Sample Visibility Report — Real Audit, Anonymized Client

Part A — AI Visibility Audit

CLIENT: small business, York Region, Ontario (anonymized at client’s request)
AUDIT DATE: November 9, 2026 · RE-AUDIT: November 10, 2026 (after fixes)
METHOD: 66-check protocol · passive tier only · frozen 12-query citation panel
RESULT: 42 of 66 checks met · 7 priority findings · re-audit: 63 of 66 met

Bottom line: the site is clean, well-built, and machine-readable at the basics — a search engine or AI system can read it and come away certain about who the business is. What it does not do is answer questions. Not one page is written as a question a buyer would actually ask, and the business did not appear in the results for any of the 12 buyer questions tested. The gaps are in how the site presents itself to machines and assistants — fixable, mostly small, and worth doing in a specific order.

Finding	Status	Importance	Fix
Pages do not answer questions directly — no passage on any page is written to be quoted by an assistant.	Not met	High	Under each question heading, put a direct answer of about 40–80 words as the first paragraph.
No coverage of the questions clients actually ask — zero pages built around a buyer’s question.	Not met	High	Add headings written as the questions clients actually ask, each followed by its answer.
No phone number displayed on the homepage.	Not met	High	Display a phone number on the homepage.
No street address published anywhere on the site.	Not met	High	Add a visible street address (contact page + footer).
Business identity in machine-readable form is incomplete — the structured record is missing key identity fields.	Not met	High	Complete name / URL / address / telephone on the entity schema.
Conflicting page addresses — 5 pages declare an official address that points to a different page.	Not met	High	Remove the conflicting declarations so each page claims only its own address.
Contact details consistent across the site — could not be verified against directory listings with the access this audit has.	Needs confirmation	High	Choose one phone number, use it on every page, then check name/address/phone against the main listings.

Did the assistants cite the business? (citation panel)

Twelve questions a buyer in this trade might actually ask were run verbatim and the top results recorded. The client appeared in 0 of 12. The occupied positions were review sites, national media, generic IT vendors, and content farms — nobody local, and nobody selling exactly what this client sells.

What this number does and doesn’t mean: 0 of 12 on broad head terms is normal for a small site — those terms are occupied by big names with big budgets, and no on-page fix beats them. It is not the whole scoreboard. The audit also records the narrower, local, specific questions where the top results are thin and winnable; that is where the fix list aims and where a small site can actually appear. The citation gap here is off-page authority (listings, presence, content), not site structure — which is why the fix list is ordered the way it is.

What was already working well

A search engine or AI system can read the site and come away certain about who the business is.
No page returned a server error or a fake “not found” page.
The site’s instructions let AI reading systems read it rather than shutting them out.
The site says the same thing about a fact wherever it discusses it.
The site publishes the structured record that identifies it as a local business.

The fix list, in payoff order

Answer-first paragraphs. Under each question heading, a direct 40–80 word answer as the first paragraph.
Question-shaped headings. Headings written as the questions clients actually ask, each followed by its answer.
Phone number on the homepage.
Visible street address on the contact page and in the footer of every page.
Complete the entity schema — name, URL, address, telephone.
Remove conflicting page-address declarations so each page claims only itself.
One phone number, every page — then check it against the directory listings.
Re-measure after the fixes: re-run the same 66 checks and the same 12 questions, and compare line by line with this report.

Re-audit: before and after

The client had the fixes made. The same protocol was re-run against the same frozen checks and the same frozen question set. This is the comparison the client received:

Measure	Before	After
Checks met (of 66)	42	63
Site-internal failures	7 priority findings	0
Pages answering questions directly	0	Question-shaped pages with answer-first paragraphs; FAQPage schema in place
Phone / address published site-wide	Not published	Published on every page, consistent, with a maps link
Machine-readable identity	Incomplete	Complete (name, URL, address, telephone on the service entity)
Citation panel (frozen 12 queries)	0 / 12	0 / 12 — unchanged, and reported as such

The honest part: the citation panel did not move after the on-page fixes, and the report says so. On-page fixes make the site quotable and the business unambiguous; appearing in assistants’ answers is a slower game of off-page authority — listings, presence, and content aimed at winnable questions. Anyone who promises a citation number in a week is selling something else. The re-audit exists to show movement that is real and to name the movement that isn’t yet.

What to ignore

You do not need: a blog posting schedule, paid “AI optimization” packages, a chatbot on your website, or chasing lab speed scores on a low-traffic site. None of those move the 0-of-12 number. The fix list above does what it can, and says honestly what it can’t.

Part B — External Exposure Scan (format example)

CONSENT: written authorization on file before scanning (required, always)
SCOPE: external only — public website and public server responses. No internal network, no password attempts against real accounts.
STATUS: this client’s scan is on file and in their full deliverable; its findings are not reproduced here. The table below shows the format and severity language Part B uses.

Finding	Severity	What it means	Fix
End-of-life web server software — banner discloses an unsupported version	High	Version disclosure hands an attacker a known-exploit menu; unsupported software no longer receives security patches.	Upgrade or suppress the version banner; put the server on a patch cadence.
Admin login reachable from the public internet	High	Automated bots find login pages within hours and try credential stuffing against them. This is how small-business sites get defaced.	Restrict by IP or VPN, enable MFA, rate-limit and lock out repeated failures.
SPF present, DKIM and DMARC missing	Medium	Anyone can send email that looks like it came from your domain — to your clients. This is how invoice fraud starts.	Add DKIM signing and a DMARC policy, tightened to reject over time.
Open directory listing on a subdomain	Medium	File names like board-minutes-2024-04.pdf are a roadmap for what to go look for next.	Disable directory indexing; move anything sensitive out of the web root.
TLS certificate chain incomplete on one host	Low	Some browsers and scanners flag the connection as untrusted even though the traffic is encrypted.	Install the full intermediate chain.

The no-hostage rule, in practice: every finding, with fix instructions, goes to the client free, in writing, whether or not they hire me. Fix it with your IT person, fix it yourself, or hire me. The information is never the product.

A real small business, audited and anonymized