What actually gets you cited by AI (and what's being sold instead)

A client on a programme I run showed me a page their agency had recommended. A special page, written for AI assistants to read, so the models would “understand the site better”.

I suspected BS. But suspicion isn’t evidence, so I did the homework. I had Claude analyse the seven sites I operate or advise on, pulled the published research, and looked properly at the products being sold in this space, including Chris Donnelly’s Searchable and Tibo’s Outrank. I also dug into Anthropic’s new watermarking announcement and Cloudflare’s latest numbers on machine traffic, because both came up this week.

Here is what the evidence actually says. Short version: the special page is BS, two of the four things that work are free, and some of what’s being sold could genuinely hurt you.

The game has changed shape, not rules

When someone asks ChatGPT “where’s the best place to find staff in my sector”, something decides which pages get quoted. That something is mostly the search infrastructure that already existed.

Every major AI assistant retrieves through a search layer. ChatGPT grounds through Bing plus its own crawl. Google’s AI results run on Google’s core ranking systems. Their words, not mine. Perplexity runs its own index built on conventional authority signals. A 2025 academic study measured it directly: getting a page to rank in retrieval was roughly 7.6x more effective than the best “AI content optimisation” trick tested.

One genuine change is worth understanding. People don’t type keywords into a chatbot, they describe situations. “We’ve had a vacancy open for three months, where should we be advertising?” The model then quietly decomposes that into boring sub-searches, “best niche job boards UK 2026” and the like, up to 16 of them, and stitches an answer from pages that answer those sub-questions cleanly. You choose your targets by listening to how customers actually talk. You win them with the unglamorous assets that rank for the sub-searches.

The four things with evidence behind them

1. Rank in classic search. Still the foundation. Nothing else works without it.

2. Serve your words in the HTML. The AI crawlers do not run JavaScript. Vercel’s log analysis showed GPTBot, ClaudeBot and PerplexityBot fetch script files and never execute them. If your content only appears after the page loads in a browser, machines see a blank shell.

3. Get mentioned on sites that aren’t yours. This is the strongest lever in every dataset. Ahrefs studied 75,000 brands: mentions of your brand across the web predicted AI visibility two to three times more strongly than backlinks. Around 85-90% of what AI answers cite is third-party material: trade press, “best of” lists, review sites, Reddit, Wikipedia. Getting into the lists AI already quotes beats anything you can publish yourself.

4. Write things worth quoting. Named authors, real dates, specific numbers, cited sources. Machines cannot cite what they cannot date or attribute.

That’s the list. Notice what it is: SEO, working infrastructure, PR, and good writing. Business fundamentals wearing a new hat.

What I found on my own sites

The audit was humbling, which is rather the point of audits.

My strongest domain, the one with real authority built over years, was returning a 403 error to every single AI crawler. A firewall setting, switched on for good reasons during a spam cleanup, had quietly made the whole site unquotable. Whatever we published, no AI system could read a word of it. Minutes to diagnose, minutes to fix.

The bakery, with the best press coverage of anything in the set, national “best bakery” coverage, industry awards, had zero structured data on its site. Every AI answer about it was built from third-party review sites because its own site gave machines nothing to work with.

And my own personal site was the opposite case: technically immaculate, welcoming every crawler by name, and cited by nobody, because almost nothing links to it yet (sob sob). Configuration was never its problem. Authority was.

Three sites, three different diseases, and not one of them would have been fixed by anything the AI visibility industry is selling.

The most important first step is asking these questions.

Now the things being sold

The special AI page. The recommendation that started all this. There’s a whole family of these: llms.txt files, “AI info” pages, instructions written for chatbots. No major AI platform has confirmed reading any of them. Google’s own guidance says flatly that no special files or markup are needed for AI features. And Ahrefs measured actual bot behaviour across 137,000 sites that had deployed these files: 97 per cent were never fetched by a single bot. Not once. You’re writing letters to a reader who never reads the post.

Searchable. Chris Donnelly’s monitoring platform, $14M raised, real product, real engineers behind it. It tracks whether AI assistants mention your brand across a panel of prompts, from $125 a month. Here’s my issue, and it isn’t fraud: it’s a dashboard. Monitoring tells you where you stand. It does not move you one place up. You can replicate the core of it with a spreadsheet, fifteen realistic customer questions, and one hour a month of asking ChatGPT, Perplexity and Google yourself. When you have real budget and a client to report to, tools like this earn a place. As a first move for a small business, the free version of the habit gets you most of the value.

Outrank. Tibo’s tool auto-generates and auto-publishes an AI article to your site every day, with a “backlink exchange” between customer sites, from $99 a month. The automation genuinely works, and that’s the problem. Unedited AI content published at scale is precisely what Google’s scaled content abuse enforcement has been deindexing sites for throughout 2026, and reciprocal link networks have been against the rules since long before AI. On a disposable affiliate site, fine, that’s a calculated bet. Pointed at a domain your business depends on, it’s a loaded gun. This is the “at worst, risky” end of the market. Caveat - I have not tried it and I remain open to doing so, but risk is a factor to consider.

The pattern worth learning: the legitimate parts of this industry sell measurement, crawlability and PR, all verifiable. The other parts sell proprietary scores you can’t audit, files nothing reads, and volume Google punishes. My rule of thumb, ask any provider for their evidence. If the answer is a score only they can calculate or a file only they can write, keep your hand on your wallet.

If you need a sane read, Alexander Chukovski, the sharpest debunker I know on search, who has spent years separating what moves rankings from what moves invoices. Check his blog.

Two developments worth knowing about

Anthropic now watermarks Claude’s output. Announced this month: an invisible statistical marker woven into generated text, driven by EU transparency rules. Before anyone panics, the detail matters. There’s no public detection tool, only Anthropic can verify it (currently), editing substantially degrades it, and a positive result proves “Claude touched this”, which includes proofreading, not “a machine wrote this”. Google’s position on AI-assisted content remains quality-based, not origin-based. If your process is AI drafts, human judgment, named author, real substance, nothing changed for you. If your process is publish-whatever-the-machine-emits, the problem was never the watermark.

Machines became the majority of internet traffic in May. Cloudflare’s numbers, reported on their August earnings call: non-human traffic overtook human traffic this spring, and on current trends could reach a thousand times human levels within five years. Their words: humans become “a rounding error on the internet”. An AI agent researching a purchase might check 5,000 pages where a human checks five. You can read that as dystopia. I read it as a practical instruction: an increasing share of your future customers’ first impressions will be formed by a machine reading your site on their behalf. Making your business legible to machines isn’t a growth hack. It’s becoming table stakes, like having a website was in 2005.

What to actually do

I turned the whole exercise into a checklist, the same one I’m working through across my own sites. Five parts: can machines read you, does your site say what you are, is your content worth citing, does the rest of the internet vouch for you, and how to measure it monthly for free. Plus the short list of things to ignore.

Download the AI Search Readiness Checklist

Work through it with whoever runs your website. Most items take under an hour. The most expensive problem I found across seven sites was caused by a free setting, and the most valuable fixes cost nothing but attention.

That’s usually how it goes.