AI & security

AI Validator

Whether AI models can find, read, quote and operate your site

Three separate things have to go right before an AI system is useful to your business, and most tools check at most one of them.

Try:

Free, no signupNo account, no card
No AI in the score986 deterministic rules
Nothing publishedYour scans stay yours
Answers in secondsQuick scan, no browser

Can it reach you? Every major AI crawler is controlled by its own robots.txt token, and blocking one does not block the others. GPTBot, OAI-SearchBot, ClaudeBot, Claude-User, PerplexityBot, Google-Extended, Applebot-Extended and the rest are each checked individually, alongside llms.txt.

Can it quote you? Answer engines lift passages. Question-shaped headings, FAQ markup, semantic landmarks, declared authorship and publication dates are what make a passage liftable with attribution rather than paraphrased without it.

Can it operate you? This is the part almost nobody checks. Agents that drive a real browser read the accessibility tree and click real controls - so a styled `div` is not a button, a hover-only menu cannot be opened, and an unlabelled field cannot be filled. A site can be perfectly crawlable and completely unusable by an agent.

Why this matters

I asked an AI about my own business and got a rival

You ask ChatGPT or Perplexity about the thing you sell, and it names somebody else. Nothing is broken and nothing is logged - a model that never fetched your page leaves no trace, and neither does one that read it and then quoted a clearer page. Three different faults produce that same silence: you were blocked, you were not quotable, or an agent could not use the page once it arrived.

What it costs you when this is wrong

Trained on, never cited
A security plugin, a leftover staging rule or a bot-blocking setting can disallow the retrieval crawler while leaving the training crawler untouched. Your content still shapes the answer; the citation and the click go elsewhere. Nothing errors, the file looks deliberate, and the loss only ever appears as referrals you never had.
Your answer, someone else's name on it
An answer engine lifts a passage it can attribute - a question-shaped heading, a self-contained answer under it, a named author, a date. Without those, your page can be read in full and still be paraphrased into an answer that credits whoever structured theirs. You find out by asking the model about your own subject.
The agent stops at the consent wall
A blocking consent modal, a CAPTCHA on the landing page, or a listing that only loads as you scroll: each ends the visit before anything is bought. A person clicks the notice away without thinking; an agent has no way through it. It lands in your analytics as one more visit that bought nothing.

Why run it here

All three questions in one scan
Crawler access, quotability and agent operability fail independently, and this page runs all three over the same rendered page in one pass - 100 GEO rules, 100 AEO rules and 28 agentic rules, 228 in total. A clean robots.txt tells you nothing about whether an agent can use your checkout.
The agent checks read the page, not the root
Agent readiness is measured against the DOM after JavaScript has run: whether a control is a real button, whether a click handler sits on a bare div, whether a field carries a name an agent can match. A file at the root of your domain cannot answer any of that.
Every crawler token resolved on its own
81 tokens are each resolved against RFC 9309 precedence, so a specific Allow correctly beats a wildcard Disallow - a case pinned by its own regression fixture. Each carries its own weight, from GPTBot at critical down to a niche indexer at informational, and every block comes back with the exact robots.txt lines to paste.

This check runs on its own here, and as part of the full audit alongside the other 985 rules. Either way the findings carry their evidence and their citation, and the report is never published or kept.

How to make your site AI-visible

Three separate capabilities, and a site routinely passes one while failing the others. Fix them in this order — permission first, because nothing downstream matters without it.

Check your robots.txt per AI user-agent token rather than as a whole. GPTBot, OAI-SearchBot, ChatGPT-User, ClaudeBot, Google-Extended and PerplexityBot are governed independently.
Serve your substantive content in the initial HTML response. AI crawlers generally do not execute JavaScript, so client-rendered content is reliably invisible to them.
Give every answer on the page a heading that states the question it answers, so a passage can be bounded and lifted.
Add a named author and a visible publication or modification date to anything you want cited.
Make every control a real control with a readable accessible name, so an agent acting for a user can operate the page.

What happens when you run it

Enter your address
Just the domain is enough — example.com, with or without the https. No account, no card, no crawl of your whole site.
We render it like a visitor
Your page opens in a real browser and JavaScript runs to completion, so what gets audited is the page a person actually sees — not the raw HTML your server sent. A screenshot comes back with the report as evidence of exactly what we measured.
You get findings you can act on
Up to 986 checks run against that rendered page. Each finding names the rule, quotes the evidence found on your page, cites the public specification behind it, and says what to change. Nothing is a judgement call — run it twice on an unchanged page and the score is identical.

What runs this check

Real browser rendering
RFC 9309 robots parsing
JSON-LD expansion

Named because provenance is the product. Every finding in your report says which of these produced it, so you can check the reasoning rather than take a score on faith.

Questions

Does blocking GPTBot stop ChatGPT from citing me?: Not necessarily - they are different tokens. GPTBot is the training crawler; OAI-SearchBot handles search retrieval and ChatGPT-User handles live browsing on a user's behalf. Blocking one and not the others is extremely common and usually unintentional, which is why each is checked separately.
What is llms.txt?: A proposed convention for a plain-text file describing your site for language models. It is not a standard and support is not established, so it is checked and reported at EMERGING confidence - it appears in your report and is deliberately near-incapable of moving your score.
What is agent readiness?: Whether an AI agent driving a browser can complete a task on your site: find a control, read its label, fill a form and confirm the result. It is a different question from crawlability, and it is the one that decides whether agent-mediated visits convert.

Also checks

This page answers these searches too — they are the same job, so they share one page rather than being split across near-identical ones:

validator ai
ai website checker
llm visibility checker
chatgpt seo checker

Other checkers

Run the ai validator now

No signup, no credit card. Quick answers in seconds; a full audit takes about a minute.

Run a free scan

No signup. No credit card. Nothing stored but the result.

I asked an AI about my own business and got a rival

What it costs you when this is wrong

Trained on, never cited

A security plugin, a leftover staging rule or a bot-blocking setting can disallow the retrieval crawler while leaving the training crawler untouched. Your content still shapes the answer; the citation and the click go elsewhere. Nothing errors, the file looks deliberate, and the loss only ever appears as referrals you never had.

Your answer, someone else's name on it

An answer engine lifts a passage it can attribute - a question-shaped heading, a self-contained answer under it, a named author, a date. Without those, your page can be read in full and still be paraphrased into an answer that credits whoever structured theirs. You find out by asking the model about your own subject.

The agent stops at the consent wall

A blocking consent modal, a CAPTCHA on the landing page, or a listing that only loads as you scroll: each ends the visit before anything is bought. A person clicks the notice away without thinking; an agent has no way through it. It lands in your analytics as one more visit that bought nothing.

Why run it here

All three questions in one scan

Crawler access, quotability and agent operability fail independently, and this page runs all three over the same rendered page in one pass - 100 GEO rules, 100 AEO rules and 28 agentic rules, 228 in total. A clean robots.txt tells you nothing about whether an agent can use your checkout.

The agent checks read the page, not the root

Agent readiness is measured against the DOM after JavaScript has run: whether a control is a real button, whether a click handler sits on a bare div, whether a field carries a name an agent can match. A file at the root of your domain cannot answer any of that.

Every crawler token resolved on its own

81 tokens are each resolved against RFC 9309 precedence, so a specific Allow correctly beats a wildcard Disallow - a case pinned by its own regression fixture. Each carries its own weight, from GPTBot at critical down to a niche indexer at informational, and every block comes back with the exact robots.txt lines to paste.

Questions

Does blocking GPTBot stop ChatGPT from citing me?

Not necessarily - they are different tokens. GPTBot is the training crawler; OAI-SearchBot handles search retrieval and ChatGPT-User handles live browsing on a user's behalf. Blocking one and not the others is extremely common and usually unintentional, which is why each is checked separately.

What is llms.txt?

A proposed convention for a plain-text file describing your site for language models. It is not a standard and support is not established, so it is checked and reported at EMERGING confidence - it appears in your report and is deliberately near-incapable of moving your score.

What is agent readiness?

Whether an AI agent driving a browser can complete a task on your site: find a control, read its label, fill a form and confirm the result. It is a different question from crawlability, and it is the one that decides whether agent-mediated visits convert.

AI Validator

I asked an AI about my own business and got a rival

What it costs you when this is wrong

Trained on, never cited

Your answer, someone else's name on it

The agent stops at the consent wall

Why run it here

All three questions in one scan

The agent checks read the page, not the root

Every crawler token resolved on its own

How to make your site AI-visible

What happens when you run it

Enter your address

We render it like a visitor

You get findings you can act on

What runs this check

Questions

Also checks

Other checkers

Run the ai validator now

AI Validator

I asked an AI about my own business and got a rival

What it costs you when this is wrong

Trained on, never cited

Your answer, someone else's name on it

The agent stops at the consent wall

Why run it here

All three questions in one scan

The agent checks read the page, not the root

Every crawler token resolved on its own

How to make your site AI-visible

What happens when you run it

Enter your address

We render it like a visitor

You get findings you can act on

What runs this check

Questions

Also checks

Other checkers

Run the ai validator now