Agent readiness for WooCommerce stores: what you control

On WooCommerce, you control almost everything an AI agent meets: your theme, your plugins, your caching, your security tools and your checkout settings. That's a lot of freedom, and a lot of places for agents to get stuck. This guide covers what WooCommerce and WordPress give you, what to check, and what to change, based on their own documentation.

What WooCommerce and WordPress give you

Out of the box, according to the official documentation:

• A sitemap. Since WordPress 5.5, WordPress serves a sitemap index at /wp-sitemap.xml covering public post types and taxonomies, and references it in the robots.txt it generates.
• A generated robots.txt, which plugins and themes can change through the robots_txt filter.
• Product structured data. WooCommerce outputs product data as JSON-LD, a change it made in version 3.0.
• A guest checkout setting, in WooCommerce's Accounts and Privacy settings.
• Block-based cart and checkout, the default for new installations since WooCommerce 8.3.

Everything else depends on the theme and plugins you chose, and on your host. That's why two WooCommerce stores can score very differently in AgentScore.

• WordPress Sitemap, robots.txt, visibility settings
• WooCommerce Product data, guest checkout, cart and checkout
• Theme Buttons, pop-ups, variant pickers, markup
• Plugins and host SEO, caching, security, firewalls

Site visibility settings

Two settings can hide a live store, and both are easy to forget after launch.

• WooCommerce Coming soon mode. Set under WooCommerce > Settings > Site visibility. While it's on, visitors see a Coming soon page instead of your store. WooCommerce's documentation says new stores start in Coming soon mode after onboarding, and an "Apply to store pages only" option protects just the store pages, including Shop, Cart and Checkout. Check it says Live.
• WordPress "Discourage search engines from indexing this site". In Settings > Reading. Since WordPress 5.3 it adds a noindex,nofollow robots meta tag to your pages. Make sure it's unticked on your live site.

robots.txt, sitemaps and structured data

On many WooCommerce sites, an SEO plugin takes over some of this from WordPress. That's fine, but find out which plugin is in charge before changing anything.

• robots.txt. Open /robots.txt and look for rules naming AI assistants or AI search agents, such as ChatGPT-User, Claude-User or OAI-SearchBot. A plugin may have added rules for AI agents without anyone noticing. Blocking training crawlers is a business choice; blocking assistants keeps you out of their answers. See robots.txt for AI agents.
• Sitemap. Check that your sitemap lists your products, whichever plugin generates it.
• Structured data. View the source of a product page and confirm there's one Product block with price, currency and availability. SEO plugins often add their own, which can leave two blocks that disagree. For variable products, WooCommerce's documentation for its Google Product Feed extension notes that core outputs a single aggregated block, with a price range rather than per-variation prices. See product data AI shopping agents can read.

Also check that prices are in the HTML your server sends. Currency switchers and dynamic pricing plugins sometimes fill prices in with JavaScript, which most AI assistants never run.

Caching and security plugins

Caching. WooCommerce's developer documentation says the Cart, My Account and Checkout pages should not be cached, because they show information specific to the current customer, and lists cookies to exclude too. A cached cart or checkout can show the wrong contents or totals, so check your caching plugin and host follow this. Caching your product pages is good for agents: they load fast and arrive as complete HTML.

Security plugins and host firewalls. Many WordPress security plugins and hosting firewalls block or challenge traffic by user agent, by country, or by how "bot-like" it looks. That can catch AI assistants fetching a page for a real person. Questions to answer for each tool:

• Does it block or challenge known AI agents by name, and can you allow verified ones?
• Does it add a CAPTCHA to the cart or checkout, or only to login and comment forms?
• Does it rate limit, and does it send a 429 status rather than a block page?
• Can you see what it blocked, and why, in a log?

If your host or a CDN sits in front of WordPress, ask them the same questions. Our questions for your CDN or bot protection vendor cover them in detail.

Gets in an agent's way

• Cart and checkout cached
• CAPTCHA on every checkout
• AI agents blocked by name

Works for agents

• Product pages cached, cart and checkout live
• CAPTCHA only on login and comments
• Verified agents allowed, impostors blocked

Checkout settings

In WooCommerce > Settings > Accounts and Privacy, "Enable guest checkout" lets shoppers buy without creating an account. Turn it on unless you truly need accounts: agents can't create one for a shopper. WooCommerce notes that subscription purchases still require an account. If you offer accounts, the "After checkout" option lets buyers create one after placing an order, which keeps the account without blocking the sale. See guest checkout.

Then look at which checkout you run. Newer stores use the Checkout block; older ones may still use the classic shortcode checkout. WooCommerce asks extensions that change the cart or checkout to declare whether they're compatible with the blocks, and an extension that hasn't may behave unexpectedly. Either way, check that every field is labelled, error messages are in text, and no plugin adds a CAPTCHA to every order. In our store study, of the 94 stores whose cart or checkout form we could inspect, 71% had fields an agent can't reliably read. See how to make checkout work for AI shopping agents.

WooCommerce > Settings > Accounts and Privacy

Enable guest checkout On: agents can finish

Account creation: After checkout Accounts without the wall

Agentic commerce on WooCommerce

WooCommerce's agentic commerce page marks the Model Context Protocol as live, shipped in WooCommerce 10.3 so AI assistants can read your store's products and orders, and lists Google's Universal Commerce Protocol and Stripe's Agentic Commerce Protocol as coming soon. It says agentic checkout is coming to Stripe for WooCommerce, and suggests installing that extension now to prepare. WooCommerce's announcement of its first MCP described it as covering product and order management, which is a tool for running your store rather than a way for shopping agents to buy.

AgentScore's protocol checks look for an MCP server or WebMCP tools on your site, and a UCP profile at /.well-known/ucp. Each is worth one point, and a store without them gets a warning, not a fail, because these standards are young. Your pages are what every agent can use today, so the rest of this guide matters more. See agentic commerce protocols explained.

Where to start

1. Check Site visibility says Live, and "Discourage search engines" is unticked.
2. Run AgentScore. Its report shows which checks your theme and plugins fail, with a fix for each.
3. Turn on guest checkout, and check your caching excludes Cart, My Account and Checkout.
4. Review your security plugin and host firewall rules for AI agents.
5. Send a Ghost Agent from a product page to checkout. It stops before payment and replays each step.
6. Re-scan after plugin and theme updates.

Working with an agency on this? See how to brief your agency on agent readiness.