10 Things We Check When We Audit a Local Business for AI Search

These are the ten things LocalStar checks when we audit a local business site for AI search visibility. It is our own audit methodology. No operator of ChatGPT, Perplexity, Claude, or Google AI Overviews publishes a checklist of what earns a citation, so nothing here should be read as one. Where an operator documents how its crawlers and search products work, we follow that documentation and name it. Where nobody documents anything, we fall back on engineering practice that holds up no matter which reader arrives. The ten items are answer-first content structure, schema markup, AI crawler access, server-side rendering, third-party brand mentions, citation-worthy content, content freshness, author authority, internal linking structure, and an llms.txt file.

Three kinds of claim appear below, kept separate on purpose. Documented facts come from operator documentation, RFC 9309, or schema.org, and we say whose. Reasonable best practices are argued on their engineering merits, because they serve human visitors and machine access at the same time. Our working model covers everything else: the conventions, thresholds, and weightings we use in our own audits because we have found them useful.

For the LocalStar methodology behind these items, see our SignalScore™ framework. For a deeper read on the dimension most local businesses under-invest in, see The Sixth Dimension: Brand Authority.

1. Answer-First Content Structure

What it is: writing pages so the direct answer to the page's question appears in the first 40 to 60 words, ahead of the context, history, or sales pitch. The 40-to-60-word window is our own working convention. No engine publishes a required length, and we use that range because it is roughly the size of a self-contained answer that a person can read in one glance and a model can quote without trimming.

Why it matters: a short opening paragraph that fully answers the headline question is easy to quote and easy to skim. A 300-word warm-up that buries the answer in the middle serves neither reader. Worth being precise about the sourcing here, because this claim is often mis-cited: Google's helpful content guidance does not prescribe answer-first placement or any word window. What it asks for is original, substantially complete, well-sourced, people-first content. The answer capsule is our practice for meeting the people-first part, and the human benefit is the part we would keep even if no model ever read the page.

How to check: read the first paragraph of any service or FAQ page and ask whether a stranger could answer the headline question using only that paragraph. If they would need to keep reading, rewrite it. Common mistake to avoid: opening with a brand origin story, a "welcome to our site" line, or a long history paragraph before the substantive answer ever appears.

2. Schema Markup (Organization, LocalBusiness, Person)

What it is: structured data in JSON-LD format that states, in a machine-readable form, what a page and a business are. The types that earn their keep for a local business are Organization, LocalBusiness (or a more specific subtype such as Plumber, Dentist, or Restaurant), Service for what you sell, and Person for author and principal profiles. The full vocabulary is published at Schema.org. Our practical schema markup guide covers the types that matter most and how they nest.

Why it matters: schema removes ambiguity for any machine reading the page. "We serve the East Metro" is open to interpretation. A LocalBusiness block with explicit `areaServed`, `address`, `telephone`, and `openingHours` fields states the same thing without guesswork. One limit is worth stating plainly, because a lot of GEO marketing gets it wrong: JSON-LD asserts your identity and attributes, it does not verify them. Search systems corroborate what you assert against other sources, so markup that contradicts your Google Business Profile, your footer, or your invoices is a liability rather than a shortcut. And no operator documents preferential treatment for JSON-LD in AI answers.

How to check: run the page through Google's Rich Results Test and Schema.org's validator, then read the output against what the page actually says. Common mistake to avoid: shipping template placeholders such as `"telephone": "+1-555-555-5555"`, or marking up content that does not appear visibly on the page. On FAQPage specifically, Google stopped showing FAQ rich results in May 2026, so treat FAQ markup as description rather than as a rich-result play, and only where the questions and answers are genuinely on the page.

3. AI Crawler Access (robots.txt and Your CDN)

What it is: whether the documented AI agents can actually fetch your pages. The important detail is that operators now run several agents that do different jobs, and each is controlled separately. OpenAI documents `GPTBot` for model training, `OAI-SearchBot` for ChatGPT Search indexing, and `ChatGPT-User` for fetches a user triggers, which OpenAI notes robots.txt may not apply to. Anthropic documents `ClaudeBot` for training, `Claude-SearchBot` to index for search, and `Claude-User` for user-directed retrieval. Perplexity documents `PerplexityBot` for search indexing and `Perplexity-User` for user-requested fetches, which generally ignores robots.txt because a person asked for the page. Google's `Google-Extended` is not a crawler and has no user-agent string at all: it is a robots.txt token governing whether content already fetched by Google's crawlers may be used for Gemini training and grounding, and it has no effect on Search inclusion, ranking, or AI Overviews. Our crawler allowlist post lists the current agents with their documented purposes.

Why it matters: because the agents are separate, the decisions are separate. Blocking a training agent opts you out of training and does nothing to your presence in that operator's search product. Allowing a training agent does not put you in it either. The agents that matter for whether you can be cited are the search and retrieval ones, and those are the ones to confirm you have not blocked by accident. This is the single most common piece of confusion we clean up in audits, usually installed by a CMS plugin that offers one "block AI" switch for a set of decisions that are not the same decision.

How to check: start from the actual rule, which is that access is the default. Under RFC 9309, a URL with no matching `Disallow` rule is allowed, so an explicit `Allow: /` is unnecessary unless it is overriding a more specific disallow. Two things actually block AI agents in practice. The first is an overbroad wildcard disallow, typically a `Disallow: /` left behind from a staging site or flipped on by a builder's privacy toggle. The second is your CDN or WAF: Cloudflare's AI crawler controls are enforced at the edge and will stop a bot regardless of what robots.txt says. Note that `curl -A GPTBot yourdomain.com/robots.txt` verifies nothing, since it only fetches a text file with a spoofed user-agent string. Real verification is reading your server or CDN logs for the documented agents, validated against the operators' published IP ranges, plus a look at your bot-management settings.

Common mistake to avoid: adding a per-bot group that contains only `Allow: /`. Once a specific user-agent group matches a bot, the wildcard `*` group stops applying to that bot entirely, so a group like that silently discards every `Disallow` you wrote for everyone else and exposes `/admin/`, `/api/`, and anything else you had protected. If you add a per-bot group, repeat your disallow rules inside it. Most sites need no per-bot groups at all: if your wildcard group only disallows a handful of private paths, every compliant AI agent is already allowed.

4. Server-Side Rendering (No JS-Only Content)

What it is: content that appears in the raw HTML your server returns, before any JavaScript executes. Plenty of modern site builders ship pages where the headings and body copy are injected client-side after load, leaving an initial response that is close to empty.

Why it matters: operators do not publish rendering guarantees for their AI agents, so the safe engineering assumption is that a retrieval agent reads the initial HTML response and nothing more. Server-rendered HTML is the version of your page every reader gets. Google is the documented exception worth knowing: Googlebot renders JavaScript, and Google's AI features are grounded in the normal Search index, so Google will generally see client-rendered content. That is one engine out of several, and server-rendered HTML is also faster to first paint, more accessible, and easier to debug, so we would recommend it on those grounds alone. It is one of several checks in our technical health guide.

How to check: view the page source, using View Page Source rather than Inspect, and search for your headline text. If it is missing from the raw source but present in the rendered DOM, you have a client-only rendering problem. Common mistake to avoid: running a marketing site on a JavaScript framework left in client-side-rendering mode. Next.js, Remix, Nuxt, and SvelteKit all support server rendering or static generation, and any page you want quoted should use one of them.

5. Brand Mentions Across Third-Party Sources

What it is: references to your business name, brand, or principals on sites you do not control. Review platforms, local news, industry directories, podcast guest pages, partner and certification pages, Chamber of Commerce listings, and BBB profiles all count.

Why it matters: our working model is that anything a business says about itself is the weakest available evidence, while what independent sources say is something a reader or a search system can corroborate. No AI operator published that model, but it lines up with how Google describes reputation in its quality guidance around experience, expertise, authoritativeness, and trust, and with what we see in audits: the businesses that come up in AI answers usually have a trail of independent references behind them.

How to check: search your business name in quotes. The first two pages of results should include sources you do not own. If every result is your own website, social profiles, and Google Business Profile, that is the gap. Common mistake to avoid: buying cheap citation packages that mass-list you in low-quality directories. Those listings are trivially purchasable, which is exactly why they carry little weight with a human reader, and Google documents low-quality link and listing schemes as something its systems target.

6. Citation-Worthy Content (Statistics, Sources, Expert Quotes)

What it is: content containing discrete, attributable facts that someone could quote. Statistics with sources, expert quotes, specific project numbers, definitions, comparison tables. Generic marketing copy such as "we provide excellent service" gives a reader nothing to carry away. A sentence in the form "[specific number or range], per [named, verifiable source]" is far more useful, provided the number and the source are both real. Pull figures from your own records, a trade association, or a government dataset, and link the source.

Why it matters: a page full of verifiable specifics is more useful to a customer comparing options and more quotable to anything summarizing the topic. A page with no specifics has nothing to extract. In our own methodology we weight Citability at 25 percent of a SignalScore audit, the highest of any dimension, because it is the item a business can move fastest under its own control. That weighting is ours, and it reflects our judgment about leverage, not measured engine behavior. More on the reasoning in our post on citability and quotability.

How to check: scan a service page and count the attributable claims, meaning a stat, a source, a named expert, or a specific number. A 1,000-word page with zero of them is a marketing page rather than a reference. Common mistake to avoid: inventing statistics to sound authoritative. A fabricated figure cannot be corroborated by anyone who goes looking for the source, and the reputational cost when a customer or a competitor checks is entirely yours.

7. Content Freshness (Accurate, Current, Honestly Dated)

What it is: whether a page is actually current, and whether its dates say so honestly. The signals are the `dateModified` field in schema, sitemap `<lastmod>` entries, and a visible "Updated" line in the page body.

Why it matters: for anything where staleness changes the answer, such as pricing, regulations, permit requirements, or product availability, an out-of-date page is simply a wrong page. That is true for the customer reading it and for anything quoting it. Google documents dates as something it uses to understand and display content, and our working model is straightforward: keep the pages where the facts move accurate, and let the date reflect real edits.

How to check: take your top five commercially important pages, read them for anything that is no longer true, and confirm the visible updated line matches the `dateModified` value in schema. Common mistake to avoid: rolling the date forward without changing the content. Google's own guidance on dates is explicit that you should not artificially freshen a page by changing its date without making substantive changes, and a page dated this month that still quotes last year's pricing is worse than an honestly dated old page, because a customer will act on it.

8. Author Authority Signals (Person Schema, sameAs, hasCredential)

What it is: structured, checkable information about the humans behind the content. Person schema with `sameAs` links to LinkedIn, professional profiles, and published work, plus `hasCredential` entries for licenses and certifications, and an About page that says who the principals are and what they are qualified to speak about.

Why it matters: this is the experience and expertise half of the framework Google publishes for assessing content quality, and it is also what a cautious customer looks for before calling a contractor. Schema.org's Person type exists precisely to make that information machine-readable rather than leaving it buried in prose. A named, verifiable author gives any reader something to check. An anonymous page gives them nothing.

How to check: open any substantive content page and ask whether a stranger could identify the author and verify their credentials from that page alone. Common mistake to avoid: hiding authorship behind a generic "the team" byline, or listing impressive credentials in marketing copy with no corresponding Person schema and no outbound link that lets anyone confirm them.

9. Internal Linking Structure (Clear Topical Hierarchy)

What it is: how pages on your site link to each other. A clear set of pillar pages on core topics, supporting pages that link up to the pillar and across to related sub-topics, and consistent descriptive anchor text.

Why it matters: internal links are how any crawler discovers pages and how any reader moves between related ones, which makes this long-standing best practice rather than anything specific to AI. A page nothing links to is easy to miss entirely. A coherent structure also makes the shape of your expertise legible: one strong pillar page per service with supporting detail underneath reads as a specialist, and a pile of unconnected pages reads as a brochure.

How to check: take your most important service page and count the internal links pointing into it. Zero or one is a gap, and it means the rest of the site is not supporting the page you most want found. Common mistake to avoid: generic anchor text such as "click here" or "read more" where descriptive anchor text would tell both the reader and the crawler what is on the other end.

10. llms.txt (A Cheap Hedge, Honestly Described)

What it is: a file at `yourdomain.com/llms.txt` giving a curated, hand-written map of your site's most important pages, following the llms.txt proposal. It is a community proposal rather than a standard, and it has not been adopted by any major engine as a documented input.

Why it matters: less than most GEO marketing claims, and we would rather say so. Google has stated explicitly that it ignores llms.txt, so publishing one neither helps nor harms you there. No other major search operator documents consuming it either. Some AI developer tools and documentation readers do read it when pointed at a site, which is real but narrow. The entire case for publishing one is cost: writing a curated file is an hour of work with essentially no maintenance, which makes it a cheap hedge if the convention gets picked up later. That is the whole argument. If anyone tells you llms.txt drives citations today, ask them which operator documents it.

How to check: visit `yourdomain.com/llms.txt`. A 404 means you do not have one. Common mistake to avoid: generating a sprawling file that dumps every URL on the site, which recreates the sitemap you already have. The point is curation: the ten to thirty pages most worth reading, grouped by topic, each with a one-line description.

How LocalStar Scores on Its Own 10-Point Checklist

The fair test of an agency that publishes a checklist is whether it holds itself to it. We published our own audit numbers in We Audited Our Own Site: 95 out of 100 on our automated quick diagnostic and 73.5 out of 100 on the full six-dimension audit. Both figures are LocalStar SignalScore methodology scores: internal measures produced by our own instrument. No engine issued them or sees them. They track our work against our own bar, and that is all they do.

The technical and structural items are where we score strongest, because they are bounded work that finishes. The two we treat as ongoing are brand mentions across third-party sources and citation-worthy content, and those are also what pulled our full-audit score down. That is the same posture we set with clients: the technical items are checklist work with a completion state, while building a body of reference-quality content and independent mentions is continuing practice. Treating that second half as a project with an end date is how it stops happening.

If you want an assessment of where your business stands on these ten items, that is what a SignalScore™ audit produces: a scored, dimensioned baseline against our methodology that you can act on, included in any LocalStar GEO engagement.