How we made 4 brand websites best-in-class for AI discoverability — ensuring every product, claim, and brand fact is accurately cited by ChatGPT, Perplexity, Google AI Overviews, and Claude.
AI search is replacing traditional search. ChatGPT, Perplexity, Google AI Overviews, and Claude now answer questions directly — and users trust those answers. Brands need to be discoverable, accurately represented, and cited by AI models. This is Generative Engine Optimization.
Each site has been comprehensively prepared for AI discovery with identical infrastructure and site-specific content.
Every brand site publishes discovery files in its local language plus English — ensuring visibility in both native-language AI search and ChatGPT/Claude's English retrieval pipeline.
| File | Purpose | Kallo | Clipper | Crimble's | Ecotone |
|---|---|---|---|---|---|
| llms.txt | AI-optimised site summary | View | View | View | View |
| llms-full.txt | 5,000+ word comprehensive brand reference | View | View | View | View |
| ai.txt | AI permissions & restrictions (v1.1.1) | View | View | View | View |
| brand.txt | Canonical naming & terminology guide | View | View | View | View |
| faq-ai.txt | 25–30 Q&A pairs for AI retrieval | View | View | View | View |
| identity.json | Machine-readable organisational identity | View | View | View | View |
| robots.txt | 60+ AI crawler management rules | View | View | View | View |
| sitemap.xml | All pages + discovery files | View | View | View | View |
Every page emits rich structured data that AI models and search engines use to understand content, relationships, and context.
OrganizationWebSiteWebPageFAQPageProductNutritionInformationRecipeCollectionPageContactPageBreadcrumbListSpeakableSpecificationSearchActionapplication/ld+json to inspect the structured data.
We connected directly to Ecotone's beCPG Product Lifecycle Management system and extracted verified nutrition data for 161 products.
We allow all AI crawlers — both search and training. Our discovery files are designed to be consumed by AI models.
Fetch content in real time to answer user queries.
Index content for model training — building permanent brand knowledge.
Every site passes all 43 checks in our comprehensive GEO audit.
Every technique, principle, and best practice for maximising organic search visibility — from technical foundations to AI-era answer engine optimization.
SEO has evolved from keyword stuffing and link farms to a sophisticated discipline covering technical performance, content quality, user experience, and AI answer engine visibility. Here's the difference between doing it well and doing it badly.
The invisible foundation. If search engines can't crawl, render, and index your site efficiently, nothing else matters.
Ensure search engines can discover and index every important page.
Page speed is a confirmed ranking factor. Every millisecond counts.
HTTPS is a confirmed ranking factor since 2014. No exceptions.
Clean, descriptive URLs that both users and search engines understand.
The content and HTML elements on each page that tell search engines what the page is about and why it should rank.
Pages with schema markup receive 42% more AI citations and dramatically higher click-through rates via rich snippets.
| Schema Type | Use Case | Rich Result |
|---|---|---|
| Organization | Brand identity, logo, social profiles, contact | Knowledge Panel |
| Product | Products with price, availability, reviews | Product rich snippets |
| FAQPage | Question-and-answer pairs | Expandable FAQ in SERP |
| HowTo | Step-by-step instructions | Step display in SERP |
| Recipe | Recipes with ingredients, times, nutrition | Recipe card in SERP |
| Article / BlogPosting | Articles with author, date, publisher | Article rich result |
| BreadcrumbList | Navigation breadcrumbs | Breadcrumb trail in SERP |
| LocalBusiness | Physical locations with hours, address | Local pack results |
| Review / AggregateRating | Customer reviews and star ratings | Star ratings in SERP |
| Event | Events with dates, locations, ticketing | Event rich result |
| VideoObject | Video content with duration, thumbnail | Video thumbnails in SERP |
| SpeakableSpecification | Voice-search-ready content sections | Voice assistant answers |
Three metrics that Google uses as ranking factors. Only 47% of websites pass all three in 2026.
Experience, Expertise, Authoritativeness, and Trustworthiness — Google's quality framework that underpins every ranking decision.
Demonstrate first-hand experience with the topic.
Content must be created by people with genuine knowledge.
Become the definitive source on your subject area.
AI engines weigh recency when selecting sources to cite.
What happens beyond your site matters as much as what's on it — links, citations, local presence, and global reach.
Over 60% of searches are on mobile. 8.4 billion voice assistants are in use. And JavaScript can make or break your indexing.
AI Overviews now trigger for ~18.5% of commercial queries. Being cited in AI answers is the new "ranking first."
A continually updated reality-check on what actually moves AI visibility — so effort goes where the evidence is, not where the hype is.
dateModified accurate, surface a visible “last updated” date, and refresh cornerstone content quarterly — an up-to-date page out-cites an identical stale one.You can't improve what you don't measure. Track everything, iterate constantly.
The essential items every website should have in place.
Every website we build follows a battle-tested security framework — from HTTP headers to API endpoint protection, environment encryption, and real-time threat detection.
A hacked website gets deindexed by Google, loses customer trust overnight, and can expose personal data. We build security into every layer from day one — not bolted on as an afterthought.
Every response from our servers includes a comprehensive set of security headers via Helmet.js — the first line of defence against XSS, clickjacking, and MIME-sniffing attacks.
| Header | Value | Protects Against |
|---|---|---|
| Content-Security-Policy | default-src 'self'; script-src 'self' analytics; style-src 'self' 'unsafe-inline' fonts; img-src 'self' data https; frame-ancestors 'none'; object-src 'none' | XSS, code injection, clickjacking |
| Strict-Transport-Security | max-age=31536000; includeSubDomains; preload | Protocol downgrade, cookie hijacking |
| X-Frame-Options | DENY | Clickjacking attacks |
| X-Content-Type-Options | nosniff | MIME-type sniffing |
| Referrer-Policy | strict-origin-when-cross-origin | Information leakage via referrer |
| Permissions-Policy | camera=(), microphone=(), geolocation=(), payment=() | Unauthorized hardware/API access |
| Cache-Control (API) | no-store, no-cache, must-revalidate | Sensitive data caching |
| X-DNS-Prefetch-Control | Controlled per environment | DNS prefetch information leakage |
API keys, database credentials, and third-party secrets are never stored in plaintext. We encrypt all .env files using industry-standard authenticated encryption with strong key derivation.
Environment files are encrypted at rest using authenticated encryption. Each file includes a unique salt, initialisation vector, and authentication tag. The encrypted payload is decrypted in memory at application startup — plaintext credentials never exist on disk.
This approach ensures that even if a server is compromised, environment secrets cannot be read without the separate decryption key.
Our API security middleware detects and blocks reconnaissance probes, hacker tools, and malicious requests before they reach the application.
Requests matching known attack signatures are immediately blocked and the source IP is flagged.
Known vulnerability scanners and attack tools are rejected before reaching the application.
Every authenticated endpoint uses industry-standard password hashing, timing-safe comparisons, and secure session management.
Security doesn't stop at the application layer. Our web server configs, process management, and deployment practices are hardened to production standards.
Every website we deploy passes this checklist before going live.