Methodology — How we audit a site

How the AIO score and Ghost Test work: which pages we sample, the checks behind each of the four pillars, and how the crawler answer test flags hallucination risk.

What an audit looks at

Most AI crawlers (GPTBot, ClaudeBot, PerplexityBot) read the HTML your server sends and do not run JavaScript. An audit compares that server HTML with the page a visitor sees after JavaScript has run, and scores what the crawler actually receives.

We sample a set of important pages, found through your XML sitemap and the links on your homepage: the homepage, pricing, docs, product and feature pages, and a few others. Each page is fetched as a plain HTTP request (the crawler view) and loaded in a real browser (the visitor view). A report covers that sample, not every URL on the site; the Audit scope section lists how many pages were sampled, how they were found, and any that failed to load.

The AIO score (0–100)

The AIO score is the sum of four pillars. Page-level pillars are averaged across sampled pages, with pricing and docs pages weighted most.

  • Technical & crawlability (25) — robots.txt allows the main AI crawlers (GPTBot, OAI-SearchBot, Claude-SearchBot, PerplexityBot): up to 10. An XML sitemap is reachable: 10. An llms.txt file exists: 5.
  • Renderability & JS (20) — how much of the visible text is already in the server HTML. Points are lost when more than half, and again when more than three quarters, of the text only appears after JavaScript runs.
  • Structure & readability (30) — in the server HTML: an H1 heading, a sensible number of H2/H3 subheadings, lists, tables or FAQs, and an early summary.
  • Metadata & consistency (25) — in the server HTML: a title, a meta description, OpenGraph tags, structured data (JSON-LD or microdata) and a canonical tag, 5 points each.

Headings, schema or meta tags that exist only after JavaScript runs do not count, because AI crawlers never see them. The page-by-page breakdown on each report marks these as “only after JS”.

A score of 70 or more is shown as Strong, 40–69 as Needs work, and below 40 as At risk. Fixes are ranked by how far the pillar they address is from its maximum.

The Ghost Test (hallucination risk)

The Ghost Test checks whether an AI that only reads your server HTML can answer the questions buyers ask. For each question we ask an AI model twice: once using only the server HTML, and once using the text a visitor sees after JavaScript runs. The model is told to answer only from the content it is given, and to say “not found” otherwise.

  • “What is the pricing?” is asked about your pricing page (/pricing or /plans). If there is no pricing page, the question is skipped and the report says so.
  • “What are the main features?” is asked about your features or product page (/features or /product).
  • If there is no features or product page, we ask one broad question about your homepage instead: “What is this, and how does it make my life better?”

A question is flagged when the server-HTML answer is “not found” or empty but the visitor-view answer is a real answer. That means the information exists, but an AI crawler would not find it, and an assistant answering from what it crawled may guess or omit it. The report shows both answers side by side.

Hallucination risk is reported when at least half of the questions asked are flagged (1 of 1, or 1 of 2). A flag is evidence of risk, not proof that a particular AI product gave a wrong answer to a real user.

Reading the two together

  • Strong score, questions flagged: the site is generally crawlable, but the specific facts buyers ask about (usually pricing) are rendered with JavaScript. Server-render those pages first.
  • Lower score, nothing flagged: the key facts reach crawlers, but discovery, structure or metadata gaps make the site harder to find and quote. Work through the prioritized fixes.
  • Both strong: a good result for the sampled pages, not a guarantee for every page or AI product.

Scores are comparable between audits made with the same methodology. When we change how scores are calculated, reports made before the change are left out of a company’s score trend.

The Threshold Test (can AI assistants open the site?)

The audit above reads your pages the way AI crawlers do. It doesn’t tell you whether an AI assistant gets in when a person pastes your link into ChatGPT, Claude or Perplexity. Each assistant then sends a user-triggered fetcher (ChatGPT-User, Claude-User, Perplexity-User), and firewalls and bot protection often turn it away. These fetchers are separate from the search crawlers (OAI-SearchBot, Claude-SearchBot, PerplexityBot) and training crawlers (GPTBot, ClaudeBot) that the robots.txt check scores, so a site can allow one kind and block another.

The Threshold Test is run only for site owners who ask for it. It has three steps:

  • Probe as each assistant. We request a sample of your key pages with each fetcher’s exact user agent, and once more with our own as a control. If the assistant is turned away but the control gets through, the block is aimed at the assistant. Requests are spaced out and carry an X-AIExorcist-Probe header.
  • Ask the assistant itself. For ChatGPT and Claude, we ask the assistant through OpenAI’s and Anthropic’s APIs to read one key page (pricing, or the homepage), and check the title and heading it reports against the page. In our tests these requests came from the same fetcher and network as the ChatGPT and Claude apps. When this check gives a clear pass or fail, it decides that page’s result. Perplexity’s API doesn’t read a given page live, so Perplexity is probed only.
  • Name the cause and the fix. Firewall block, bot challenge, rate limit, login wall, redirect loop, timeout, empty or JavaScript-only page, or a robots.txt rule (Claude-User follows robots.txt; in our tests ChatGPT-User and Perplexity-User did not), with instructions for your setup.

Each page and assistant is marked Got in, Turned away or Can’t tell. “Can’t tell” means our probe server was turned away too, so the block isn’t specific to AI assistants, or the check couldn’t finish. Some firewalls decide by where a request comes from rather than its name, which the probe can’t reproduce; the API check covers that for one page. A pass covers the sampled pages only, and a failure is strong evidence, not proof. We never try to get past a CAPTCHA or bot challenge.

Results go in a private report and don’t change the AIO score, the Ghost Test or the Registry. About the Threshold Test