Skip to main content
BA://OS · Navigation
Services
Cannabis SEOCannabis AI SearchAnswer Engine (AEO)Generative Engine (GEO)Zero-Click OptimizationVoice SearchSchema MarkupLocal SEO & GBPDutchie SEOWeb Design & CROContent StrategyDigital PR & Links
Resources
Cannabis SEOCannabis AI SearchAnswer Engine (AEO)Generative Engine (GEO)Zero-Click OptimizationVoice SearchSchema MarkupLocal SEO & GBPDutchie SEOWeb Design & CROContent StrategyDigital PR & Links
Markets
Cannabis SEOCannabis AI SearchAnswer Engine (AEO)Generative Engine (GEO)Zero-Click OptimizationVoice SearchSchema MarkupLocal SEO & GBPDutchie SEOWeb Design & CROContent StrategyDigital PR & Links
Who We Serve
Apex MenuEdge
About
Get Free Audit

> budauthority.com

Insights

Cannabis SEO Audit Checklist 2026: The 35-Pillar Apex QA Protocol Bud Authority Runs on Every Dispensary Client — Technical, Content, Local, Schema, AI Search, Compliance

By , Founder, Bud Authority·Last updated

The 35-pillar cannabis SEO audit framework Bud Authority runs on every client. Each pillar is a ranking factor dispensaries get wrong. Six audit phases.

Get a Free Audit for This Service
8 sections
|8 min
> Audit
Introduction

The Apex QA Protocol is Bud Authority's 35-pillar audit framework — each pillar a measurable ranking factor that cannabis dispensaries routinely get wrong. The framework is the gate every client engagement passes through before launch, and the same gate Bud Authority's own corporate site is held against monthly. The 35 pillars distribute across six audit phases (technical, content, local, schema, AI search, compliance). A clean pass on all 35 produces the structural baseline against which WordPress-on-Elementor competitor sites cannot compete.

This guide enumerates all 35 pillars, the six-phase audit structure, the DIY-vs-pro split for operators who want to self-check, and how to read the audit output once it lands.

Section 01

What a Cannabis SEO Audit Checks

A complete cannabis SEO audit covers six phases. Each phase has its own measurement methodology, tool stack, and remediation playbook.

Phase 1: Technical.

Server response, render performance, mobile-real-device Core Web Vitals, JavaScript bundle weight, crawl-error inventory, and responsive layout integrity. This is the foundation. A site that fails technical cannot win content, local, or AI surfaces.

Phase 2: Content.

Entity-first phrasing, AEO answer-block presence, image originality, structured data completeness, author verification, content depth per page type, and absence of AI-slop fingerprints. Content quality is the ranking signal post-April-2026 Core Update.

Phase 3: Local.

GBP claim and verification status, NAP consistency across 50+ citations, Map Pack keyword coverage, review velocity and quality, photo freshness, services catalog completeness, and Q&A seeding. Local is the highest-leverage phase for single-location operators.

Phase 4: Schema.

Linked `@id` schema graph, per-page-type schema completeness, author entity, Wikidata verification, dynamic dateModified, and ItemList for ranking content. Schema is the structured surface AI crawlers extract for citation.

Phase 5: AI Search.

Robots.ts 63-bot allowlist, llms.txt, llms-full.txt, ai.txt, multimodal content co-location. This is the AI citation foundation.

Phase 6: Compliance.

State-by-state regulatory framing and prohibition-state noindex. Cannabis-specific. Critical for multi-state operators.

Section 02

The 35 Pillars by Phase

Phase 1: Technical (Pillars 1-8)

  1. 1Mobile LCP < 1.8s on real device. Largest Contentful Paint measured on a real iPhone or Android device, not lab simulation. Google's 2.5s "Good" threshold remains in force per web.dev/articles/lcp, but Bud Authority targets 1.8s for competitive margin (Source: web.dev/articles/lcp).
  2. 2INP < 150ms. Interaction to Next Paint below Google's 200ms threshold with margin. Measured on real mobile interactions, not synthetic.
  3. 3CLS < 0.05. Cumulative Layout Shift held below 0.05 on every page. Above 0.10 is "Poor" — many WordPress builds run 0.15+ from ad slots and cookie banners.
  4. 4TTFB < 100ms from edge. Time to First Byte under 100ms when served from the nearest CDN edge. Next.js static generation on Vercel typically lands under 50ms.
  5. 5Total client JS < 90KB. First-load JavaScript budget under 90KB compressed. WordPress builds with Elementor typically ship 400KB+.
  6. 6SSL valid + HSTS preload. TLS certificate valid, HSTS header present with `preload` directive, domain submitted to the Chrome HSTS preload list.
  7. 7Crawl errors zero. Google Search Console crawl error count at zero. Every page returns 200 or a deliberate 301/410. No accidental 404s, no soft-404s.
  8. 8Mobile responsive zero overflow. Every page tested at 320px viewport width with zero horizontal overflow, every interactive target at 44px minimum, and `clamp()` typography on all headings.

Phase 2: Content (Pillars 9-15)

  1. 1Entity-first first paragraph. The first 40-60 words of every page deliver a direct factual answer to the page's primary query. No marketing prose preambles.
  2. 2AEO Answer blocks per section. Each content section ends with a direct-answer block formatted for AI extraction. Cannabis FAQ pages should have 6-12 AEO blocks per page.
  3. 3Original images only. Zero stock photography, zero AI-generated imagery. Real product photography, real interior, real staff. May 2026 GBP audit-trigger rule applies here.
  4. 4dateModified dynamic + visible byline. Article `dateModified` populates from `fs.statSync().mtime` or equivalent, not hardcoded. Byline visible to the user with linked author profile.
  5. 5Author.sameAs verified. Article and Person schema include `sameAs` linking to verified LinkedIn, Twitter/X, Wikidata, and at least one industry-specific profile (cannabis trade publication, panel speaker page).
  6. 6Content depth 2,500w+ per service page. Service-tier pages (cannabis SEO, local SEO, AI search optimization) carry minimum 2,500 words. Service detail pages may run longer. Thin content fails the gate.
  7. 7No AI-slop fingerprints. Zero "AI Citation Block N" labels. Zero "discover/embrace/elevate" verb patterns. Zero "synergy/unleash/harness/leverage" filler. Zero purple-blue gradient mentions. Zero em-dash overuse.

Phase 3: Local (Pillars 16-22)

  1. 1GBP claimed + verified. Google Business Profile claimed by the operator, ownership verified via postcard or video. Re-verify any profile pending more than 14 days.
  2. 2NAP consistency across 50+ citations. Name, Address, Phone matched exactly across Google, Bing, Apple Maps, Leafly, Weedmaps, state license registry, and 50+ secondary citations. Any drift suppresses Contextual Verification.
  3. 3Map Pack neighborhood KW coverage. Profile appears in top 3 of Map Pack for primary metro keyword plus at least 5 adjacent neighborhood keywords. Audit via geo-grid rank tracker.
  4. 4Reviews ≥ 4.5 / 50+. Aggregate review rating at 4.5 stars or higher, total review count above 50. Below either threshold suppresses ranking and reduces CTR.
  5. 530-day photo freshness. Most recent owner-uploaded photo within the trailing 30 days. May 2026 GBP rule. Operate at 18-day cadence to buffer against the floor.
  6. 6Services catalog complete. GBP services catalog populated with flower, edibles, concentrates, vapes, accessories, delivery, in-store pickup, medical-card support where applicable.
  7. 7Q&A seeded before Gemini AI. 10-15 owner-marked canonical answers seeded to the legacy Q&A surface before Gemini AI's signal weighting fully consolidates. Operator-marked text weights higher than scraped third-party content in Gemini synthesis.

Phase 4: Schema (Pillars 23-28)

  1. 1Organization + LocalBusiness + WebSite linked @id graph. Root-level schema graph with `@id` anchors linking Organization, LocalBusiness (or CannabisDispensary), and WebSite. Per-page schemas reference graph nodes via `@id`.
  2. 2FAQPage + Speakable + Article per content type. FAQ pages emit `FAQPage` schema. Voice-extractable content emits `Speakable`. Blog posts and learn articles emit `Article` with `author`, `datePublished`, `dateModified`.
  3. 3Person@id for author w/ sameAs. Author `Person` schema with `@id` anchor and `sameAs` array linking to LinkedIn, Twitter/X, Wikidata, and industry profiles. Anonymous bylines fail the gate.
  4. 4Wikidata Q-IDs verified. Every Wikidata Q-ID referenced in schema verified against `~/.claude/state/verified-qids.json` and the Wikidata API. Q-ID hallucination is the most common schema failure mode (Source: feedback_apex_2026_schema_graph.md).
  5. 5Dynamic dateModified (no hardcoded ISO). All schema dates pulled from filesystem mtime or build-time API. Hardcoded ISO strings fail the gate and trigger the schema-guard hook.
  6. 6ItemList for ranking content. "Best X" pages, comparison pages, and ranked lists emit `ItemList` schema with `ListItem` entries in ranking order.

Phase 5: AI Search (Pillars 29-33)

  1. 1robots.ts 63-bot explicit allowlist. App Router robots.ts (not legacy robots.txt) ships explicit Allow for the 63 AI and search bots Bud Authority's current allowlist covers. Refreshed monthly.
  2. 2llms.txt with citation-bait passages. Root-level llms.txt with concise citation-ready summaries of the site's most important content. Linked from `<head>`.
  3. 3llms-full.txt with verified outcomes. Extended llms-full.txt with deep detail and verified-outcome data. Linked from `<head>` alongside llms.txt.
  4. 4ai.txt with agent declaration. Root-level ai.txt declaring the site's AI training and citation policy. Vendor-side guidance increasingly references ai.txt as a permissions surface.
  5. 5Multimodal co-location (image + text). Original photography paired with text content adjacent in the DOM, not isolated in separate components. Multimodal co-location signals authentic first-hand content to AI crawlers.

Phase 6: Compliance (Pillars 34-35)

  1. 1State-by-state regulatory framing. Per-state cannabis regulations are not portable. Content references NY OCM for NY operators (including PLMA loyalty rules where applicable), CA BCC for California, MA CCC for Massachusetts, MO DHSS for Missouri. Cross-state content blocks must call out per-state distinctions explicitly.
  2. 2Prohibition-state noindex. Operators with national content surfaces must noindex pages targeting prohibition states (TX, ID, KS, AL, SC, NC, IN, WI). Indexable content in prohibition states risks regulatory complaints and serves no commercial purpose.
Section 09

DIY vs Pro Audit

Operators with technical capacity can self-check a subset of the 35 pillars.

Self-check feasible: Pillars 1-4 (Core Web Vitals via PageSpeed Insights), Pillar 5 (JavaScript bundle weight via Chrome DevTools), Pillar 6 (SSL via SSL Labs), Pillar 11 (image originality manual audit), Pillar 16 (GBP claim status), Pillar 17 (NAP consistency via manual citation crawl), Pillar 20 (photo freshness manual check), Pillar 29 (robots.txt allowlist manual review), Pillar 30 (llms.txt presence check).

Pro audit required: Pillars 7, 8, 12-15, 18, 19, 21-28, 31-35. The schema graph, Wikidata Q-ID verification, INP measurement on real devices, Map Pack geo-grid rank tracking, content-depth analysis, AI-slop fingerprint detection, and compliance framing review require either specialized tooling (Lighthouse CI, geo-grid rank tracker, schema validators) or domain expertise that takes years to accumulate.

The 70/30 rule: an operator can self-resolve 70% of basic technical hygiene. The 30% that requires pro audit is also where 80% of ranking lift comes from.

Section 10

How to Read Audit Results

A clean Apex QA Protocol report ships a pass/fail per pillar with remediation priority. Failures rank by impact severity, not order.

Tier-1 failures (deploy-blocker): any Phase 1 technical failure, Pillar 16 GBP unclaimed, Pillar 17 NAP drift, Pillar 23 missing root schema graph, Pillar 26 Wikidata Q-ID hallucination, Pillar 29 robots allowlist missing AI bots.

Tier-2 failures (sprint-priority): Phase 2 content failures, Pillars 18-22 local-SEO gaps, Pillars 24-28 schema completeness, Pillars 30-33 AI search surfaces.

Tier-3 failures (backlog): cosmetic schema completeness, edge-case responsive behaviors, low-traffic page-level optimizations.

The audit output is a remediation roadmap, not a scorecard. Operators who treat the audit as a one-time scoring event miss the value. The framework is designed for ongoing engagement — monthly re-audits track regression, identify new failures introduced by content additions, and surface drift in third-party signals (citations, reviews, schema validation status).

Section 11

AEO Answer: What is a cannabis SEO audit?

A cannabis SEO audit is a structured evaluation of a dispensary website against ranking factors that drive organic search, Map Pack visibility, and AI citation. Bud Authority's Apex QA Protocol covers 35 pillars across six phases: technical (Core Web Vitals, JS bundle, crawl errors), content (entity-first phrasing, schema, author verification), local (GBP, NAP consistency, review velocity), schema (linked @id graph, FAQPage, Article), AI search (robots.ts allowlist, llms.txt, multimodal content), and compliance (state-specific regulatory framing).

Section 12

AEO Answer: How much does a cannabis SEO audit cost?

Cannabis SEO audit pricing varies by depth. A basic technical audit covering Core Web Vitals and on-page SEO ranges from a few hundred dollars to low-thousands per site. A full 35-pillar Apex QA Protocol audit covering technical, content, local, schema, AI search, and compliance phases is priced as a structured engagement at Bud Authority. Multi-location MSO audits scale per-location. Ongoing monthly audits with regression tracking are bundled into retainer engagements.

Section 13

AEO Answer: Can I audit my own dispensary website?

Yes, partially. Operators with technical capacity can self-check around 70% of basic hygiene pillars — Core Web Vitals via PageSpeed Insights, JavaScript bundle weight via Chrome DevTools, SSL via SSL Labs, robots.txt allowlist via manual review, GBP claim status, NAP consistency via manual citation crawl, and photo freshness. The 30% that requires professional audit — schema graph validation, Wikidata Q-ID verification, Map Pack geo-grid rank tracking, AI-slop fingerprint detection, compliance framing — is where 80% of ranking lift comes from.

Section 14

AEO Answer: How long does a cannabis SEO audit take?

A full 35-pillar Apex QA Protocol audit on a single-location dispensary site completes in approximately 5-7 business days. The technical phase (Pillars 1-8) takes one day with Lighthouse, Chrome DevTools, and PageSpeed Insights. The content audit (Pillars 9-15) takes two days for manual review and AI-slop fingerprint scanning. Local, schema, AI search, and compliance phases (Pillars 16-35) take 2-3 days combined. Multi-location MSO audits scale per-location at roughly 3 incremental days per additional store.

The 35 pillars are the gate. Every Bud Authority client engagement passes through this gate before launch, and the same gate is applied monthly on the BA corporate site against its own competitor field.

Book a 35-pillar cannabis SEO audit at /audit or learn about the full cannabis SEO service at /cannabis-seo.

Continue Exploring

Insights

Dutchie Plus Sunset 2026: Migration Guide for Dispensaries Losing Headless Commerce — Three Migration Paths, Decision Tree, and 8-Step Apex MenuEdge Cutover

Dutchie Plus headless commerce API is being sunset in 2026 with a 6-month deprecation runway. Three migration paths ranked, decision tree, and exact cutover steps.

Insights

May 2026 Google Business Profile Cannabis Update: Q&A Discontinued, AI Imagery Banned, 30-Day Photo Freshness Mandatory — Dispensary Compliance Checklist

The May 2026 GBP update kills Q&A, bans AI/stock images, and mandates 30-day photo freshness. Cannabis dispensaries lose paid ads — GBP is critical channel.

Insights

NY OCM PLMA Loyalty Marketing Explained: What New York Cannabis Operators Can and Cannot Do Under the December 2025 Promotional Loyalty Marketing Authorization

NY OCM authorized cannabis loyalty programs and discount marketing in December 2025 via PLMA. What's permitted, what's banned, and why this is NY-only.

Page

Cannabis Menus That Convert: How Product Page Architecture, Schema Markup, and UX Design Turn Browsers into Buyers

Cannabis menu optimization combines UX design, CRO psychology, and SEO schema. Learn product page architecture, checkout flow, A/B testing for higher conversion rates.

Page

Cannabis Brand Storytelling: How Content Architecture Builds Customer Trust and Search Visibility

Cannabis stories drive customer trust and search ranking. Learn how brand narrative, content architecture, and SEO combine to build sustainable competitive advantage.

Page

Mastering Cannabis SEO in 2026: The Complete Operator's Playbook for Dispensaries, Delivery Services, and Brands

The definitive 2026 cannabis SEO guide for dispensaries, delivery, and brands. Cover AEO/GEO, zero-click, voice search, schema, local SEO, content architecture.

// deploy

Ready to Deploy This Protocol?

Start with a comprehensive audit. We'll map every opportunity and build your custom growth protocol.

> [ INITIATE AUDIT ]
BA://OS