AI agent readiness self-check: 18 questions for your business

Has someone in your business deliberately decided which AI crawlers and assistants your robots.txt file allows, rather than leaving the default?

robots.txt is the first file most crawlers read. It is a request, not a lock, but it is where you state your position.

Has anyone checked in the last six months whether your CDN, firewall or bot protection blocks AI crawlers or AI assistants?

Cloudflare and Vercel both offer rules for AI bots. A setting switched on for one reason can turn away agents you want.

Do you publish an up-to-date sitemap that lists the pages you most want found?

A sitemap is the simplest map of your site for any automated visitor.

Have you decided whether to publish an llms.txt file, a short guide to your site written for language models?

llms.txt is a proposed format, revised to version 2 in August 2026. Deciding yes or not yet both count; not knowing does not.

Do your key pages (products, services, prices, policies) show their main text without needing JavaScript to run in the visitor's browser?

Many automated readers do not run JavaScript. If the text arrives only after scripts run, they may see an empty page.

Are prices, availability, opening hours and delivery or cancellation terms written as text on the page, not only inside images, PDFs or pop-ups?

An agent that cannot read a price or a policy cannot compare it or act on it.

Do your product, event, offer or article pages carry structured data (for example Schema.org markup in JSON-LD)?

Structured data states facts such as price and availability in a form machines read directly.

Can your site give a clean text or markdown version of a page to an agent that asks for one?

Cloudflare, for example, can convert pages to markdown at the edge when a client asks for it.

Can the main task on your site (buy, book, subscribe or request a quote) be completed with standard web forms and buttons, without a CAPTCHA at every step?

Agents working in a browser use the same forms people do. Custom widgets and repeated challenges are where they stall.

Do your forms have clear labels and error messages that say what went wrong and how to fix it?

Clear labels help people and agents alike. An unexplained error ends the task.

Do you offer a documented API, an MCP server or WebMCP tools for your main tasks?

These give agents a direct, described way to act instead of clicking through pages.

Can a customer complete the main task as a guest, or sign in with a standard login flow such as OAuth rather than a custom one?

Agents acting for a person need a login flow they can recognise and a person can approve.

Is the full price, including taxes, fees and delivery, shown before the final step?

An agent comparing options on a customer's behalf needs the total, not a starting price.

Has your payments or fraud team agreed how to treat a purchase or booking that an AI agent starts for a customer?

Fraud tools built to block automation may decline a legitimate agent. Someone needs to own that decision.

Has anyone in your business looked at agent payment approaches such as x402, ACP, UCP or MPP, even just to decide not yet?

Cloudflare's Is It Agent Ready scanner lists these under commerce. Knowing they exist is enough for this question.

Can your team tell verified bots and agents (for example through Web Bot Auth signatures or a verified bot directory) apart from unknown automation?

Verification lets you welcome known agents without opening the door to every script.

Are your returns, cancellation, privacy and terms pages public, current and readable without logging in?

Agents and the people behind them check the rules before committing.

Is there a named person in your business who owns how AI agents are treated on your site?

Most of these questions cross marketing, ecommerce, security and engineering. Without an owner, nobody decides.