Google can see the site.
Sarasota cannot see it in Google yet.

GA4 recorded 727 generate_lead events in the last 90 days against 89 form_submit events. 712 of the leads landed on two days (2026-07-12, 2026-07-26), 351 and 241 of them geolocated to New York, desktop, direct, in sessions averaging 29 seconds. A Cloudflare Turnstile bot check was added to the form on 2026-07-27 and no day since has exceeded six leads, so the form flood is closed. What continues is page-view traffic with the same signature: bursts of 401, 376, 346, 207 sessions on 2026-07-12, 2026-07-26, 2026-08-11, 2026-09-08, 1,348 sessions in total on that signature, 1,157 of them from "New York". The origin log for the September burst shows Google Cloud addresses probing for .env files and cgi-bin exploits with a Chrome user agent, so these are vulnerability scanners that happen to run JavaScript. No Google Ads campaign is running now (GA4 saw 5 google / cpc sessions in the window, from old tagged links), so nothing was bid on this traffic; the thank-you page does fire the Ads conversion tag, so the July numbers will sit in that Ads account's conversion history.

Done or ready: a Cloudflare WAF rule that blocks the probe paths and challenges datacenter networks is written and waiting to be applied; GA4 needs a filter or a date annotation so the history reads correctly.

Evidence: GA4 events: generate_lead 727, form_submit 89. generate_lead by day and city: 20260712 New York 351, 20260726 New York 241. City x device x channel: New York desktop Direct 1,157 sessions, engagement 90%, 29s average. Bot-city desktop sessions per day >= 100: [('20260712', 401), ('20260726', 376), ('20260811', 346), ('20260908', 207)]. Turnstile widget created 2026-07-27 (vault record). nginx access log 2026-09-08: 1,421 requests from four Google Cloud IPs, paths include /.env, /cgi-bin/php-cgi. Source: contact/thank-you.astro fires generate_lead and the Ads conversion on load.

The Google Business Profile exists, is rated 5 and has 2 reviews. The highest-reviewed IV businesses within 20 km have 251, 248 and 225. On a live Maps search from central Sarasota, "mobile iv therapy sarasota" places you at #12 behind SHINE IV Drip Spa & Mobile IV Therapy, Jeffe (7 reviews), SHINE IV Drip Spa & Mobile IV Therapy, Downt (258) and Drip Refresh Mobile IV Therapy, Sarasota (12); "iv therapy sarasota" does not place you in the top 20. Proximity and a street address matter too, which is why a 7-review listing can sit at #1, but reviews are the largest gap you control, and for a mobile service the map pack is where the calls come from.

Evidence: Google Maps live SERP, September 19, 2026, 27.3364,-82.5307: brand search returns the profile (5 stars, 2 reviews); rank 12 on the mobile query, unranked on the generic one. Business listings dataset, 20 km radius, by review count: SHINE IV Drip Spa & Mobile IV Ther 251, Ultimate IV & Wellness 248, Sarasota IV Lounge 225, ELITE IV HYDRATION 205. Live SERP and the listings dataset report SHINE at 258 and 251; both are quoted as their source gives them.

Average position across all queries is 40.3. The terms that describe the business sit on page five and beyond: "iv therapy sarasota" 54.2, "mobile iv therapy sarasota" 41.4, "iv hydration sarasota" 62.0. Only 32 queries rank on page one and together they were shown 71 times: about a third are brand or near-brand ("sarasota iv infusion", "drip doctor") and about half are junk queries with no buyer behind them. Impressions rose 59% from July to August, so the site is being evaluated; it has not yet been trusted.

Evidence: Search Console, sc-domain property, 2026-06-19 to 2026-09-16: 9,670 impressions, 35 clicks, CTR 0.36%, position 40.3. Prior 90 days: 281 impressions, 3 clicks. 437 distinct queries.

The single biggest source of impressions is /concierge/weight-loss/ at 1,633, driven by "tirzepatide sarasota" (633 impressions, position 43.4) and "sarasota weight loss doctors" (403, position 50.7). Weight-loss queries total 1,627 impressions, more than any single IV term (the largest, "iv therapy sarasota", has 381) though less than all IV terms together (3,664). The page gets zero clicks because it sits on page five. Decision: is medical weight loss a line Dr. Patel wants to grow? If yes, it deserves its own content plan; if no, the page is pulling crawl attention toward a service you do not lead with.

Evidence: Search Console pages report: /concierge/weight-loss/ 1,633 impressions, 0 clicks, position 49.9. Query report as quoted.

We asked ChatGPT, Gemini and Perplexity the same eight questions a Sarasota buyer would ask, with web search on. Perplexity named Sarasota IV Doctors in 7 of 8 answers and cited the site in 8 of 8. ChatGPT named you in 4 and cited the site once. Gemini named you in 3 and never cited the site. The domains AI answers cite most, after yours, are shineivdripspa.com and theivdoc.com at 7 of 24 each, then five domains at 6 of 24. GA4 confirms this is real traffic: 9 sessions arrived from chatgpt.com in 90 days, already more than paid search (5).

Evidence: DataForSEO LLM Responses, September 19, 2026, 24 live calls, $0.56, saved in ai_probes.json. Negative control (ai_control_tampa.json): the same question for Tampa on Perplexity named no Sarasota provider. GA4 source/medium: chatgpt.com / ai-assistant 9 sessions.

GA4 reports 0 conversions for the period while recording 727 generate_lead events. The event fires; it is not marked as a key event, so every GA4 report and every attribution view see a site with no goals. Phone taps were sent to the Google Ads tag only and never reached GA4; fixed today, they now arrive as a phone_call event. Mark both as key events and the Analytics section of the next report can show which channel produced which call.

Evidence: GA4 Data API: conversions metric 0 across all channels; eventCount generate_lead 727. Source: Base.astro ivPhoneConvert() sends an Ads conversion event only.

Three PageSpeed Insights runs on the home page scored 71, 99, 74 with LCP 7.7s, 1.4s, 7.5s. One run on one service page scored 100 with LCP 1.2s, so the template is fast; the hero poster image is not always. Slow, fast, slow is consistent with a cold-cache fetch of the poster: the origin was sending a 4-hour cache lifetime and Cloudflare reported the file as revalidated. Done today: the origin now sends a 30-day lifetime for images and fonts and the edge reports a cache hit. Three runs after the change scored 94, 100 and 74 (LCP 1.5s, 1.5s, 7.1s), so the cache was part of the cause and not all of it; the remaining slow run is still open and is the one performance item left on this list.

Evidence: PSI API v5, mobile, September 19, 2026: home samples [(71, 7663), (99, 1375), (74, 7459)]; median score 74, LCP 7459ms. /services/classic-hangover/ one run (100, 1233). No CrUX field data (traffic below threshold). Poster headers before: cache-control max-age=14400, cf-cache-status REVALIDATED; after the nginx change: max-age=2592000, HIT. Post-change PSI: 94/1530ms, 100/1509ms, 74/7090ms (evidence/psi-after-cache.json holds the slow run).

33 titles run past 60 characters (the longest is 128) and 26 meta descriptions run past 160. Google rewrites or truncates these, which means the words you chose to win the click are often not the words a searcher sees. With a 0.36% CTR across 9,670 impressions, the snippet is the cheapest lever on this list. Done today: all 40 affected titles and descriptions were rewritten, local term first, within Google's display limits (33 titles and 26 descriptions across 40 pages), and the home page H1 now names Sarasota.

Evidence: Crawl of 65 HTML pages, September 19, 2026: title length > 60 on 33, meta length > 160 on 26. Example: /services/myers-cocktail/ title 79 characters.

The best non-brand positions on the site belong to "sarasota cme" (115 impressions, position 11.7), "medical conference sarasota florida" (100, 14.5) and "sarasota cme conferences". They land on /events/, which is written for conference attendees who might want an IV. That is a real audience, and it is the best-ranked non-brand topic on the site (the athletic-recovery science page, at 11.9, is the other). Decision: lean in (a conference-recovery package page, priced) or accept it as incidental.

Evidence: Search Console queries: sarasota cme (115, 0, 11.7), medical conference sarasota florida (100, 0, 14.5), cme sarasota florida (72, 0, 12.6). /events/ page: 738 impressions, position 13.8.

The backlink index shows 55 links from 51 domains, 10 of them nofollow, domain rank 56 on a 0-1000 scale. This is directional only (a single index, not authority-scored). For a site relaunched three months ago it is normal; it will not by itself move the terms in finding 3. Reviews and citations (finding 2) matter more here than links.

Evidence: DataForSEO backlinks summary, September 19, 2026: backlinks 55, referring domains 51, main domains 48, broken 0, rank 56.

The sitemap lists 66 URLs. A link-walk from the home page reached 65 HTML pages and did not reach /book/ (it carries a noindex tag, so it should not be in the sitemap at all) or /case-studies/ (the index page for The Science section was not linked from any crawled page). Small, but a sitemap that lists what you tell Google not to index sends a mixed signal. Done today: the QR page is out of the sitemap and the footer now links the Science index.

Evidence: Sitemap 66 URLs; crawl 69 URLs, 65 HTML 200s. In sitemap, not crawled: /book/, /case-studies/. /book/ meta robots: noindex,nofollow (evidence/book.html).

Every other security header is present (HSTS, frame, content-type, referrer). CSP is the one that limits what an injected script could do on a site that collects health intake. Not urgent, and it needs care because the site loads Google and Meta tags; a report-only policy first.

Evidence: audit-live-security.sh: one WARN, content-security-policy missing; secrets in served JS: none.

A site: query estimates 72 results against 66 sitemap URLs, consistent with full coverage (URL Inspection in Search Console would confirm it page by page). Structured data covers 13 MedicalBusiness pages, 20 MedicalProcedure pages and 28 FAQPage blocks, all parsing clean; the 10 blog posts and the About page carry a second block the crawler records as untyped (a nested graph, checked by hand on one post), and the three Science pages carry Article. robots.txt names and allows the AI crawlers (one, meta-externalagent, has no explicit rule and passes by default), llms.txt is present, and pages average 1,001 words. Nothing to fix here.

Evidence: DataForSEO SERP site:sarasotaivdoctors.com se_results_count 72. JSON-LD types across 65 pages: BreadcrumbList 67, FAQPage 28, MedicalProcedure 20, MedicalBusiness 13, Service 8, CollectionPage 3. audit-seo-files.sh 14 PASS, 1 WARN (meta-externalagent has no explicit Allow), 0 FAIL (evidence/audit-seo-files.txt); audit-ai-crawler-access.sh 0 blocked (evidence/audit-ai-crawler.txt).

Strip the bot sessions out and about 299 sessions remain over 90 days, roughly 23 a week. Organic search visitors stayed an average of 232 seconds, which for a service site is a reader, not a bouncer. The problem in this report is volume, not the site.

Evidence: GA4 channels: Organic Search 72 sessions, 232s average; Organic Social 34; AI Assistant 9; Paid Search 5; Direct 1,528 (bot-dominated, see finding 1).