Over the past year, "GEO" (Generative Engine Optimization) has been sold as a new discipline. New files, new formats, tricks that "convince" AI. When I look at it as an SEO, I see something different: AI assistants run a search before they write an answer. And the way to be visible in a system that searches is still SEO.

I am not the only one saying this. In its official guide published in May 2026, Google says that optimising for generative AI search is "still SEO". In this article I explain why, with a test I ran on my own name and with the layer that really decides the outcome: the entity.

How does an AI know about a brand?

A language model can know about a brand in only two ways.

1. Training data. The model learns from a large copy of the internet. That copy is months old and cannot be updated from outside. A new brand is either missing from this memory or very weak in it.
2. Live search. When a user asks a question, the model searches the web, reads the pages it finds and writes the answer from them. The technical name is retrieval-augmented generation (RAG).

There is no third door. A question I hear often is: "If I tell a chatbot about my brand, will it recommend it to other users?" No. What you say in a chat stays in that chat. The model will not tell another user, "someone told me about this brand the other day."

In practice, the meaning is simple. For a new or small brand, the only realistic route is live search. And live search means a search engine.

AI search starts with an ordinary search

Before an AI assistant writes an answer, it searches like a person does. Google says this openly: AI Overviews and AI Mode are built on its core ranking and quality systems. They split a complex question into several smaller searches. This is called query fan-out.

So the rule does not change: a page that is not in the search results will not be in the AI answer either. The only thing that changes is the question "which search results?"

• Gemini and Google's AI features rely on Google's own search systems.
• ChatGPT uses its own crawler, OAI-SearchBot. According to OpenAI's documentation, sites that block this bot will not be shown in ChatGPT search answers.
• Perplexity builds its own index with its own crawler, PerplexityBot. Perplexity's documentation says this bot is designed "to surface and link websites in search results".
• Copilot grounds its answers in Bing. Microsoft's documentation says Copilot sends generated search queries to Bing.

So each AI looks at a different set of search results. A site that does well in Google will not automatically be found in Perplexity.

Query fan-out also creates an opportunity. A question like "best technical SEO consultant" can turn into several narrower searches in the background. You do not need to be on page one for the main keyword. If you are strong in one of the smaller searches, you can still be cited. The work is still SEO, just across the whole topic rather than one keyword.

Entity: does the AI know who you are?

Being found is not enough. To be recommended, the AI has to identify you correctly. This is the entity layer: working out which person, brand or company a name belongs to.

I tested this with my own name. My site went live in October 2026. I asked three AI assistants the same question: "Who is Sedat Pehlivantürk?"

Perplexity's first answer is a typical case of entity confusion. In its index, the strongest sources carrying my name were social media profiles, and they were not about me. At the time, my site was not ranking in Bing yet. ChatGPT and Gemini, on the other hand, connected my site and my contributions on a professional association's site, and found the right person.

Then I checked Cloudflare's AI crawler report. My site does not block any bot. Over the last 30 days, the numbers looked like this:

This matches the test exactly. ChatGPT and Gemini, whose crawlers visit my site, identified me correctly. Perplexity, whose crawler never came, mixed me up with someone else. Leaving the door open is not enough; the bot has to come in and add you to its index.

So how do you get a bot to visit? There is no "submit your site" button for OAI-SearchBot or PerplexityBot. Crawlers find your site through links on pages they already crawl. For Bing you have Webmaster Tools and IndexNow. For the others, the only way is to be mentioned and linked on other sites. Even attracting AI crawlers comes down to classic SEO: discoverability and links.

The difference is whether sources confirm each other. When several independent sources describe the same person in the same way, the model can build an entity. When there is only one weak source, someone with the same name can come out ahead.

What a strong entity needs is not new:

• Complete profiles. Every profile that describes the brand or person (LinkedIn, Gravatar, GitHub, industry platforms) should carry the same name, the same title and the same expertise, and link back to the site. In my test, Gravatar was the only source Perplexity found. If that profile had been empty, it might not have found me at all.
• Structured data. Person or Organization schema, with sameAs links to those profiles. This is the machine-readable way of saying "all these profiles are the same person".
• Being part of the topic. Being cited on relevant sites through articles, contributions and quotes. In my test, what brought the right answer was my contributions on a professional association's site.

None of this is "AI-specific". It is the same thing Google has asked for its Knowledge Graph for years.

What do "GEO tricks" actually do?

Most of what is sold as GEO is either old SEO with a new name or an idea with no proof behind it. Google's guide addresses several of them one by one.

• llms.txt. Google says you do not need llms.txt, special AI text files or Markdown versions to appear in its AI features. It does no harm, but it will not get you recommended.
• Chunking content into small pieces. Not needed. Google says its systems can understand several topics on one page.
• Special schema. There is no special schema type for AI. Schema is still useful, but because it defines the entity.
• Fake brand mentions. Google says seeking inauthentic mentions is not as helpful as it might seem. My test showed the opposite path: what worked were real contributions.
• Hidden instructions on the page. Adding text that people cannot see, to steer an AI, is not a ranking tactic. It is spam.

The Agentic Browsing section in PageSpeed Insights is also often misread. It arrived with Lighthouse 13.3 in May 2026 and is still under development. It checks the accessibility tree, layout shift (CLS), WebMCP and llms.txt. Its purpose is to help an AI agent move around a site and fill in forms. It is not about whether an AI recommends you, and Google has not announced it as a ranking factor.

In short: being found and being recommended are SEO and entity work. Agents being able to act on your site is a separate technical topic.

How do you measure it?

There is no single ranking report for AI visibility, but you can measure the parts.

• Bing Webmaster Tools, AI Performance. Shows which of your pages are cited in AI answers on Bing. Topics Portfolio (Beta), added on 13 October 2026, also lists queries where other sites are cited and yours is not.
• Google Search Console. Because Google's AI features are built on its core systems, organic performance is still the best signal.
• Analytics. Referral traffic from ChatGPT, Perplexity and Gemini.
• Server or CDN logs. Are crawlers like OAI-SearchBot and PerplexityBot visiting the site?
• Regular prompt tests. Ask the same questions at set intervals and record the answers. AI answers change, so do not read one answer as a permanent ranking. In my Perplexity test, the same question gave two different results on two tries.

A short checklist

1. Can AI crawlers reach your site? Check robots.txt and your CDN's AI bot settings.
2. Is your site indexed in Bing as well as Google?
3. When you search for your name or brand, does the AI match you with the right person or company?
4. Do your site, profiles and external sources describe the same identity? Are your sameAs links in place?
5. Do you say something that cannot be found anywhere else? Google calls this "non-commodity content".
6. Do you have real contributions on other sites?

GEO may be a new name, but the work is old. Make sure search engines can find you and identify you correctly, and AI will find you too.

Enter a page address and see whether AI search crawlers and search engines can reach and read it. Free, no sign-up.

This tool checks technical readiness only. It does not measure real rankings or citations in ChatGPT, Gemini or other AI assistants.

What it checks

• Six crawlers: OAI-SearchBot, ChatGPT-User, Claude-SearchBot and PerplexityBot (AI search), plus Bingbot and Googlebot (search engines). For each one, the tool reads your robots.txt rule, then requests the page with that crawler's real user agent and compares the answer with a normal browser request. Firewalls and bot-protection pages (Cloudflare and others) are detected.
• Indexability: HTTP status, redirect chain, noindex and canonical.
• Content without JavaScript: most AI crawlers do not run JavaScript. If the raw HTML is empty, the page is empty for them.
• Structured data: JSON-LD, and an Organization or Person with sameAs links (an entity signal).
• Page structure, sitemap and performance (PageSpeed). llms.txt is shown for information only and does not change the score.

What it does not measure

This tool does not tell you whether you actually appear in ChatGPT or Gemini answers. Technical readiness only means the crawlers can get through the door. Whether an AI recommends you still depends on your place in search results and the strength of your entity. I explain why in GEO Is Just SEO: How Brands Really Get Into AI Answers.

How the score works

The score starts at 100 and every warning or failure costs points. Critical blockers (noindex, an error status, or every AI crawler blocked) cap the score at 40. A score of 90 or more needs every measured check to pass. 85 and above is good, 50–84 is fair, below 50 is poor.

Why I built it

When I looked at my own site's Cloudflare bot data, PerplexityBot had not visited once in 30 days, and Perplexity could not find me on the first try. Checking whether a site is open to AI crawlers meant digging through logs and robots.txt by hand. I built this tool to turn that into a single scan. I developed it myself as a WordPress plugin.

Frequently asked questions

How do I allow OAI-SearchBot in robots.txt?

Add a group for it, for example User-agent: OAI-SearchBot followed by Allow: /. OAI-SearchBot is the crawler behind ChatGPT search. GPTBot is a different crawler, used for training. You can block GPTBot and still allow OAI-SearchBot, so your pages can appear in ChatGPT search without being used as training data.

Does Cloudflare block AI crawlers?

It can. Cloudflare has settings that block AI crawlers, and on some sites they may be switched on without the owner noticing. If the checker shows a bot-protection page for an AI crawler while browsers get the real page, check the bot and AI crawler settings in your Cloudflare dashboard.

Can AI crawlers read JavaScript-heavy sites?

Usually not. Most AI crawlers read the raw HTML and do not run JavaScript. If your text only appears after scripts run, those crawlers may see an empty page. Server-side rendering or static HTML fixes this.

Do I need an llms.txt file?

It does no harm, but no major AI search engine has confirmed that it uses llms.txt to choose sources. That is why the checker only reports it for information and it does not change your score.

Why is Googlebot or Bingbot marked "Unverified"?

Many firewalls block requests that only claim to be Googlebot or Bingbot, because the real crawlers come from known IP addresses. The checker cannot tell that apart from a real block, so it does not fail you for it. Use the URL Inspection tool in Google Search Console, or Bing Webmaster Tools, to confirm.

Run a free scan on the AI Search Readiness Checker → Only the page you enter is scanned. You can run 2 new scans per hour; results are kept for 24 hours.

Why brand search results are hard to break into

If you have an established digital footprint, your brand search is actually a very calm place. Search engines recognise your brand as an entity: domain history, backlink profile, brand signals and user behaviour all combine, and the results page barely moves outside of a few predictable conditions.

That stability is a wall for the attacker. Getting a pixel-perfect phishing clone to rank organically for your brand term is close to impossible — because algorithms work out very quickly that it’s a clone. The rest of this article is about how that wall gets climbed anyway.

The clone nobody is allowed to see

Picture a financial scam. The first step is a one-to-one clone of the target brand’s site — visually indistinguishable. Next to it, the attacker registers a domain that evokes the brand’s name — something like secure-examplebank-login[.]com or examplebank-verify[.]net, to use harmless, defanged examples.

But this clone never tries to rank. On the contrary, it’s deliberately kept out of the index. On top of it sits a cloaking layer (known in the field as a cloaker or shell). That layer sorts visitors: only the targeted profile — a specific device type, a specific location — reaches the real clone. Everyone else (bots, security scanners, traffic from the wrong country) is quietly redirected to the brand’s genuine website.

Notice why this paralyses the defence. When an automated scanner arrives to check the site after an abuse report, the cloaker sends it to the real bank — so it concludes “nothing wrong here, this is a legitimate site,” and the report dies. By controlling visibility, the attacker controls detection.

Borrowing trust: site reputation abuse

If the clone can’t rank, how does it reach people? Not by email or SMS — through the search result itself.

A separate landing page is built; its domain is again close to the brand, or the brand name is padded with words like “login”, “secure” or “vip”. That page is then dropped into the canonical tag of a compromised site bought on the black market (in the trade this is usually called a hacklink). Google’s own spam policy has a name for the underlying abuse: site reputation abuse.

The logic is this: the compromised site is old, established and trusted. When a page declares via its canonical tag “my real content lives at this address,” the search engine tends to extend trust to the address it points to. So trust is siphoned from a legitimate site and transferred to the phishing page. To speed things up, bulk backlinks are pointed at it too, and the page suddenly surfaces for the brand term — though usually on the fourth or fifth page.

This “borrow someone else’s trust” pattern isn’t a one-off. Security researchers have documented the same mechanics repeatedly in large-scale campaigns, including operations that turned compromised institutional sites into ranking weapons. It’s an established method, not an edge case.

Manufacturing demand: fake engagement

Who clicks a link on the fourth page of a brand search? Nobody. And that’s the real problem the attacker has to solve.

Enter fake engagement — automated click farming, known in the field as hitbots. Automated sessions that imitate a real user go to the search engine, type the brand name, find the phishing link among the results, click it, and then move around the page like a genuine visitor. When those signals are produced at enough volume, the algorithm reads the page as “a result people search for and find useful under this brand term,” and lifts it up. Within a short time it settles into the top positions of the brand search you run every day.

I’m deliberately not detailing how those sessions are built. The goal here isn’t a recipe — it’s to make the mechanism detectable.

The payoff — and why it’s so hard to kill

Now the chain is complete. The user searches for the brand as they always do, clicks the top result, the cloaker routes them to the clone based on their profile, and they hand over their credentials believing they’re logging into “their own bank.”

This is not a niche problem. In 2025 alone, losses reported to the FBI’s Internet Crime Complaint Center passed the 20-billion-dollar mark, and phishing/spoofing was the single most-reported crime type across every category (FBI IC3 2025 Annual Report).

Here’s the awkward part. A site ranked this way doesn’t last long — algorithms usually catch the mistake and drop it within three or four days. That might sound like good news. But for a high-traffic brand, those three or four days are a disaster. “Wait and hope the algorithm corrects itself” is not a defence. You need something faster.

Building a search-forensics early-warning system

My approach was to turn this into a system rather than chase it by hand.

Continuous SERP monitoring. I built monitoring that queries the results page for brand terms relentlessly and tracks the position of my own site. Because an established brand’s SERP is stable, every deviation is meaningful: if the site drops a few places, or an unfamiliar domain plants itself in the top five, that’s an anomaly.

Anomaly to alarm. On such a deviation, the system raises an alarm. That could be wired to a notification or an email — but I connected it to full automation: the alarm triggers the next step without asking a human.

Automated inspection — and beating the cloaker. The moment the alarm fires, a process starts scanning the suspect site: source, HTML, DOM. There’s a critical obstacle here. A good cloaker can recognise my scanner and throw it a harmless decoy page. To get past that, I repeat the scan under conditions different from the “clean” profile the cloaker expects — the aim is to see the page a real victim sees.

Classification with an AI agent. I pass the scan data to an AI agent I’ve trained for this job. The agent isolates the suspicious and malicious patterns on the page and makes a call: is this a phishing page or not.

Multi-channel reporting. If the answer is yes, the system opens the abuse action — notifying roughly 22 platforms via API, including Cloudflare, Google Safe Browsing and PhishTank.

With this flow I’ve taken down close to 500 phishing sites — not one by one by hand, but as a line that runs itself from alarm to report.

Of course it doesn’t solve everything. Sometimes even three or four days is a luxury; when an immediate response is required, manual abuse reports through Cloudflare — which can produce results in around ten minutes — come into play. But that deserves an article of its own, so I’ll leave it for the next one.

Originally published on sedatpehlivanturk.com.