The Technical GEO Checklist Every Web Designer Should Run

This series has covered rendering, llms.txt, crawler access, schema, citability, E-E-A-T, brand, and platforms. This final post pulls the technical pieces into one pre-launch checklist — the things to verify before you call any site "GEO-ready."

1. Rendering & crawlability

The foundation. If crawlers can't read it, nothing else matters.

• Key content is server-rendered (SSR/SSG) — verify with curl … | grep "<h1".
• Headings and body text appear in raw HTML, not just after JS runs.
• No critical content is locked behind login/paywall.
• No accidental noindex / noai on pages you want surfaced.

2. AI crawler access

• robots.txt explicitly allows GPTBot, ClaudeBot, PerplexityBot, CCBot, Google-Extended, etc.
• No CDN/WAF rule silently blocking AI bots.
• Sitemap: directive present in robots.txt.
• Test: curl -A "GPTBot" -I https://yoursite.com/ returns 200.

3. Signposting files

• llms.txt exists, summarises the site, and deep-links real URLs.
• sitemap.xml is present, complete, and dated (<lastmod>).
• Canonical URLs are correct and per-page (no duplicate-canonical bugs).

4. Structured data

• Page-specific schema (BlogPosting, Product, Course, FAQPage) — not one global graph.
• Organization.sameAs populated with real profiles.
• Authors marked up with Person schema.
• All schema validates (Rich Results Test + Schema.org validator).
• BreadcrumbList on deep pages.

5. Security & trust headers

Trust signals AI and browsers both respect:

• Strict-Transport-Security (HSTS)
• Content-Security-Policy
• X-Frame-Options
• X-Content-Type-Options: nosniff
• Referrer-Policy
• Permissions-Policy

In Next.js, set these once in next.config.js:

// next.config.js
const securityHeaders = [
  { key: 'X-Content-Type-Options', value: 'nosniff' },
  { key: 'X-Frame-Options', value: 'SAMEORIGIN' },
  { key: 'Referrer-Policy', value: 'strict-origin-when-cross-origin' },
  { key: 'Permissions-Policy', value: 'camera=(), microphone=(), geolocation=()' },
];

module.exports = {
  async headers() {
    return [{ source: '/:path*', headers: securityHeaders }];
  },
};

6. Performance (Core Web Vitals)

Fast pages crawl better and signal quality:

• LCP < 2.5s (Largest Contentful Paint)
• INP < 200ms (Interaction to Next Paint — replaced FID)
• CLS < 0.1 (Cumulative Layout Shift)

7. Metadata & social

• Unique <title> and meta description per page.
• Complete Open Graph + Twitter Card tags.
• Per-page OG images where it matters (blog/product).
• Descriptive alt text on all meaningful images.

8. Content freshness

• Visible Published and Updated dates on content.
• datePublished / dateModified in schema, kept current.

Run it like a pre-flight

Treat this as your launch checklist, the same way you'd check responsiveness and accessibility. Run it on every build, and "GEO-ready" stops being a vague aspiration and becomes a verifiable state.

That's the series. If you'd rather skip the checklist and have a team handle it end to end, that's exactly what we do — let's talk.