# The GEO Scorecard and Playbook: Rationale and Knowledge Base This document explains every meaningful decision behind the GEO Playbook (thearm.ai/geo.html) and the GEO Scorecard (thearm.ai/geo-scorecard.html): what we check, how we weight it, what we refuse to do, and why. It is written to be read by people and by machines. If you attach a chatbot to this file, it should be able to answer nearly any "why does the tool do X" question from the text below. Built by Chris Hudson. Questions and contributions: chris@promisepath.ai Last updated: 2026-07-25 ## 1. Purpose and philosophy The playbook and scorecard exist to help any business become readable, citable, and usable by AI systems: AI search (ChatGPT, Gemini, Claude, Perplexity), AI recommendation, and the autonomous buyer agents now arriving through protocols like UCP, ACP, and AP2. Three principles govern everything: 1. Own your data layer. Vendors should extend your reach, not be your whole strategy. Every recommendation favors assets the business controls: its own schema, its own feeds, its own files at its own domain. 2. The person who teaches the most owns the category. Everything is free, the methods are public, and the tool explains its own reasoning. This document is part of that. 3. No manufactured urgency. There is no race and no deadline. It is simply, factually, very helpful to be among the first in your market that agents can talk to, because AI answers come from whatever data is easiest to find, parse, and trust. ## 2. The fairness doctrine The single most important scoring rule: a site is only marked down for what is affirmatively observed missing or broken, never for what the tool could not reach. Why: browser-based auditing has real limits. Some platforms block auditing tools entirely. Some fetch routes strip markup. Punishing a site for our own visibility limits would produce false failures, and false failures destroy trust in every true finding. So any check we cannot verify on a given run is excluded from both sides of the score (it earns nothing and counts against nothing) and is labeled in the results as excluded, with instructions for verifying it by hand. Consequences of this rule you will see in real results: - On shielded platforms audited through the fallback rendering route, markup-dependent checks (schema, meta tags, ratings) show as excluded, not failed. - The sitemap check is excluded on the fallback route because that route cannot reliably fetch raw XML, so "missing" and "unfetchable" would be indistinguishable. - A site that blocks every route gets no score at all, with a diagnosis, rather than a fake zero. ## 3. Scoring architecture ### 3.1 Tiers Checks are organized into four tiers that mirror how the work should actually be sequenced: - Tier 1, Foundation: crawler admission and machine-readability. Do first, low effort. Skipping these makes everything else moot, but they are basics, not differentiators. - Tier 2, Authority: reputation and identity signals. Highest impact, ongoing. AI systems weigh third-party reputation heavily and cite sources they trust, which is often not your own website. - Tier 3, Content: answer-shaped pages and freshness. Feeds your own-site citations. - Tier 4, Measure: closing the loop. Everything above is a hypothesis until you watch citations move. ### 3.2 Automated versus manual Automated checks are things observable from a site's own pages and files. Manual checks are things that live on other platforms (Google Business Profile, review sites, Reddit) which cannot be crawled from a browser tool. Manual checks are listed, explained, and given fix guidance, but they carry no points. Scoring them would mean guessing, and guessing violates the fairness doctrine. The automated score is therefore explicitly labeled as the automated half of the full playbook. ### 3.3 Weights Weights are 3, 2, 1, or 0.5, assigned by two questions: how much does this signal matter to whether AI can find, parse, and trust the site, and how confident is the evidence base. Weight 3 (critical): AI crawlers allowed in robots.txt; machine-readable pages without a JavaScript wall; core Organization or LocalBusiness schema. Fail these and AI either cannot enter, cannot read, or cannot identify the business. Weight 2 (major): extended Product, Service, FAQPage, and Review schema; an LLM-readable catalog feed; sameAs entity links; AggregateRating markup; third-party profile links; query-shaped FAQ content. These decide how deeply AI understands and how much it trusts the site. Weight 1 (meaningful): llms.txt; sitemap; title and meta description; freshness signals; the noindex or noai directive check. Real signals with either lower current crawler pickup or lower catastrophe-if-missing. Weight 0.5 within NAP partial credit: phone and address are half-credited separately since address applies mainly to local businesses. ### 3.4 Score bands - 90 to 100: TOP 2%. Substantially every automated signal in place. - 70 to 89: AGENT-READY. Solid foundation with a clear short list of remaining points. - 40 to 69: ON THE MAP. Visible to machines with significant gaps. - 0 to 39: NOT YET VISIBLE. Foundational work needed. Bands are directional labels, not certifications. GEO is young; treat weightings as informed and evolving, and let measurement settle disputes. ## 4. The checks and why each exists ### Tier 1: Foundation robots.txt allows AI crawlers (w3, high confidence). GPTBot, OAI-SearchBot, ClaudeBot, PerplexityBot, and Google-Extended must not be disallowed. Businesses get this wrong constantly, usually via old blanket rules. A site passes if nothing blocks the AI crawlers; explicit Allow rules are recommended as a declaration of intent. No accidental noindex or noai directives (w1, high confidence). A meta robots noindex, none, noai, or noimageai tag silently overrides a welcoming robots.txt. These usually survive from a redesign or a staging push and their owners have no idea. It is checked on raw homepage markup only; on the fallback rendering route, where meta tags are not visible, it is excluded per the fairness doctrine. Weighted 1 rather than 3 because most sites pass by default; the value of the check is catching the rare, catastrophic accident. Machine-readable pages (w3, high confidence). Most AI crawlers do not execute JavaScript. If the raw HTML is empty, the site does not exist to them. The tool also detects template defects: unrendered template variables leaking into the HTML that crawlers see, which is reported as a distinct defect because found-and-broken is more actionable than missing. Core schema, Organization or LocalBusiness (w3, high confidence). JSON-LD identity: who you are, where, what you sell or do. Any specific business type is accepted (Store, Restaurant, ProfessionalService, AutoDealer, MedicalBusiness, and so on). Broken JSON-LD is reported explicitly: if schema blocks exist but fail to parse, the results say so, because a business that tried and shipped broken markup needs a different fix (repair) than one that never started (create). Extended schema, Product, FAQPage, Review (w2, high confidence). Detail-page product or service markup, FAQ markup, and review markup are what agents lift directly for comparisons and answers. The scan follows links from the homepage to a live product or detail page and an FAQ page (maximum three extra fetches) so schema living on deeper pages is credited. Passing requires at least two of the three families; a scanned detail page with no product schema is called out specifically because that is the page buyer agents care about most. LLM-readable catalog feed (w2, high confidence). A machine-readable feed of the business's offerings at a common path (/llm/inventory, /data/products.json, /products.json, /data/inventory.json) or declared in llms.txt. Framed deliberately as a differentiator rather than table stakes: schema on pages is how AI reads offerings today, and a feed is the next tier, handing an agent the entire catalog with pricing and freshness in one request. Feed candidates are validated: JSON paths must parse as JSON, and content that is actually a rendered webpage (such as a styled 404 page) is rejected to prevent false passes. llms.txt (w1, medium confidence). A curated agent-facing index. The honest picture as of mid-2026: Google says it is not required for their AI features, Anthropic recommends it, OpenAI references it for agents, and Lighthouse audits for it. Cheap insurance for the agent layer, weighted accordingly. Sitemap (w1, high confidence). Exists and is declared in robots.txt. Excluded rather than failed on the fallback rendering route. Title and meta description (w1, high confidence). The first two things every crawler reads. ### Tier 2: Authority sameAs entity links (w2, medium-high confidence). Three or more sameAs URLs in schema pointing to the business's real profiles gives AI one unambiguous identity to merge signals into. AggregateRating markup (w2, high confidence). The review score in a machine-trusted format. The tool and playbook are explicit: real numbers only, refreshed monthly, never invented. A business without reviews should earn some first; the markup should follow reality. Third-party profiles linked from site (w2, high confidence). Four or more linked platforms from the recognized set (Google Maps, Yelp, Trustpilot, Facebook, YouTube, Instagram, LinkedIn, TripAdvisor, BBB, and industry review sites) passes; two gives partial credit. AI answers "best X near me" from a cross-referenced source stack; a site that never points at its own profiles leaves that stack invisible. Name, address, phone (w1 split, high confidence). Visible contact identity in raw HTML, consistent with listings everywhere. Address applies to local businesses, hence partial credit structure. Manual checks in this tier: Google Business Profile completeness and review cadence (for local businesses, the single biggest lever for Gemini; recency and velocity beat raw volume), presence and rating across the industry's review platforms and increasingly Reddit, and brand search volume plus entity consistency. ### Tier 3: Content Query-shaped pages with FAQ blocks (w2, high confidence). Literal question-and-answer content with FAQPage markup is the most-studied GEO tactic there is. Detected on the homepage and on a discovered FAQ page. Freshness signals (w1, medium-high confidence). dateModified in schema and recent sitemap lastmod dates. Staleness reads as abandonment. Manual: high-trust user-generated content on Reddit, YouTube, and forums, where AI leans for opinion. ### Tier 4: Measure Both checks are manual by nature: running a standard buyer-intent prompt set monthly against the major AI systems, and tracking listing health against citation movement. The playbook's position is that every optimization is a hypothesis until the citations move. ## 5. Fetch architecture and platform shields ### 5.1 The routes The tool reads sites the way an AI crawler does: raw HTML first, no JavaScript. Because browsers restrict cross-origin reads, fetches cascade through routes in order: direct fetch (works same-origin and on permissive sites), the tool's own server-side proxy (a Netlify function fetching with normal browser headers), two public CORS proxies, and finally a browser-grade rendering service that executes JavaScript. The first route to return real content wins, and every result is labeled with the route that produced it. ### 5.2 Why the fallback route limits the audit The rendering route returns processed content rather than raw markup. Checks that depend on inspecting markup (schema, meta tags, ratings, sometimes sitemaps) cannot be verified through it, so they are excluded from the score on those runs, labeled, and pointed to hand-verification tools (validator.schema.org, Google Rich Results Test). ### 5.3 Challenge detection Every route rejects bot-challenge pages rather than treating them as content. Detection is two-tier by design: technical fingerprints of challenge systems (Cloudflare challenge scripts, Turnstile, Akamai error hosts) always count, while human-facing phrases (just a moment, access denied, are you a robot) only count when the page has almost no visible text, which is the actual shape of a challenge page. The second tier exists because legitimate content can discuss bots and security; a site about AI agents must not be misclassified as a bot wall for talking about its own subject. ### 5.4 The shield report When every route is challenged or dropped at the network level, the tool issues no score and renders a full diagnosis instead, structured around three honestly-labeled possibilities: 1. Most likely, fine: CDNs usually distinguish verified AI crawlers, which authenticate via published IP ranges, from unverified automation like this tool. If verified crawlers are allowlisted, AI reads the site fine and only auditing tools are blocked. 2. Possible, a problem: if bot management challenges all non-browser traffic including verified crawlers, the site is invisible to AI search. Only server logs distinguish this from the first case. 3. Either way, agents: buyer agents present as unverified automation, exactly as this tool does. A shield tuned to block tools also blocks those agents by default. Admitting them is a business decision worth making deliberately. The report includes the definitive verification path (thirty days of server logs filtered by the AI crawler user agents; the CDN's verified-bots configuration; a robots.txt review), optional adjustments (allow the verified-bot category; serve robots.txt, llms.txt, sitemap, and feeds unshielded; consider rate-limited access for well-behaved unverified agents), and a downloadable text version addressed to the site's web provider. The reasoning: a no-score outcome should produce more clarity than a wrong score, and the owner should leave with a concrete next action that does not require understanding CDN internals. ### 5.5 Refusals that are not shields Domain parking pages are refused with a parking diagnosis. Pages with no business signals and almost no text, fetched cleanly, are refused as probable placeholders or wrong addresses. Before any such refusal on a fast route, the tool escalates to the rendering route and re-evaluates, because thin content on a fast route is usually a challenge or JavaScript shell rather than a real placeholder. Every refusal and failure includes a route trace showing exactly what each route returned. ## 6. What we deliberately do not do - No invented data, ever. The rating check requires real reviews. The fix guides say so explicitly. The site hosting this tool follows the same rule and publishes its own imperfect score. - No scoring of manual checks. Guessing at reputation from a browser would be fabrication. - No competitor mentions in the tool or playbook copy. The tool works on any site a user chooses to enter; the copy does not direct anyone at anyone. - No urgency language. The case for acting is stated factually: early machine-readability is a real and durable advantage, and there is no deadline. - No paywalls, no signup, no lead capture. Value first; the contribution channel is an email address. - No fashionable checks without evidence. Content-licensing signals (RSL, ai.txt) matter for publishers monetizing content, not businesses seeking discovery, and are omitted. Markdown mirrors are recommended with honest caveats about limited crawler pickup. Bing indexing is a playbook item, not a scored check, because it cannot be verified from the site alone. ## 7. Known limits - The tool reads what a site serves to unauthenticated automated requests. It cannot see server logs, analytics, or CDN configuration, which is why shielded platforms get diagnoses rather than scores. - The public-proxy and rendering routes are third-party free services with their own rate limits; traces label their failures honestly (for example, a rate-limited renderer is reported as the service declining, not the site blocking). - Weights reflect the best public evidence and practitioner experience as of mid-2026 and will be revised as measurement accumulates. Disagreements should be settled by data: run the prompts, move a lever, re-measure. ## 8. Glossary - GEO: Generative Engine Optimization, the practice of making a business readable, citable, and usable by AI systems and agents. Good SEO is its foundation. - Verified crawler: an AI crawler that authenticates itself via published IP ranges and reverse DNS (GPTBot, ClaudeBot, PerplexityBot, OAI-SearchBot, Google-Extended), and can therefore be allowlisted by CDNs. - Buyer agent: an AI acting on a specific customer's behalf, researching, comparing, and increasingly transacting. Presents as unverified automation. - llms.txt: a plain-Markdown index at a site's root, curated for AI consumption. - JSON-LD: the schema.org markup format placed in script tags, the primary way sites describe themselves to machines. - Shield: platform or CDN bot management that challenges or drops automated requests. - ARM: Agent Relationship Management, the layer this all points toward, how a business registers, trusts, and manages the agents that interact with it. See thearm.ai. ## 9. Changelog highlights - Fairness doctrine formalized: unverifiable checks excluded from both sides of the score. - Deep scan added: product or detail page and FAQ page discovery, so deeper schema is credited. - Feed discovery expanded to multiple common paths plus llms.txt declarations, with validation against rendered-404 false passes. - Platform shield handling added: challenge rejection on every route, two-tier detection, the three-verdict shield report with downloadable provider version. - Mobile parity: in-page results replacing popups, screen wake lock, live activity feed with staged score reveal. - Self-serve remediation: per-check fix guides with copy-paste code and a ranked path-to-higher-score card. - Added noindex and noai directive detection, broken-schema reporting, and shareable score links. ## 10. Contributing Run the tool, read this document, and if you find a check that misfires, a weight you can argue against with data, or a signal we are missing, write: chris@promisepath.ai. The playbook improves in public.