On 20 July we ran our own AEO audit against brandinglab.io — the same audit we sell. It found that every page on our site was serving the homepage's title tag. No page had a meta description. No article emitted BlogPosting or FAQPage schema. Three URLs we invented on the spot returned 200 and rendered as real, indexable pages.
Our site looked perfect. Google's Rich Results Test said it was fine. And for weeks, every article we published presented to search and AI engines as a copy of the homepage.
That is what an AEO audit is for. Not the checklist — the checklist is table stakes — but the discipline of testing what machines actually receive instead of what the browser shows you. Here is the full anatomy of the audit, using our own failure as the worked example, because a methodology you won't run on yourself is marketing, not method.
What does an AEO audit include?
An AEO audit tests six layers, in order: technical foundation (crawl access, robots.txt, llms.txt, sitemap integrity, 404 behaviour), on-page SEO (titles, descriptions, canonicals), structured data (entity schema sitewide, BlogPosting/FAQPage/Service schema per page), content extractability (answer-first structure, question-phrased headings, FAQ blocks), authority signals (third-party citations, entity consistency, roundup presence), and measurement (whether you can even tell if any of this is working).
Each finding gets an ID, the evidence that produced it, why it matters, the specific fix, and a priority from P1 to P4. No finding ships without evidence. In our own audit that rule is what separated the real problem from the two wrong theories that preceded it.
How is every finding verified?
Every claim in the audit comes from fetching a URL and reading what came back — raw HTML the way a non-JS crawler receives it, and the rendered DOM the way a browser builds it. The gap between those two views is where AEO failures live.
Our own audit fetched 37 URLs. All 37 returned an identical 5,434-byte shell whose body was 46 characters long. Then we rendered the pages in a real browser and found the second, worse problem: even with JavaScript fully executed, the head tags never changed. A 2,218-word article with a perfect H1 and a full FAQ block was being labelled with the homepage's title and nothing else.
The diagnostic that found it takes ten seconds: open DevTools on any article and read document.title. Weeks of theories about crawlers, prerendering and hosting had missed it, because every theory was tested at the delivery layer — and the failure was one layer up, in a head-management library that silently stopped working. We wrote up why absence from AI answers compounds in why your B2B website isn't showing up in AI search; this is the mechanism by which it happens to sites that look healthy.
Why didn't Google's own tools catch it?
Google's Rich Results Test passed our broken site, because our sitewide organisation schema — served statically on every URL — was valid and eligible. One valid item detected. Green tick.
What the test doesn't say is that an article page should have produced three items, not one. The static entity schema masked the dead per-page layer. This is the general lesson about validation tools: they confirm that what exists is valid, and stay silent about what should exist and doesn't. An audit's job is exactly that silence — the expected-but-absent. It is why a checklist run by a tool is not an audit.
How are audit findings ranked?
Findings are ranked on impact and effort together, and the ranking's job is to find the fixes that collapse multiple findings at once. In our audit, four P1 findings — wrong titles everywhere, missing descriptions, missing canonicals, missing article schema — traced to a single root cause. One fix, verified with one DevTools check, closed all four. That fix outranked everything else in the report, including findings that were individually more alarming.
The output is a 2x2: high-impact/low-effort items are this week's work, high-impact/high-effort items are month one, low-impact/low-effort items fill spare capacity, and low-impact/high-effort items get named and deliberately deferred. If an audit hands you thirty findings of equal weight, you've been handed a liability transfer, not a plan. The AEO maturity model is the strategic version of the same discipline — knowing which level you're at tells you which fixes are even worth doing yet.
How is the schema generated?
The audit doesn't recommend schema in the abstract — it ships the JSON-LD, pre-filled from your real site data, ready to paste. Organization schema built from your actual name, founding date, locations and social profiles. Service and Offer schema carrying your actual pricing. FAQPage schema generated from the questions already on your pages.
On our own site the schema layer is generated programmatically: article pages build BlogPosting and FAQPage JSON-LD from the CMS record, and the FAQ block on each page is parsed into schema automatically. That's the end state the audit points at — schema as a build output, not a plugin bolted on. The distinction matters for AI engines specifically, and we've covered the definitional ground in what is AEO and the strategic split in AEO vs SEO.
How is the roadmap planned?
Each roadmap item names the file, the change, and the verification step — because a roadmap you can't verify is a wish list. Ours read: fix the head-management layer, then confirm document.title changes per page and the managed-tag count is above zero. Return real 404s for unmatched routes, then confirm an invented URL renders a noindex 404 page. Regenerate llms.txt from the database, then confirm it lists what the sitemap lists.
The phases are honest about time: week one is the quick wins (in our case, one dependency fix closed the worst four findings in an afternoon), month one is the structural work (consolidating duplicate pages, rebuilding stale files), and everything after that is cadence.
How are updates tracked?
Presence or absence in the answer is the metric, and it's logged monthly by hand. Take your 20 most important buyer queries, run them in Google, ChatGPT and Perplexity three times each, and record three things: did an AI answer appear, were you cited, who was cited instead. Alongside that, GA4 tracks AI-referrer sessions — traffic arriving from chatgpt.com, perplexity.ai and their peers — and Search Console confirms what Google actually crawled.
The audit repeats quarterly. Ours found a failure our own weekly monitoring had missed, which is the honest argument for the cadence: monitoring watches the metrics you chose; an audit re-tests the assumptions underneath them.
The uncomfortable part, and why we published it
We sell AEO services, and our own site spent weeks presenting every article as a copy of the homepage. We could have fixed it quietly. We published it instead, because the audit that found it is the product, and the find is the proof. The fix went live the same day: correct titles, descriptions, canonicals and a five-block schema stack on every article — verified in the DOM, not assumed.
If you want the same test run against your site, get a free AEO audit — it checks the four things that caught our failure: what crawlers receive, what the rendered head contains, what schema actually emits, and whether your invented-URL test returns a real 404. If the results need acting on, the full audit and programme picks up from there.