The agent-ready web is being built without you

Six companies in six different industries spent the last six months rebuilding their infrastructure for visitors that aren't human. Cloudflare cleared a week of launches for it. Shopify shipped a toolkit. Stripe opened a payment rail. Google pushed a commerce protocol through the FIDO Alliance with sixty co-signatories in under three months. Netlify built a separate front door at netlify.ai. Supabase rewrote its own positioning to read like machine documentation.

None of these companies coordinated. They all saw the same thing.

The thing they saw is that a meaningful share of website traffic now arrives via AI agents — software acting on behalf of a human who delegated the task — and the infrastructure most websites run on was built for a different visitor entirely. JavaScript-rendered SPAs. Cookie walls. Multi-step checkouts designed to maximise persuasion surface. Forms that need a human to fill them. Sites that work beautifully for a person with a mouse and fall apart the moment a non-human reader arrives expecting structured data and callable functions.

For eighteen years I've watched the SEO industry argue about the same surface — Google's index, Google's ranking, Google's snippet. The argument has been useful and occasionally important. It has also been parochial. The thing happening now is not a Google update. It is six infrastructure vendors quietly building a parallel web for a class of visitor that doesn't read your hero section, doesn't watch your testimonial video, and doesn't care about your brand promise. It cares whether your content is machine-readable, your actions are discoverable, and your transactions are callable through a structured API.

If your website is built for the first kind of visitor and not the second, you have a distribution problem you can't yet see in any analytics dashboard. And it's going to get worse before it gets visible.

The thing nobody is naming clearly

Slobodan Manic's piece at Search Engine Journal calls this "agent-readiness," which is correct but underplays what's actually happening. This isn't a feature you bolt on. It's a category of visitor your site was never designed to serve, and the infrastructure giants are building for that visitor whether you participate or not.

The honest framing: the web is being forked.

The honest framing: the web is being forked. Not violently, not all at once, but structurally. One fork serves humans — the persuasion-funnel web, the hero-image web, the social-proof-and-CTA web. The other fork serves agents — the structured-data web, the markdown-content web, the callable-function web. Cloudflare's Agent Readiness Score, Shopify's Agent Toolkit, Google's Universal Commerce Protocol, Stripe's Projects, Netlify's separate .ai subdomain — these are all infrastructure for the second fork.

The mistake almost every business will make in the next eighteen months is treating this as an SEO problem. It isn't. SEO is about being found and ranked by an index. This is about being usable by a piece of software that decided, on a human's behalf, to visit your site and complete a task.

The two problems overlap. Discoverability matters in both. But the actions you need to take are different, and most of the agencies, consultancies, and tool vendors currently selling "GEO" or "AEO" services are selling the SEO playbook with a new label. The infrastructure question — can an agent read, navigate, and transact on your site? — is barely being addressed.

Six independent bets, one underlying signal

Manic's piece walks through what each of the six companies shipped. The list is worth pausing on because the pattern only becomes clear when you see them stacked.

Cloudflare launched Web Bot Auth with GoDaddy for agent identity, Markdown for Agents for content extraction, WebMCP in Browser Run for callable functions, and the Agent Readiness Score as a public diagnostic. An infrastructure vendor clearing a launch week for something speculative would be commercial malpractice. They cleared it.

Shopify shipped the Agent Toolkit. Any AI agent can now browse a merchant's catalog, check inventory, and complete checkout through a structured API the merchant didn't have to build.

Google released Universal Commerce Protocol, expanded it at I/O 2026 with Universal Cart, and pushed Agent Payments Protocol through FIDO with sixty organisations. A draft spec went to production integration in under a quarter.

Stripe shipped Projects — a platform where agents can create accounts, buy domains, deploy infrastructure, manage subscriptions. Stripe is not a speculative company. They do not ship platforms for visitor classes that don't exist.

Netlify built netlify.ai as a separate surface. Not a feature inside the existing product. A different door, designed for non-human visitors.

Supabase — and this is the one that should make every marketing team uncomfortable — rewrote its tagline. "Postgres development platform" reads like a machine-readable description of capabilities. It does almost nothing for a human visitor's emotional purchase decision. It does everything for an agent trying to decide whether this is the right tool for the task it was sent to complete.

That's the loop. And we built it.

The signal these six independent bets reveal is not "AI is coming." It is "a class of visitor with specific infrastructure needs is already arriving, in volumes that justify capital expenditure from companies that don't waste capital expenditure." If Cloudflare, Stripe, and Google are all spending engineering quarters on this, the channel is real. It's just not yet visible in your GA4.

---

What "agent-ready" actually requires

Most of the writing on this topic so far has treated agent-readiness as a content question — markdown, schema, structured data, clean HTML. Those things matter. But they're the entry-level concern. The deeper requirement is architectural, and it splits into four problems most websites cannot currently solve.

Pillar 1: Machine-readable identity

An agent visiting your site needs to know, within seconds, what you are and what you do. Not in marketing language — in functional language. Supabase's tagline shift is the clearest example: "Postgres development platform" tells an agent exactly what category to file you under and what tasks you can complete.

Most homepages do the opposite. They open with a value proposition aimed at a human's emotional decision-making — "We help ambitious teams unlock their potential" — which means precisely nothing to a piece of software trying to determine whether you're the right vendor for the task at hand. The human-facing copy can stay. But there needs to be a parallel machine-readable layer — schema, structured data, agent-facing endpoints — that states plainly what category you occupy and what actions you support.

This is not the same as the schema markup conversation the SEO industry has been having for ten years. That conversation was about helping Google understand a page so it could rank it. The agent-readiness conversation is about helping a piece of software understand a business so it can transact with it. Different goal, different requirements, different surface.

Pillar 2: Server-rendered, semantically structured content

If your site depends on client-side JavaScript rendering to display its core content, most agents see an empty page. This has been true of search crawlers for years, and the SEO industry has mostly made peace with it via SSR or pre-rendering. The agent-readiness problem is the same, but the tolerance is lower. A search crawler will sometimes wait, sometimes execute JS, sometimes return later. An agent on a task often gives up immediately.

Semantic HTML matters here in a way it hasn't really mattered since the early 2010s. An <article> tag, a <nav> element, a properly nested heading hierarchy — these read as structure to an agent. A <div> soup reads as noise. Cloudflare's Markdown for Agents is essentially a layer that converts site content into a structure agents can extract reliably. The fact that an infrastructure vendor built this product is a signal: most sites cannot do this themselves.

Pillar 3: Discoverable, callable actions

The thing humans do on websites — click, fill, click, fill, submit — is an interaction pattern designed around eyes and hands. Agents don't have either. What an agent needs is a way to discover what actions are available on a site and to call them through a structured interface.

WebMCP, Shopify's Agent Toolkit, and Stripe Projects are all attempts to standardise this layer. The pattern is consistent: the site (or the platform the site runs on) exposes its actions as callable functions with documented inputs and outputs, and the agent calls them directly. No clicking through a checkout flow. No completing a multi-step form. The agent reads the available actions, picks the right one, supplies the arguments, completes the task.

Most small and mid-sized businesses are nowhere near this. Their booking forms, their contact forms, their checkout flows are all built assuming a human will complete them. When the platforms they run on (Shopify, Stripe, WordPress with the right plugins) start exposing these flows as agent-callable APIs, the businesses on those platforms inherit agent-readiness for free. The businesses on bespoke stacks inherit nothing.

Pillar 4: Predictable, machine-verifiable transactions

The final layer is trust. An agent completing a purchase on behalf of a human needs to know the transaction will execute as described. This is what Agent Payments Protocol and Universal Commerce Protocol are addressing — standardising how price, inventory, shipping, returns, and identity get communicated and verified between sites and agents.

For most businesses this layer is platform-provided. If you sell on Shopify, you'll inherit it. If you take payments through Stripe, you'll inherit it. If you run a bespoke ecommerce stack with custom payment flows, you'll need to build it. And — this is the bit being underdiscussed — if you don't take payments online at all, if your conversion path is "fill in this form and we'll call you back," you have a structural problem that no schema markup will fix. An agent cannot complete that transaction. The human who delegated the task gets a result saying "this vendor requires manual follow-up" and the agent moves on to one that doesn't.

Why this isn't an SEO problem

Agent-readiness is an infrastructure decision, not a marketing one.

The SEO industry's instinct, watching this happen, is to absorb it into the existing playbook. Add a few new audit items. Charge for "agent optimisation." Rebrand technical SEO as "agent SEO." This is the same move the industry made with GEO last year, and it was wrong then for a related reason: most of the work that actually moves the needle isn't on the SEO surface.

Server-side rendering is a developer decision. Semantic HTML is an architectural decision. Callable APIs are a platform decision. Payment infrastructure is a business model decision. None of these sit in the marketing team's gift. They sit with engineering, with product, with the CTO. The marketing team's role is to make the case that these decisions matter — but the decisions themselves cannot be implemented by a content strategist with a Yoast license.

This is uncomfortable for the agency model because the agency model is built around services that can be delivered without engineering involvement. Schema markup, content briefs, keyword research, link building — all of these can be done at the agency's desk and shipped to the client. Agent-readiness mostly can't. The serious work requires engineering hours on the client's side. The agency can audit, advise, write specifications. But the implementation is on the dev team.

The agencies that will navigate this well are the ones that already do technical SEO at a senior level — the ones who write engineering specifications, not blog posts. The agencies that have spent the last decade selling content and links will find this difficult, because the new surface doesn't reward what they're set up to sell.

The brand layer agents actually use

Here's the part that goes against the technical-determinism reading of this whole shift: brand still matters. Maybe more.

Agent-readiness gets you considered. Brand gets you chosen.

An agent sent to find a vendor doesn't pick one at random from the list of agent-ready sites. It picks one its training data, its retrieval index, or its tool-use heuristics tell it is a credible choice for the task. That credibility is brand. It's built the way it's always been built — through earned media, through community presence, through being mentioned by the right people in the right places, through showing up in the conversations where the agent's training data was sourced.

Rand Fishkin's recent SparkToro work on audience affinity hits this from the other side. The hidden-gem placement — the niche site with 5,000 visitors and 93 audience affinity — is the placement that builds the credibility signal the agent will eventually weight. Forbes gives you reach. The niche site gives you association with the right buyers, repeated across multiple trusted sources, building the dense web of mentions that an LLM's retrieval layer can actually detect.

The pattern is consistent: agent-readiness gets you considered. Brand gets you chosen. Sites that solve only the infrastructure problem will be technically eligible for agent traffic and still lose to brands the agent has heard of. Sites that solve only the brand problem will be considered by the agent and then fail at the task-completion stage because their checkout requires a human to be present.

You need both.

What this means for measurement

The measurement problem here is worse than the measurement problem for AI Overview citations, and the AI Overview measurement problem is already terrible.

For citations, you can at least pull logs, parse user agents, monitor citation tracking tools, and infer something. For agent transactions, the visitor lands as a normal browser session (the agent runs in a real browser context with a real IP), completes a task, and leaves. Your GA4 sees a session. Your Stripe sees a transaction. Neither knows whether the buyer was a human or a software agent acting on a human's instructions.

This is going to break attribution in ways the industry hasn't reckoned with. If 5% of your conversions next year come from agent-initiated sessions, your attribution model will assign them to whatever channel the agent appeared to come from — probably direct, probably organic, possibly referral from an AI platform — but the actual journey was: human asked an agent to find a vendor, agent searched its own index, agent visited your site, agent completed checkout. None of the conventional channels capture that.

Cloudflare's Web Bot Auth is the obvious starting point — if agents authenticate themselves at the network layer, you can at least segment the traffic. But adoption will take years, and in the meantime you're going to have a growing share of revenue that you can't cleanly attribute to any channel you're tracking. Plan for that. Don't optimise away from a channel because your dashboard says it's flat.

The honest limits

A few things this argument doesn't cover, and where reasonable people might disagree.

First, the volume question. Nobody outside the platforms has a clean number on what share of traffic is currently agent-initiated. The bets these six companies are making suggest they expect significant growth, but "significant" could mean 5% of transactions by 2028 or 30%. The strategic implication doesn't change much at either number — if it's 5%, agent-readiness is a competitive edge; if it's 30%, it's table stakes — but the urgency does. I would not bet a small business's roadmap on this being 30% next year.

Second, the standardisation question. Universal Commerce Protocol, WebMCP, Agent Payments Protocol — these are all early standards, and standards bodies have a habit of producing two competing specifications where one would have done. It's possible the dominant agent-interaction layer in 2028 looks different from what's being built now. Investing heavily in one specific protocol is risky. Investing in the underlying principles — machine-readable identity, server-rendered semantic content, callable actions, predictable transactions — is not.

Third, the platform question. Most of what I've written above assumes you can act on these problems. Many small businesses can't, because they run on platforms whose roadmaps they don't control. If you're on Shopify, you'll inherit agent-readiness as Shopify ships it. If you're on a bespoke stack from a freelancer who's now unreachable, you won't. The platform choice you made two years ago may determine your agent-readiness more than anything you do this year.

Fourth, there is a real argument that this is overstated — that agents will mostly fail at real-world transactions for the next several years and the infrastructure being built now is ahead of demand. That argument is defensible. I don't fully buy it, because the platforms building this are not speculative companies and the protocols going through FIDO are not draft documents. But I'd hold the position loosely. If by mid-2027 agent transactions are still negligible, I'll write the piece saying I was early.

What to actually do

The practical implication of all of this is uncomfortably short, because most of the work isn't in marketing's gift.

If you're a business owner: pick a platform whose roadmap includes agent-readiness. Shopify, Stripe, the major hosted CMSes are all moving on this. Bespoke stacks built by one freelancer five years ago are not. The platform decision is the single biggest agent-readiness lever most small businesses have.

If you're a marketing manager: stop treating this as an SEO add-on and start treating it as a cross-functional infrastructure project. The audit your SEO agency can produce is useful as a diagnostic — Cloudflare's Agent Readiness Score is a reasonable starting point — but the implementation will live with your engineering team. Get them in the conversation now, not after the dashboards start showing weirdness.

If you're an agency: the work you can credibly deliver in this space is the specification work — auditing, mapping, writing requirements for the engineering team to implement. The work you cannot credibly deliver alone is the implementation. Be honest about that division of labour. The agencies that pretend they can ship agent-readiness as a content engagement will get found out within two contracts.

If you're a consultant or freelancer: the discipline that's about to be in demand is the one that bridges marketing strategy and engineering implementation. It's an old role with a new urgency. The people who can sit with a CTO and a CMO in the same meeting and produce a specification both can sign off on are going to be busy.

The close

Most strategic shifts in this industry get announced by a vendor and trickle into client conversations over the following two years. This one is happening in reverse. The infrastructure has been built. The protocols have been agreed. The platforms have shipped. The dashboards just haven't caught up to it yet.

The businesses that will navigate this badly are the ones who wait for the trend pieces, the case studies, and the dashboard line going up before they act. By the time those arrive, the structural decisions that determine agent-readiness — platform choice, rendering strategy, payment architecture, content structure — will already have been made by someone else, often years earlier, and reversing them will be expensive.

The businesses that will navigate this well are the ones who understand that a class of visitor has arrived that doesn't read their hero image, doesn't watch their testimonial, doesn't care about their brand story, and is making purchase decisions on behalf of humans who delegated the task. That visitor needs a different web than the one most businesses built. Six infrastructure giants have decided to build it. The question is whether your business will be on it, or beside it.