Related guides: The free AI visibility checker.
14 of the hundred checks are in this group. Each is listed with its weight in the score and whether it affects AI search directly, and for each: why it matters, and what to do. The hub page has the other groups and how the score is made.
- Compression
- HSTS
- app-ads.txt
- security.txt
- Apple App Site Association
- Android asset links
- ads.txt
- favicon.ico
- favicon.svg
- apple-touch-icon.png
- Web manifest
- /.well-known/ served
- Legacy files
- Trackers and consent
Compression
mediumBarely affects AI search
Why it matters. Uncompressed HTML makes every crawl slower and larger. It is a one-line server setting and it applies to every request a crawler makes.
What to do. Enable gzip or brotli for text/html, text/css and application/javascript at your server or CDN.
HSTS
lowBarely affects AI search
Why it matters. Strict-Transport-Security tells a browser never to try http:// for this host again, which removes the first insecure request of every visit rather than redirecting it. Its search effect is marginal — the redirect is what crawlers act on — but it is a one-line header and it closes the window the redirect leaves open.
What to do. Send "Strict-Transport-Security: max-age=31536000; includeSubDomains" on HTTPS responses. Start with a shorter max-age if you are not certain every subdomain serves HTTPS, because this is not quickly reversible.
When it is not scored. No Strict-Transport-Security header. Worth adding, and not scored — the HTTPS redirect above is what actually matters for crawling.
app-ads.txt
lowNo effect on AI search
Why it matters. The in-app counterpart to ads.txt. No search or AI effect.
What to do. Only needed if you sell advertising inside a mobile app.
When it is not scored. Not present — only needed if you sell in-app advertising. Not scored.
security.txt
mediumBarely affects AI search
Why it matters. Not a ranking factor, but it is a cheap, standardised, machine-verifiable signal that a real organisation actively maintains this site. Trust signals compound into whether a model treats you as an authority worth quoting.
What to do. Add /.well-known/security.txt per RFC 9116 with Contact and Expires fields. Expires is mandatory — without it the file is treated as stale.
Apple App Site Association
lowNo effect on AI search
Why it matters. Lets links to your site open your iOS app directly instead of bouncing through Safari. Only relevant if you ship a mobile app.
What to do. Serve /.well-known/apple-app-site-association as application/json with NO file extension — the missing extension trips up most static hosts.
When it is not scored. Not present — only needed if you ship an iOS app. Not scored.
Android asset links
lowNo effect on AI search
Why it matters. The Android equivalent of AASA — verifies your domain owns the app so links open natively.
What to do. Serve /.well-known/assetlinks.json with your package name and signing certificate fingerprint.
When it is not scored. Not present — only needed if you ship an Android app. Not scored.
ads.txt
lowNo effect on AI search
Why it matters. Declares which parties may sell your ad inventory, which stops spoofing. No effect whatsoever on search or AI visibility.
What to do. Only needed if you sell advertising. Your ad network provides the exact lines.
When it is not scored. Not present — only needed if you sell advertising. No search or AI effect. Not scored.
favicon.ico
highBarely affects AI search
Why it matters. Google fetches /favicon.ico from that exact path regardless of your <link> tags, and answer engines increasingly show it beside your citation. Missing it means a blank grey square next to your brand in an AI answer, right where a competitor shows a logo.
What to do. Place a multi-resolution .ico at the site root. Keep it there even if you also serve modern formats.
favicon.svg
lowNo effect on AI search
Why it matters. Scales cleanly on high-DPI displays and can adapt to dark mode via an embedded media query. Cosmetic, but it is the difference between a crisp mark and a blurry 16px bitmap.
What to do. Add an SVG icon and reference it with <link rel="icon" type="image/svg+xml">.
apple-touch-icon.png
lowNo effect on AI search
Why it matters. Used when someone saves your site to an iOS home screen. Without it, iOS screenshots your page and uses that — almost always unreadable.
What to do. Add a 180×180 PNG at /apple-touch-icon.png with no transparency.
Web manifest
lowNo effect on AI search
Why it matters. Enables install-to-homescreen and sets the browser theme colour on mobile. A mild mobile-quality signal and a prerequisite for any PWA behaviour.
What to do. Add /site.webmanifest with name, short_name, 192px and 512px icons, and theme_color.
/.well-known/ served
highBarely affects AI search
Why it matters. Many hosts, CDNs and static site frameworks block dot-prefixed directories by default. If that is happening, every file you place in /.well-known/ silently returns 404 and you would never know without testing it in production.
What to do. Explicitly allow /.well-known/ in your server or host config, then curl each path against production — not localhost.
Legacy files
lowNo effect on AI search
Why it matters. humans.txt is a credits file for the people who built the site. Pleasant, and read by nobody automated: no search engine or answer engine does anything with it.
What to do. Nothing to do. Safe to delete if present.
When it is not scored. Not present — fine, this has no search or AI value.
Trackers and consent
mediumBarely affects AI search
Why it matters. Every analytics, advertising or chat script on a page is another company watching your visitors, and most of them set cookies the moment the page loads. India's DPDP Act expects a privacy notice wherever personal data is taken; the EU and UK expect to be asked before a non-essential cookie is set. A buyer's legal team reads this before a contract, and a consent wall that hides the page until somebody clicks hides it from a crawler too.
What to do. Link a privacy policy from every page. Where a script sets cookies, hold it behind consent: Google's Consent Mode with analytics denied by default and one small notice, or a cookieless tool such as Plausible or Fathom that needs none.