The toolkit
The toolkit: a self audit, an order of work and a monthly scorecard
Five pages you can print. A self audit against what this document establishes, a sequence for the first ninety days, the things worth stopping, a one page scorecard, and the checks that take five minutes each.
-
The self audit
Twenty-two checks, each one traceable to a source in this document. Tick what is true today.
-
Thirty, sixty, ninety
An order of work, not a timetable. Nothing here assumes how many hours you have.
-
The stop-doing list
Eleven things this document found no evidence for, so you can spend the time elsewhere.
-
The scorecard
One page a month. Nine numbers, each one with its denominator written next to it.
The self audit.
Twenty-two checks. Every one of them is a thing this document establishes from a primary source, turned into something you can verify about your own business in an afternoon.
- Cloudflare. If your site sits behind Cloudflare, "Block AI bots" is off, or you have opted out of the new defaults before 15 September 2026
- robots.txt. You have opened it and you know what it says. Googlebot, Applebot and Bingbot are not blocked
- Training versus search. If you block AI training, you know that OpenAI, Anthropic, Amazon and Perplexity separate the two and Google, Apple and Meta do not
- Indexed. Every page you care about is in Google Search with a snippet, which Google states is a condition of appearing in its AI answers
- Search Console. Claimed, verified, and you have looked at the generative AI report if it has reached your account
- No JavaScript. Your key pages return their real content when loaded without JavaScript, because most AI crawlers do not run it
- Business Profile claimed. Google names it as a route into AI answers, in its own optimisation guide
- Business name. No taglines, no keywords, no phone number in it. It matches your signage. This is a suspension rule, not a preference
- Categories. As few as possible, per Google's own wording. The primary one is right
- Hours. Correct, including the exceptions, because being open at the time of search is a ranking input
- Reviews. You ask every customer, you never offer anything for one, and you reply to all of them
- Review replies. Not templated. Half of consumers surveyed say generic replies put them off
- Menu or services in text. Readable as text on the page, not only inside an image or a PDF
- Answer-first pages. The questions customers ask are answered in the first paragraph under a heading, because these systems cite passages, not pages
- Email authentication. SPF and DKIM set up. A DMARC record exists. It can be p=none
- One-click unsubscribe. Working, and processed within two days
- Postmaster Tools. Set up, and you know your domain reputation grade
- Consent basis. In the UK, everyone on your list consented or meets all four soft opt-in conditions. In the US, every email carries a physical address and a working opt-out
- Analytics. Installed, and you know that a zero can mean thresholded rather than none
- Asking. You collect how people heard about you at the point of sale, knowing nobody has tested how accurate that is
- Your own numbers. You compare this month to your own last twelve, not to a published benchmark
- The AI check. You have asked ChatGPT and Perplexity for a business like yours in your area and read what came back
An order of work, not a timetable.
This is a sequence: what is worth doing before what. It says nothing about how long any of it takes, because we have no idea how much time you have and it would be a guess.
First, the things that can be actively costing you
- Check whether Cloudflare is blocking Googlebot, and fix it before 15 September 2026
- Open your robots.txt and read it
- Claim and correct the Business Profile: name, categories, hours, address
- Load your own site with JavaScript off and see what a crawler sees
- Set up SPF, DKIM and a DMARC record, and turn on Postmaster Tools
- Check every email carries a working unsubscribe and, in the US, a physical address
- Ask ChatGPT and Perplexity for a place like yours and read what comes back
Then, the things that compound
- Start asking every customer for a review, and reply to all of them properly
- Put your menu or services on the page as text, dish by dish or item by item
- Rewrite your key pages so each question is answered in its first paragraph
- Start collecting how people heard about you, at the till or on the booking form
- Pick the one platform where your customers actually are and stop spreading yourself across five
- Set up one triggered email, the one that fires after somebody has done something
Then, the things you can only do once the above exists
- Fill in the scorecard for the first time and keep the page
- Compare month two to month one on your own numbers, not to a benchmark
- If you are spending on ads, turn one campaign off for a fortnight and watch what happens to bookings
- Read your review replies back as a stranger would
- Check the Business Profile again, because hours and categories drift
Eleven things this document found no evidence for.
None of these is proven useless. Each one is a thing widely recommended, for which we could find no primary source, no measurement, or a source that says the opposite. The time is better spent elsewhere.
| The practice | Why it is on this list |
|---|---|
| Creating an llms.txt file to be found by AI | Google's own documentation: Search "doesn't use them." Costs nothing to keep, should never be sold or bought as a visibility measure |
| Adding special schema for AI search | "There's no special schema.org markup you need to add." Ordinary structured data for rich results is a different thing and still worth having |
| Buying E-E-A-T optimisation | It is a description of what Google wants its systems to reward, not a lever. "No single rating can directly impact how a particular webpage, website, or result appears in Google Search" |
| Posting on your Business Profile to improve ranking | The only test that exists found no local pack effect across 441 keywords per location. Posts may well help conversion. They were not shown to help ranking |
| Putting a keyword in your Business Profile name | It works, on a sample of one, and it is a direct breach of Google's guidelines with suspension as the penalty |
| Manufacturing nine filler posts to earn one promotional one | Reddit publishes no ratio. Its actual rule targets repetition, volume and unsolicited contact, which is what filler-then-promote looks like |
| Reporting your email open rate | 55 to 60 percent of recorded opens are machine pre-fetches. Report clicks, replies and what happened next |
| Adding a first name or an emoji to subject lines to lift opens | Across 4.4 billion messages both were associated with fewer opens, not more |
| Comparing your reach to a published benchmark | Six platforms count an impression six different ways, and every benchmark table is one vendor's own customers with no sector denominator |
| Bidding on your own business name | The largest controlled experiment on this found brand-keyword ads had "no measurable short-term benefits." Test it by switching it off, not by reading the platform's report |
| Spreading yourself across every platform | Not because it fails, but because nothing in this document supports it and every platform chapter rewards depth on one over presence on five |
One page a month.
Nine numbers. Every one of them has its denominator written next to it, which is the single habit this whole document is arguing for. Compare each month to your own previous months and to nothing else.
| The number | Where it comes from | What it is a share of | This month |
|---|---|---|---|
| Enquiries, bookings or covers | Your own book | Nothing. It is a count, and it is the only number here that is unambiguously yours | |
| Where they said they came from | Asked at the till or on the form | Of the people who answered, which is never all of them | |
| Business Profile: calls, directions, website clicks | Google Business Profile | Deduplicated to one impression per person per day, which makes this the most conservative count you have | |
| New reviews, and average rating | Google, and anywhere else you appear | A count and an average. The one metric with published evidence of a revenue link, for independents | |
| Search Console clicks | Google Search Console | Of impressions in Google Search. AI Overviews and AI Mode are folded in and cannot be separated | |
| Website sessions, and the Direct share | Analytics | Of sessions. Direct is a residual bucket for everything with no source information, not people typing your address | |
| AI assistant sessions | Analytics, AI assistant channel | Of sessions, classified on a list Google does not publish. No data exists before 13 May 2026 | |
| Email clicks and replies | Your email platform | Of emails delivered. Not opens. Opens measure a proxy server | |
| Email domain reputation | Google Postmaster Tools | A grade, not a rate: Bad, Low, Medium or High. Watch this rather than spam rate |
Six checks that take five minutes each.
Each of these answers a question this document raises, using something you already have access to, without buying anything.
-
01
Are you visible to AI at all
Open ChatGPT and Perplexity. Ask for the kind of business you run, in your town, the way a customer would phrase it. Read what comes back and note who is in it. Do it again in a month. This is not a measurement, it is a look, and it is the only look available
-
02
What a crawler sees
Turn JavaScript off in your browser and load your own key pages. If the menu, the services or the prices vanish, most AI crawlers are not seeing them either
-
03
What your robots.txt says
Type your domain followed by /robots.txt. Read it. If Googlebot, Applebot or Bingbot appear under a disallow, somebody made a decision you may not know about
-
04
Whether Cloudflare is about to block Google
If your site is behind Cloudflare, open the security settings and find the AI bot controls. If "Block AI bots" is on, it starts blocking Googlebot on 15 September 2026
-
05
Whether your email is arriving
Google Postmaster Tools, free, shows your domain reputation as Bad, Low, Medium or High. Anything below High is a real signal and the spam rate can look fine while it happens
-
06
Whether an ad is doing anything
Turn one campaign off for a fortnight and watch bookings, not the platform's report. If nothing changes, the platform was counting people who were coming anyway
How this was built
The standard
Every claim was checked against a primary source before it went on a page. Sources are labelled first party, meaning the company's, regulator's or researcher's own publication, or second party, meaning a vendor study or a press report.
No percentage appears without what it is a percentage of. Every claim carries the date of its source. Where two credible sources disagree, both are printed and the disagreement is left standing rather than resolved.
What we did not do
Where a page could not be retrieved, that is said on the page rather than filled with a secondary source. No cache, archive or mirror was substituted for a source we could not reach.
Where nobody has measured something, that is said too. Part Seven ends with eight questions this document could not answer, which is the most useful page in it.
Dates and review
Research was carried out between 28 July and 8 August 2026. Anything in here can be checked, and some of it will be wrong by the time you read it, which is why every source carries a date and a link you can follow.
Version 1.0, August 2026. Next review February 2027.
Colin Rooney and Neli Rooney
Wonder Works Design · wonderworksdesign.net
Free to share, in full, unchanged.