Check this page with an assistantOpens a chat asking it to summarise this article and name the evidence behind each claim.
Claude opens with the prompt on your clipboard: Anthropic does not support prefilled prompts on the web, and we would rather copy it than ship a button that drops it.
What Shipped, and Why It Is Worth an Hour
Cloudflare launched the Agent Readiness Score in April 2026: a public score from 0 to 100 assessing whether a site is technically readable and usable by AI agents, backed by sixteen checks and available as a free tool anyone can point at any domain. It was added to the Cloudflare dashboard the following month.
The score is not a ranking factor and nothing about it feeds a search engine. What makes it consequential is that it is public. A number that exists and can be run against your domain by anyone will get quoted at you, usually by someone selling a service to improve it, and usually with more authority than it carries.
That is the honest reason to understand it: not to chase the number, but to be able to say accurately what it measures, which parts of it reflect something real about your site, and which parts score you against protocols your business has no use for.
The Five Layers, and Which Ones Matter Now
The checks group into layers covering discoverability, content, bot access control, capabilities, and commerce. They are not equally relevant to a given business, and treating the composite score as one number obscures that.
| Layer | What it checks | Worth acting on? |
|---|---|---|
| Discoverability | robots.txt, sitemap, Link headers for mapping content | Yes; this is basic and you should pass it, per XML sitemaps |
| Content | Whether content can be read without parsing full HTML, including markdown negotiation | Partly; readability yes, emerging formats optional |
| Bot access control | AI bot rules and content signals | Yes, and it may reveal a mismatch, per when your firewall refuses crawlers |
| Capabilities | Whether agents can discover callable functionality and authenticate | Only if you have an API worth exposing, per WebMCP |
| Commerce | Agentic payment and commerce protocol support | Only if you sell things, per agentic commerce readiness |
The bot access layer is the one most likely to surface something you did not know. A site can be carefully configured in robots.txt and still refusing crawlers at the edge, and a check that looks at access control from outside is one of the few things that surfaces that discrepancy without reading logs.
Reading a Low Score Correctly
A low score means you do not implement a set of standards one infrastructure company considers indicative of agent readiness. It does not mean agents cannot use your site, that you are invisible to assistants, or that anything is broken.
Several checks assess protocols with limited adoption. Capability discovery, agent authentication, and agentic commerce standards are genuinely emerging, and a site scoring zero on all of them may simply be a business with nothing to expose and nothing to sell to an agent. That is a correct state, scored as a deficiency.
The composite number is therefore less useful than the breakdown. A site failing discoverability checks has a real problem; a site failing only commerce checks has a category mismatch. Anyone presenting the single figure as a verdict is discarding the information that made it worth running.
What to Actually Fix
Sort the failures into things you should have anyway, things that depend on your business model, and things that are premature. Most sites will find their genuine failures are in the first group and are unglamorous.
- Fix discoverability failures immediately.
A missing or broken sitemap and a robots file that blocks more than intended are problems for ordinary search before they are problems for agents, per how search works.
- Investigate any bot access finding.
This is the highest-value output of the whole exercise, because a mismatch between your stated policy and your edge configuration is invisible from every other tool.
- Treat content readability as the real content check.
Whether meaningful content exists in the served HTML matters far more than emerging negotiation formats, and it is the same requirement as JavaScript SEO.
- Skip capability and commerce checks unless relevant.
Exposing callable functionality is a product decision with authorisation and rate-limiting consequences, not a score to improve. If there is nothing an agent should be doing on your site, failing those checks is correct.
- Do not implement standards to satisfy a checker.
Adding protocol support you have no use for creates a surface to maintain and secure in exchange for a number nobody is paying you for.
The Category Problem Worth Naming
A public score run by an infrastructure company against emerging standards is a useful diagnostic and an excellent sales instrument. Both things are true, and the second is why it will be quoted at you.
The pattern is familiar. A number exists, it is free to obtain, it can be run against a prospect without their involvement, and it produces a gap to be closed. That is the structure of every audit tool ever used in a pitch, and the fact that this one comes from a credible source does not change what it is being used for when it appears in an unsolicited email.
Hold it to the same standard as any other vendor score. It is not a Google metric, does not correlate with anything measured, and is one company's structured opinion, which is exactly the framing applied to third-party authority scores in domain authority. Useful for comparison and diagnosis; not evidence of an outcome.
Questions About the Agent Readiness Score
- What is the Agent Readiness Score?
A public score from 0 to 100, launched by Cloudflare in April 2026, measuring whether a website is technically readable and usable by AI agents. It runs sixteen checks across layers covering discoverability, content, bot access control, capabilities, and commerce, and anyone can run it against any domain from a free tool.
- Is it a ranking factor?
No. It is one company's structured opinion about agent readiness, not a signal any search engine uses. A low score does not mean you rank badly and a high one does not mean you will be cited. Treating it as a ranking input is the most likely way to misuse it.
- Why does a public score matter if it is not a ranking factor?
Because anyone can run it against your domain, including competitors and vendors selling you something. A number that exists publicly gets quoted whether or not it means what the person quoting it thinks. Understanding what it measures is worth an hour purely so you can respond accurately.
- Should I try to maximise the score?
No, and several checks would be actively premature to chase. It scores against emerging standards, some of which have limited adoption. Fix the parts that reflect genuine readability, which most sites should have anyway, and ignore the parts that score you against protocols your business has no use for yet.
- Which checks actually matter today?
The discoverability and content layers, because those describe whether anything can read your site at all, and the bot access control layer, because that reveals whether your infrastructure is refusing crawlers you meant to allow. The commerce and capability checks matter only if you have transactions or an API worth exposing.
