The AI Search Foundations checklist: is your website AI-ready?

The five foundations

A website is ready for AI search when it is found, understood, trusted, secure, and converting. Those five are the AI Search Foundations: the base layer that decides whether AI assistants recommend you and whether the buyers they send take action.

Your next customer now asks an AI before they ask you. 54% of UK adults use AI tools such as ChatGPT, Copilot or Gemini (Ofcom, 2026), around 30% of UK consumers have researched a purchase with an AI chatbot (SearchScore, 2026), and 89% of B2B buyers use AI across the purchase journey (Forrester, 2026). The assistants doing that research judge every website the same way, whether it belongs to an accountancy firm, a law practice, a clinic or a software company.

That's what makes a checklist possible: five foundations, each with a plain test. Check your own site as you go.

Found: can an AI reach and read you?

You are found when an AI assistant can fetch your pages quickly and read your meaning without executing anything.

There is no separate AI index to submit to (Google, 2026). Assistants draw on ordinary search indexing and on live fetches of your actual pages, which means the read happens on your real HTML, at real speed, often in the seconds while an answer is being written.

What good looks like:

• Your server responds fast enough to make the answer window, every time.
• Your key content sits in plain HTML - it survives with JavaScript switched off.
• No accidental blocking: no "block AI bots" switch at your host, no copied robots.txt quietly turning away the search and fetch bots that put you in answers.
• The classic plumbing holds: clean titles, a sitemap, a crawlable structure.

What failure costs: you're skipped, silently. The answer names someone the assistant could read, and no trace of the lost sale ever reaches your analytics.

Understood: is your meaning legible and consistent?

You are understood when a stranger - human or AI - can state what you do, for whom and where in one sentence, and every source on the web agrees.

AI assistants do not just rank pages; they resolve entities. They build a picture of who you are from your site, your directories, your reviews and your profiles, and they recommend with confidence only when the picture holds together.

What good looks like:

• Every page opens with its answer in the first 40 to 80 words, written to be quoted alone.
• Schema (JSON-LD) restates what each page visibly shows - never what it does not.
• Your name, offer, prices and facts read identically everywhere you appear online.
• Claims carry sourced numbers: adding citations, statistics and quotations each lifted visibility in AI answers by roughly 40% in the one study that measured it (Aggarwal et al., 2024).

What failure costs: the AI fills your gaps by guessing, and its invented version of you is what your buyers hear. Muddle doesn't read as modesty. It reads as risk.

Trusted: are you fast and safe?

You are trusted when your pages render in under 2.5 seconds on clean HTTPS, with nothing burying the content.

Speed is the first trust signal both audiences read. Google calls a page good under 2.5 seconds (Google, 2024); as load time grows from one second to three, the chance a visitor leaves rises 32% (Google, 2017); and a 0.1-second improvement lifted retail conversions by 8.4% (Deloitte, 2020). An AI assistant on a deadline of seconds is the least patient reader you have.

What good looks like:

• Main content renders in well under 2.5 seconds - a well-built site manages well under one.
• Valid HTTPS everywhere, with no mixed content or expired certificates.
• No cookie walls, pop-up stacks or widget clutter standing between the reader and the point.
• A tracker payload close to zero: the cheapest page to read is the easiest to cite.

What failure costs: the bounce you paid for and the citation you never got, on every single visit.

Secure: is there anything to breach?

You are secure when there is almost nothing to attack: no needless database, no plugin stack, no admin login to phish, and an email domain nobody can forge.

The average data breach now costs $4.88 million (IBM, 2024), and the way in is usually the baggage: 91% of WordPress vulnerabilities live in plugins (Patchstack, 2025). Security by subtraction removes the doors rather than guarding them.

What good looks like:

• Static wherever possible - no database serving what is really a brochure.
• Dependencies you can count on one hand, each one chosen, none inherited.
• Security headers in place, doing quiet work on every response.
• Email authentication (SPF, DKIM, DMARC) set correctly, so nobody can send invoices as you.

What failure costs: the breach itself, then the harder bill - explaining it to clients whose confidence was the product. In accounting, law and healthcare, that trust rarely returns at full strength.

Converting: is the next step obvious?

You are converting when a ready buyer can get from landing on your site to starting a conversation in about two clicks.

This foundation banks the others. AI-referred visitors convert around 4x higher than classic organic search (Semrush, 2025) because the assistant compared the field before the click - your visitor lands half-decided. The page's job is no longer to persuade a cold stranger; it is to confirm a recommendation and open the door.

What good looks like:

• What you do, for whom, is unmissable within ten seconds of landing.
• Proof sits beside the ask: real credentials, real results, no padding.
• One obvious next step per page, roughly two clicks from landing to engaging.
• Forms ask only what they must - cutting one field from four to three raised conversions by around 50% in an analysis of 40,000 forms (HubSpot).

What failure costs: the most expensive miss on this list - a pre-sold buyer, delivered to your door, lost to whoever made starting easier.

Where do you stand?

You could audit all five by hand; this page is written so you can. Or see it scored in about ten seconds instead.

Our free diagnostic runs 40+ deterministic checks across the AI Search Foundations - found, understood, trusted, secure - and hands you a score plus the one thing to fix first. No email, no sales call, no obligation. It reads your site exactly the way an AI assistant would, which is the only opinion that now settles the argument.

One more reason to do it now rather than eventually. The next wave - AI agents that do not just recommend but act, booking the call and requesting the quote - will demand these same foundations, only harder. Build them once and you stop starting over every time the goalposts move. Fewer than 5% of UK SMEs have acted on any of this (SearchScore, 2026). The checklist above is how you join the 5% your buyers' assistants can actually recommend.

Run the diagnostic, or if you would rather walk through your score with us, talk to Agentu. Either way, find out which foundation is quietly costing you - before another answer goes out without you.