Can AI Agents Actually Use Your Website? Here's How to Check

For twenty years the question every business owner asked was: will Google show me? That question is quietly being replaced by a different one: can an AI agent even use my site?

The shift is not theoretical. AI assistants are already browsing, comparing, and in some cases checking out on behalf of the people who use them. Accenture's 2026 Consumer Pulse Research, a survey of more than 25,000 consumers across 16 countries, found that a striking majority would trust a personal AI agent to handle routine buying tasks on their behalf. Whether or not an agent can actually complete that task on your site depends on something most owners have never checked: whether your website is technically legible to a machine at all.

This article is about that layer, the plumbing underneath your AI visibility.
And there's now a free tool that measures it, so you don't have to guess.

The layer beneath AI visibility

There are two different things people mix up, and keeping them separate is the whole point of this piece.

AI visibility — the world of Answer Engine Optimization (AEO) and Generative Engine Optimization (GEO) — is about whether an AI names and recommends you in its answer. That's the question we covered in "Why Your Brand Is Invisible to AI." It's about reputation, mentions, and being the answer.

Agent-readiness is a different, lower layer. It asks whether an AI agent can technically access, read, and act on your website in the first place. Not whether you're recommended — whether you're even usable.

Think of it in order. Being recommended is worthless if the agent then arrives at a site it can't parse, can't navigate, and can't transact with. The readiness layer comes first because it's the floor everything else stands on. It's also the layer that is measurable and fixable today, which -as you'll see- is exactly why it's an opportunity.

What "agent-ready" actually means

In April 2026, Cloudflare launched a free scanner called Is It Agent Ready that checks any website against the emerging standards agents use to understand a site. It groups its checks into five categories. Here's what each one means in plain language, and more importantly, why an agent cares.

Discoverability: Can an agent find its way around?

This covers your robots.txt (the file that tells bots what they can access), your sitemap (a map of every page), and Link response headers (pointers an agent reads straight from the HTTP response without parsing your HTML). If an agent can't find your content, nothing else matters.

Content accessibility. Can the agent actually read your pages cheaply?

The key check here is Markdown content negotiation, serving a clean, stripped-down markdown version of a page when an agent asks for one, instead of a heavy HTML page full of menus and scripts. Cloudflare measured that the markdown version can cut token usage by up to 80% in some cases, which makes an agent faster, cheaper, and far more likely to read your page in full rather than skim and move on.

Bot access control. Do you decide what agents can do with your content?

This is where you set AI-specific rules in robots.txt, declare Content Signals (separately allowing or blocking AI training, AI inference, and search), and optionally verify friendly bots. It's the governance layer permission, not just access.

Protocol discovery. Can an agent do something on your site, not just read it?

This covers more advanced standards, an MCP Server Card, Agent Skills, an API Catalog, OAuth discovery, that let an agent call your tools and take actions. Most small business sites don't need all of these, and that's fine.

Commerce. Can an agent pay you?

This checks for the emerging agentic-checkout standards (x402, UCP, ACP) that let an agent complete a purchase without a human typing in a card. Cloudflare currently flags these but does not count them toward your score, because they're still early — relevant mostly to e-commerce.

The honest framing: not every site needs every category. A clinic or law firm is a content-and-contact site, not an API platform, and the tool lets you scan against a content-site profile so you're measured only against what actually applies to you.

How to check your site in 30 seconds

The tool lives at isitagentready.com. It's free, requires no account, and is run by Cloudflare, the infrastructure company that already sits in front of a large share of the web.

You paste in your URL and it scans. Within seconds you get a numeric score out of 100, a level name, and a category-by-category breakdown of exactly which checks passed and which failed.

For every failed check, the tool generates a copy-paste instruction you can hand to a coding agent, Cursor, Claude Code, Windsurf, Copilot — to implement the fix. One honest caveat worth stating: those are AI-generated recommendations, and the tool itself flags that AI can make mistakes. They're a strong starting point, not a guarantee, and someone should review the changes before they ship.

What your score is telling you

One thing the tool does not do: it does not tell you whether ChatGPT recommends your brand. It measures whether your site is technically agent-ready, that's a different layer, and saying so plainly is a strength, not a weakness, because readiness is the part you can actually measure and fix.

When you read a non-100% result, sort the gaps into two piles.

The easy wins are usually in the first three categories: a proper robots.txt with AI rules, a working sitemap, and markdown content negotiation. These are configuration and response-logic changes, real work, but well-defined and shippable in days, not months. Independent testers who ran their own sites through the scanner reported moving their score meaningfully with a single small fix in this area.

The deeper items live in protocol discovery and commerce, MCP servers, API catalogs, agentic payment standards. These matter enormously for the right kind of business and barely at all for others. A live MCP endpoint with real tools is a genuine build, not a checkbox, and pretending to support a standard you don't actually run is worse than honestly declaring you don't. The goal is a score that's honest for your site type, not a vanity 100 stuffed with stubs.

Why most sites score low (and why that's the opportunity)

Most of the web is not ready, and the numbers are stark. When Cloudflare scanned the 200,000 most-visited domains, it found that while robots.txt is nearly universal, the overwhelming majority are written for old-school search crawlers, not AI agents. Only around 4% of sites had declared their AI usage preferences, and markdown content negotiation passed on fewer than 4% of sites. The newest standards (MCP Server Cards, API Catalogs) appeared on fewer than 15 sites in the entire dataset.

That is not a problem. That is a window.

Early adoption of a new web standard has paid off before, sites that took search-engine optimization seriously in its early years spent a decade ahead of competitors who waited. Agent-readiness is at that same embryonic stage right now. Being one of the first sites in your city or your industry that an agent can cleanly read, navigate, and trust is a lead that's genuinely hard to buy later, because it compounds. The businesses moving now are competing against a field that is, for the most part, invisible to agents entirely.

For transparency: NovallyAI scored 100/100 on this exact tool against a content-site profile for novallyai.com, with a DNS-based AI discovery record, markdown-negotiation middleware, and an llms.txt file all in place.

We didn't chase the number with stubs; we implemented the standards that a content-and-services site should actually run. That's the practical target for a clinic, a law firm, or a real-estate business, not a perfect score on paper, but a clean, honest, fully-readable site.

Where to go from here

If you've run the scan and you're sitting at less than 100% for your site type, that gap is exactly the kind of thing we fix. NovallyAI offers a free 30-minute AI Visibility audit where we'll look at your agent-readiness score, sort your gaps into quick wins versus real builds, and tell you plainly what's worth doing and what isn't — no sales pitch, no obligation. If nothing else, you'll leave knowing precisely where your site stands in the machine-read web. Reach out on WhatsApp and we'll take a look together.