What isitagentready.com measures and what it leaves out: how to interpret the score

isitagentready.com, Cloudflare's tool, checks whether a site declares the standards that let AI agents discover it, read it and know what they can do on it. It does not measure visual design, forms or accessibility for people. A high score indicates that those signals exist; it does not show that an agent can complete a purchase, or that the site is more visible or sells more.

This guide is written for someone who received a report from this tool and needs to decide what to do with it, not for those who write code. Technical terms are explained in plain words and the detail goes under the label "For the technical team", which can be passed to the IT department or to the provider.

It is worth stating where this is written from. CookingMetrics offers audits of this kind, and that is why it also publishes the results for its own site, with its flaws, in What we learned from reviewing our site for AI agents. This piece does not repeat that measurement: it explains how to read one like it.

In summary

• The tool measures whether a site declares standards for AI agents, which Cloudflare groups into four dimensions: discovery, content, bot access control and capabilities. The current page shows five categories, because it adds commerce, which according to Cloudflare is run but does not count toward the score.
• Cloudflare does not publish the formula or the weight of each check. That is why the score is useful for comparing one site with itself over time, with the same configuration, and not for comparing different sites.
• The tool does not measure visual design, the ease of forms or accessibility for people. Cloudflare uses "accessibility" to mean reading by agents, not by humans.
• This guide offers no evidence that a higher score increases visibility in AI answers, visits or sales.
• Each of the gaps has a manual test that can be done without special tools; they are checks of the real site, not of the report.

What it is and who makes it

isitagentready.com is a Cloudflare tool: you enter the address of a site and it returns an agent readiness score. The official announcement, published on April 17, 2026 and last modified on July 15, 2026, presents it as an "agent readiness" score based on four dimensions (Introducing the Agent Readiness score, consulted November 11, 2026). An artificial intelligence agent is, in this context, a program that reads pages and can act on them on behalf of a person.

Two clarifications about the tool, both dated:

• The score has no published formula. The announcement does not explain how the checks are combined or how much each dimension weighs. It mentions "levels" without defining them.
• The tool has changed, or is presented differently, since the announcement. The blog speaks of four dimensions; the page, consulted on November 11, 2026, shows "5 categories" with a list of checks that lets you choose which ones to run (isitagentready.com). The page does not show a total number of checks; the list it offers has 22 entries, a count made while reading it. That is why it is worth always recording the date and the configuration of each measurement.

The categories, in plain language

Each category answers a different question. It is indicated which type of site it applies to and what it does not guarantee; that applicability is an editorial criterion of CookingMetrics, not a Cloudflare classification.

• Discovery: can an agent find the pages? It checks the robots rules file (robots.txt), the sitemap, Link-type headers and a DNS record for discovering AI services. It applies to any site. It does not guarantee that the announced addresses work in practice: that is verified by opening them.
• Content accessibility (for agents): can an agent read it easily? It checks that the site can deliver its content in Markdown, a simple text format, when an agent asks for it. It applies to sites with content to read. It does not guarantee that the content is clear, useful or correct.
• Bot access control: who can come in and what can they do with the content? It checks the rules for AI robots in robots.txt, the Content Signals declarations and Web Bot Auth. Web Bot Auth is only needed if the site makes requests to other sites, according to Cloudflare. It applies to any site that wants to decide how its content is used. Content Signals declares an intention and does not block access; the topic is explained in Content Signals in robots.txt.
• API, authentication and MCP: what can an agent do on the site? It checks the API catalog, OAuth discovery, MCP server cards, agent cards, agent skills (Agent Skills) and WebMCP, among others. It applies only if the site offers something an agent can execute, such as an API or an action. On a blog or an institutional site, it normally does not apply. Cloudflare states that several of these standards are under development and that the MCP server card is a draft.
• Commerce: can an agent pay or buy? It checks protocols such as x402, MPP, UCP and ACP. According to Cloudflare's announcement, these checks are run, but they do not count toward the score. It applies to ecommerce that wants to experiment with purchases made by agents. It does not guarantee that any purchase works.

In addition, llms.txt is a file proposed to guide language models. According to Cloudflare, the tool does not check it by default; it has to be turned on. In our baseline article we treated it as part of what the tool evaluates; this piece clarifies that point.

Exclusive content

For signed-in readers

Decide which checks apply to the site

Compare a magazine, store, and application to distinguish a needed capability from an option that does not apply.

Sign in to access this section →

We work to offer the best possible content, which is why some of these explanations are not public.

What it does not measure, and how to check it by hand

The following six checks are not made by the tool. Each has a test that can be requested from the team or done directly.

1. Visual design and the hierarchy of the page

The tool has no design check: according to Cloudflare's announcement, the score does not measure visual design. To know whether the design helps whoever visits the site, the test is human: open the key pages and check that what matters is seen first and that the main action can be found without searching for it.

2. Content that depends on JavaScript

Many modern sites assemble the page in the browser with a program called JavaScript. A robot or an agent that does not run it may receive an almost empty page. Google states that pages go through a queue before their JavaScript is run and recommends server-side rendering or pre-rendering, among other reasons because not all robots run JavaScript (JavaScript SEO basics, page updated March 4, 2026, consulted October 27, 2026).

• Test: open a key page, right-click, choose "view page source" and search for a paragraph of the main text. If it does not appear, it depends on a program that runs afterwards.
• For the technical team: the same check with curl; the browser inspector shows the already processed content and is not suitable.
• This criterion is explained in more detail in What to look for in a web design and development provider.

3. Forms, cart and payment

That a site declares standards for agents does not say whether the purchase journey can be completed. According to its list of checks, the tool does not go through those flows: that is an inference from what it lists, not a limitation that Cloudflare declares. As a consequence, a site could score high and have a form that an agent cannot complete, and a site with a low score could have a journey without flaws. It is a logical possibility, not a finding.

• Test: make a test purchase or submit a test form using only the keyboard. Every field must have its label, errors must be explained in text and there must be no windows that trap the user with no way out.

4. Accessibility for people

Cloudflare uses the word "accessibility" to mean that an agent can read the content, not that a person with a disability can use the site. They are two different matters with a word in common. For people there is a reference standard, the Web Content Accessibility Guidelines 2.2 (WCAG 2.2), a W3C Recommendation published on December 12, 2024 and backwards compatible with version 2.1 (WCAG 2.2). It is the basis for agreeing a concrete conformance level with a provider.

• Test: go through the main flow using only a keyboard, with a screen reader and with color contrast checked, and ask for the report with the pages tested and the date. The result of an automated tool is a starting point, not the complete evidence.
• For the technical team: version 2.2 adds criteria such as minimum target size (2.5.8, level AA) and accessible authentication (3.3.8, level AA).
• The confusion is common: our own accessibility test for bots uses "accessibility" to mean access by robots, not by people.

5. Whether the content is worth anything

A site with an impeccable sitemap and generic content will be found and discarded. The tool measures whether the site is readable by an agent; it does not measure whether what it says deserves to be cited. This limitation is already stated in our baseline article.

6. Whether an agent completes a task

The most direct test would be to ask a real agent to complete a task on the site, for example, adding a product to the cart. It is an optional test, with caveats: an agent's result is not always the same, products change frequently and an isolated result shows nothing about other flows.

• CookingMetrics has not run this test. It is described here as a method, not as a result.

Exclusive content

For signed-in readers

Manual tests that complement the report

Prepare keyboard, form, content, cart, and agent task cases with evidence and outcome statuses.

Sign in to access this section →

We work to offer the best possible content, which is why some of these explanations are not public.

How to read a score without over-interpreting it

• Choose the site type and the checks first. The tool lets you choose which checks to run. A score for a content site and another for a site with an API are not comparable, because they do not measure the same things.
• Record the date and the configuration. The tool changes, and a score from April is not simply compared with one from November.
• Do not compare with other people's sites. With no published formula, the difference in points between two sites has no documented interpretation. What is useful is comparing the same site, with the same configuration, before and after a change.
• Distinguish what does not apply from what is missing. A check that does not correspond to the type of site, such as Web Bot Auth on a site that does not make requests to others, is not a gap.
• Treat it as a starting diagnosis. A score points out which signals are declared. It is not a certificate, nor an indicator of visibility or of sales.

Exclusive content

For signed-in readers

Turn the report into concrete work

Classify failures, not applicable, and unknowns in an example without invented scores or traffic promises.

Sign in to access this section →

We work to offer the best possible content, which is why some of these explanations are not public.

Our own case: the baseline and the "after" that does not exist yet

On September 4, 2026, we measured cookingmetrics.com against Cloudflare's public Agent Readiness criteria. Each point was checked with an HTTP request on that date: the sitemap returned 404 on the three usual paths, although robots.txt announced one; llms.txt returned 404 because it was written and never published; the home page responded without cache; and the field LCP was 6.15 s on desktop and 6.20 s on mobile. The complete measurement is in the baseline article.

In that article we promised a second measurement after applying five changes. That second measurement does not exist yet: as of November 11, 2026 it had not been published. When it is done, it will be repeated with the same site type and the same checks, the date will be recorded and the result will be published, whatever it is.

Exclusive content

For signed-in readers

Prepare a comparable repeat assessment

Record configuration and intervening changes to compare results without mixing different methods.

Sign in to access this section →

We work to offer the best possible content, which is why some of these explanations are not public.

Limits of this guide

• It is not an evaluation of the tool. It is a guide to interpreting its result. The tool works as a starting diagnosis.
• Scope of the sources. What is cited from Cloudflare describes its tool and its standards, which are evolving. What is cited from Google describes Google.
• Dated figures. The number of categories and checks corresponds to the consultation of November 11, 2026 and may change.
• Manual tests not run. The tests described are a method; CookingMetrics does not publish results from them here.

What to do next

The next step is to split the report into two lists: what fails and applies to the type of site, and what does not apply. Then it is completed with the six manual tests, which are the ones the tool does not cover, and the measurement is repeated with the same configuration after each change.

If you would like us to carry out this measurement and these tests on your site, you can learn about our SEO for AI search service. We review the site and support your development team; we do not develop the site.

Frequently asked questions

Does a high score improve my visibility in AI?

This guide offers no evidence of that. The score indicates which signals for agents are declared, not how an assistant responds or how much traffic or sales the site generates. Google also states that there are no additional requirements to appear in its AI features (AI features and your website, page updated December 10, 2025, consulted October 27, 2026).

Is llms.txt needed to score?

Not necessarily. According to Cloudflare, the tool does not check it by default and that check has to be turned on. Publishing it costs little; promising an effect has no support in what this guide cites.

Does isitagentready measure web accessibility for people?

No. Cloudflare uses "accessibility" to mean that an agent can read the content. Accessibility for people is checked with the WCAG standard and with tests carried out by people.

Does every site need MCP, WebMCP or commerce protocols?

No. It only makes sense if the site offers something an agent can execute, such as an API, an action or a queryable catalog. Cloudflare states that several of those standards are under development; a blog or an institutional site can go without them without that being a flaw.