By Aurélien Debord ·
Key takeaways
"Agentic ready" doesn't mean "drop an
llms.txtfile at the root". The data says the opposite: 97% of those files received no requests at all, and Google states that Search ignores them.What matters comes in four layers. Let the agents in (many sites block them without knowing it). Serve complete HTML without JavaScript, because almost no AI crawler executes JS. Structure your information (schema.org, visible prices and stock, explicit answers). And, if you sell, expose a real machine interface: product feeds, MCP, agentic commerce protocols.
The first three layers are classic technical work that pays off for SEO as much as for agents. The fourth only makes sense if you have a catalogue.
Your visitors aren't all human any more. A growing share of what lands on your site is a program: a crawler training a model, an assistant fetching a live answer for its user, and increasingly an agent filling in a form, comparing two offers, or trying to place an order.
Hence the phrase that has been going around for a few months: making your site "agentic ready". The problem is that the term has already become a sales pitch, usually bundled with a miracle file to install. On the sites we audit, reality is more mundane: a site that is ready for agents is usually a technically clean site whose access nobody blocked by mistake.
Here's what to do, in order, with the 2025-2026 data on the table.
Three different things, which people tend to conflate:
Level 1 concerns everyone and can be worked on today. Level 2 is becoming real right now, with agentic browsers. Level 3 only concerns e-commerce, for the time being. Confusing the three is the surest way to pay for an "agentic" project you have no use for.
Asked in June 2026 about AI-specific files, John Mueller (Google) pointed back to the only thing that matters in his view: don't block agents. In practice, that's the main hurdle for most sites.
And it's rarely a deliberate decision. A robots.txt copied from a panicked anti-AI tutorial from 2024, a web application firewall that challenges anything without a mouse, an "under attack" mode left switched on, a CAPTCHA on the contact form: your site is closed to agents without anyone having decided so.
Except "AI bots" aren't one homogeneous group. You need to separate:
Blocking all three categories at once is the most common reflex, and the most expensive one. You protect yourself from a training vacuum cleaner, and you shut the door on real users who were asking you something.
The training debate itself is legitimate. Also according to Cloudflare (August 2025), the ratio between pages crawled and visitors sent back was 50,000 to 1 for Anthropic, 887 to 1 for OpenAI, 118 to 1 for Perplexity. They take a lot and give back little. Refusing training while allowing search and user agents is a defensible trade-off, and it's what per-user-agent robots.txt rules and bot management tools are for.
What we check on a site before anything else:
robots.txt: which user agents are refused, and is that intentional?OAI-SearchBot explains a lot.AI crawlers do not execute JavaScript. The joint Vercel and MERJ analysis, covering more than 500 million GPTBot requests, found no trace of JavaScript execution: the bot sometimes downloads JS files, but never runs them. Same behaviour for ClaudeBot and PerplexityBot. The notable exception is Google's infrastructure, which has been rendering JS for years.
So if your main content (prices, product descriptions, article text, contact details) is injected client-side after load, it doesn't exist for most AI systems. You can rank first on Google and be completely invisible in ChatGPT or Perplexity.
What to do:
<h1>, a proper heading hierarchy, <table> for tables, correct <button> and <label> elements. An agent driving a browser relies on the accessibility tree: accessibility work directly serves agents.Good news for classic WordPress sites: they are server-rendered by default. The risk comes mostly from JS-heavy themes, page builders that lazy-load content, and fully dynamic e-commerce funnels.
An agent doesn't "read" your page like a human, it extracts facts. The more explicit your facts, the less it extrapolates, and the less it gets you wrong.
Structured data (schema.org, as JSON-LD) remains the format everyone understands, classic search engines and answer engines alike. The types that matter: Organization (with sameAs pointing to your profiles), Product with offers, price, priceCurrency and availability, Article, FAQPage, LocalBusiness, Service. They must reflect what the page displays. Markup announcing a different price than the page backfires.
Facts belong in the text, in plain sight. Your prices, lead times, service area, warranty terms. A "pricing on request" page can't be compared by any agent, so you drop out of the comparison. Same for information locked inside an image or an untagged PDF.
Write answers. A section that starts by answering the question in its own heading, in two sentences, gets picked up far more easily than a paragraph circling the subject. It's the same work as quality content and writing with SEO in mind, which means you aren't working for a single channel.
Stay consistent off-site. An agent cross-checks. If your address, legal name or opening hours differ between your site, Google Business Profile and LinkedIn, it will pick one version, not necessarily the right one.
The llms.txt file has been pitched for two years as the "robots.txt of AI": a Markdown sitemap at the root, meant to guide models towards your important content. It's now the product most often sold under the "agentic ready" label, and the data doesn't back it up.
Ahrefs tracked 137,000 domains: 28% published an llms.txt, and 97% of those files received no requests at all during May 2026. For the remainder, most traffic came from audit tools, not answer engines.
On Google's side, Search ignores the file, it has no effect on rankings or AI Overviews, and John Mueller calls it "purely speculative", noting that no AI system uses it. He compares it to the meta keywords tag: a manifest self-declared by the site, and therefore useless as a trust signal.
Should you remove yours if you have one? No. It does no harm, it costs a few minutes, and nothing stops a vendor from adopting it. But it should never come before steps 1, 2 and 3, and nobody should bill it to you as a strategy.
This is the part where the standards are moving fast.
WebMCP is a proposal driven by Google and Microsoft engineers within the W3C (Web Machine Learning Community Group). Instead of letting an agent guess your interface by clicking blindly, your page declares its actions (search a product, add to cart, book a slot) with a name, a natural-language description and an input schema. The agent calls the tool instead of simulating clicks.
In practice, the page registers its tools through document.modelContext.registerTool(), and an agent running in the browser discovers them. Chrome opened a public origin trial starting with Chrome 149 (announced in May 2026), Edge ships preview support, and the API has already moved from navigator to document. It's promising, Mueller himself says he prefers this approach to declarative files, but it's neither a finished standard nor a cross-browser feature.
We'd test it on one high-value journey (search, booking, configurator) before thinking about rolling it out. Clean HTML remains the foundation, since most agents don't have WebMCP.
The Model Context Protocol (MCP) is the other end of the problem: exposing your data and operations to server-side agents, with authentication and permissions.
The WordPress ecosystem moved quickly. WooCommerce shipped a native MCP server in version 10.3 (October 2025), at /wp-json/woocommerce/mcp, then formalised canonical product and order abilities in 10.9 (June 2026), exposed through the WordPress MCP adapter. An MCP client can query and update a live catalogue.
An MCP server wired into a production store is an attack and error surface. Before opening it up, ask what a poorly briefed agent could break, then keep the scope minimal, use dedicated keys, restrict writes and log everything. This ties straight back to site maintenance and security.
If you sell online, an extra layer is taking shape: the one that lets an agent pay.
Three protocols are competing for the ground:
Nothing is settled, nobody knows which protocol will survive, and PSPs are taking different positions: Stripe, Adyen and Checkout.com cover several standards, smaller ones only cover a single one. On the WordPress side, ACP extensions for WooCommerce already exist in the official repository.
What we advise a store today is to build the foundation all the protocols need rather than bet on one of them. A clean, up-to-date catalogue, complete product attributes (price, stock, lead times, shipping costs, EAN/GTIN), a reliable product feed, a solid internal API, and a checkout that doesn't depend on a visual CAPTCHA. The day a protocol wins, integration is a thin layer on top.
One last, quieter piece of work is agent identity. A user agent can be faked in one line, which makes any access policy approximate at best.
Web Bot Auth, driven by Cloudflare at the IETF, replaces declaration with proof: HTTP message signatures (RFC 9421), one key per agent, a Signature-Agent header, a public key directory. A site can then apply a clear rule: verified agents get through, anonymous scrapers don't.
For a regular site, there's nothing to implement, it's a checkbox at your CDN. It lets you escape the "wide open or fully closed" choice, welcoming user agents while filtering the rest. It's also what already lets Cloudflare customers charge training crawlers for access.
What we actually do when a client asks us to get their site ready for agents:
This week
robots.txt and CDN bot rules; separate training, search and user agents.curl on your key pages, or inspect the raw HTML).This month
Organization, Product, Article, FAQPage, consistent with the page.This quarter
The first eight points would have been sound SEO advice in 2019. They became urgent because a growing share of your readers can't read anything but your raw HTML.
Want to know what ChatGPT, Claude or Perplexity actually see on your site, and what they can't reach? Get in touch for an audit, or take a look at our technical WordPress SEO agency and our WooCommerce agency if your catalogue is involved.
And at Madori
Lighthouse audit, JSON-LD schemas, clean hreflang. Costed audit within 5 business days. our technical WordPress SEO agency.
See our technical SEO offer →Whether you need a new site, a takeover of an existing one, or expert maintenance, we help your marketing and communications teams rely on a reliable, high-performing WordPress that's easy to manage.
Let's discuss your project →Discover our other WordPress tips
Since its inception, WordPress has established itself as one of the most popular content management systems (CMS) in the world. Offering both simplicity for novices and advanced customization for developers, this platform has evolved to meet the changing needs of the web. In a logic of flexibility and pursuit of [...]
"There has been a critical error on this website": this message replacing your homepage is a fatal PHP error. Here's how to identify it, understand where it comes from, and fix it, cause by cause.
Gutenberg has been WordPress's default editor since 2018, yet millions of sites still rely on Classic Editor. Comparison, drawbacks, and step-by-step migration guide.
How much does a business website cost in 2026? From $0 DIY to $27,500+ with an agency. Discover real prices by provider type, technology, and the recurring costs to plan for.
