Check library

HTTPS

The page must be served over TLS so browsers, Google and AI crawlers treat it as a safe document.

Page loads (HTTP 200)

Crawlers can only index a URL that returns a successful HTML document.

Indexable

A noindex directive tells search engines not to show the page in results — fatal if used on purpose-built landing pages.

Canonical tags

rel=canonical tells crawlers which URL is the preferred copy when parameters, trailing slashes or duplicates exist.

Mobile viewport

A viewport meta tag is the basic signal that the layout is meant for phones — still a ranking and usability prerequisite.

Compression

gzip or brotli cuts HTML bytes on the wire and speeds up both users and crawlers.

Sitemap

An XML sitemap is the explicit map of URLs you want discovered — especially for new or weakly linked pages.

robots.txt

robots.txt is the first file crawlers request; it should exist, be valid, and not accidentally block the site.

Main landmark

<main> marks the unique content of the page for assistive tech and for parsers that skip chrome.

Form labels

Every visible input needs a programmatic name so users and browsers know what to type.

Page title

The <title> is still the strongest on-page query-matching signal and the default SERP headline.

Title length

Titles around 30–60 characters tend to display fully and describe the page without stuffing.

Unique titles

Duplicate titles make it hard for Google to choose a snippet and often collapse similar URLs into one result.

Meta description

The meta description is the default SERP abstract and a secondary relevance hint.

Description length

120–155 characters is the practical window before most SERPs truncate the snippet.

Single H1

One H1 should name the page topic; extra H1s blur the outline for users and extractors.

H1 on the page

A page without any H1 has no explicit top-level heading in the outline.

Image alt text

Alt text describes images to screen readers and is used when the file does not load — and as a mild image-search signal.

Open Graph

og: tags control link previews on Slack, LinkedIn, Facebook and many chat apps.

Twitter Cards

twitter:card tags (still used by X) produce large image previews instead of a bare link.

URL length

Short, readable URLs are easier to paste, cite and remember; very long URLs look like tracking junk.

Clean URLs

Lowercase, hyphen-separated paths avoid duplicate HTTP variants and look professional.

Internal linking

Internal links spread PageRank-like attention and help crawlers discover related URLs.

Orphan pages

An orphan is a URL with no internal links pointing at it — invisible unless it is in the sitemap.

Breadcrumbs

Breadcrumbs explain hierarchy in the UI and can generate BreadcrumbList rich results.

Structured data present

JSON-LD (or microdata) makes entities explicit for Google and for generative engines.

Crawl depth

Important URLs should sit close to the root (few path segments / clicks).

Crawl completeness

If we cannot fetch this URL, a site-wide crawl will not analyse it either.

Load time

How long the HTML document takes to download from our crawler — a floor under real user speed.

TTFB

Time to first byte is the wait before any HTML arrives — usually origin or TLS overhead.

Page size

The HTML payload should stay lean; we cap the check at 500KB of markup.

Response compression

Same as technical compression, scored again because it directly changes transfer time.

Cache headers

Cache-Control/Expires tell browsers and CDNs whether they may reuse the response.

LCP (lab)

Largest Contentful Paint should occur within 2.5s on mobile lab data (PageSpeed Insights).

CLS (lab)

Cumulative Layout Shift should stay under 0.1 so content does not jump while loading.

INP (lab)

Interaction to Next Paint should stay under 200ms so clicks feel instant.

AI crawlers allowed

If GPTBot, PerplexityBot, ClaudeBot or Google-Extended are disallowed, generative engines cannot cite you.

robots.txt not blocking all

User-agent: * combined with Disallow: / hides the entire site from every well-behaved crawler.

Structured data coverage

JSON-LD on the page gives models explicit types, names and relationships to quote.

Article schema

Article/NewsArticle/BlogPosting (or WebPage) types flag the document as citable content rather than chrome.

FAQPage schema

FAQPage markup maps Q&A blocks to a format models already use in answers.

Answer-first sections

Generative engines prefer sections whose first 40–60 words already answer the heading.

Question-style headings

Headings that match how people ask ChatGPT (“How do I…?”) are easier to retrieve.

Content Clarity

Short paragraphs and a sensible heading rhythm make extraction and reading easier.

llms.txt present

llms.txt is a voluntary index at the site root that tells LLM crawlers which pages to read first.

Summary section

A TL;DR / key takeaways block is a ready-made citation paragraph.

Author information

A visible byline is a core E-E-A-T and GEO trust signal.

Person schema

Schema.org Person ties the byline to an entity Google and models can graph.

Organization schema

Organization (or LocalBusiness) identifies who publishes the site.

sameAs entity links

sameAs URLs connect your entity to Wikipedia, Wikidata, LinkedIn, Crunchbase.

About page

A linked About/Company page is a classic trust destination for users and raters.

Contact information

A visible email or contact path supports trust and press/citation requests.

Social profiles

Official social URLs corroborate the brand entity.

Credentials

Words like certified, PhD, years of experience are weak but useful expertise cues.

Named entity in schema

Organization/Person/WebSite JSON-LD must include a name field.

Brand in title or H1

The schema entity name should appear in the title or H1 so the page is about that entity.

External source links

Outbound links to sources are one of the strongest GEO citation features.

References section

A labelled Sources/References/Bibliography block is easy to parse as evidence.

Quotations

Attributed <blockquote> or <q> elements mark third-party speech.

Statistics present

Concrete numbers, percentages and “according to” phrases make claims checkable.

Statistics density

A handful of data points beats a single stray percent sign.

Authority links

Links to .gov, .edu, Wikipedia and similar domains transfer recognisable authority.

Publication date

datePublished in Schema.org is the cleanest recency signal we can parse.

Modified date

dateModified or Last-Modified shows the document was maintained.

Content age

The newest valid schema date should be within about a year for a full score.

Current year mentioned

Mentioning the current year in the body (not the copyright footer) is a cheap freshness cue.

NewsArticle schema

NewsArticle/LiveBlogPosting is for timely reporting — optional for evergreen sites.

Event schema

Event markup exposes dates and locations for models and rich results.

Images: alternative text

WCAG 1.1.1 requires a text alternative for non-text content.

Page language

WCAG 3.1.1: the default human language of the page must be programmatically determined.

Language on every page

Templates should declare lang consistently so a crawl does not find mixed missing attributes.

Decorative images

role=presentation/none images should use alt="" so they are skipped by assistive tech.

Main landmark

WCAG 1.3.1 / 2.4.1: users should be able to skip repeated chrome and land in the main content.

Navigation landmark

Primary navigation should be in <nav> (or role=navigation) so it can be found or skipped.

Skip-to-content link

WCAG 2.4.1 Bypass Blocks: keyboard users should jump past repeated navigation.

Form labels

WCAG 1.3.1 and 3.3.2: every input needs a label so the accessible name is clear.

Link purpose

WCAG 2.4.4: the purpose of each link can be determined from its accessible name.

Button names

WCAG 4.1.2: buttons must have an accessible name (Name, Role, Value).

Page titled

WCAG 2.4.2: documents have a title that describes topic or purpose.

Title length (clarity)

Extremely short or long titles are harder to distinguish in a tab list.

H1 heading

A top-level heading exposes the page topic in the heading map (WCAG 1.3.1).

Single H1

One H1 keeps the heading outline unambiguous.

Heading hierarchy

Do not skip levels (H1 → H3) — WCAG 1.3.1 information and relationships.

Unique IDs

WCAG 4.1.1 (and good HTML): id values must be unique in a document.

Table headers

Data tables need <th> or scope so header cells can be announced (WCAG 1.3.1).

Iframe titles

WCAG 4.1.2: frames need an accessible name, usually title.

ARIA roles

aria-label on a generic <div> without a role is often ignored or mapped incorrectly.

HTTPS (transport)

All user traffic should be encrypted. This is the Security-pillar twin of the SEO HTTPS check.

HSTS

Strict-Transport-Security tells browsers to skip HTTP entirely on future visits.

HTTP → HTTPS redirect

Port 80 should permanently redirect to the HTTPS URL.

Mixed content

An HTTPS page must not load scripts, images or iframes over http://.

Content-Security-Policy

CSP is the primary browser defence against XSS and unwanted embeds.

CSP quality

A CSP that allows unsafe-inline, unsafe-eval or * is much weaker than it looks.

Clickjacking protection

X-Frame-Options or CSP frame-ancestors stops other sites from framing you.

X-Content-Type-Options

nosniff stops the browser from guessing MIME types.

Referrer-Policy

Controls how much of the URL is sent in the Referer header to others.

Permissions-Policy

Disables powerful browser APIs (camera, mic, geolocation) you do not use.

CORS (ACAO)

Access-Control-Allow-Origin: * on a credentialed or sensitive response lets any origin read it.

Forms over HTTPS

Form action URLs must not post to http://.

Secrets in page source

API keys and tokens must not appear in HTML or inline JavaScript.

Iframe sandbox

Third-party iframes should be sandboxed so they cannot break out into your origin easily.

Subresource Integrity

SRI (integrity=) detects CDN tampering on third-party scripts.

noopener on target=_blank

Links that open a new tab should set rel=noopener (or noreferrer) to prevent tabnabbing.

Outdated JavaScript libraries

Known old majors (jQuery 1/2, AngularJS 1, Bootstrap 3, …) often have public CVEs.

HTML comment leaks

Comments that mention passwords, TODOs with internals, or staging hosts should not ship to production.

Inline JavaScript

onclick= handlers and javascript: URLs block a strict CSP and enlarge the XSS surface.

Cookie flags

Session cookies need Secure, HttpOnly and SameSite.

Version disclosure

Server and X-Powered-By headers that include versions help attackers pick exploits.

Sensitive paths in robots.txt

Disallowing /admin in robots.txt advertises that /admin exists.

CMS generator meta

meta name=generator that includes a version (WordPress 6.x) is free reconnaissance.

Exposed files

Read-only probes for /.git, /.env and similar must not return content.

security.txt

RFC 9116: publish a contact for vulnerability reports at /.well-known/security.txt.