Technical Signals for AI Search That SEO Still Overlooks

Technical signals for AI search don't stop at crawlability, robots.txt, or a bot's ability to read HTML. An audit of 50 large websites covered by Search Engine Journal shows many sites are already fairly good at making content easy to discover, but far weaker once AI has to understand who owns a piece of information, what an entity actually means, and whether an agent can take action on that website.

This finding is covered in a Search Engine Journal article on technical signals for AI search that SEO still overlooks. Reza Moaiandin and the SALT.agency team built a three-layer AI-readiness framework: Retrievability, Attribution and Meaning, and Agent Transaction and Discovery.

This framework needs to be read with the right context. It's an audit framework the authors developed based on a set of protocols and signals they classify as established, emerging, or frontier. So the result isn't an official ranking-factor list from Google, OpenAI, Anthropic, or any other AI vendor.

What Are the Three Layers of AI Visibility in This Framework?

SEJ's framework splits a website's AI readiness into three stages: can AI fetch the content, can AI understand and correctly attribute it, and can an AI agent interact with the website to complete a task.

A simple analogy: reading isn't the same as understanding, and understanding isn't the same as being able to act.

In information retrieval, a system can successfully find a document yet still misinterpret an entity or a relationship inside it. This framework tries to expand technical SEO from simple "discoverability" into "understandability and usability."

How Was This 50-Website Audit Conducted?

The SALT.agency team audited 50 large websites across retail, SaaS, travel, publishing, and finance. All data was collected on the same day, June 12, 2026.

They used an instrumented browser to capture:

• live HTTP responses;
• the rendered DOM;
• raw server HTML;
• machine-discovery endpoints.

The full framework contains 27 audit elements: 11 for Layer 1, three for Layer 2, and 13 for Layer 3.

But the final scoring only uses 12 signals they classify as Established. Emerging and Frontier signals are still tracked but don't count toward the final score.

What's the Average Score Across the Audited Websites?

Overall, the average website only implements a little over half of the established protocols being scored.

But that overall figure hides a huge gap between layers.

Retrievability is already fairly mature. Attribution and meaning are far weaker. Agent transaction has barely been adopted at all.

Layer 1: What Is Retrievability?

Retrievability answers whether AI can fetch, parse, and understand a page's basic structure without tripping over a technical barrier.

This is the layer closest to traditional technical SEO.

The eight established audit elements that count toward the score are:

1. robots.txt and AI user-agent directives;
2. accessibility tree integrity;
3. ARIA labeling and descriptive names;
4. semantic HTML and document hierarchy;
5. token-efficient DOM density;
6. server-rendered or clean HTML delivery;
7. form and input machine usability;
8. sitemap declaration.

This layer's average score is 74.4%. Only three websites scored below 50%.

Why Is Retrievability Already Fairly Good?

Because many of its signals have long been standard web-engineering and technical-SEO practice.

Semantic HTML, sitemaps, server rendering, accessibility, and a clean document hierarchy aren't concepts that were born out of AI search.

A website that already has a strong technical foundation often ends up automatically covering much of what retrievability requires.

But the SEJ article stresses that retrievability is only the first layer. A website that's readable isn't necessarily interpretable with high confidence.

What Role Does Semantic HTML Play for AI?

Semantic HTML gives a page explicit structure.

For example:

<main>
  <article>
    <h1>...</h1>
    <section>
      <h2>...</h2>
    </section>
  </article>
</main>

A structure like this helps distinguish main content, heading hierarchy, navigation, forms, and other elements.

This doesn't mean semantic HTML is an "AI ranking factor." In the SALT framework, it's an established signal that helps with retrievability and machine interpretation.

What Is Token-Efficient DOM Density?

This is the term the framework uses to assess how dense the useful content is compared to unnecessary markup or DOM elements.

A page with a very bloated structure can carry a lot of:

• wrappers;
• inline scripts;
• duplicated navigation;
• hidden elements;
• UI boilerplate.

The more noise there is, the higher the processing overhead when a system needs to extract the main content.

But the article doesn't offer a universal threshold for "ideal DOM density." So this is better used as an audit concept than a specific target number.

Why Does Server-Rendered HTML Still Matter?

Clean or server-rendered HTML makes the main content available in the initial response without relying too heavily on client-side rendering.

This helps a crawler or agent whose JavaScript capability isn't identical to a human browser's.

But again, the source doesn't state that every client-side-rendered website is automatically bad for AI search.

Its main value is reducing dependence on extra rendering just to find the primary information.

Layer 2: What Is Attribution and Meaning?

This layer assesses whether AI can understand what a page's information actually means and which entity it's connected to.

The average score drops sharply to just 38.5%.

The two established signals scored here are:

1. JSON-LD schema and semantic richness;
2. Content Signals Policy.

This is the layer the authors say shows the biggest gap between a website that's merely crawlable and one that's actually easy for a machine to understand.

How Many Websites Already Use JSON-LD?

Out of 50 homepages audited, 35 — or 70% — have JSON-LD structured data.

Nearly all of them earned a maximum score on that element.

But that still leaves almost a third of websites without JSON-LD on the homepage tested.

The authors argue schema helps AI understand relationships like:

• this is a product;
• this is a price;
• this is a brand;
• this is an author;
• this is an organization.

Without schema, a model can still try to guess from the page. But the chance of misinterpretation remains.

Is Schema Guaranteed to Increase Citation?

No. This needs to be separated from the authors' claim that schema increases interpretation confidence.

The SEJ article states better understanding can increase the likelihood of citation and reduce misrepresentation, but the audit itself doesn't run a controlled experiment proving that adding JSON-LD causes citation to rise.

So the safe framing is:

Schema:
helps describe meaning explicitly.

Not proven by this audit:
schema = a specific citation boost.

What Is the Content Signals Policy?

Cloudflare's Content Signals Policy is a set of directives within robots.txt meant to state how a crawler may use content in the context of search indexing, AI query responses, and model training.

In the audit, only 5 of 50 websites implemented it.

The authors see this as a way to move past a binary choice —

block all AI
or
allow all AI

— toward a more granular policy.

But SEJ also stresses that content signals are a preference statement. There's no technical mechanism forcing every bot to comply.

Why Does Robots.txt for AI Need to Be a Deliberate Decision?

A fairly striking finding is that 29 of 50 websites appear to have no explicit decision about AI agent access.

They don't clearly block or allow any specific bot.

According to the authors, this leaves access policy "left to chance."

Meanwhile, some major brands make very explicit decisions instead.

The BBC, CNN, and The Guardian block many AI bots. Amazon also has directives restricting most AI bots.

By contrast, Airbnb and Cloudflare don't have a blanket block but set rules against specific bots.

So "AI readiness" doesn't always mean letting every crawler in.

Why Isn't a Low Score Always Bad?

Because business models differ.

A publisher may have an incentive to restrict an AI crawler so its content doesn't get used without a direct visit.

A retailer, SaaS company, travel business, or financial service may have a different incentive, since it wants its product or service to show up in an AI recommendation.

The SEJ article even uses Amazon as an example. Amazon scores low overall, around 29.2%, but the authors don't think that's because Amazon forgot about AI.

Its bot policy looks deliberate.

The lesson: a technical signal isn't a checklist that always has to be maxed out to 100%.

Layer 3: What Is Agent Transaction and Discovery?

The third layer assesses whether an AI agent can discover a website's capability and safely take action.

This is where the average score falls off a cliff, down to just 2.1%.

Of the 13 elements in this layer, only two are categorized Established and count toward scoring:

1. OAuth Discovery, or Authorization Server Metadata;
2. OAuth Protected Resource Metadata.

Of the 48 websites whose endpoints could be tested, 46 scored zero.

Airbnb and Vercel have OAuth authorization server metadata, but neither had protected resource metadata in this audit, so each earned only 50% on Layer 3.

Why Is OAuth Discovery Relevant for an AI Agent?

An AI agent that wants to interact with a service needs to understand how to authorize safely.

OAuth discovery metadata can help a client learn:

• the authorization endpoint;
• the token endpoint;
• the supported mechanism;
• the identity requirements;
• protected-resource information.

This isn't a traditional SEO feature, but it becomes important once an agent needs to take action on a user's behalf.

What's the Connection to MCP?

The framework also tracks a number of emerging signals related to the Model Context Protocol (MCP).

MCP lets an AI system connect directly to a specific tool or server.

In an e-commerce context, for example:

Without a direct tool:
AI reads product pages one at a time.

With a direct server/tool:
AI pulls data directly from the product database.

The authors see a direct approach like this as potentially reducing processing overhead and the risk of misinterpretation.

But specific MCP signals are still categorized as Emerging, not Established.

What's the Connection to UCP and Agentic Commerce?

The article also names Google's Universal Commerce Protocol (UCP) and OpenAI's Agentic Commerce Protocol (ACP) as new protocols that could become important for transactions carried out through an AI conversation.

This shows how AI visibility is starting to expand from:

Can AI find us?
↓
Can AI understand us?
↓
Can AI transact with us?

For a commerce website, this third layer could become a strategic area over the next few years.

If your team has previously covered UCP or WebMCP, the internal article Gemini Is Evolving From Chatbot to AI Agent: What Does It Mean? can serve as an internal link once the previous article's URL is verified.

What's llms.txt's Status in This Framework?

llms.txt is classified as Frontier, so it doesn't count toward scoring.

The reason is that the format isn't yet a ratified standard and doesn't yet have an agreed specification body.

Even so, 11 of the 50 audited websites already publish one.

The authors describe it as a kind of curated guide to help AI understand a website's content and structure.

Why Isn't llms.txt Enough on Its Own?

SEJ gives Expedia as an example.

Expedia has an llms.txt that describes the brand's identity and capability quite neatly.

But in the same audit, Expedia only scored 33.3% overall.

The authors note several other gaps:

• no JSON-LD structured data on the homepage tested;
• no sitemap declaration;
• only about a quarter of the content delivered server-side.

The authors' analogy: building an llms.txt without fixing the other layers is like hanging an "open for business" sign but forgetting to unlock the door.

Can Robots.txt Force Every AI Bot to Comply?

No.

The article states a robots.txt directive is a preference statement, and compliance remains voluntary.

Major crawlers like GPTBot, ClaudeBot, Google-Extended, and Applebot-Extended are generally said to respect that directive.

But other bots may not.

The Content Signals Policy has even weaker technical enforcement: it depends entirely on a bot choosing to honor that signal.

What Does "Signals Are Not Guarantees" Mean?

This is one of the article's most important points.

The authors themselves stress that no single technical signal guarantees an outcome.

Building a:

• more granular robots.txt;
• llms.txt;
• schema;
• OAuth metadata;

doesn't automatically produce a citation, a recommendation, or a transaction.

The value of optimization lies in strengthening as many signals as make sense for the business's actual goals.

What's a Sensible Audit Priority?

Don't chase the newest protocol first. Start from the layer that's already established.

Priority 1: Retrievability

• audit robots.txt;
• check the user-agent policy;
• fix semantic HTML;
• make sure the main content is delivered cleanly;
• check the sitemap;
• audit form and input accessibility.

Priority 2: Attribution and Meaning

• audit JSON-LD;
• make sure entity relationships are clear;
• check brand/author/product attribution;
• deliberately set a content-use policy.

Priority 3: Agent Capability

• assess whether the business genuinely needs agent interaction;
• audit OAuth discovery;
• track MCP/UCP/WebMCP as fits the use case;
• don't implement a protocol just to chase a score.

How Should an SEO Team Work With Engineering?

This framework shows AI readiness can't be a content or SEO project alone.

Retrievability needs technical SEO and frontend work.

Attribution needs content, schema, and data governance.

Agent transaction needs backend, identity, authorization, API, security, and product engineering.

A sensible operating model:

SEO
→ finds the visibility gap

Engineering
→ implements machine access

Security
→ defines the permissions

Product
→ decides which action an agent is allowed to take

Content
→ makes sure meaning and entity are correct

Does Every Website Need an Agent Transaction Layer?

No.

A news publisher whose monetization depends on pageviews may have no reason to open up an agent transaction layer.

A retailer, SaaS, travel, or financial service may see far more benefit.

The framework itself acknowledges an ideal scoring should be weighted by industry and business model.

What's the Risk of Letting Old Defaults Decide Your AI Strategy?

The authors close the article with a fairly strong point: some AI decisions may already have been made by an old setting.

For example:

• a legacy robots.txt;
• a security policy;
• a CDN setting;
• a server-rendering architecture;
• a default bot rule.

If it's never audited, a company can end up accidentally:

• blocking a bot it actually wants to allow;
• letting through a bot it wants to restrict;
• delivering content with no clear enough meaning;
• having no safe path for an agent.

A Technical Signals Checklist for AI Search

FAQ About Technical Signals for AI Search

What's the most important technical signal for AI search?

There isn't a single one. SEJ's framework splits the requirement into retrievability, attribution and meaning, and agent transaction and discovery.

What's the average retrievability score from this audit?

Layer 1's average is 74.4%, showing many large websites already handle a technical foundation similar to conventional SEO fairly well.

Where's the biggest gap found?

Agent Transaction and Discovery averages only 2.1%, while Attribution and Meaning sits at 38.5%.

Does JSON-LD increase AI citation?

The audit shows JSON-LD helps describe meaning explicitly, but the study doesn't run a controlled test proving that adding schema causes citation to increase.

Has llms.txt become a standard?

Not yet. The framework classifies it as Frontier and doesn't include it in established-signal scoring.

Should every AI crawler be let in?

No. Many large websites deliberately choose to allow or block specific bots based on their own business model.

Can robots.txt force an AI bot to comply?

Not entirely. A robots.txt directive is a preference statement and depends on the crawler's own compliance.

Conclusion

Technical signals for AI search go well beyond traditional technical SEO. SALT.agency's audit of 50 large websites shows retrievability is already fairly mature at an average 74.4%, but attribution and meaning sits at only 38.5%, and agent transaction and discovery at just 2.1%.

That finding reveals three distinct stages: AI has to be able to fetch information, understand its meaning and ownership, and then — for certain use cases — safely interact with the website.

But this framework isn't an official ranking-factor list. Schema, content signals, OAuth metadata, MCP, UCP, and llms.txt are all technical signals and protocols at different levels of maturity. Implementation should follow the business model, not just chase an audit score.

For SEO and generative AI teams, the most important step is making a deliberate decision: which bots may access the content, how entities get described, and whether the website genuinely needs to support agent transactions.

If your business wants to run an AI readiness audit, fix its technical architecture, structured data, or crawler policy, or prepare a website for AI agents and generative AI search, you can discuss your business's technology needs with our technical team.