GEO audit example — a real AI visibility report

• Keyphrase placement40 / 40
  primary phrase "apple airpods pro" appears in title, H1, URL slug, meta description
  The four places a search engine and an extractive answer engine both look for what a page is about. Weighted by where each carries most signal (title and H1 above slug above meta description), and the slug leaves the denominator on a root URL, which has no slug to hold a phrase.
• Keyphrase density25 / 25
  the primary phrase sits inside the target density band
  Our judgement: a 40–300% share of words is the long-standing convention for "present without stuffing". Google publishes no density target, but keyword stuffing IS a documented spam policy, so the band is defensible in both directions.
• Search position0 / 35
  this page does not appear in the first 10 organic results for the phrase it targets
  A measured zero, not an absence: the search ran and the page was not there. Ranking nowhere for your own declared phrase is the single most consequential on-page finding, which is why the module cannot reach a passing score without it.

• Title length25 / 25
  title is 41 characters
  Google truncates titles past roughly 60 characters in the result and one under 30 wastes the strongest on-page field. Binary — inside the band or not.
• Meta description25 / 25
  description is 144 characters
  Google rewrites descriptions outside roughly 110–155 characters, so a non-conforming one forfeits control of the snippet rather than failing outright. Weighted level with the title because losing the snippet costs clicks even when ranking is unaffected.
• Canonical URL15 / 15
  a canonical URL is declared
  Google Search Central: a canonical consolidates duplicate URLs (tracking parameters, print views, trailing-slash variants) onto one indexed address. Binary.
• Open Graph tags15 / 15
  Open Graph tags are present
  Open Graph protocol — what every social platform reads when the page is shared. Our judgement on the weight: it costs nothing in search and everything in how a share looks.
• Twitter card tags10 / 10
  Twitter card tags are present
  Our judgement, weighted below Open Graph because X falls back to the OG tags, so their absence is rarely visible to a reader.
• Viewport meta10 / 10
  a viewport meta tag is set
  Required for mobile rendering, and Google indexes mobile-first. Low weight only because it is nearly universal; when it IS missing the page is broken on a phone, which the Mobile card grades directly.

• Lighthouse performance75 / 100
  Lighthouse scores this page 75 of 100 on lab data
  Google's own published composite of First Contentful Paint, Speed Index, Largest Contentful Paint, Total Blocking Time and Cumulative Layout Shift, at Google's weights. Taken whole rather than re-derived from the vitals we hold — a second computation would disagree with the number Lighthouse published, and this card exists to report Google's verdict.

• Viewport meta tag25 / 25
  a viewport meta tag is declared
  Mere PRESENCE of the tag — the weakest of the three signals, which is why the Lighthouse judgement below is weighted higher: a viewport tag can be declared and still be wrong.
• Mobile-optimised viewport35 / 35
  Lighthouse judges the viewport genuinely mobile-optimised
  Lighthouse's `viewport-insight` audit — its judgement that the tag is configured for a phone rather than merely present. Weighted above the tag itself because it is the one that can disagree with it.
• Mobile Core Web Vitals30 / 40
  mobile Core Web Vitals score 75 of 100
  The three Core Web Vitals as measured on the MOBILE run (web.dev thresholds), and the heaviest weight here because it is the only continuous, richly-informative signal of the three — the other two are booleans about configuration.

• Alt text40 / 40
  every image has alt text
  WCAG 2.2 SC 1.1.1 (Non-text Content) requires a text alternative, and Google Images uses alt text to understand a picture. Saturates at ALL images missing it — the worst case is a page no screen reader or image index can read.
• Dimensions declared25 / 25
  every image declares width and height
  Undeclared dimensions are a direct cause of layout shift, and CLS is a Core Web Vital with a 0.1 'good' threshold (web.dev/cls). Weighted below alt text because a single image rarely dominates CLS.
• Modern formats25 / 25
  all images use a next-gen format
  Our judgement, not a standard: Lighthouse flags 'Serve images in next-gen formats' as an opportunity rather than an audit failure, so it costs page weight rather than correctness.
• Sized for display10 / 10
  no image is larger than its display box
  Our judgement, weighted lowest: oversized images waste bandwidth but render correctly, and on a fast connection the reader never notices.

• Broken internal links45 / 45
  no broken links among the 30 checked
  Google's own guidance treats broken internal links as wasted crawl budget and a dead end for readers. Saturates at 10% of the sample: past that the navigation is broken as a whole rather than in places.
• Orphan pagesnot measured
  the site-wide link graph was not built on this audit
• Click depth25 / 25
  no page sits deeper than 3 clicks
  Three clicks is our judgement, and a long-standing SEO convention rather than a Google rule: depth correlates with crawl frequency because each level dilutes internal links. Saturates at a quarter of the links being deep.

This is an upper bound: the checks above are all we could take, and the ones we could not can only lower it. It is the ceiling for this page, not its score.

• Broken outbound links45 / 45
  no broken links among the 9 checked
  A dead outbound link is a broken promise to the reader and a stale-content signal. Saturates at 15% of the sample — higher than the internal threshold because link rot on other people's sites is partly outside the owner's control.
• Safe new-tab links30 / 30
  every new-tab link sets rel=noopener
  target=_blank without rel=noopener gives the opened page access to window.opener — the tab-nabbing hole (OWASP; MDN rel=noopener). A security defect, so it saturates at ALL such links rather than a percentage.
• Outbound authoritynot measured
  no backlink provider ran on this audit, so link authority was never fetched

This is an upper bound: the checks above are all we could take, and the ones we could not can only lower it. It is the ceiling for this page, not its score.

• robots.txt12 / 12
  robots.txt is served
  Google's crawler requests /robots.txt on every visit; its absence is not an error but it forfeits all crawl direction. Binary — the file is present or it is not.
• XML sitemap15 / 15
  sitemap found, listing 68 URLs
  Google Search Central lists a sitemap as the primary discovery aid for pages that are weakly linked internally. Binary, and weighted above robots.txt because it adds discovery rather than only restricting it.
• Redirecting pages11 / 11
  no redirects among the pages crawled
  A sitemap-listed URL that redirects spends crawl budget to reach a page the sitemap could have named directly. Saturates at 20% — our judgement, the most forgiving threshold here because a redirect still serves the reader correctly.
• noindex on listed URLs10 / 10
  no crawled page is marked noindex
  A sitemap asks Google to index a URL the page itself refuses — a direct self-contradiction, and Search Central calls out the mismatch explicitly. Saturates at 5%: our judgement, strict because the site is arguing with itself.
• Pages returning 4xx20 / 20
  no 4xx responses among the pages crawled
  A 404 on a sitemap-listed URL is a page the site claims exists and does not. Saturates at 10% of pages crawled — our judgement, set low because a sitemap should not list dead URLs at all.
• Pages returning 5xx20 / 20
  no server errors among the pages crawled
  A 5xx is a fault on our side of the wire, and Google backs off crawling a host that returns them. Saturates at 2% — far stricter than 4xx, because any server error is an outage symptom.
• Canonical consistency12 / 12
  no canonical conflicts among the pages crawled
  A canonical pointing somewhere unexpected tells Google to index a different URL than the one it fetched (Search Central, consolidate duplicate URLs). Saturates at 15% — our judgement.

• HTTPS45 / 45
  the page is served over HTTPS
  Chrome marks plain HTTP as Not Secure and Google has confirmed HTTPS as a ranking signal. Binary, and the largest weight here because every other transport signal is meaningless without it.
• No mixed content15 / 15
  no insecure subresources
  Browsers block active mixed content outright and flag passive mixed content, so a single insecure subresource can break the page or strip the padlock. Binary — the page is clean or it is not.
• HSTS0 / 12
  no Strict-Transport-Security header
  HSTS closes the first-request downgrade window that HTTPS alone leaves open (OWASP Secure Headers). Weighted below mixed content because it hardens an already-working HTTPS setup rather than fixing a visible fault.
• TLS 1.38 / 8
  the host negotiates TLS 1.3
  TLS 1.3 (RFC 8446) removes the legacy cipher suites and cuts a round trip from the handshake. Our judgement, weighted low: TLS 1.2 correctly configured is not a vulnerability, so this is hygiene rather than a defect.
• Security headers3 / 20
  1 of 6 recommended security headers are set
  The six are the OWASP Secure Headers baseline (CSP, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, X-Frame-Options, COOP). Linear rather than saturating: each header closes a distinct class, so the fifth is worth as much as the first.

• Organization or Person schema25 / 25
  the publisher is identified in schema
  schema.org/Organization is how a site states who publishes it — the entity Google and the answer engines resolve a brand to. Binary.
• Content schema25 / 25
  the page's content type is declared in schema
  Google's rich-result eligibility is per TYPE (Article, Product, FAQPage): without one the page can be indexed but cannot win an enhanced result. Binary.
• Valid schema blocks50 / 50
  every schema block validates
  Google's Rich Results Test rejects a block missing its required properties outright, so an invalid block buys nothing while looking like it does. Saturating: one malformed block is a different problem from ten, and past a few the markup is simply unreliable. The heaviest weight because a broken block is worse than an absent one — it claims a capability the page does not have.

• Analytics installed40 / 40
  a web analytics tool is installed
  Our judgement, and the largest weight here: without analytics none of the other fixes in this report can be measured for effect. A measured zero — we read the page and found none — so it is a real fail with a finding, not an absence.
• Consent before non-essential tags30 / 30
  a consent platform was detected alongside the ad and social pixels
  GDPR/ePrivacy require prior consent for non-essential tracking in the EU, and Google Consent Mode v2 is the mechanism Google itself requires for ad tags. Binary, and weighted second because it is a legal exposure rather than a measurement gap.
• Tag manager wiring15 / 15
  no tag-manager misconfiguration was detected
  A container with no visible GA4 tag may be collecting nothing at all, which is worse than no analytics because it looks installed. GA4 and GTM together is the recommended setup and earns full marks here.
• No duplicate or retired tools15 / 15
  no duplicate or retired analytics tools
  Our judgement, weighted lowest and saturating at both issues present: overlapping trackers fragment data and add page weight, but they do not stop measurement the way the three faults above do.

• Preview image20 / 20
  og:image is set
  The Open Graph protocol makes og:image the field that turns a shared link into a card rather than a line of text, and Facebook, LinkedIn and X all read it. The largest share-readiness weight for that reason.
• Preview title15 / 15
  og:title is set
  Open Graph protocol, required property. Weighted below the image because the fallback (the <title> tag) is usually acceptable, whereas there is no fallback for a missing image.
• Preview description10 / 10
  og:description is set
  Open Graph protocol, optional but universally consumed. Our judgement on the weight: it fills the card's body text, and its absence degrades the preview rather than breaking it.
• Canonical share target10 / 10
  og:type and og:url set
  og:url is what makes shares of tracking-parameter variants consolidate onto one canonical target; og:type tells the platform what kind of object it is. Both Open Graph protocol; low weight because most platforms guess acceptably without them.
• X / Twitter card5 / 5
  twitter:card is declared
  Our judgement, the smallest weight here precisely because X reads Open Graph as a fallback, so its absence is rarely visible to a reader.
• Linked profiles0 / 40
  no social profiles are linked from this page
  Our judgement: linked profiles are how a reader and an entity-resolver both confirm the brand is the same one, and schema.org sameAs exists for exactly that. Full credit at 3 networks rather than all eight — three is enough to establish identity, and more is a marketing choice rather than a technical one.