How audits work

What we check, what the results mean, and how to ship the fixes.

Scoring

Each category starts at 100 and loses points for every finding, more for higher severity. Your overall score is the weighted sum of the categories. Commerce only counts for online stores; for other sites its weight is spread across the rest. Missing llms.txt, entity schema or server-rendered content cost extra. A homepage that blocks our automated request or cannot be fetched at all fails outright, rather than receiving ordinary category scores — while a site doesn't answer, an agent gets nothing. Redirects name the destination instead of scoring another domain. Access for individual AI bots is not verified by our browser-like probe. We only report what we actually fetched.

Firewall blocked your audit? See how to allow AI agents →

A: 92–100
B: 80–91
C: 65–79
D: 50–64
F: < 50

Commerce readiness only counts if you sell online. If you don't, that 20 points is spread across the other five categories so your score reflects what actually matters for your site.

Category weights by site type
Category	Online store	Content / Local business / SaaS
Crawl & Bot Access	20 pts	25 pts
Structured Data	25 pts	31.25 pts
Commerce Readiness	20 pts	Not scored — redistributed
Content Machine-Readability	15 pts	18.75 pts
Policy & Trust	10 pts	12.5 pts
Entity Signals	10 pts	12.5 pts

Detection uses observed product links and structured data. Correct a misclassification on your results page; the project remembers your choice and shows the previous and corrected scores. Local business and SaaS use the same weights as Content site.

Full methodology, limitations and changelog →

Extra weight

A standard finding takes a fixed number of points from its category's 100: critical 50, high 25, medium 12, low 5. A few findings cost more than their severity alone, because they decide whether agents can use your site at all. On your results they carry an Extra weight badge, and the "How this score was built" panel lists the extra cost as its own line. A category never drops below 0.

Finding	Category	Deduction
missing llms.txt No llms.txt file	Crawl & Bot Access	−12 standard − 23 extra = −35 pts
missing Organization (entity) schema No Organization schema	Structured Data	−25 standard − 10 extra = −35 pts
missing entity definition No entity definition	Entity Signals	−12 standard − 28 extra = −40 pts
no JSON-LD structured data No JSON-LD structured data on homepage	Structured Data	−50 standard − 10 extra = −60 pts
content not server-rendered Content is likely JavaScript-rendered	Content Machine-Readability	−50 standard − 20 extra = −70 pts

The extra cost is the total deduction minus the standard deduction for the finding's severity. These are the exact values the scorer uses; nothing is rounded except the final weighted total.

The six categories

Crawl & Bot Access

Weight varies by site type

Can GPTBot, ClaudeBot and PerplexityBot reach your pages, or do robots.txt and firewalls turn them away?

robots.txt rules for 15 AI user agents (GPTBot, ClaudeBot, PerplexityBot, Google-Extended…)
Whether the homepage is blocked by a firewall or bot challenge
A Sitemap: line in robots.txt

Structured Data

Weight varies by site type

Is there schema.org JSON-LD that tells agents what you are, what you sell and at what price?

JSON-LD blocks on the homepage and whether they parse
Organization, WebSite and (for stores) Product and Offer types

Commerce Readiness

Stores only

Can an agent find a product, read its price and availability, and get to checkout?

Product pages found via the sitemap
Prices and availability in structured data, not just visible text

Content Machine-Readability

Weight varies by site type

Is your content in the HTML, with llms.txt and a sitemap that point agents at what matters?

Whether /llms.txt and /llms-full.txt exist and are well-formed
How much text is in the initial HTML, before JavaScript
Title, meta description and headings

Policy & Trust

Weight varies by site type

Are shipping, returns, privacy and terms easy for an agent to find before recommending you?

Links to shipping, returns, privacy and terms pages from the homepage

Entity Signals

Weight varies by site type

Do agents recognise your brand: name, logo, contact details and official profiles?

Brand name, logo, contact details and sameAs profile links in Organization schema

What each finding means

Every finding has a title, a plain-English description, and the evidence we observed (the exact robots.txt line, HTTP status or missing field). Severity tells you what to fix first:

Critical: Agents are blocked or can't understand the site at all. Fix first.
High: Agents can reach you but will likely skip or misrepresent important information.
Medium: A real gap that lowers your chances of being recommended.
Low: Polish. Worth doing once the bigger items are fixed.

Using the generated fixes

Click Generate fix on a finding, or Generate all fixes to get everything as one .zip. Fixes are built only from values observed on your site; anything we couldn't observe is left as a REPLACE_WITH_… placeholder.

robots-snippet.txt

Add the lines to the top of /robots.txt at your site root. Delete any rule the comments mark for deletion. If you use Cloudflare or another CDN, also allow-list AI crawlers in its bot settings.

llms.txt

llms.txt is an emerging convention, not a ratified standard. Use the guided builder on your results page, or upload as-is to your site root so it's served at yourdomain.com/llms.txt. Every link comes from your own sitemap or homepage. Nothing is invented.

schema.jsonld

Each block has a comment saying which page it belongs on. Paste it inside <head>, replace every REPLACE_WITH_… placeholder with your real value, then check it with Google's Rich Results Test.

recommendations.md / checklist.md

Plain-English steps for content and settings changes that can't be expressed as a file. Hand them to whoever manages your site.

After shipping fixes, re-audit the same domain. It lands in the same project so you can see the score move. See a sample report.

Seeing AI agent visits

The project page has an AI agent visits panel. Visits are counted only from evidence you give us — we never estimate or assume a visit happened.

Pasting access logs

Paste combined server access logs. Recognized records retain the agent name and purpose, sanitized path, time, and observed status and response size when provided. IP addresses, referrers, query strings and raw log lines are never stored. Pasting the same records again won't count them twice.

The snippet — exactly what it collects

The snippet runs on your server (as Node/Express middleware or a Cloudflare Worker), not in visitors' browsers, because most AI crawlers don't run JavaScript.

It only does anything when a request's user agent matches a known AI agent. Requests from people are ignored completely.
For those requests it sends us: the user-agent string (so we can name the agent), the page path, and your project key.
We store only the agent's name, the path without query string, and the time we received it. We do not store the full user-agent string.
It never sends or stores IP addresses, cookies, query strings, form data, or anything about human visitors. It sets no cookies.
It is fire-and-forget: it doesn't wait for us, so it can't slow down or break your pages. Delete it at any time to stop.

Reading the results

No hits doesn't prove agents aren't interested: crawlers visit on their own schedules, sometimes weeks apart. No log data is displayed separately from no recognized visits in an export. Google-Extended and Applebot-Extended are robots.txt control tokens, not crawlers, so they never show up as visits. When an agent our audits saw blocked is later seen allowed, we show how many days passed before it first appeared in your logs — counted from the audit that saw the change, which may be later than the change itself.

CSV and generic ingestion

Upload CSV with timestamp,user_agent,path,status,bytes headers. Timestamps must include a timezone. Combined Apache/nginx logs and newline-delimited JSON are also accepted. Each upload is streamed and capped at 10 MiB, 100,000 records, and 64 KB per record. Visits and coverage are retained for 90 days; older or future-dated requests are excluded. User-Agent names are claims, not verified identities. AI-Primed's own synthetic crawler requests are excluded.

The project panel can create or revoke an account ingestion key. Only its hash is saved; copy the new key before leaving. POST raw CSV, combined log lines or newline-delimited objects to /api/public/traffic-ingest?projectId=YOUR_PROJECT_ID&format=csv (or logs / ndjson), with Authorization: Bearer YOUR_ACCOUNT_KEY. Objects use timestamp, user_agent, path, status and bytes. Responses include read, matched, added, duplicate, unparseable and outside-retention counts, plus the supplied date envelope. A 422 response indicates a partial import; re-importing is safe.

Deduplication uses agent, exact timestamp, sanitized path, status and size. Identical requests at identical timestamp resolution may collapse; provide high-resolution timestamps where possible. Export envelopes do not prove complete logging between their endpoints. Queries, IPs, raw lines and full User-Agents are never stored; potentially personal information in page paths should be removed before export.

Cloudflare availability

Storage planning: retained records equal accepted bot requests per day × up to 90 days. For capacity planning only, assuming 0.5–1 KB per indexed record, 1,000 accepted requests/day implies roughly 45–90 MB per customer; 100,000/day implies roughly 4.5–9 GB. These are assumptions, not measured storage or a billing quote; path lengths, indexes, backups and provider pricing change the total. Human requests are not retained, and no bot share is assumed.

No automatic Cloudflare pull is connected. The raw HTTP Requests dataset, via Logpull or Logpush where your plan supports it, supplies ClientRequestUserAgent, EdgeStartTimestamp, ClientRequestURI, EdgeResponseStatus and EdgeResponseBytes. Verify available fields for your zone before configuring ingestion. Sampled GraphQL aggregates are not a raw visit ledger. Logpush sends new batches without historical backfill, and requires destination setup and potential provider charges.