Skip to content

The master checklist

The whole book compressed into one list. Work top to bottom — the ordering is deliberate (measurement before changes, crawlability before content, foundations before amplification). Each item links to the chapter that explains it.

0 · Before you change anything

1 · Crawlability (the gate)

  • [ ] robots.txt allows what you think it allows — fetch it from the public URL and read it → Sitemaps and robots
  • [ ] Explicitly allow the AI crawler roster (GPTBot, OAI-SearchBot, ClaudeBot, Claude-SearchBot, PerplexityBot, Google-Extended) → AI crawlers
  • [ ] Curl your site as Googlebot and GPTBot — no 403/429/challenge pages → Rendering, WAFs, and bot challenges
  • [ ] Key content renders server-side (view-source shows your copy) → Rendering
  • [ ] If behind a reverse proxy/CDN: canonicals, robots, and sitemap all show the public host, and the internal host isn't a crawlable duplicate → Reverse proxies and CMS traps

2 · Measurement plumbing

  • [ ] Google Search Console verified (consider a domain property + service-account API access) → Search Console
  • [ ] Bing Webmaster Tools set up (import from GSC takes minutes) → Bing Webmaster Tools
  • [ ] XML sitemap live, referenced in robots.txt, and actually fresh → Sitemaps
  • [ ] IndexNow key deployed if your platform supports it → IndexNow

3 · Identity and structured data

  • [ ] One canonical schema.org graph strategy — CMS-auto or hand-authored, never both on the same node → Structured data
  • [ ] Organization/LocalBusiness node with sameAs links to every real profile → Entities and trust
  • [ ] The node types that earn rich results for your category, validated live → Rich results
  • [ ] Local business: sitewide LocalBusiness @id graph + per-page Service/FAQ/Breadcrumb → LocalBusiness schema
  • [ ] FAQ schema generated from visible page content only → FAQ schema
  • [ ] Review markup only on Service nodes, only with real reviews → Reviews

4 · Local (if applicable)

  • [ ] Google Business Profile claimed, complete, categorized; API quota requested early if you'll automate → Business Profile
  • [ ] Live review sync (Places caps at 5 via API — design for it) → Reviews
  • [ ] Service-area pages pass the honesty tests: real city limits, real photos, real reviews per area → Service-area pages
  • [ ] Authenticity audit passed — no stock photos captioned as real jobs, no invented testimonials → Authenticity audits

5 · Content for intent queries

6 · AI-specific surfaces

  • [ ] llms.txt shipped if cheap on your stack (know its limits — it's mostly for coding agents) → llms.txt
  • [ ] Ask-AI deep-link widget considered for footer/docs → Ask-AI widget
  • [ ] Off-site presence on the surfaces AI retrieves: directories, comparison content, Reddit/forums, GitHub → Off-site signals

7 · Agent layer (if you have an API/MCP server)

  • [ ] server.json published to the official MCP Registry with a verified reverse-DNS namespace → MCP Registry
  • [ ] Listings mirrored to the community directories → MCP Registry
  • [ ] OAuth discovery chain returns correctly end-to-end (401 → resource_metadata → both .well-known docs) → OAuth discovery
  • [ ] Tool descriptions written for agent intent, not marketing → Tool descriptions
  • [ ] GitHub org discoverable: names/descriptions/topics carry your keywords → GitHub as discovery

8 · Trust infrastructure

  • [ ] You know who actually serves your DNS (dig NS) → Domains and DNS
  • [ ] SPF + DKIM + DMARC live and tested → Email trust
  • [ ] If you ever changed domains: 301s live, old domain retired properly, GSC told → Domain migrations

9 · Keep it running

  • [ ] Operating cadence on the calendar: weekly checks, monthly review, quarterly re-audit → Operating cadence
  • [ ] Re-run the AI visibility audit on schedule → AI visibility audit