Agent readiness for Shopify stores: what you control

Shopify does a lot of agent readiness work for you, and more of it each release. But your theme, your apps and a handful of settings still decide whether an AI agent can read your products and get to checkout. This guide sets out what Shopify handles, what you control, and what to check, based on Shopify's own documentation.

What Shopify handles for you

According to Shopify's documentation, every store gets these without any work from you:

• A sitemap, generated automatically at /sitemap.xml and updated when you add products, collections, pages or blog posts.
• A default robots.txt that Shopify describes as optimal for SEO. It blocks pages such as admin, cart, checkout, account and filtered collection pages.
• Bot protection through Cloudflare, which Shopify says is always active and requires no action from you.
• An agents.md file at /agents.md, which /llms.txt and /llms-full.txt mirror by default.
• WebMCP tools that Shopify says it provides on every Liquid storefront, for agents running in a shopper's browser. WebMCP is a proposed web standard, and Shopify notes agent support is currently limited to Chromium-based browsers.
• Agentic storefronts, which Shopify says are active by default for eligible stores (more below).

That's a strong starting point. In our study of 255 stores (all platforms, not just Shopify), 49% published an llms.txt file and 27% published an agentic checkout profile. What's left for you is mostly in your theme and settings.

• Shopify Sitemap, default robots.txt, Cloudflare, agents.md, WebMCP tools
• Your theme Structured data, buttons, pop-ups, variant pickers
• Your apps Anything they add to pages or remove from HTML
• Your settings Sign-in at checkout, CAPTCHAs, agentic channels

robots.txt and llms.txt

You can change robots.txt by adding a robots.txt.liquid template to your theme. Shopify's help center calls this an unsupported customization and warns that incorrect use "can result in loss of all traffic". It recommends adding or removing rules with Liquid on top of the defaults, rather than replacing the file with plain text, so Shopify can keep updating it.

Two things to check:

• Has anyone added rules for AI agents? Open /robots.txt on your store and look for Disallow rules naming assistants or AI search agents, such as ChatGPT-User, Claude-User or OAI-SearchBot. Blocking training crawlers is a business choice; blocking assistants keeps you out of their answers. See robots.txt for AI agents.
• Is the template out of date? Shopify notes that an older template can output rules the current default no longer has.

The default rules that keep crawlers out of the cart and checkout don't cost you in AgentScore: its key pages check looks at robots.txt rules for product and pricing pages, not the cart.

For llms.txt, Shopify lets you add an agents.md.liquid template, or a dedicated llms.txt.liquid that affects only /llms.txt. Adding one replaces Shopify's managed default at that address. If you do, Shopify advises using the template's agents object for its UCP and MCP endpoints rather than hardcoding them, so they stay current. Read what your store serves at /llms.txt today before deciding whether to customize it. See how to write an llms.txt file.

Your theme and apps

Your theme builds every product page, so it decides most of what an agent can read and use.

• Structured data. Liquid has a structured_data filter that turns a product into schema.org JSON-LD: a Product, or a ProductGroup for a product with variants. Check whether your product template uses it, or outputs its own data, and that price, currency and availability are there. See product data AI shopping agents can read.
• Prices and stock in the HTML. Apps that change prices, currencies or stock badges with JavaScript can leave the HTML saying one thing and the page another.
• Named buttons. Icon-only cart, search and menu buttons need a text label. In our store study, 58% of stores had buttons or links with no name an agent can read.
• Pop-ups. Email capture, spin-to-win and region apps often cover the page on arrival. Each needs a close button with a clear label.
• Variant pickers and add to cart. Swatches that only work on hover, or an add-to-cart button disabled until a size is picked with no clear way to pick it, stop agents.

Re-scan after you install or update an app or theme. Theme updates are where these regressions usually come from.

Bot protection, CAPTCHAs and sign-in

A few Shopify settings put challenges in an agent's way. All are worth knowing about:

Setting	What Shopify's docs say	What to check
Spam protection (hCaptcha)	On by default for contact, newsletter and comment forms, and for legacy customer account login, account creation and password recovery pages. Toggled in Online Store > Preferences.	Fine for forms and sign-in. Make sure shoppers never need those pages to buy.
Checkout bot protection	Shopify Plus only, activated through Plus Support, for events of up to 60 minutes, with a reCAPTCHA or hCaptcha challenge.	Only schedule it for genuine high-demand drops, since agents can't pass it.
Require sign-in before checkout	A setting in Settings > Checkout. When it's on, accelerated checkout options such as Apple Pay aren't shown in the cart.	Leave it off unless you truly need accounts. Agents can't create one for a shopper. See guest checkout.
Private mode	Asks visitors for a password before they can see the store. Set in the Store access section of Preferences.	Make sure it's off once you launch.

If you run your own CDN or bot product in front of Shopify, it adds a second place an agent can be stopped. For the vendor side, see questions to ask your CDN or bot protection vendor.

Agentic storefronts and protocols

Shopify's agentic storefronts let customers find and buy your products in AI channels, which Shopify lists as including ChatGPT, Google AI Mode and Gemini, Microsoft Copilot, and Meta. Products reach those channels through Shopify Catalog, or, for Google AI Mode and Gemini, through the Google & YouTube sales channel or Google Merchant Center. You manage channels under Sales channels > Agentic in your admin. Shopify's requirements page describes ChatGPT as discovery-focused, with purchases finishing on your online store checkout, while other channels support direct checkout if you activate it.

Shopify's data and privacy page says you can turn off a channel's access to Shopify Catalog, and that AI channels can still reach your product information through web crawling, which "might not always be as complete, accurate, or up-to-date". So even if you sell through these channels, your website still needs to be readable.

For developers, Shopify's docs describe the Universal Commerce Protocol business profile at the merchant storefront, {shop}.myshopify.com/.well-known/ucp. AgentScore's agentic commerce check requests /.well-known/ucp on the address you scan, so open that path on your own domain to see whether it's served there too. See agentic commerce protocols explained.

Even if you sell through AI channels, agents still read your website. Your theme still matters.

Where to start

• robots.txt No rules blocking AI assistants or AI search agents.
• Checkout "Require sign-in before checkout" off, unless you need it.
• Theme Product structured data with price, currency and availability.
• Buttons and pop-ups Named buttons, closable pop-ups.
• Agentic channels Reviewed in Sales channels > Agentic.

1. Run AgentScore on your store. It finds a product page and your cart, and when the checkout only shows its form with something in the cart, it adds one item first. It never fills in or submits a form.
2. Fix what the report finds in your theme first: buttons, pop-ups and product data.
3. Review the settings in the table above, and your agentic channels.
4. Send a Ghost Agent from a product page to checkout. It stops before payment and shows each step.
5. Re-scan after every theme update or new app.

Shopify's agent features are changing quickly, so check its documentation for the current state, and keep our questions for your e-commerce platform handy for your account manager.