same conditions every time

Run each prompt three times in each engine, in a fresh logged-out session, and log every answer as its own row with a screenshot. For the 30-prompt store set across three engines, that is 270 captures, or about two days of steady work. Record the country you ran from, because answers about shipping and price change with it.

LLM Pulse plans for "two to three minutes per prompt-engine combination". At that pace, 270 captures take 9 hours at two minutes a capture and 13.5 hours at three. The identity set alone is 90 captures; if the week gets squeezed, finish those first, because they feed the error register.

Our protocol asks for "Fresh, logged-out sessions per run — no chat history, no personalisation, no memory", with session, location, language and product mode recorded, because ChatGPT with search and the ChatGPT API are different products. For the sock brand, run the German-market prompts from a German connection, and in German if that is how its buyers ask. Log refusals and empty answers too. They score zero, because "from the buyer's position it is identical to absence."

This is the capture sheet, with three illustrative rows for the sock brand (not real results):

Add columns for date and time, session type, language and screenshot file name. Each fact on your sheet gets its own check column.

Day 5: score it, then trace every error

Collapse each prompt-engine trio into one majority result, compute every rate with its denominator, and copy every factual error into a separate register. Then fix in this order: access problems, wrong facts, commercial absence. Content cannot help a page an engine cannot fetch, and more visibility for wrong facts spreads them further.

Our protocol records any disagreement between the three runs "as volatility rather than averaged away". Keep the majority result for a two-one split but mark the pair volatile; where a field with more than two values splits one-one-one, record no result and mark it volatile. Copy any run that got a fact wrong into the register anyway. One wrong price in three runs is still a wrong price a buyer can see.

Your Friday scorecard, with blanks for your own counts:

The commercial rates sit on 60 prompt-engine pairs and identity accuracy on 30 identity scores. Write them that way, "named in 14 of 60 commercial pairs", never as a bare percentage. Our guide to measuring AI visibility shows how wide the error range is at that size.

Our protocol says the error register, "not the score, is usually what a client acts on first." Each wrong price or shipping country goes in as its own line with the engine, language and date. Then trace it:

Open the sources the engine cited for that answer and look for the wrong figure there. Search the exact wrong figure in quotes to find any page that states it: an old product page, a marketplace listing, a review or affiliate site. Check your own feeds and profiles: Merchant Center, marketplace listings, your Google Business Profile. Fix it at the source or ask the site owner to, note the date in the register, and re-run that identity prompt after 30 days.

What one week cannot tell you

A five-day audit gives you a dated first reading. AI answers change between runs and between weeks, so one week cannot separate a real gap from noise. Re-run the same frozen set after 30 days before you treat any number as your baseline, and only then judge whether a fix worked.

That is why our full protocol runs over a 30-day measurement window. I work baseline first, opinion second: measure where the brand stands on a fixed set of prompts, then re-run those same prompts on the same cadence, so you can see movement instead of taking anyone's word for it.

Disclosure: DeviLabs sells this audit; everything above works without us. If you would rather not spend 9 to 13.5 hours capturing answers, our AI Visibility Audit runs 30–50 prompts across at least three engines, three runs each, with "up to 450 logged AI answers" and screenshots, in ten working days for €1,500 excl. VAT, credited in full if you continue to GEO Foundations within 30 days. Either way, write the fact sheet first; you will need it whoever runs the prompts.