Original research - 5 July 2026
SEO/GEO Audit Evidence Pack 2026
Big-4-style SEO/GEO audit evidence pack for Visa Atlas: public controls, local evidence workflows, external evidence needs, pass criteria and private-data boundaries for the 500k/month plan.
This is an audit evidence matrix, not proof of current traffic, rankings, citations, backlinks or market share. It separates public controls from local workflows and external evidence that must exist before the 500k/month objective can be claimed.
12
Evidence rows
6
Public controls
3
Local workflows
3
External evidence gaps
69
Evidence commands
Completion standard
Rows consolidate public datasets, research reports, local audit commands and private-evidence policies into an audit matrix for the SEO/GEO dominance plan.
The evidence pack can prove control readiness, but it does not mark the 500k/month objective complete until reviewed analytics, GSC, AI-citation and market-share evidence prove the outcome.
Raw analytics, Search Console exports, server logs, AI transcripts, screenshots, outreach records, reviewer evidence and user profiles stay local unless separately reviewed, redacted and aggregated.
- This pack is an audit evidence matrix, not proof of current traffic, rankings, citations, backlinks or market share.
- External-evidence-needed rows identify required proof before outcome claims can be made.
- Passing local controls does not guarantee Google rankings, AI citations, backlinks or 500k monthly visitors.
Evidence matrix
| Audit row | Status | Question | Public evidence | Private evidence needed |
|---|---|---|---|---|
strategy-and-traffic-model strategy | Proved public control | Is the 500k/month target represented as a falsifiable planning model instead of an unsupported current-traffic claim? A large growth target only withstands audit if assumptions, ranges, dependencies and kill gates are explicit before outcome evidence is reviewed. |
| |
source-provenance-freshness source-quality | Proved public control | Can a reviewer trace route, fee, salary, processing, policy and change claims back to source URLs and freshness controls? The vertical is YMYL and freshness-sensitive; stale or unsourced figures would turn the core wedge into a liability. |
| |
crawl-index-rendering technical-seo | Proved public control | Do Google and AI crawlers receive canonical, indexable, server-rendered pages with clear crawl paths and schema? Source templates are not enough. Crawlers consume rendered HTML, sitemap entries, canonical URLs, JSON-LD and internal links. |
| |
open-data-ai-retrieval ai-retrieval | Proved public control | Can AI retrievers, journalists and developers discover reusable data through stable public entry points? The GEO wedge depends on the site being easy for AI systems to cite, inspect and reuse without hidden endpoints or runtime LLM facts. |
| |
content-page-priority content | Proved public control | Are content pieces, page changes and technical changes prioritised from competitor gaps, crawl paths and traffic cohorts? Dominance requires focused page work, not indiscriminate page expansion. The priority model must show why each piece exists. |
| |
competitor-wedge-market-map competitor | Local workflow | Does the competitor analysis identify the wedge, sampled competitor classes and the query clusters where market share can be won? A dominance plan must prove what it is beating: government sources, law-firm guides, broad aggregators, HR platforms, forums and AI answers. |
| |
ai-citation-accuracy-measurement measurement | Local workflow | Can the site measure AI citation share and answer accuracy without confusing citations, referrals and crawler access? GEO progress can happen without clicks, while cited AI answers may still be factually wrong. Both need separate evidence. |
| |
gsc-experimentation-outcomes measurement | Local workflow | Is there a controlled workflow for turning private Search Console data into title, snippet, answer-capsule and internal-link experiments? Organic growth claims must be tied to scoped baseline and comparison windows, not impressions anecdotes. |
| |
authority-distribution-backlinks authority | External evidence needed | Is there an auditable path from original data and tools to off-site citations, repository mirrors, backlinks and entity signals? A site cannot dominate a vertical through on-site excellence alone; it needs authority distribution that is measurable and not bought-link theater. |
| |
ymyl-trust-reviewer-controls ymyl-trust | External evidence needed | Are high-risk immigration pages governed by reviewer evidence controls before reviewedBy schema or reviewer claims go live? Visa and immigration pages are high-risk YMYL. Trust improvements must be real, credential-backed and blocked by default. |
| |
release-gate-governance governance | Proved public control | Is there a repeatable release gate that runs source, technical, rendered, freshness and evidence-boundary checks before launch? Audit readiness requires a reproducible control chain, not one-off manual confidence. |
| |
outcome-proof-500k measurement | External evidence needed | What evidence would prove the objective has actually reached 500k+ monthly visitors and durable vertical market-share gains? The project can be technically audit-ready before the business outcome is proven. Completion requires outcome evidence, not only green controls. |
|
Pass criteria and failure response
- Proved public control
strategy-and-traffic-model
Actual sessions, Search Console rows, AI-citation runs and referrer exports stay local unless reviewed and aggregated.
Source datasets
Local commands
npm run audit:traffic-forecastnpm run audit:visibility-metrics
Pass criteria
- Forecast low/high range includes the 500k/month planning target.
- Current traffic, ranking and market-share claims are explicitly excluded.
- Each cohort exposes measurement commands and falsification gates.
Failure response
- Rebase the target range before publishing growth claims.
- Do not quote unreviewed analytics exports in public surfaces.
Known gaps
- The forecast proves planning logic, not current monthly sessions.
- Ranges must be rebased when reviewed private evidence contradicts assumptions.
- Proved public control
source-provenance-freshness
Working notes, failed probes and source-refresh triage remain local until reviewed; public feeds expose only approved source-backed claims.
Source datasets
Local commands
npm run audit:sourcesnpm run audit:stalenpm run audit:freshnessnpm run audit:data-citationnpm run audit:policy-claims
Pass criteria
- Every public figure-bearing dataset exposes source URLs and review dates.
- Freshness report has no stale or invalid high-risk records before release sign-off.
- Policy claims and fact changes expose stable IDs and source-backed old/new context.
Failure response
- Freeze affected content expansion until stale records are fixed.
- Remove or caveat claims that cannot be tied to a current source URL.
Known gaps
- Network liveness is intentionally skipped in the default release gate and must be run before source-refresh sign-off.
- Proved public control
crawl-index-rendering
Crawl-path intent is public; live crawler-fetch proof requires private server logs or Search Console evidence.
Source datasets
Local commands
npm run audit:technical-seo-controlsnpm run audit:topical-authority-mapnpm run audit:indexable-page-manifestnpm run audit:noindexnpm run audit:rendered-seo
Pass criteria
- Sitemap, indexable-page manifest and noindex controls agree on indexable classes.
- Rendered representative pages expose canonical URLs, schema, source context and no accidental noindex.
- Topical clusters expose canonical hubs, supporting pages and crawl entry points.
Failure response
- Remove or noindex sparse pages until source-backed value is restored.
- Fix rendered artifacts, not only source templates.
Known gaps
- Rendered audit is representative by design; source audits cover broader template classes.
- Proved public control
open-data-ai-retrieval
Public endpoints expose reusable contracts; crawler logs, AI referrals and raw citation runs remain local until reviewed.
Source datasets
Local commands
npm run audit:data-front-doornpm run audit:openapinpm run audit:webapi-schemanpm run audit:mcp
Pass criteria
- Every public dataset is listed in /data, /api/public, OpenAPI, API docs and LLM discovery files.
- API routes advertise documentation, collection, license and LLM alternate link headers.
- MCP remains read-only and provenance-out.
Failure response
- Do not add a public feed without catalog, docs, reuse-guide and LLM discovery wiring.
- Do not infer AI reach from discovery without citation, referral or server-log evidence.
Known gaps
- Discovery surfaces prove availability and crawl permission, not AI citation or referral outcomes.
- Proved public control
content-page-priority
Public rows show prioritisation logic. Private Search Console exports and experiment notes stay local until aggregated.
Source datasets
Local commands
npm run audit:content-opportunitiesnpm run audit:execution-readinessnpm run audit:seo-geo-production-queuenpm run seo:ticket-evidence -- seo-geo-ticket-evidence.jsonl --jsonnpm run audit:ticket-evidencenpm run audit:seo-geo-page-action-mapnpm run seo:execution-proof -- execution-proof.json --jsonnpm run audit:execution-proofnpm run audit:topical-authority-mapnpm run audit:competitor-query-battlecardsnpm run audit:thinnpm run audit:longtail-provenance
Pass criteria
- Priority rows expose page targets, technical changes, competitor wedge, evidence surfaces and source datasets.
- Production-ticket evidence is reviewed before a battlecard is treated as executed.
- Execution proof reconciles all 52 production tickets, all 13 battlecards and all 118 page-action rows before shipped-work claims are made.
- Topical clusters connect page targets to canonical hubs and supporting pages.
- Long-tail expansion is subordinate to thin-page and provenance gates.
Failure response
- Pause page production if the target has no source-backed role, evidence surface or crawl path.
- Prefer improving an existing cluster over adding isolated pages.
Known gaps
- Public priority rows are planning evidence; actual query lift still needs reviewed GSC experiment outcomes.
- Some local-workflow rows require external authority or reviewer evidence before public outcome claims.
- Local workflow
competitor-wedge-market-map
Raw SERP snapshots, AI transcripts and query rows remain local unless reviewed, redacted and aggregated.
Source datasets
Local commands
npm run audit:source-transparencynpm run audit:competitor-query-battlecardsnpm run audit:quarterly-market-share-summarynpm run seo:surface-snapshots -- snapshots.jsonl --jsonnpm run seo:market-share-summary -- surface-summary.json --jsonnpm run seo:market-share-proof -- market-share-proof.json --jsonnpm run audit:market-share-proof
Pass criteria
- Battlecards tie each query cluster to competitor archetypes, target pages and measurement commands.
- Public benchmark caveats prevent overclaiming sampled competitor coverage.
- Market-share summaries publish only approved aggregate evidence.
- Market-share proof verifies complete battlecard coverage, channel-balanced SERP/AI evidence, competitor source-class evidence and stale-claim safety before share claims are made.
Failure response
- Do not claim market-share gains from anecdotal SERP checks.
- Refresh battlecards when competitor classes materially change.
Known gaps
- The public baseline maps competitor pressure but does not prove current market share won.
- Quarterly rollups require reviewed local snapshot evidence before claims are published.
- Local workflow
ai-citation-accuracy-measurement
Raw model outputs, transcripts and referral exports stay local until reviewed and aggregated.
Source datasets
Local commands
npm run kpi:citation-sharenpm run seo:ai-visibility-proof -- ai-visibility-proof.json --jsonnpm run audit:citation-benchmarknpm run audit:ai-referralsnpm run audit:ai-visibility-proofnpm run audit:answer-capsules
Pass criteria
- Fixed prompt basket remains stable for trend comparability.
- Answer keys identify stale or wrong claims separately from citation presence.
- AI referrals, citations and crawler access remain separate metrics.
- AI visibility proof joins full fixed-basket citation-share, answer-accuracy and bot-filtered AI-referral evidence before GEO visibility claims are made.
Failure response
- Do not publish unscoped AI answer examples as outcome evidence.
- Re-run benchmark after major source changes or high-risk answer corrections.
Known gaps
- Public protocols exist; current citation share and AI answer accuracy require local runs and reviewed aggregate publication.
- Local workflow
gsc-experimentation-outcomes
Raw Search Console exports stay local; public evidence can include only reviewed aggregate outcomes.
Source datasets
Local commands
npm run seo:gsc-opportunities -- gsc-queries.csv --json --period-start=YYYY-MM-DD --period-end=YYYY-MM-DD --property-label=gsc-domain-redacted --search-type=webnpm run seo:gsc-battlecard-experiments -- gsc-queries.csv --json --period-start=YYYY-MM-DD --period-end=YYYY-MM-DD --property-label=gsc-domain-redacted --search-type=webnpm run seo:gsc-experiment-outcomes -- gsc-experiment-outcomes.jsonl --jsonnpm run audit:gsc-cohortsnpm run audit:gsc-experiment-outcomes
Pass criteria
- Every experiment declares changed pages, query rules, measurement commands and decision rules.
- Outcome rows require baseline/comparison periods, scope match and redacted export hashes.
- Private GSC data is never embedded directly in public pages.
Failure response
- Reject outcome claims without matching baseline/comparison scope.
- Revert or re-test changes that fail decision rules.
Known gaps
- Public experiment contracts exist, but raw query/page data remains private and must be reviewed before public outcome claims.
- External evidence needed
authority-distribution-backlinks
Contacts, credentials, outreach notes, rejected submissions and unpublished listing URLs stay local unless approved for aggregate publication.
Source datasets
Local commands
npm run audit:authority-distributionnpm run audit:publisher-citation-kitsnpm run audit:repository-mirrorsnpm run audit:knowledge-graphnpm run seo:authority-distribution -- authority-distribution-log.jsonl --jsonnpm run seo:authority-proof -- authority-proof.json --jsonnpm run audit:authority-proofnpm run seo:publisher-citation-kits -- outreach-log.jsonl --jsonnpm run seo:repository-mirrors -- repository-mirror-log.jsonl --json
Pass criteria
- Each distribution channel has public entry points, copy assets, evidence fields and local commands.
- Approved off-site rows include source URLs, canonical backlinks and review status.
- Reviewed authority proof meets approved public evidence, channel, canonical backlink, source-preservation and anti-paid-link requirements before authority claims are made.
- No paid-link, guaranteed-backlink or unapproved launch claims are published.
Failure response
- Do not publish authority wins without approved external evidence rows.
- Remove or correct unverified sameAs, DOI or backlink claims.
Known gaps
- Launch readiness is public; completed third-party publication and backlink evidence must come from reviewed external rows.
- No public claim should imply completed off-site publication until evidence exists.
- External evidence needed
ymyl-trust-reviewer-controls
Reviewer contacts, credential documents, notes and content diffs stay local unless separately approved for publication.
Source datasets
Local commands
npm run audit:expert-reviewersnpm run audit:reviewedby-schemanpm run audit:review-acquisitionnpm run audit:p0-page-refreshnpm run seo:expert-reviewers -- reviewer-evidence-log.jsonl --jsonnpm run seo:review-acquisition -- reviewer-acquisition-log.jsonl --jsonnpm run seo:p0-page-refresh -- p0-reviewed-page-refresh-log.jsonl --jsonnpm run seo:reviewer-proof -- reviewer-trust-proof.json --jsonnpm run audit:reviewer-proof
Pass criteria
- Reviewer acquisition, schema rollout and P0 refresh controls remain blocked until evidence exists.
- Reviewer claims distinguish source editing from regulated review.
- High-risk page refreshes require source freshness, legal-scope and content-diff evidence.
- Reviewer trust proof joins reviewer evidence, acquisition handoff, reviewedBy export and P0 page-refresh rows into complete cross-workflow reviewer evidence chains.
Failure response
- Remove reviewedBy schema or reviewer claims without approved evidence.
- Do not publish high-risk page refresh claims from private notes alone.
Known gaps
- Controls are public and blocked by default; actual reviewer completion needs private evidence and approved handoff rows.
- reviewedBy schema must remain blocked until evidence is approved.
- Proved public control
release-gate-governance
Gate outputs can be summarized publicly; raw private evidence used by optional checks stays local unless reviewed.
Source datasets
Local commands
npm run audit:seo-geonpm run audit:allnpm run audit:release-gatenpm run audit:execution-readinessnpm run audit:rendered-seo
Pass criteria
- TypeScript, source audits, production build and rendered SEO audit pass.
- Critical technical controls block release when failed.
- Private evidence controls reject unreviewed analytics, GSC, crawler, market-share and reviewer claims.
Failure response
- Block release until failing gates are corrected.
- Do not publish outcome claims from a failed gate.
Known gaps
- Default full gate skips network liveness; run with --include-liveness before source-refresh or release sign-off.
- External evidence needed
outcome-proof-500k
Raw analytics, GSC exports, referrers, bot logs, screenshots and transcripts remain private until reviewed and aggregated.
Source datasets
Local commands
npm run seo:traffic-outcome-proof -- traffic-outcome-proof.json --jsonnpm run seo:gsc-cohorts -- gsc-pages.csv --json --period-start=YYYY-MM-DD --period-end=YYYY-MM-DD --property-label=gsc-domain-redacted --search-type=webnpm run seo:ai-referrals -- analytics-referrers.csv --json --period-start=YYYY-MM-DD --period-end=YYYY-MM-DD --property-label=ga4-redacted --bot-filterednpm run seo:market-share-summary -- surface-summary.json --jsonnpm run seo:market-share-proof -- market-share-proof.json --jsonnpm run audit:traffic-outcome-proofnpm run audit:market-share-proof
Pass criteria
- 500k+ monthly qualified visits are proven by reviewed analytics evidence.
- GSC and AI-citation evidence support that the growth is SEO/GEO driven, not a one-off referral spike.
- Market-share evidence is summarized from reviewed SERP and AI answer-surface snapshots.
- A complete approved market-share rollup covers all 13 battlecards and all 10 high-priority clusters.
- Reviewed market-share proof verifies the complete rollup before the traffic outcome proof consumes it.
Failure response
- Keep the goal active until outcome evidence exists.
- Rebase forecast assumptions when observed evidence materially underperforms.
Known gaps
- Current public evidence does not claim the 500k monthly visitor outcome has been achieved.
- Outcome proof must include bot filtering, date ranges and reviewed aggregate publication rules.
Cite or reuse this dataset
This SEO/GEO audit evidence pack is free to reuse under CC BY 4.0. Cite the JSON endpoint for machine-readable audit rows and the report page for methodology, caveats and completion limits.
Suggested citation
Visa Atlas, "Visa Atlas SEO/GEO audit evidence pack", https://visaatlas.org/research/seo-geo-audit-evidence-pack-2026. Last verified 5 July 2026.
Primary sources (21)
- /api/public/visibility-metrics
- /api/public/traffic-forecast
- /api/public/technical-seo-controls
- /api/public/topical-authority-map
- /api/public/content-opportunities
- /api/public/execution-readiness
- /api/public/source-transparency-benchmark
- /api/public/competitor-query-battlecards
- /api/public/battlecard-search-experiments
- /api/public/serp-answer-surface-snapshots
- /api/public/quarterly-market-share-summary
- /api/public/crawler-access
- /api/public/authority-distribution-plan
- /api/public/publisher-citation-kits
- /api/public/external-repository-mirrors
- /api/public/expert-reviewer-entities
- /api/public/reviewedby-schema-rollout
- /api/public/high-risk-page-review-acquisition
- /api/public/p0-reviewed-page-refresh
- /api/public/indexable-pages
- /api/public/freshness