As of October 2026, we recommend starting a law firm website review with two questions: can a crawler read the public pages the firm wants found, and are private pages protected from unauthorized access? This is our proposed starting point, not a ranking formula. Use the checks below to examine public information and private access separately.
What the documentation says
Use these three Google Search Central documents as the starting references for this proposed review. We have not tested a firm's website for this guide. Check current provider wording before acting, and keep your own dated observations alongside the documentation.
- Google's page on AI features and your website says a page must be indexed and eligible to be shown in Google Search with a snippet, fulfilling the Search technical requirements, to be a supporting link in AI Overviews or AI Mode. It says there are no additional technical requirements, that specific optimization isn't required for these features, and that existing SEO fundamentals continue to be worthwhile.
- Google's JavaScript SEO basics describes how Googlebot crawls a page, queues it for rendering and renders it with headless Chromium. It adds that server-side or pre-rendering is still a great idea because it makes a site faster for users and crawlers, and not all bots can run JavaScript.
- Google's Control the content you share on Search covers the noindex robots meta tag, page- and text-level presentation settings and password protection. It says confidential or private content needs to be password protected.
Google says AI Overviews are shown only when its systems determine they add to classic Search, and often do not trigger. We recommend keeping that limit in view when examining whether a particular answer links to a page.
The six checks
Use the proposed checks below as a discussion plan for the person responsible for the website. We have not validated the pass conditions as predictors of search inclusion. Keep the provider statements separate from our recommendations about which firm pages and records to review.
Check 1: Are the pages you want found indexable and snippet-eligible?
Google states that a page must be indexed and eligible to be shown in Google Search with a snippet, fulfilling the Search technical requirements, and that there are no additional technical requirements for AI features. The same page tells site owners to follow Search policies. We recommend verifying the site in Search Console, then inspecting your practice-area pages, attorney profiles and location pages. Look for stray noindex tags, nosnippet or max-snippet limits, and robots.txt rules that block the pages. Because snippet eligibility is part of the condition, a snippet limit should be a deliberate decision, not a default.
Recommended pass condition: every page the firm wants prospective clients to find is indexed and shows a snippet, and any exception is written down with a reason.
Check 2: Does the page content survive without a rendering step?
Google says it renders JavaScript, but pages are queued for rendering, and a page may stay in that queue for a few seconds or longer. It also says not every bot runs JavaScript. For a firm, the practical question is whether the practice description, attorney names, office locations and contact route appear in the HTML response itself or only after scripts run. We recommend viewing the raw page source for your top five pages and reading only the text.
One more caution from the same page: Google Search won't render JavaScript from blocked files or on blocked pages. If robots.txt blocks a script that builds your page content, it follows that you have kept that content from Google's renderer.
Recommended pass condition: the substantive text of each key page is present in the initial HTML, or the firm has confirmed through Google's inspection tooling that the rendered output includes it.
Check 3: Are links real links, and do status codes tell the truth?
Google says it can only discover links that are HTML anchor elements with an href attribute. In our reading, a practice-area menu built from click handlers may look fine to a person and be invisible to a crawler. The same guidance recommends meaningful HTTP status codes, such as 404 for a page that could not be found and 401 for pages behind a login. It also describes soft 404 errors as a risk in client-side rendered sites, so we suggest checking whether a removed attorney profile still loads as a normal page.
Recommended pass condition: every key page is reachable through ordinary links from the homepage, and retired pages return a status that says so.
Check 4: Do your firm facts agree everywhere? (Our practice, not a Google rule)
This check is our recommendation, not a Google requirement. The reason is operational. A prospective client, a referral partner and an intake coordinator should all land on the same office address, the same phone route and the same description of which matters the firm accepts. Compare the website, Google Business Profile, bar directory listings and any legal directories the firm maintains. Differences can be leftovers from a move, a departed attorney or an old campaign, though only your own records can tell you which.
Recommended pass condition: one maintained source of truth for names, offices, phone routes and practice areas, with a quarterly comparison against each public listing.
Check 5: Is private content actually private? (Confidentiality first)
In our judgment this check carries the most risk, and Google's documentation is direct about the core point. Google says that if you have confidential or private content, you need to password protect it. The noindex robots meta tag keeps a page out of Search results, but Google notes the content can still be linked to and visited through other pages or directly by users with a link. It follows that noindex is not access control.
On top of that guidance, we recommend inventorying the places where private material could become a public URL:
- We recommend confirming that client portals and document-sharing links sit behind authentication.
- We recommend that intake form confirmation pages not echo submitted details, and we think keeping them out of the index is reasonable.
- We recommend checking scheduling pages for matter-specific parameters in the URL.
- We recommend including staging sites and uploaded documents in the inventory.
We recommend preserving spam checks, consent notices, encrypted connections and the firm's approved retention settings during a readability review. Keep public information readable while protecting the intake form and its submitted details. We have not tested a firm's form protections in this guide. Ask the firm's designated legal or privacy advisor about disclosure and retention obligations before changing those arrangements.
Recommended pass condition: no client-specific information appears in any publicly reachable URL, and every authenticated area returns a login or 401 response to an unauthenticated request.
Check 6: Are preview and AI controls set on purpose?
Google describes several controls. Robots.txt directives for Googlebot are the control for how a site is crawled for Search. The nosnippet, data-nosnippet, max-snippet and noindex controls limit the information shown from your pages. Google-Extended limits AI training and grounding in some of Google's other systems. A Search generative AI control in Search Console manages a site's inclusion in AI Overviews and AI Mode. In our view, each control trades visibility for restriction, and a partner may reasonably decide that a page about a sensitive matter type should be limited. We recommend recording that as a decision rather than leaving it to a plugin default.
Recommended pass condition: a one-page register listing each control in use, the pages it affects and who approved it.
Measure with logs, not scores
Google says sites appearing in AI features are included in overall Search Console traffic, reported in the Performance report under the Web search type. We recommend using that for trend monitoring and pairing it with first-party data your firm already controls, such as the intake source field and call-tracking records.
For direct observation of AI answers, we recommend a simple dated log:
- Write 10 to 15 generic questions a prospective client might ask in your practice area and city. Use no real client names or matter facts, because third-party tools are the wrong place for confidential detail.
- Run them in the assistants you care about on the same day each month.
- Record the date, tool, question, whether the firm was named, whether the facts stated were correct, and which URL was cited.
- We recommend recording site changes alongside the observations. A difference after a change does not establish that the change caused it.
Expect variation. Google itself says AI Mode and AI Overviews may use different models and techniques, so the set of responses and links they show will vary. The log is a record of observations, not a ranking. If it shows the firm missing or misdescribed, that is a hypothesis worth investigating against intake records. It is not proof of lost matters, and public evidence alone cannot show lead loss or lost revenue.
Read our earlier piece on building useful firm information rather than chasing AI citation shortcuts for a related content discussion. We have not measured a citation or business outcome from the proposed audit in this guide.
Limits of this guide
- It draws on Google documentation only. Other assistants and search tools publish their own guidance, which we have not reviewed here.
- Check current provider wording before acting on a saved documentation copy. Record the date of that check with any proposed website change.
- We recommend treating the pass conditions as proposed checks for discussion. We have not measured their effect on any firm's search presence or intake.
- Completing these checks does not establish that a page will be indexed, cited or referred to a prospective client. Keep those outcomes separate from the observations in the review.
A one-hour version
We suggest three tests. Check indexing and snippet settings on your five most important pages. View their raw source and note any content that only appears after scripts run. Then request one private URL, such as a portal page or a form confirmation page, in a logged-out browser and see what comes back. We recommend recording each result and its limits, assigning an owner to investigate any discrepancy, and agreeing when to repeat the checks.