SAMPLEThis is a sample for a sample company, “Mihon (Sample) Co., Ltd.”. It is not related to any real company or website.
Left as is, your company keeps missing prospects who come through AI, and harm using your site or name can happen.
Sales opportunity
In 7 of the 10 questions prospects ask AI, your company is not among the candidates.
Not named at the comparing, checking prices stage. First cause: "The home page never names the product"
Risk of harm
There is a serious security problem visible from outside, and 2 condition(s) match real incidents.
0 item(s) were fixed since the last inspection.
Overall rating (A–E)
Below GEO maturity Level 1 (Read). It stops at the security foundation.
A–E restates GEO maturity (below Level 1 = E, Level 1 = D, 2 = C, 3 = B, 4–5 = A).
Who reads what
KnownFor AI guides are AI agents, not human staff. This inspection covers only what is visible from outside and does not guarantee safety.
Overall
E / A–E
Alert level (security)
5 / 5
Questions where you were named
3 / 10
Cited in 0
Within your industry
2 of top 2
By how often AI names you
4 risk(s) above the act-now line (R1 Data leak, R2 Tampering, redirect to fake sites, R3 Impersonation, fraud, R4 Lost sales opportunity; heat map in 03)
| To decide | Who · work time | By | |
|---|---|---|---|
| 1 | R1 Encrypt the form submission | Web agency · half a day to 2 days | 10/27/2026 |
| 2 | R2, R3 Update old software and hide versions / Add the setting that stops spoofed email | Web agency · 5–13 days | 11/19/2026 |
| 3 | R4 Write product names and comparison details | In-house · 3–11 days | 10/27/2026 |
Can be done this week without approval: A phone number different from the site’s own (1–2 hours in total)
Not covered by this inspection: legal compliance (copyright, advertising and other laws), pages behind login, penetration testing. Please consult a specialist if needed.
We matched what we found on your site with real incidents at other organisations (sourced ones only). It does not mean the same is happening to you or will happen.
A weakness in the site’s content management system was used to rewrite pages so that visitors were automatically sent to a malicious site. The site was taken down for investigation.
The same condition was found.Software version numbers are visible from outside
Source: ScanNetSecurity (Apr 7, 2023)
Japan's Ministry of Internal Affairs and Communications, the National Police Agency and the Ministry of Economy, Trade and Industry asked credit card companies to strengthen anti-phishing measures, as phishing emails posing as card companies were frequently leading users to fake sites to steal card numbers. Noting that phishing emails often spoof domain names, they asked companies to add DMARC to all public domains, including ones that send no email, and to run it with a policy that has receivers reject spoofed email.
The same condition was found.No DMARC policy for telling fake email apart
Source: Ministry of Internal Affairs and Communications (Feb 1, 2023)
On an event application form for a program the city outsourced, the contractor set the viewing settings incorrectly, so applicants could see what other applicants had entered. The names, school grades, phone and fax numbers, email addresses and reasons for applying of 40 people were affected. An applicant reported it on October 14, and the contractor fixed the setting the same day.
The cause was not encryption (https), but it is an example of form input being seen by others.
A similar condition exists.Forms that send data without protection
Source: Osaka City press release (Oct 15, 2026)
Overall
E / A–E
Alert level
5 / 5
Fixing the most urgent item lowers it to 3
Named by AI
3 / 10
Cited
0 / 10
Whether you were named, by stage of the question
| Stage | Question (example) | Named |
|---|---|---|
| Looking | 工場のとき、どんなエアコンの節電用品がありますか | 3／6 |
| Comparing | エアコンの節電用品の保守体制はどう比較すればよいですか | 0／2 |
| Checking prices | エアコンの節電用品の納期と価格の目安を教えてください | 0／2 |
Found in AI answers (2)
GEO maturity (how well AI guides people to you)
You are below Level 1. While a basic security item has a serious problem, Level 1 cannot be reached however good the AI numbers are.
Compared with the last inspection
| Fixed | Still there | New or worse |
|---|---|---|
| 0 | 21 | 2 |
We compare only with your own previous inspection.
We grouped the 21 findings into 6 business risks and rated them by likelihood and impact. The further up and right, the bigger the risk; the red zone (15+ points) needs action now.
| Risk | Cause (what we found) | Points | Response | Who · by · work time | After fixing |
|---|---|---|---|---|---|
| R1 ● | Customers’ input is read (personal data leak) Forms that send data without protection | 5×5=25 | Reduce: Encrypt the form submission | Web agency · 10/27 · half a day to 2 days | 1×5=5 |
| R2 ▲ | Pages are rewritten and customers are led to fake sites Software version numbers are visible from outside; An outdated JavaScript library; Protective headers are missing and 1 more | 4×4=16 | Reduce: Update old software and hide versions | Web agency · 11/19 · 5–11 days | 2×4=8 |
| R3 ◆ | Fake emails in your company’s name harm partners No DMARC policy for telling fake email apart | 4×4=16 | Reduce: Add the setting that stops spoofed email | Web agency · 11/19 · half a day to 2 days | 2×4=8 |
| R4 ★ | Prospects coming through AI are lost Not named by AI (7 of 10); The home page never names the product; Product pages have almost no explanation and 6 more | 5×3=15 | Reduce: Write product names and comparison details | In-house · 10/27 · 3–11 days | Measured with the same questions after 28 days |
| R5 ■ | AI gives the wrong contact number or page A phone number different from the site’s own | 3×3=9 | Reduce: Align phone numbers and guidance to one official source | In-house · 10/27 · 1–2 hours | 1×3=3 |
| R6 □ | The site looks unfinished and loses trust Template placeholder text is published; Menu labels do not match the page they open; The logo links somewhere other than home | 3×2=6 | Accept and watch (fix when there is time) | In-house · 11/19 · 6 hours to 3 days | 1×2=2 |
The 1–5 scales for likelihood and impact are at the end of this chapter. Positions after fixing follow fixed rules and are not forecasts.
Roadmap: who and by when Work time adds up the effort in the statement of work (small = 1–2 hours, medium = half a day to 2 days, large = 3–5 days). We do not show prices.
| When | Main items | In-house | Web agency | KnownFor AI guide |
|---|---|---|---|---|
| This week | Forms that send data without protection, The home page never names the product and 1 more | 2 · 2–4 hours | 1 · half a day to 2 days | ― |
| Within 30 days | Product pages have almost no explanation, Template placeholder text is published and 10 more | 6 · 2–7 days | 6 · 6–15 days | ― |
| Within 60 days | The main heading is only an image, Product pages lack Product structured data and 2 more | 1 · 1–2 hours | 2 · 5 hours to 3 days | 1 (drafts) |
| After the next inspection | Buying happens on another site, No llms.txt | 1 · 1–2 hours | ― | 1 (drafts) |
Tick your choice and write who decided and when. You can also record it on screen; the next report checks it.
Many findings sit where routine work (server updates, contractor changes, new pages) brings them back. Setting a rule to check at those moments prevents the next problem as much as fixing does.
| Work where fixes slip back | Whose work | When it slips back | Now |
|---|---|---|---|
| Server configuration changes | Your web team | When settings change | 4 |
| Publishing and redesign steps | Your web team | When settings change | 4 |
| Rules for new pages | Your team | New pages, new staff | 11 |
| Updating contact details everywhere | Your team | New pages, new staff | 1 |
| Expiry dates (certificates, domains) | Your web team | When a date comes | due 12/1/2026 |
| Software updates | Your web team | When a date comes | 2 |
| Email sending settings | Your web team | When settings change | 1 |
For example: Hand over a checklist whenever the server or vendor changes / Run one re-scan after each change
Of the 10 public pages read, the 10 pages with findings are listed (numbers on the right match the statements of work).
| Page | Clicks from home | Statement |
|---|---|---|
| 見本株式会社 | 総合的なビジネスパートナー Home page | 0 | P-02 P-16 |
| サービス内容 | 見本株式会社 /services | 1 | P-08 P-12 P-16 |
| 商材 | 見本株式会社 /products | 1 | P-06 P-08 P-16 |
| お客様の声 | 見本株式会社 /voice | 1 | P-05 P-08 P-16 |
| 採用情報 | 見本株式会社 /recruit | 1 | P-16 |
| 会社概要 | 見本株式会社 /company | 1 | P-16 |
| Fold-M210S | 見本株式会社 /products/fold-m210s | 2 | P-04 P-08 P-16 P-17 P-20 |
| クリアミナモ | 見本株式会社 /products/クリアミナモ | 2 | P-04 P-08 P-16 |
| thank | 見本株式会社 /thank | unreachable | P-03 P-16 P-18 |
| お問い合わせ | 見本株式会社 /contact | unreachable | P-07 P-16 |
| Q | Question | Named | Cited |
|---|---|---|---|
| 1 | “工場のとき、どんなエアコンの節電用品がありますか” (original text) | ✓ | × |
| 2 | “事務所の工程で電気代の削減を改善するには、どんな設備が使われますか” (original text) | × | × |
| 3 | “エアコンの節電用品を選ぶとき、納期で比べるとどのメーカーが候補になりますか” (original text) | ✓ | × |
| 4 | “エアコンの節電用品の納期と価格の目安を教えてください” (original text) | × | × |
| 5 | “エアコンの節電用品の保守体制はどう比較すればよいですか” (original text) | × | × |
| Q | Question | Named | Cited |
|---|---|---|---|
| 1 | “工場のとき、どんなエアコンの節電用品がありますか” (original text) | ✓ | × |
| 2 | “事務所の工程で電気代の削減を改善するには、どんな設備が使われますか” (original text) | × | × |
| 3 | “エアコンの節電用品を選ぶとき、納期で比べるとどのメーカーが候補になりますか” (original text) | × | × |
| 4 | “エアコンの節電用品の納期と価格の目安を教えてください” (original text) | × | × |
| 5 | “エアコンの節電用品の保守体制はどう比較すればよいですか” (original text) | × | × |
Full answers are shown in KnownFor (ask your contact).
General examples. Please confirm with your web team that an example suits your site before applying it. They are the same as Appendix C of the statement of work.
# .htaccess (Apache) - add after the https redirect <IfModule mod_headers.c> Header always set Strict-Transport-Security "max-age=31536000" Header always set Content-Security-Policy "frame-ancestors 'self'" Header always set X-Content-Type-Options "nosniff" </IfModule>
// WordPress (child theme functions.php)
add_action('send_headers', function () {
header('Strict-Transport-Security: max-age=31536000');
header("Content-Security-Policy: frame-ancestors 'self'");
header('X-Content-Type-Options: nosniff');
});# httpd.conf / apache2.conf ServerTokens Prod ServerSignature Off
; php.ini expose_php = Off
// WordPress (child theme functions.php)
remove_action('wp_head', 'wp_generator');
add_filter('the_generator', '__return_empty_string');; DNS TXT record - review the reports first, then tighten step by step _dmarc.example.jp. TXT "v=DMARC1; p=none; rua=mailto:dmarc@example.jp"
Today, AI reads the pages and writes an answer before people open them, and cyber attackers look at the same pages from outside by machine. This report inspects, on one line called GEO maturity, how far the site has grown inside AI answers, with the security visible from outside as its base.
| Target | Public pages of mihon.example.jp. We read 10 pages, starting with the most important. The whole site may be larger. Pages behind a login were not read. |
|---|---|
| AI answers | We asked AI (Gemini) the questions buyers are likely to ask, per product (without your name; 10 in total). We checked whether you were named and whether your site was cited. |
| How we asked | We asked Gemini (gemini-3.6-flash) with web search on, once per question, around 12:00 on 10/20/2026. AI answers can change each time, so this is one snapshot. The next inspection asks the same questions to the same AI and compares. |
| Security | We checked 19 items anyone can see from outside (encryption, certificate expiry, browser security settings, software versions shown, email sender checks, etc.). Judgments follow fixed rules without AI, so anyone gets the same result. |
| GEO maturity | The criteria (GEO Maturity Model) are published at www.knownfor.jp/en/maturity/. An inspection can see security, search and AI reading settings, and the numbers in AI answers. AI crawler visits (Cloudflare), Google’s index (Search Console) and visits and inquiries from AI (GA4) cannot be seen in an inspection, so they are marked “no record”. |
Items with no issues found (12). None of the following were found: No redirect from http to https / An https page loads http content / Cookies without protection flags / DMARC is set to monitor only / No SPF record to check where email comes from / The SPF record does not restrict senders / The certificate expires soon (or has expired) / Server software (such as PHP) shows a version with publicly known vulnerabilities / Runs on PHP, and the vulnerability fix cannot be confirmed from outside / A version affected by a known exploited vulnerability is visible / Scripts loaded from outside lack tamper protection (SRI) / Signs of tampering (clusters of unrelated spam words) are visible
| GEO maturity | A five-level scale (Read, Read correctly, Recommended, Cited, Driving action) showing, on one line from externally visible security to people’s actions, how far a website has grown inside generative AI answers. |
|---|---|
| Alert level | The danger level of the security visible from outside (5 steps). 5 is the most dangerous, like Japan’s disaster alert levels — the opposite direction from GEO maturity levels. |
| Verification window | The period (28 days) we wait after a fix, without counting, before saying whether it worked. |
| No record | No material, so neither passed nor not yet. Never filled in by guesswork. |
| Cited | When an AI answer uses the site as its source (link). |
| HSTS | A setting telling browsers to always open the site over https. |
| SPF / DMARC | Settings that let receivers check whether an email’s sender is genuine. DMARC has stages: monitor, quarantine, reject. |
| Description (meta description) | A one- or two-sentence description search and AI use to introduce a page. |
| llms.txt | A text file that tells AI what the site is and its key pages (optional). |
| Statement of work | A separate document for your web team with steps, completion criteria and what to report for each finding. |
| Niigata University of Health and Welfare, Japan (2023) | ScanNetSecurity (Apr 7, 2023) https://scan.netsecurity.ne.jp/article/2023/04/07/49179.html |
|---|---|
| Figures on cyber attackers | National Police Agency, cyber threat report for H1 2026 (Sep 2026), p.5 NICT, NICTER Observation Report 2025 (Feb 2026) / National Police Agency 2025 report, p.19 National Police Agency, H1 2026, pp.9–10 IPA, 10 Major Security Threats 2026 [Organizations] |
Page structure · Read by AI and search
Let AI and search read it correctly: work on descriptions, headings, guidance for AI, etc.
Security · Gaps visible from outside
Close the gaps visible from outside: work on server, email and browser security settings.
| P-01 | Forms that send data without protection | Serious | Web team | This week |
| P-02 | The home page never names the product | Serious | You | This week |
| P-03 | A phone number different from the site’s own | Serious | You | This week |
| P-04 | Product pages have almost no explanation | Serious | You | Within 30 days |
| P-05 | Template placeholder text is published | Warning | You | Within 30 days |
| P-06 | Menu labels do not match the page they open | Warning | You | Within 30 days |
The full list of 21 items is on the next page.
| No. | What to do | Severity | Who | When |
|---|---|---|---|---|
| P-01 | Forms that send data without protection | Serious | Web team | This week |
| P-02 | The home page never names the product | Serious | You | This week |
| P-03 | A phone number different from the site’s own | Serious | You | This week |
| P-04 | Product pages have almost no explanation | Serious | You | Within 30 days |
| P-05 | Template placeholder text is published | Warning | You | Within 30 days |
| P-06 | Menu labels do not match the page they open | Warning | You | Within 30 days |
| P-07 | Pages not linked from home but open to search and AI | Warning | You | Within 30 days |
| P-08 | Pages without a meta description | Warning | You | Within 30 days |
| P-09 | The member site’s value is not explained on public pages | Warning | You | Within 30 days |
| P-10 | Software version numbers are visible from outside | Warning | Web team | Within 30 days |
| P-11 | An outdated JavaScript library | Warning | Web team | Within 30 days |
| P-12 | The logo links somewhere other than home | Warning | Web team | Within 30 days |
| P-13 | Protective headers are missing | Warning | Web team | Within 30 days |
| P-14 | No DMARC policy for telling fake email apart | Warning | Web team | Within 30 days |
| P-15 | Software that is no longer supported is visible | Warning | Web team | Within 30 days |
| P-16 | The main heading is only an image | Warning | Web team | Within 60 days |
| P-17 | Product pages lack Product structured data | Warning | KnownFor | Within 60 days |
| P-18 | A form completion page is in the sitemap | Minor | You | Within 60 days |
| P-19 | No security contact (security.txt) is published | Minor | Web team | Within 60 days |
| P-20 | Buying happens on another site | Minor | You | After the next inspection |
| P-21 | No llms.txt | Minor | KnownFor | After the next inspection |
Items the client judges to be intended can be recorded on the KnownFor screen; they no longer appear from the next inspection and are out of scope.
The numbers follow the order of work and match the report (P-01, etc.).
Of the 10 pages in the list, all 10 pages with problems are listed. The P numbers on the right match this statement of work.
| Page | Clicks from home | Inbound links | Problems found |
|---|---|---|---|
| 見本株式会社 | 総合的なビジネスパートナー / | 0 | 9 | Serious P-02Warning P-16 |
| サービス内容 | 見本株式会社 /services | 1 | 9 | Warning P-08Warning P-12Warning P-16 |
| 商材 | 見本株式会社 /products | 1 | 9 | Warning P-06Warning P-08Warning P-16 |
| お客様の声 | 見本株式会社 /voice | 1 | 9 | Warning P-05Warning P-08Warning P-16 |
| 採用情報 | 見本株式会社 /recruit | 1 | 9 | Warning P-16 |
| 会社概要 | 見本株式会社 /company | 1 | 1 | Warning P-16 |
| Fold-M210S | 見本株式会社 /products/fold-m210s | 2 | 1 | Serious P-04Warning P-08Warning P-16Warning P-17Minor P-20 |
| クリアミナモ | 見本株式会社 /products/クリアミナモ | 2 | 1 | Serious P-04Warning P-08Warning P-16 |
| thank | 見本株式会社 /thank | unreachable | 0 | Serious P-03Warning P-16Minor P-18 |
| お問い合わせ | 見本株式会社 /contact | unreachable | 0 | Warning P-07Warning P-16 |
Please confirm with your web team that an example suits your site before applying it.
# .htaccess (Apache) - add after the https redirect <IfModule mod_headers.c> Header always set Strict-Transport-Security "max-age=31536000" Header always set Content-Security-Policy "frame-ancestors 'self'" Header always set X-Content-Type-Options "nosniff" </IfModule>
// WordPress (child theme functions.php)
add_action('send_headers', function () {
header('Strict-Transport-Security: max-age=31536000');
header("Content-Security-Policy: frame-ancestors 'self'");
header('X-Content-Type-Options: nosniff');
});# httpd.conf / apache2.conf ServerTokens Prod ServerSignature Off
; php.ini expose_php = Off
// WordPress (child theme functions.php)
remove_action('wp_head', 'wp_generator');
add_filter('the_generator', '__return_empty_string');; DNS TXT record - review the reports first, then tighten step by step _dmarc.example.jp. TXT "v=DMARC1; p=none; rua=mailto:dmarc@example.jp"