The state of agent readiness
We sent a verified, signed AI shopping agent to 13,854 online stores, six times as many as in October, including Shopify and long-tail stores drawn at random. The answer to “can an agent buy here?” depends less on the store than on the platform it runs on.
13,854 stores tested October 21 – November 2, 2026 · each store’s most recent check · October 2026 edition
Why the headline number fell
In October, 26% of the 2,323 stores we tested were agent-ready. This month the share is 16%. Stores didn’t get worse. We widened the sample: October’s stores came mostly from best-of lists and high-traffic sites, and nearly half ran on Shopify. This edition adds more than 11,000 stores, chosen to cover every major commerce platform, plus random draws, so Shopify is now 29% of the sample. The stores in the October report still stand at 26%. A full re-check of them is scheduled for late November and will appear in the December edition.
Six things the agent found
The platform decides.
51% of the 3,993 Shopify stores we tested are agent-ready. Across the 9,861 stores on every other platform, or with no platform detected, 2.1% are. A Shopify store is about 24 times as likely to be ready for an agent. Of the 2,252 agent-ready stores we found, 2,042 run on Shopify, 200 on BigCommerce and 10 on anything else.
It isn’t just the well-known brands.
Most of our Shopify stores in October came from best-of lists and popular sites, which might flatter the result. So we drew 2,336 Shopify stores at random, most of them small sites outside the top million. 49% were agent-ready, close to the 54% of hand-picked Shopify stores. An ordinary Shopify store does about as well as a famous one.
An agent checkout is necessary, not sufficient.
Every agent-ready store advertises an agent checkout. But BigCommerce shows that isn’t enough: 97% of BigCommerce stores now advertise one, yet only 7% are agent-ready. Of the BigCommerce stores that let the agent in but fell short, 84% don’t publish product data an agent can read reliably. On Shopify, about half of stores still fall short on other checks, such as product data or linked policies.
The enterprise platforms are the furthest behind, and the most closed.
Across 3,693 stores on Adobe Commerce (Magento), Salesforce Commerce Cloud and SAP Commerce Cloud, 2 were agent-ready. Almost none advertises an agent checkout. They also keep agents out most often: 30% to 43% of these stores blocked our verified agent at the front door or on product pages, against 3% of Shopify stores.
The long tail is no better.
We drew 807 small stores at random from sites outside the top million, most of them on WooCommerce. 1% were agent-ready, though 42% were partly ready. Across all 2,458 WooCommerce stores we tested, 2 passed.
The largest retailers still haven’t moved.
None of the 100 largest US retailers passed. 36% of their web stores turn the agent away at the front door, and those we could scan averaged 32.4 out of 100. Only 12 of the 115 web stores we tested reach even Partial.
What the store runs on
| Platform | Stores | Agent-ready | Share ready | Agent checkout | Blocked | Avg score |
|---|---|---|---|---|---|---|
| Shopify | 3,993 | 2,042 | 51% | 95% | 3% | 81.5 |
| BigCommerce | 2,799 | 200 | 7% | 97% | 13% | 65.3 |
| WooCommerce | 2,458 | 2 | 0.1% | 0.3% | 8% | 56.3 |
| Adobe Commerce (Magento) | 1,876 | 2 | 0.1% | 0.4% | 36% | 43.5 |
| Salesforce Commerce Cloud | 1,136 | 0 | 0% | 0% | 30% | 45.9 |
| SAP Commerce Cloud | 681 | 0 | 0% | 0% | 43% | 41.5 |
| Other platforms | 32 | 2 | 6% | 31% | 34% | 51.5 |
| Custom or undetected | 879 | 4 | 0.5% | 4% | 54% | 36.7 |
Blocked: turned away at the front door or on product pages. Average scores cover stores we could scan. Platform is detected from the store’s pages, or from HTTP Archive’s technology data when a store blocks us. Stores with neither fall into “Custom or undetected,” which lowers that group’s scores. Other platforms: Wix, Wix eCommerce, Oracle Commerce Cloud, VTEX, Medusa, Squarespace, PrestaShop.
Where the stores came from
Six groups, built from public rankings and from HTTP Archive’s public crawl of the web. Each store is counted once, in the group where we first found it.
| Group | Stores | Agent-ready | Partial | Turned away at door | Agent checkout | Avg score |
|---|---|---|---|---|---|---|
| The October stores 2,329 stores first checked by October 24: the 2,323 in our October report plus earlier test scans | 2,329 | 26% | 30% | 15% | 47% | 60.4 |
| More high-traffic stores Top-one-million follow-up, Oct 25–29 | 243 | 47% | 39% | 4% | 81% | 76.1 |
| Most-visited sites that are stores Tranco top-sites list, top 60,000 checked | 574 | 27% | 32% | 11% | 53% | 62.0 |
| Every major platform HTTP Archive, Oct 2026 crawl: most-visited stores per platform | 7,565 | 3% | 40% | 6% | 36% | 54.7 |
| Shopify stores at random HTTP Archive, random draw | 2,336 | 49% | 45% | 0.1% | 95% | 81.8 |
| The long tail HTTP Archive, random draw below the top million sites | 807 | 0.9% | 42% | 1% | 5% | 56.0 |
| All stores | 13,854 | 16% | 39% | 7% | 48% | 60.9 |
The October group includes the NRF Top 100 Retailers and Newsweek’s America’s Best Online Shops; see the October edition for those breakdowns.
Throttled: told to slow down, and never let in
Some stores answer a busy visitor with HTTP 429, “too many requests.” We don’t count that as a block: our agent pauses as asked and tries again, and the scheduler retries hours later. 89 stores (0.6%) still answered 429 on three tries hours apart, and 69 of them run on Shopify. Many platforms use that answer to turn away visitors they think are bots, so we now report these stores separately, as throttled, instead of scoring them.
What moves a store to agent-ready
- Let verified agents through your bot protection. Blocks usually come from bot-protection settings. Allow verified bots and signed agents (Web Bot Auth), including those connecting from cloud servers.
- Ask your platform for an agent checkout. Every agent-ready store we found advertises an agent checkout protocol (UCP or ACP). If your platform doesn’t publish one, ask when it will.
- Publish product data agents can read. Structured product markup with price and stock on every product page. This is what most often holds back stores that already have an agent checkout.
- Link the basics from every page. Shipping, returns, contact, privacy and terms.
- Check where you stand. Scan your store free. It takes about a minute and tells you exactly what’s in the way.
Method
The agent. Every request carried a Web Bot Auth signature (RFC 9421 HTTP message signatures, Ed25519) pointing to our published key directory. Cloudflare lists our agent as a verified bot. It identifies itself as PegasusKYA in its user agent, honors robots.txt, makes at most 30 requests per store at one per second, reads only public pages, and sends no orders, carts or account actions. The only non-page request is a read-only catalog search, when a store advertises one. More about our agent.
The checks. Four checks, 25 points each. Found: sitemap, structured product data, price, stock, an agent manifest, linked policies. Admitted: home page and product pages open to the signed agent without a challenge. Checkout: an advertised agent checkout (UCP or ACP), and a cart and checkout an agent can reach. Trust: HTTPS, business identity in structured data, contact, privacy and terms pages, security.txt, and the store’s own signing keys. 85 or more is Agent-Ready, 60–84 Partial, under 60 Not ready. A store that challenges verified agents can’t be Agent-Ready however high it scores. “Turned away at the front door” means the home page was blocked or didn’t answer.
The stores. The October stores (the NRF Top 100 Retailers 2026, Newsweek’s America’s Best Online Shops 2025, BuiltWith’s US e-commerce top sites with Semrush category leaders and major marketplaces, and stores among BuiltWith’s top one million sites), plus: stores among the top 60,000 sites on the Tranco list; the most-visited stores on each major platform in HTTP Archive’s October 2026 crawl, up to 3,000 per platform; and two random draws from the same crawl, one of Shopify stores and one of non-Shopify stores outside the top million sites. The random draws use a fixed seed, so they can be reproduced. New candidates were kept only if their robots.txt showed a store (cart or checkout rules, or a commerce platform). New candidates were mostly limited to .com, .us, .co, .shop and .store domains. We held back 3,971 PrestaShop, Shopware and VTEX stores, mostly outside the US, because our checks read English link labels; they will be reported separately (a few found through other sources are included). 56 stores ask our agent to stay out and were not scanned, leaving 13,854 stores tested.
Rate limits. Scans ran from Cloudflare’s network, at most a few hundred stores an hour. When a store answers 429, the agent waits as asked and tries once more; if it still answers 429, nothing is recorded and the store is retried hours later. After three tries it is reported as throttled. Throttled and unreachable stores are unscored but count in every share, so each percentage is out of all stores tested. An early run counted rate limits as blocks; those stores were re-checked before this edition.
Limits. A scan reads pages as a server sends them, before scripts run, which can understate stores built as JavaScript apps. Checkout detection looks at common addresses and advertised protocols, not every possible flow. Except for the random draws, groups favor popular sites. Scores are a snapshot from October 21 to November 2, 2026; stores change.
Cite as: PegasusKYA (Pegasus Source LLC), “The State of Agent Readiness,” November 2026, pegasuskya.ai/state-of-agent-readiness.