GeoPulse 6-Dimension GEO & Technical SEO Scoring Methodology

GeoPulse is a deterministic Generative Engine Optimization (GEO) and Technical SEO auditing workbench powered by Cloudflare Worker edge probes and browser WebCrypto, inspecting 6 endpoints over HTTPS in 5 seconds to produce 100% reproducible JSON reports.

GeoPulse evaluates passage-level AI citability (25%), Schema.org @graph entity graphs with SHA-256 CSP hashes (20%), 8 AI crawler rules with Content-Signal (20%), llms.txt and Markdown negotiation (15%), multilingual hreflang (10%), and security headers (10%) across 4 languages with localStorage state.

AI Citability 25% Schema @graph & SHA-256 CSP 20% 8 AI Crawlers & Content-Signal 20% llms.txt & Accept: text/markdown 15% Technical SEO & hreflang 10% Security & Trust Headers 10%

⚙️ 6 Weighted Scoring Dimensions & Formulas (100-Point Rubric)

01 · Passage-Level AI Citability & Answer-First Prose (25%)

Weight 25% · Passage Citability

GeoPulse extracts every <p> and <dd> block of at least 40 bytes inside <main>, verifying whether passages stay within 18–140 words (or 45–450 characters), open with explicit brand naming instead of vague pronouns, and include concrete metrics like seconds, HTTPS, JSON, or localStorage for 100% AI retrieval clarity.

Passage Score (100) = Base(40) + Length_18_140w(20) + NoPronounOpen(15) + BrandEntityNamed(10) + ConcreteMetrics(15) Category Weight = Average(All <main> <p>/<dd> Passages) × 25%

02 · Connected Schema.org Entity @graph & SHA-256 CSP Hash (20%)

Weight 20% · Schema @graph & CSP

GeoPulse parses all application/ld+json blocks to confirm a connected @graph linking Organization, WebSite, SoftwareApplication, BreadcrumbList, and WebPage with SpeakableSpecification and FAQ mainEntity items, while computing the SHA-256 digest in 1 second to verify Content-Security-Policy.

Schema Score (100) = Organization(20) + WebSite(15) + SoftwareApp(20) + Breadcrumb(15) + Speakable(10) + FAQ(10) + ExactCSPHash_NoFakeRating(10) CSP Verification = script-src includes exact 'sha256-<base64>' && zero 'unsafe-inline'

03 · AI Crawler Access Whitelist & Content-Signal Directives (20%)

Weight 20% · AI Crawlers

GeoPulse fetches /robots.txt and /sitemap.xml over HTTPS to verify Content-Signal: search=yes, ai-input=yes, ai-retrieval=yes, ai-train=yes, explicit Allow rules for 8 AI crawlers (Googlebot, bingbot, OAI-SearchBot, GPTBot, ClaudeBot, PerplexityBot), and 100% valid XML sitemap indexing.

Crawler Score (100) = Content-Signal(35) + (AllowedNamedBots / 8 × 40) + NoRootDisallow(15) + ValidXmlSitemap(10) Target AI Agents = Googlebot · bingbot · OAI-SearchBot · GPTBot · ClaudeBot · PerplexityBot · Google-Extended · Applebot-Extended

04 · Agent Discovery (/llms.txt) & Markdown Negotiation (15%)

Weight 15% · Agent-Readiness

GeoPulse probes /llms.txt (>100 bytes) and /llms-full.txt (>400 bytes), inspects HTTP responses for RFC 8288 Link discovery headers, and sends an Accept: text/markdown request over HTTPS to confirm the server returns clean UTF-8 Markdown starting with # in under 3 seconds.

Agent Score (100) = llms.txt_200(25) + llms-full.txt_200(25) + RFC8288_Link_Header(20) + Accept_Text_Markdown(30) RFC 8288 Link = <.../llms.txt>; rel="llms-txt", <.../llms-full.txt>; rel="llms-full-txt", <.../sitemap.xml>; rel="sitemap"

05 · Technical SEO Metadata & Multilingual hreflang Matrix (10%)

Weight 10% · Technical SEO

GeoPulse audits SSR HTML for a descriptive <title>, a single <h1>, an HTTPS canonical link, a <meta name="description"> strictly between 25 and 160 characters, and reciprocal hreflang links across 4 languages plus x-default with strict Vary header cache discipline.

Tech SEO Score(100) = Title_>=10c(20) + Description_25_160c(20) + Single_H1(20) + HTTPS_Canonical(20) + Reciprocal_Hreflang_xDefault(20) Cache-Key Discipline= Vary: Accept on /<locale>/ vs. Vary: Accept-Language, Accept on /

06 · Security Response Headers & Zero-Inline CSP Baseline (10%)

Weight 10% · Trust Headers

GeoPulse inspects 6 HTTPS security response headers—X-Content-Type-Options: nosniff, X-Frame-Options: DENY, Referrer-Policy, Permissions-Policy, Strict-Transport-Security, and a strict Content-Security-Policy with default-src 'none' and 100% removal of unsafe-inline or unsafe-eval.

Security Score(100) = Nosniff(20) + XFrameDeny(15) + ReferrerPolicy(15) + PermissionsPolicy(15) + HSTS(15) + StrictCSP_DefaultNone(20) Composite Total = 0.25×Citability + 0.20×Schema + 0.20×Crawlers + 0.15×Agent + 0.10×TechSEO + 0.10×Security

🔬 Audit Any Website for GEO & Technical SEO in 3 Steps

Dual-mode workflow combining stateless Cloudflare Worker edge probing and 100% browser-local WebCrypto inspection

01 · Enter a Live HTTPS URL or Paste Local Source

GeoPulse starts the 3 steps workflow by accepting any public HTTPS URL for live edge probing or switching to the offline inspector to paste raw HTML, HTTP headers, and robots.txt with 0 bytes uploaded externally.
02 · Probe 6 Endpoints & Verify SHA-256 Schema Graphs

GeoPulse concurrently fetches the HTML page, /robots.txt, /sitemap.xml, /llms.txt, /llms-full.txt, and Accept: text/markdown in under 5 seconds, scoring every passage and verifying JSON-LD SHA-256 CSP hashes.
03 · Copy Auto-Generated Fixes & Export JSON Reports

GeoPulse generates ready-to-deploy CSP hash headers, Content-Signal robots.txt rules, RFC 8288 Link headers, and Schema.org @graph JSON templates across 4 languages with localStorage persistence and 100% JSON export.

❓ Generative Engine Optimization (GEO) & Technical SEO FAQ

GeoPulse answers key engineering questions on how ChatGPT Search, Perplexity, Claude, and Google AI Overviews retrieve HTTPS passages, validate 100% Schema.org @graph JSON hashes, and negotiate Markdown endpoints.

Why do pages with traditional SEO scores fail to get cited by ChatGPT Search and Perplexity?

GeoPulse measures passage-level citability because AI answer engines retrieve self-contained 18–140 word (45–450 character) blocks rather than whole pages; passages that open with explicit entity naming and concrete metrics like bytes, seconds, HTTPS, and JSON achieve up to 100% higher citation rates.

Why does GeoPulse require an exact SHA-256 Content-Security-Policy hash for JSON-LD scripts?

GeoPulse enforces zero-trust CSP hygiene: allowing script-src 'unsafe-inline' just to embed Schema.org JSON-LD exposes sites to XSS and forfeits 20% of the security score, whereas authorizing the exact sha256-<base64> digest adds 0 bytes of runtime overhead.

How do /robots.txt Content-Signal, /llms.txt, and Accept: text/markdown work together?

GeoPulse verifies all 3 agent protocols in 5 seconds: /robots.txt grants explicit access to 8 crawlers with Content-Signal directives, /llms.txt and /llms-full.txt expose structured documentation maps, and Accept: text/markdown delivers 100% clean Markdown directly to LLM agents.

Why does live URL auditing use a stateless Cloudflare Worker alongside the browser UI?

GeoPulse combines a pure frontend UI with a stateless Cloudflare Worker proxy because browser CORS policies block cross-origin reads of /robots.txt, /llms.txt, and critical HTTP headers like CSP, Link, and HSTS (representing over 55% of the rubric), while saving preferences in localStorage.

How should multilingual sites configure hreflang alternates and HTTP Vary headers?

GeoPulse checks that every page links reciprocally to all sibling locales (such as 4 languages) plus x-default, and verifies that explicit locale URLs (/en/, /zh-Hans/) send Vary: Accept while only auto-negotiated root URLs (/) send Vary: Accept-Language, Accept for 100% cache accuracy.