Can AIs read your store? Accessibility and indexing with Cloudflare

Your store has two audiences: the people who buy and the robots that decide where you show up. And the second one is no longer a minority: according to Cloudflare's July 2026 bot report, more than half of web traffic is no longer human. Among those robots are the crawlers that feed ChatGPT, Copilot and Perplexity — and here's the key part: if those bots can't read your store, for AI assistants your store doesn't exist. Working on that visibility has a name: GEO, Generative Engine Optimization — structuring your content so AI systems find it, understand it and cite it in their answers.

The good news: you don't need to redesign anything. You need to review two layers of accessibility, and the trickiest one can be audited from Cloudflare in 15 minutes.

"Accessibility" here means two layers that reinforce each other

Human layer: a person can read your store. Alt text on product photos, a clear heading hierarchy (one H1, an H2 per section), clean HTML and real text — no prices or measurements buried inside an image. This is classic accessibility, the screen-reader kind. And it turns out an LLM reads your store just like a screen reader does: it doesn't see the photo, it reads the alt text; it doesn't see the design, it reads the heading structure. What you wrote for people is exactly what the model needs to understand your catalog.

Crawler layer: the robot can get in. Perfect HTML is useless if the bot bounces before entering. This layer asks for simple things: don't block it, don't ask it to solve a captcha (bots don't solve captchas — they leave), don't hide the catalog behind a login, and serve content rendered from the server: GEO guides agree on avoiding client-side rendering for key content, because many crawlers don't execute JavaScript.

The best part: every improvement in the human layer improves the crawler layer for free. They're not two projects: they're the same one.

Signs you're blocking AIs without knowing it

Roughly one in five websites goes through Cloudflare, so its configuration acts as a gatekeeper: it decides what Googlebot, Bingbot and AI bots get to see. These five signs suggest your gatekeeper may be turning away the wrong guests:

• Your Cloudflare zone was created after July 2025. Since July 1, 2025, Cloudflare blocks AI crawlers by default on new domains (the exact scope depends on what you chose during onboarding). If you never reviewed that setting, you may be bouncing the very bots that would cite you.
• Challenges or captchas for everyone. According to searchVIU, Bot Fight Mode can accidentally challenge legitimate crawlers, and JavaScript Challenges stop any bot that doesn't execute JS.
• Country blocking. Blocking traffic from the United States sounds reasonable for a store that only sells locally... until you remember that Google's, OpenAI's and Anthropic's crawlers come from there.
• A legacy robots.txt. That Disallow someone added years ago "for the scrapers" may now be cutting off the AI search bots. If you do not know where you stand, the bot accessibility test tells you what happens layer by layer.
• The GEO paradox. searchVIU gave it a name: if you block all AI crawlers, you protect your content from unauthorized training — but you also disappear from AI-generated answers.

And one myth to dismantle: blocking Google-Extended doesn't remove you from Google's AI Overviews. According to searchVIU, Overviews are fed by Googlebot, the same crawler as always; Google-Extended only controls whether your content is used to train Gemini.

How to check it with Cloudflare in 15 minutes

You don't need to be technical: it's four screens.

1. Open AI Crawl Control (available on all plans, including Free). You'll see the list of AI bots and what each one does. Explicitly allow the search ones: OAI-SearchBot (the one that searches for ChatGPT), Claude-SearchBot, PerplexityBot and Bingbot. They're different from GPTBot or ClaudeBot, which collect for training — blocking the latter doesn't cost you citations.
2. Decide what happens with training. Cloudflare's managed robots.txt — used by more than 3.8 million domains — declares Content Signals with the default search=yes, ai-train=no: "search me and cite me, but don't train on my content for free". Careful: these are declared preferences, not a technical wall. What each signal actually declares, and why no crawler honours it yet, we take apart in Content Signals in robots.txt.
3. Look at Security → Events. Filter by the bots from step 1 and check whether they show up with "Challenge" or "Block". If a search bot appears there, you found your leak.
4. Turn on Crawler Hints (free on all plans): Cloudflare notifies search engines via IndexNow when it detects new or updated content.

Want the fine detail on WAF, cache and verified bots? It's in the Cloudflare technical guide for SEO and GEO. Your domain doesn't go through Cloudflare yet? Start with the step-by-step implementation guide.

Being readable isn't enough: you also need to be in the fresh index

The crawler getting in is half the game. The other half is that the index where the AI searches has your catalog up to date — today's prices, today's stock. That rests on two pieces: a healthy sitemap, the full inventory search engines re-read every so often, and the instant notice of every change via IndexNow, the push protocol that goes straight to Bing — the index that feeds ChatGPT and Copilot.

Cloudflare's own Crawler Hints uses IndexNow, but it fires on heuristics: it infers from the cache that something changed. IndexNow Connect works with the exact signal: it listens to every addition, change and removal in your catalog and notifies the precise URL to IndexNow — without touching your store's code. Readability (Cloudflare) plus freshness (IndexNow) is the complete combination.

How to measure improvement (without paying for tools)

• Crawl activity in Cloudflare: AI Crawl Control shows which AI bots visit you and how much. If activity rises after you allow the search bots, the door is open.
• Bing Webmaster Tools' AI Performance report: in beta since February 2026, it shows how your content appears in AI experiences — but only the Microsoft ecosystem ones (Bing and Copilot), not ChatGPT or Perplexity.
• Your homemade prompt panel: pick 10-15 questions your customer would ask ("where can I buy hypoallergenic dog food online?") and run them once a month in ChatGPT and Perplexity, noting whether your brand appears and how it's described. Free, and in three months you have a trend line.

Checklist: is your store readable for AIs?

• Product photos with descriptive alt text (what it is, brand, color).
• A single H1 per page and a coherent H2/H3 hierarchy.
• Price, measurements and materials in real text, never only in an image.
• Product pages visible without login or paywall.
• Key content served from the server (no JavaScript dependency).
• OAI-SearchBot, Claude-SearchBot, PerplexityBot and Bingbot allowed in AI Crawl Control.
• Security Events with no challenges to verified search bots.
• robots.txt reviewed this year (not inherited). If your platform will not let you edit it, the robots.txt editor designs and publishes it for you.
• Sitemap up to date and accessible.
• Every catalog change announced via IndexNow.

If you checked everything, your store is readable and fresh. If you're missing the last two, that part can be automated.

Frequently asked questions

Does web accessibility (for people) help SEO?

Yes, and GEO too. Alt text, heading hierarchy and real text are the same signals screen readers, classic search engines and LLMs use to understand a page. It's a single investment that pays off with all three audiences.

How do I know if ChatGPT can see my store?

Check in Cloudflare's AI Crawl Control whether OAI-SearchBot is allowed and logging activity, and in Security → Events that it's not getting challenges or blocks. If your zone was created after July 2025, assume it's blocked until proven otherwise.

Does blocking AI bots protect my prices?

No: your prices are already public to any visitor, bots or not. What you do achieve by blocking everything is disappearing from ChatGPT and Perplexity answers — the GEO paradox. The smart move is discriminating by purpose: ai-train=no for training, and allow the search bots.

Is putting the catalog behind a login worth it?

For visibility, no: neither search engines nor AI assistants cite what they can't read, so a login-gated catalog is invisible in ChatGPT, Copilot and Perplexity. If you need private prices (wholesale, for example), keep at least the product pages public with the general information.

IndexNow Connect, by CookingMetrics, notifies Bing and the other search engines that take part in IndexNow of every catalog change, without touching your store's code, and records the response to each submission. The details are on the IndexNow Connect product page.