Be chosen
by AI.
Contents
01 - The problem
Security, spam and AI invisibility - the problems we found on 12 November 2026, followed by how we fix them.
Security exposure on the ticket site: one disclosed version, one affected-range overlap
Public-page proof · 12 Nov 2026, 04:36 UTC
Hostname: ticket.chiangmainightsafari.com/en/
Observed markers: WordPress generator metadata and versioned asset URLs disclose 6.8.3.
This confirms version disclosure and overlap with the advisory range. It is not a penetration test.
Advisory proof + limits
The advisory describes unauthenticated RCE during a full-package core-upgrade window. Affected releases include 6.8.3; the vendor fix is 7.1.4.
Not confirmed: current patch state, upgrade-window condition, exploitability, or any breach. No compromise is known from this review.
Decision this week: the ticket-site owner verifies core/plugins and patch status, patches if affected, restricts admin access, confirms MFA and backups, and reviews upgrade/web logs if exposure is possible. Treat customer data as a risk to assess, not as data known to be exposed.
Three observable brand-safety failures on your domain
Search-result proof · 12 Nov 2026
Indexed title: “PRIMATOTO X CHIANGMAI | Portal Destinasi Hiburan” on chiangmainightsafari.com/en/.
Page-one examples: /en/?/hikari-phone/ and /en/?/akb/tc/index.html appeared at positions 4–5 for “chiang mai night safari tickets”.
Technical proof + action
sitemap.xml returned a PHP warning from aioseoextensions.php (line 417).
Week 1: confirm with the web team, remove/410 injected URLs, clean indexing signals, fix sitemap output, and request re-indexing. These findings merit remediation even if no proposal proceeds.
Spam in branded search results can undermine trust in the whole domain. The next slide shows the exact distribution of official, third-party and spam results for the ticket query.
0 of 6 AI answer checks cite or mention Night Safari
Spot-check proof · 3 visitor queries × 2 AI engines
| Query | Google AI Mode | Bing Copilot |
|---|---|---|
| chiang mai night safari | 0 mentions / 0 citations | 0 mentions / 0 citations |
| things to do in chiang mai at night | 0 mentions | 0 mentions |
| chiang mai night safari tickets | 0 mentions | 0 mentions |
The checks returned third-party references, none from the official site.
Tracker screenshot · prompt-level evidence
The 15/100 and 15.1% figures are from a separate supplied grader snapshot; date and full settings were not visible. Average position was 3 when visible, ranking #2 among 10 brands. These measures are not directly comparable to the 0/6 spot-check.
Search-demand gap: 17,400 brand searches, 320 ticket searches
Where the official site appears today
- "chiang mai night safari": official page at #3 in the SERP snapshot - not owning even its own brand query
- "things to do in Chiang Mai at night": not in the top 5 - travel publishers, directories and forums take the discovery stage
The missing bridge
Between 17,400 brand searches and 320 ticket searches sit the questions nobody on your domain answers: "Is it worth visiting?" - "What time do the shows start?" - "How much are tickets and what's included?" - "How do we get there, can we book online?" These are query-path hypotheses, to validate with fuller keyword + PAA data in Q1.
7 of 8 ticket-query results are third-party or spam
| # | Result | Who profits |
|---|---|---|
| 1 | chiangmainightsafari.com/th/ (Thai page) | You - but English-speaking visitors bounce or convert via OTAs |
| 2 | Headout - "Tickets | Hotel Transfers Included" | OTA (commission) |
| 3 | Marriott Bonvoy Activities - Safari Park Ticket | OTA (commission) |
| 4–5 | Junk URLs on your own domain (/en/?/hikari-phone/ …) | Spam - brand damage |
| 6 | Tripadvisor - Night Safari Ticket (reviews) | OTA (commission) |
| 7–8 | Headout (2nd listing), AAA Tripcanvas | OTA (commission) |
The dated snapshot shows 5 third-party listings and 2 spam URLs in the top 8; only 1 result is the official site. “Third-party” includes a review/ticket listing, not necessarily a direct booking. They rank because they have the English content, structured data and review markup you currently lack. Every booking through them costs commission and hands you no customer data.
Four numbers behind the current-state gap
Search-performance proof
Competitive proof
Additional page-level evidence: /en/ canonical points to /th/; old COVID-era meta description; only Organization/WebSite/Breadcrumb structured data, with no TouristAttraction, openingHours, priceRange, FAQ or Offer; sitemap response contains a PHP warning. Dashboard screenshots above are supporting evidence; page-level counts are from the dated technical review.
02 - Why now
Travelers no longer "search and browse." They ask an AI, get one answer, and book what it recommends. The window to become that recommendation is open right now.
The shift in how people plan a night out in Chiang Mai
The new booking path
Ask ("What should we do in Chiang Mai at night with kids?") → AI answers with 2–3 named options and links → Traveler clicks a cited source → Books there. If the AI names a blog, an OTA, or a competitor instead of you, your ticket office never sees that traveler - even though you are the attraction they were asking about.
What "good enough" SEO misses
What you have today
- #1 on Google for "chiang mai night safari tickets" - but the ranking page is Thai-language, while positions #2–8 are OTAs selling your tickets in English
- Invisible in AI answers: 0 mentions across Google AI Mode and Bing Copilot for the 3 queries we tested
- Absent from page 1 of "things to do in chiang mai at night" - the discovery query that fills buses
- Indexed spam and junk URLs sitting next to your brand name in Google
What "chosen by AI" looks like
- AI answers name Night Safari first and cite your pages, not a blog or an OTA
- Every question - tickets, prices, hours, zones, how to get there - answered on your domain with structured data AI can lift directly
- English content that matches the Western traveler's questions, ranking for discovery queries, not just brand queries
- A clean, safe brand footprint in Google and in the knowledge graphs AI systems read
03 - One strategy
AIO, GEO, AEO are marketed as three products. Underneath they are one job: make your entity the most citable, most trustworthy answer in your category.
The unified thesis
AI engines choose entities.
We make Chiang Mai Night Safari the entity AI cannot skip.
🧩 Entity
One consistent, well-described "Chiang Mai Night Safari" across your site, Google Business Profile, Wikidata, press, and socials - so AI systems store confident facts about you (government nature park, world's third nocturnal zoo, zones, shows, ticket types).
📄 Evidence
AI cites what it can verify. Every claim it repeats about you should trace back to a page you own - prices, hours, showtimes, FAQs - in clean, extractable form.
🔁 Repetition
Answers are built from patterns. The same facts, stated consistently across your pages and third-party mentions, raise AI confidence until you become the default answer.
Old SEO vs Modern SEO
| Dimension | Old SEO | Modern (AIO · GEO · AEO) |
|---|---|---|
| Goal | Rank in the top 10 links | Be the named answer + the cited source |
| Unit of work | Pages & keywords | Entities, facts & question coverage |
| Content shape | Long-form prose, keyword density | Direct answers, tables, FAQ, schema markup |
| Success metric | Position, clicks | AI mentions, citations, assisted bookings |
| Competitors | Other websites | Other websites plus OTAs, blogs & Reddit threads that AI trusts more than you |
| Risk of doing nothing | Slow traffic decline | The AI answer hardens around other sources - retraining perception costs far more later |
04 - The 3 pillars
Three workstreams, one team, one reporting line - each fixing a different part of the same problem we found in your audit.
AIO - Artificial Intelligence Optimization
What we do
- Track 80 prompts travelers actually ask ("what to do in Chiang Mai at night", "night safari worth it", "chiang mai with kids") across 5 AI channels, monthly
- Engineer pages to be extraction-friendly: direct answer first, supporting detail second, tables & lists AI can lift verbatim
- Build citation sources AI systems trust: press, travel media, data mentions
- Fix the entity layer: Wikidata, knowledge panels, consistent facts everywhere
Why it matters for you
Our 12 Nov 2026 spot-check: 0 mentions, 0 citations for Chiang Mai Night Safari in Google AI Mode and Bing Copilot answers - while those answers recommended other attractions, tours and OTAs for queries about you.
Every AI-recommended alternative is a ticket sale that bypassed your counter and your margin.
GEO - Generative Engine Optimization
What we do
- Content strategy in Core / Outer rings (see Section 04): Core answers every question about visiting you; Outer owns "Chiang Mai at night" discovery topics
- 20-article English content engine in year one, each targeting a real query with FAQ blocks, tables, prices, hours
- Schema markup (TouristAttraction, FAQPage, Offer, Event) so machines read your facts, not guess them
- Digital PR & backlinks (10–15/quarter) from travel publishers AI systems treat as authorities
Why it matters for you
Your English homepage today is the Thai homepage (identical bytes, canonical pointing to /th/). There is effectively no English content layer for Google or AI to quote - which is why blogs like cktravels.com and OTAs answer questions about your own attraction instead of you.
AEO - Answer Engine Optimization
What we do
- Question inventory: map every question travelers ask about you (tickets, price, rain, kids, animals, transport, hours, safety) from PAA, Reddit, reviews, AI answers
- One canonical answer per question on your domain, formatted to be lifted: 40–60 word direct answer, then depth
- Google Business Profile optimization + review strategy so the knowledge panel feeds AI correctly
- Cross-platform consistency: same facts on website, GBP, Facebook, Tripadvisor, booking engines
Why it matters for you
Right now the definitive English answers to "Chiang Mai Night Safari" questions live on Headout, Tripadvisor, Marriott Activities and travel blogs. They define your prices, your zones, your reputation - and they monetize the traffic. AEO takes that role back.
How the three pillars work together
Listen & measure
Tracks what AI says about the category, which sources it cites, and where you appear (or don't). Sets the targets.
Build the substance
Creates the English content + structured data + authority links that give AI something worth citing.
Shape the answer
Formats facts into extractable answers and keeps every platform consistent, so AI repeats your version.
The flywheel: AIO finds the gaps → GEO fills them with citable content → AEO converts facts into answers → AI citations rise → AIO measures lift → next cycle targets the remaining gaps. One team, one dashboard, monthly.
05 - The plan
Fix the foundation fast, publish the content engine, earn the citations, compound quarter over quarter.
4-quarter roadmap
Q1 · Fix & Foundation
- Brand-safety remediation: spam removal, disavow, plugin/sitemap fix (weeks 1–2)
- Security sprint: verify + patch ticket-site WordPress (CVE-2026-119977), admin/MFA/backup review, log check
- Titles, metas, canonicals, hreflang, H1 cleanup
- TouristAttraction + FAQ + Offer + Event schema
- GBP optimization; GSC/GA4 setup (with your IT)
- AI-prompt tracking baseline (80 prompts)
- Core articles 1–6 live
Q2 · Build & Publish
- Core articles 7–10 + Outer 11–14
- Entity work: Wikidata, consistent NAP across platforms
- First digital-PR wave (5–8 travel publishers)
- English ticket-funnel page optimization (direct booking path)
- First AI-visibility re-measurement vs baseline
Q3 · Expand & Earn
- Outer articles 15–20
- ZH/JA localization of top-performing pages
- Backlinks 10–15; festival-season content push (Yi Peng)
- Reddit/forum monitoring & earned-mention program
- Answer-engine iteration from tracked-prompt data
Q4 · Compound
- Refresh + expand winners; retire dead weight
- Second market push (AR/KO per your declared hreflang)
- Annual AI-visibility report vs Q1 baseline
- Strategy reset with sales & PR team for year 2
What we measure & report
🤖 AI visibility
- Mentions & citations across tracked prompts (Google AI Mode/Overviews, Copilot, ChatGPT-class engines)
- Share-of-answer vs OTAs & blogs
- Sentiment & fact accuracy of what AI says about you
🔎 Search
- Rankings for 80 keywords (EN core + discovery)
- Impressions & clicks on new content (GSC once connected)
- Brand-SERP cleanliness score
🎟️ Business
- Organic sessions to ticket funnel
- Direct-booking referrals from content pages
- Cited-source traffic (visitors arriving from AI answers)
Reporting cadence: monthly dashboard + quarterly strategy review with your sales & PR team. All numbers labeled by source (platform tracking vs SERP spot-check vs client-supplied) - we never blend measurement types.
Content strategy: Core and Outer
🎯 Core ring - "about visiting Night Safari"
High-intent questions from people who already know you. These pages take the click back from OTAs and feed AI the canonical facts.
- Tickets, prices, zones, what's included
- Day vs Night safari, showtimes
- Getting there, opening hours, rain policy
- Family/ accessibility/ facilities guides
🌏 Outer ring - "about Chiang Mai at night"
Discovery content that puts Night Safari inside the answers for category queries you currently don't rank for at all.
- "Things to do in Chiang Mai at night"
- Itineraries, family attractions, festivals
- Area guides (Hang Dong / Mae Hia)
- Ethical wildlife & conservation stories - your unique authority as a government nature park
Language priority: English first (Western focus per brief), then Thai refresh of key pages, then Chinese/Japanese expansion in Q3–Q4 matching your declared hreflang markets. Every article ships with FAQ block + schema.
20-article content plan - ready to write (1/2)
20-article content plan - ready to write (2/2)
Sequenced so Core 1–6 ship first (they defend the money queries), Outer follows to capture discovery. Each piece internally links to your ticket booking system - ticket.chiangmainightsafari.com - keeping the commission in-house.
Where Western travelers actually research Chiang Mai
🤖 AI assistants
Google AI Mode/Overviews, ChatGPT, Copilot. Cite blogs + OTAs when the attraction has no English content. Your biggest gap.
r/ThailandTourism, r/chiangmai threads rank top-3 for "night" queries and are quoted by AI answers. Worth monitoring & earning honest mentions.
🧳 OTAs & review sites
Tripadvisor, Headout, GetYourGuide, Marriott Activities. They own the transactional SERP with English pages + reviews + schema.
✍️ Travel blogs
cktravels.com, mychiangmaitour.com, asocialnomad, trip.com toplists. Currently the "trusted voice" AI cites for discovery queries.
The strategy: we don't fight these channels one by one - we make your domain the source they (and the AIs) quote. Consistent facts + schema + authoritative content flips the citation flow back to you, while GBP/review optimization keeps the panels accurate.
Why TBS Marketing
🇹🇭 Based in Thailand, working globally
Bangkok-based team working in EN/TH markets daily. We understand both Western traveler behavior and Thai digital ecosystems - including government-affiliated organizations' procurement and approval workflows.
🔬 Evidence-first
Every claim in this deck comes from a dated, reproducible audit (SERP snapshots, AI-engine spot-checks, on-page extraction). You can verify each finding yourself - we'll show you how in the kickoff.
🧠 AEO specialists since before it was a buzzword
TBS focuses on SEO/AEO and information-retrieval systems: how AI engines discover, trust and repeat facts about entities. We run this exact playbook for hospitality and education clients across Thailand and Europe.
📦 One team, full stack
Strategy, content production (in-house writers + editors), technical SEO, digital PR and AI tracking under one contract and one dashboard - no agency-of-agencies telephone game.
Next steps
1 · This week (free)
We hand over the brand-safety evidence pack (spam URLs, indexed titles, broken sitemap, WordPress version exposure + CVE advisory) so your web team can start cleanup immediately - whether or not we work together.
2 · Kickoff call
45 minutes with sales, PR and IT: confirm scope, package, access needs (GSC/GA4, CMS, GBP), and procurement path. We adapt documentation for government-agency purchasing if required.
3 · Start within 2 weeks
Q1 begins: remediation + technical foundation + first 2 Core articles. First AI-visibility baseline report delivered by end of month 1.
The spam under your domain - and a vulnerable ticket site - are live right now.
Whatever else you decide, both should be fixed this month. Ask us for the evidence pack - it's yours either way.