Is Your Website Ready for AI Shopping Agents? A 2026 Web Development Checklist

A new kind of visitor is showing up on your website

For the last two decades, "website traffic" meant two things: human visitors and search engine crawlers. In 2026, there's a third category, and it's growing fast — AI agents that browse, compare, and in some cases buy on behalf of a person who never actually looked at your site themselves.

ChatGPT can now complete purchases through a feature called Instant Checkout. Google is rolling out agentic shopping inside AI Mode and Gemini. Perplexity's Comet browser and a growing list of "computer use" agents can click through a site, fill out a form, or complete a booking with no human watching the screen. None of this is science fiction anymore — it's live, and it's already sending traffic to small business sites that aren't built to handle it.

This isn't another post about ranking in AI search results (we've covered generative engine optimization and llms.txt files elsewhere). This is about something more fundamental: whether your website's actual code and infrastructure can be understood, navigated, and transacted with by a machine. If an agent lands on your site and can't figure out what you sell, can't find your hours, or can't complete a booking form, it doesn't ask for help — it just leaves and recommends a competitor instead.

Here's what's actually changing under the hood, and what a small or mid-sized business website needs to do about it this year.

What's actually new: agents aren't just reading, they're acting

Search engine crawlers have indexed websites for 25+ years. What's different now is that AI agents don't stop at reading — they take action. A few protocols are driving this shift, and it's worth understanding them at a basic level:

• Agentic Commerce Protocol (ACP) — built by OpenAI and Stripe, it lets ChatGPT complete a purchase on a merchant's behalf without the shopper leaving the chat window.
• Universal Commerce Protocol / agentic shopping in AI Mode — Google's approach to letting Gemini and AI Mode research products and move a shopper toward checkout.
• Model Context Protocol (MCP) — a broader standard that lets AI tools connect to live data sources and APIs, increasingly used to let agents query business information (inventory, availability, pricing) directly instead of scraping a web page.
• "Computer use" browser agents — tools like Perplexity's Comet or similar agent browsers that don't use an API at all. They open your site like a human would, read the rendered page, and click buttons.

That last category matters most for small businesses, because it means your site needs to work for a visitor that can't ask you a clarifying question, doesn't scroll out of curiosity, and gives up the moment something looks broken or ambiguous.

Why most small business sites aren't ready

None of this requires a rebuild from scratch, but it does expose some common shortcuts that were harmless when only humans and search bots visited a site:

1. Content locked inside heavy JavaScript

If your product details, pricing, or booking availability only appear after a bundle of JavaScript runs — and runs correctly, in the right order, every time — a browser agent may render a blank or partial page. Human visitors wait a beat and don't notice; an agent attempting to extract structured information often just fails silently.

2. No structured data on key pages

Schema.org markup (Product, LocalBusiness, Service, FAQPage, Offer) used to be a "nice to have" for rich search snippets. Now it's closer to an API. It tells an agent — unambiguously — what you sell, what it costs, whether it's in stock, and where you're located, without the agent having to guess from paragraph text.

3. Forms built for mouse-and-keyboard assumptions only

Booking widgets, quote forms, and checkout flows that rely on obscure custom dropdowns, CAPTCHA with no accessible fallback, or multi-step flows with unclear labels can quietly block an agent (and, worth noting, also frustrate human visitors using assistive technology — the overlap with accessibility best practices is not a coincidence).

4. Robots.txt rules written for a different era

Plenty of sites block "unknown" or aggressive-looking bots by default. That's reasonable for scrapers, but if the rule is broad enough to also block legitimate agent traffic from the services your future customers are actually using, you're turning away business without realizing it.

5. No clean, authoritative source of truth

If your hours, pricing, or service area are stated differently on your homepage, your Google Business Profile, and a third-party directory, a human eventually sorts out the discrepancy. An agent making a quick decision often just picks whichever source it found first — and it might be wrong.

The practical test is simple: if you stripped the images and styling off your site and handed the raw HTML to someone who'd never seen your business, could they tell you what you sell, what it costs, and how to buy it — in under 10 seconds? That's roughly the bar an agent is working with.

A practical readiness checklist

Make your core content readable without JavaScript

You don't need to abandon your framework of choice, but critical information — product names, prices, service descriptions, contact details, hours — should be present in the server-rendered HTML, not injected only after client-side scripts execute. Server-side rendering (SSR) or static generation for these specific pages solves this without a full platform migration. If you're not sure whether your site passes this test, view your page's source code directly (not the browser's rendered DOM) and see what's actually there.

Add structured data to every page that matters

At minimum:

• LocalBusiness schema on your homepage and contact page, with accurate address, hours, and phone number
• Product or Offer schema on anything with a price, including availability status
• Service schema for service-based businesses, describing what's offered and the area served
• FAQPage schema anywhere you already answer common customer questions

This is a few hours of focused work for a developer, and it pays off in regular search results too — it's not an either/or with traditional SEO.

Audit your forms and checkout flow for machine-friendliness

Walk through your own booking, quote request, and checkout forms and check for standard HTML form elements with clear label tags, logical tab order, and error messages tied to the specific field that caused them. This is largely the same work as a web accessibility audit, which is a good reason to treat the two as one project rather than two.

Review — don't just set and forget — your robots.txt and bot rules

Look at what's currently being blocked at the server or CDN level (including any bot-management settings in Cloudflare or similar services). Decide deliberately which agent traffic you want to allow, rather than inheriting a default deny-list from a template or plugin. This is a conversation worth having with whoever manages your hosting or security settings, not something to guess at.

Get your information consistent everywhere

Your website, Google Business Profile, social profiles, and any marketplace or directory listing should agree on hours, pricing, and contact details. This has always mattered for customer trust; it now also matters because agents often cross-reference multiple sources to double-check before completing an action.

Consider whether an API or feed makes sense for you

If you run an online store, a structured product feed (the same kind used for Google Shopping or Meta catalogs) is increasingly being read by agentic shopping tools, not just ad platforms. If you take bookings, check whether your scheduling software exposes availability in a way that's documented and queryable, rather than only through a visual calendar widget.

What this doesn't mean

It doesn't mean redesigning your site around robots instead of people. Every change above either helps human visitors too (faster pages, clearer forms, consistent information) or is invisible to them entirely (structured data, server rendering, bot rules). It also doesn't mean you need to integrate with every new commerce protocol the moment it's announced — ACP, UCP, and similar standards are still maturing, and a small business doesn't need to be first in line. What it does mean is building on a foundation — clean HTML, accurate structured data, working forms, consistent information — that will keep working no matter which specific protocol or agent ends up winning out.

Where to start if you only do three things

• Check what your site actually looks like with JavaScript disabled or to a non-browser client, and fix any critical content that disappears.
• Add LocalBusiness and Product/Service schema to your most important pages.
• Walk your own booking or checkout flow from start to finish and fix any step that depends on a visual cue rather than clear, labeled form fields.

None of this requires predicting exactly how agentic commerce shakes out over the next few years. It just requires making sure your website is honest, structured, and functional for whoever — or whatever — shows up to read it.

If you want a developer to actually run this audit on your site rather than guessing from the outside, get in touch with Kodbee and we'll walk through it with you.