Cloudflare's Agent Readiness score for retailers: what it tests and what it misses

Direct answer: Cloudflare's Agent Readiness score is a free scanner (isitagentready.com, launched 17 April 2026) that checks whether a website has published 23 agent-facing standards and gives it a level from 0 to 5. It is a good developer checklist, but it does not test whether an AI agent can read your prices, get past your firewall or reach your checkout. On 24 October 2026 we ran the 212 retailers in our Agent Commerce Index that the scanner could read through it: 207 landed on Level 1, five on Level 0 and none higher, while the same stores' Agent Conversion Scores ran from 20 to 85. Use the few checks that touch shopping, treat the rest as optional, and test the things the score leaves out.

Last verified: 24 October 2026. The tool and its standards are changing quickly, so every fact below names its source.

What the tool is

Cloudflare introduced the Agent Readiness score on 17 April 2026. You enter a URL at isitagentready.com, Cloudflare requests the site's public files and headers, and the tool reports which standards the site supports, with a copy-and-paste prompt for a coding agent for each failing check. Cloudflare also added the same checks as an Agent Readiness tab in its URL Scanner, and a "Adoption of AI agent standards" chart to Cloudflare Radar covering the top 200,000 domains (after removing categories such as redirects and ad servers).

At launch, Cloudflare reported that 78% of those sites had a robots.txt file, 4% had declared AI usage preferences with Content Signals, 3.9% could serve Markdown on request, and MCP Server Cards and API Catalogs together appeared on fewer than 15 sites. Those are April figures for the whole web, not for retailers. Radar updates the chart weekly.

The tool's own documentation (read 24 October 2026) lists 23 checks in five categories:

It does not check llms.txt by default. Cloudflare says that check can be switched on in a custom scan.

How the levels work

The level is a ladder, defined in the tool's documentation:

Two things follow from that.

1. Content Signals is a gate. Without a Content-Signal line in robots.txt, a site cannot rise above Level 1, however many later checks it passes. Our own site, scanned on 24 October 2026, is on Level 1 for exactly this reason.
2. No commerce check is in any level. Cloudflare's launch post says the commerce checks "do not currently count towards the score". The tool's documentation says they are only scored for sites with detected e-commerce signals, but its level definitions list none of them. The two descriptions differ, so read the UCP and ACP results as a separate readout, not as part of the level.

What 212 retailers scored

Cloudflare's tool measures adoption of standards across the whole web. We wanted to see what it says about shops, so we sent the URL of every retailer in the Agent Commerce Index Q4 2026 to Cloudflare's public scan API.

Method. The Index lists 240 UK and US online retailers, of which 225 were scored (the data is published under CC BY 4.0). We scanned all 240 between 10:21 and 10:31 on 24 October 2026 (Europe/Gibraltar time). The scanner returned results for 222 and a site error for 18. Of the 222, 212 are among the 225 scored retailers, and those 212 are the sample below. Agent Conversion Scores come from the Index published on 19 October 2026 (specification v0.5). This is a one-off snapshot: scanner results can change between runs, and we do not publish results for individual stores.

Selected check results across the 212:

What this tells a retailer:

• The level barely separates stores. A store with an Agent Conversion Score of 85 and one with 24 both sit on Level 1. The level was built to track standards adoption, and at the moment almost nobody in retail has adopted the Level 2 gate.
• Passing is not the same as being open. In the Index, 8 of the 116 stores we could basket-test let a page-fetching agent reach checkout, against 96 of 116 for an agent that browses like a person. Nothing in Cloudflare's 23 checks measures that difference.
• The commerce readout is useful but partial. Cloudflare's scanner found a UCP profile on more than half of the sample and no ACP discovery document on any. Our Index agrees on ACP: the check for an ACP discovery document or ACP product feed (TRX-05) failed for all 225 scored retailers.

What the score does not test

Going by the 23 documented checks, the tool does not:

• request product pages as an AI crawler or assistant would, so a firewall that returns 403 to agents is invisible to it (our check ACC-10);
• read Product and Offer structured data, or compare the structured price with the price on the page (LEG-01 to LEG-05, OFF-01);
• look for shipping and returns terms (OFF-04, OFF-06) or policy pages (LEG-09, LEG-10);
• reach a cart, test guest checkout or look for a captcha (TRX-01 to TRX-03, TRX-10);
• ask an AI assistant whether it recommends the store.

None of this is a criticism of the tool. Cloudflare describes it as a way for site owners to adopt agent standards, in the way Lighthouse guides them towards web platform standards, and it does that. The risk is reading a level as a verdict on whether agents can buy from you.

Check by check: what a retailer should do

The right-hand column is our view, not Cloudflare's. It rests on what each check does, not on a claim about how any particular agent behaves.

Web Bot Auth: the retailer's side

Cloudflare's check looks for a key directory on your own site, which only matters if your site sends automated requests. A retailer's more likely contact with Web Bot Auth is the other direction. Since 7 May 2026, Shopify applies stricter rate limits to bots and agents that reach the Storefront API and Shopify-hosted store pages without signing their requests, and says operators should sign them with Web Bot Auth. Shopify merchants who crawl their own stores can also create ready-made signatures in the Shopify admin. If you run your own CDN or firewall rules, check how they treat signed agent traffic.

Content Signals: decide before you declare

Content Signals is Cloudflare's way of stating, in robots.txt, how automated systems may use your content after they fetch it. It defines three categories:

• search: building a search index and returning links and short excerpts (not AI-generated summaries);
• ai-input: using content as input to an AI model, including retrieval and grounding for generated answers;
• ai-train: training or fine-tuning models.

An example line is Content-Signal: ai-train=no, search=yes, ai-input=yes. If you leave a signal out, you have neither granted nor restricted that use. contentsignals.org is clear that these are preferences: robots.txt does not stop a crawler operator from taking content, and some may ignore it. The policy text it adds also states that restrictions are an express reservation of rights under Article 4 of EU Directive 2019/790. That is a legal matter, so take legal advice before relying on it.

For a retailer the practical question is ai-input. If you want assistants to read your product pages when they answer shoppers' questions, a line that says ai-input=no works against that. If you use Cloudflare's managed robots.txt, check what it adds: it prepends directives built from the AI bot policies you set, plus the Content Signals Policy text. Cloudflare says that text defines the categories and does not by itself express any preference.

Markdown for Agents: one switch, a few things to know

If your store is behind Cloudflare on a Pro, Business or Enterprise plan, Markdown for Agents (documentation updated 9 October 2026) converts your HTML to Markdown when a client sends Accept: text/markdown, at no extra cost. Before you enable it:

• Set your own Content-Signal header. If your origin does not send one, the converted response carries Content-Signal: ai-train=yes, search=yes, ai-input=yes. Cloudflare keeps your header if you set one.
• Product data has to survive conversion. The conversion removes headers, footers and navigation, and keeps JSON-LD in a code block at the end. Product JSON-LD is the part of your structured data that carries through, so check it is present and correct first.
• Few agents ask for it. Cloudflare found in February 2026 that, of seven agents tested, only Claude Code, OpenCode and Cursor sent Accept: text/markdown by default. Those are coding tools, not shopping agents, and the figure may have changed.

A sensible order of work

1. Check access first. Make sure product pages, the cart and checkout answer AI crawler and assistant identities with a normal page, not a 403, a 429 or a challenge. The Cloudflare score cannot show you this.
2. Make the offer readable. Server-rendered product name and price, Product and Offer JSON-LD with a numeric price and currency, and a structured price that matches the page.
3. Write a deliberate robots.txt. Name the AI crawlers and assistants you allow, list product URLs in the sitemap, and add a Content-Signal line that reflects your decision.
4. Publish commerce discovery documents where your platform and payment provider support them: a UCP profile, and ACP discovery if you use ChatGPT checkout. The Hosted Agent Layer is our build for stores that want this done for them.
5. Test the purchase path. The Simulated Agent Buyer tries your basket and checkout as an agent would and reports where it stops.
6. Then, if you have the engineering time, consider Markdown negotiation, WebMCP tools or an MCP server. Skip the API and authentication discovery checks unless you run an API.

How to run it and read the result

• Open isitagentready.com and enter your homepage, or use the Agent Readiness tab in Cloudflare's URL Scanner.
• From a terminal: curl -X POST https://isitagentready.com/api/scan -H "content-type: application/json" -d '{"url":"https://your-store.example"}'. Adding "format":"agent" returns Markdown fix instructions meant for a coding agent.
• Read any generated fix before it goes near your robots.txt, headers or checkout. A change that adds a point to the level can still block the crawlers you want.
• Treat each run as a snapshot. Run it again after a change to robots.txt, headers or your CDN settings.

How it fits with the Agent Conversion Score

The two tools answer different questions. Our comparison of agent-readiness tools covers the wider field; the difference with Cloudflare's is this:

The free score takes about a minute. If a level or a score leaves you unsure what to fix first, get in touch.

Sources

• Cloudflare, Introducing the Agent Readiness score, 17 April 2026
• Cloudflare, isitagentready.com documentation, read 24 October 2026
• Cloudflare Radar, AI Insights: adoption of AI agent standards
• Cloudflare docs, Markdown for Agents, last updated 9 October 2026
• Cloudflare docs, robots.txt setting (managed robots.txt)
• contentsignals.org, read 24 October 2026
• Shopify, Bots and agents should identify themselves via Web Bot Auth, 7 May 2026
• ConversionVector, Agent Commerce Index Q4 2026 (CC BY 4.0), and our scans of its retailers through Cloudflare's scan API, 24 October 2026