Checklist · Buy
Agentic readiness checklist: the buy stage
An AI agent has to get from a chosen product to a payment screen using only what the page gives it. At the buy stage almost everything that stops one is an interaction that assumes a person: a hover, a popup, an account, a step that only a mouse can complete.
What the agent is trying to do here: Getting from a chosen product to a payment screen, without a person to help it.
Agent could not reach the payment step
criticalRender a payment step that does not depend on scripts an agent cannot run.
- Do not gate the appearance of the payment form on optional steps such as marketing consent or account creation.
- Make every checkout control reachable and operable by keyboard.
- Test the checkout with a plain automated browser and no extensions, which is much closer to what an agent drives than your own browser is.
See it on your own store
- Add a product to the cart and open the checkout in a browser with JavaScript disabled. Note what renders and what does not.
- With scripts enabled, work through the checkout using only the keyboard. Anything that cannot be reached by keyboard is likely unreachable to an agent.
- Note whether a payment field appears before any address validation or shipping selection completes.
- Check whether a third party payment frame is required for the form to exist at all.
Checkout requires creating an account
criticalOffer guest checkout. For agent traffic this is the difference between reachable and not.
- If you want accounts, create them after the order from the details already collected, and invite the shopper to set a password afterwards.
- Do not require email verification before payment.
- Check that no app has reinstated the account requirement. This is a setting that gets switched on by loyalty and wholesale apps as a side effect.
See it on your own store
- Open your store in a private window with no session.
- Add a product to the cart and start the checkout.
- Look for whether a payment step is offered without signing in or creating an account, and whether a password field appears before one.
- Check the account creation path too: if registration requires clicking a link in an email, an agent cannot complete it even where it can fill the form.
CAPTCHA stops the agent at checkout
criticalMove the challenge to a risk based trigger rather than applying it to every checkout.
- Exempt verified or allowlisted agent traffic from the challenge.
- Where fraud pressure is the reason, prefer controls that act on the payment attempt rather than on the ability to reach the form.
- Review this after any change to your fraud tooling, since challenge scope is commonly widened by default in an update.
See it on your own store
- Complete a checkout yourself in a private window and note whether a challenge appears, and at which step.
- Fetch the checkout page and search the source for recaptcha, turnstile, hcaptcha or a data-sitekey attribute.
- Check whether the challenge fires on every checkout or only on a risk trigger, by trying from a different network.
Checkout returned an error
criticalInvestigate the underlying error. It is failing for ordinary requests, not only for agents.
- Check third party checkout apps first. An app that fails open is invisible; one that fails closed produces exactly this.
- Make sure error states return a usable page rather than a generic failure, so the cause is visible in monitoring.
- Re test after any checkout app install or theme update.
See it on your own store
- Build a cart in a private window and start the checkout. Note the exact error text.
- Repeat with a second product, and with two items in the cart.
- Check your server logs and error tracker for the same timestamps. This stall almost always has a matching server side exception.
- Try from a different network and a different country if you serve more than one market.
The cart can only be paid with an express wallet
highShow a plain checkout button in the cart beside the express buttons: a link to /checkout, or a submit button named checkout inside the cart form.
- If an app replaced the cart, check its settings for an option that hides the standard checkout button, and turn it off.
- Keep the express buttons. They are good for people who have the wallet, and they cost an agent nothing once the plain button is there.
See it on your own store
- Add a product to the cart and open the cart drawer or the cart page in a private window.
- Look for a button or link that says checkout and leads to your own checkout. Wallet buttons do not count.
- Check the cart on a phone and on a desktop: some themes hide the checkout button on one of them.
Size or colour can only be chosen by hovering
highMake each option a real control: a select, a radio input, or a button that responds to a click and to the keyboard.
- Give each option an accessible name that matches the value a shopper would say, such as Medium rather than a swatch with no label.
- Reflect the chosen variant in the URL or in a form value, so the choice is observable rather than only visual.
- Test with the keyboard alone. If you can buy the product without touching the mouse, an agent can too.
See it on your own store
- Open a product page with size or colour options.
- Press Tab repeatedly and watch whether focus ever lands on an option value.
- With focus on an option, press Enter or Space and see whether the selection changes.
- If focus never reaches the options, or reaching them does not let you select one, this is your stall. The keyboard test is the agent test.
Choosing a variant needs JavaScript the agent cannot run
highRender the option controls in the HTML and let scripts enhance them, rather than creating them from nothing.
- Use a real form control as the base, so the page is functional before any script runs.
- Keep the option values in the markup even when the visual presentation is script driven.
- Make sure the same values appear in your structured data, so the page and the data agree.
See it on your own store
- Fetch a product page with curl and search the response for the option values you expect, for example Small or Medium.
- If they are absent from the source but visible in the browser, the control is built client side.
- Load the page in a browser with JavaScript disabled and check whether a usable option control appears.
- Look for an empty container with a variant related id or a data-options attribute, which is the usual placeholder.
A popup blocks the path to the cart
highGive every overlay a close button that is a real control with an accessible name.
- Make Escape close it.
- Do not show promotional overlays to identified agent traffic at all.
- Delay or suppress overlays on product and cart pages, which are the pages where the interruption costs the most.
See it on your own store
- Open a product page in a private window and wait for any timed overlay to appear.
- Try to close it using only the keyboard: press Escape, then Tab to find a close control.
- If neither works, an agent has the same problem.
- Check whether the overlay reappears on the next page view within the same session.
The store refused the agent’s add to cart
highLet AI shopping agents through your bot protection on the cart request, the address the finding names, for agents that identify themselves.
- Where your provider supports verified bots or signed agent traffic, allow that on the cart as well as on product pages.
- If a rule must refuse the request, answer it with a message the page shows, so a shopper or an agent knows the product did not go in.
See it on your own store
- Open a product page, open the browser developer tools on the Network tab, and press add to cart.
- Find the cart request (for Shopify, /cart/add.js or /cart/add; for WooCommerce, ?wc-ajax=add_to_cart) and read its status.
- A 403 or 503 whose response headers include cf-mitigated: challenge is a Cloudflare challenge. Any other 4xx or 5xx is a refusal from the store or a rule in front of it.
- Check your bot protection, firewall and rate limit logs for the same moment to find the rule that matched.
An age check asks for a date of birth
highAsk for a one click confirmation, such as a button that says I am of legal drinking age, rather than a typed date of birth.
- Where the law or your own policy needs a real age check, keep it at checkout, where it applies to an actual purchase, rather than on the first page.
- Give the confirmation button a clear accessible name, and remember the answer for the rest of the visit.
See it on your own store
- Open your store in a private window, so no earlier answer is remembered.
- Look at what covers the page before you can see a product.
- If the only way past it is to type a date of birth or a year of birth, this is the stall.
Add to cart needs JavaScript the agent cannot run
mediumWrap the add to cart control in a form that posts to a cart endpoint, and let scripts intercept it for the nicer experience.
- Keep a working non script path to the cart, which is the same pattern that makes the page resilient when a script fails to load.
- Give the control a stable name or identifier rather than relying on a generated class.
- Test the whole path with scripts disabled once per theme change.
See it on your own store
- Fetch a product page with curl and look for a form containing an add to cart submit control, or a link that adds to the cart.
- Load the page in a browser with JavaScript disabled and try to add the product.
- Inspect the button and check whether it sits inside a form and has a name and value, or whether it is a bare button.
A popup covers a button on the way to checkout
mediumDo not open popups over the add to cart or checkout button, and do not open them right after an add to cart.
- If an offer has to appear there, give it a close button with an accessible name, such as aria-label="Close", that a keyboard can reach.
- Let a shopper carry on without answering the offer: closing it should never be the only way to the button underneath.
See it on your own store
- Open a product page in a private window, add the product to the cart and open the cart.
- Watch for anything that opens over the add to cart or checkout button while you do.
- Try to close it using only the keyboard: Tab to its close control and press Enter. If you cannot find one, an agent cannot either.
The first press of checkout does nothing
mediumHave the theme submit the form again only once its save has finished, not straight away inside the submit handler.
- Do not hold the submit at all when there is nothing to save.
- Test checkout with cookies refused and no tracking tags in the address, which is how many agents arrive.
See it on your own store
- Open your store in a private window, refuse cookies, add a product and open the cart.
- Open the browser’s developer tools on the Network tab and press checkout once.
- If no request appears and the page stays put until a second press, this is the finding.
One item cannot be checked out below your minimum order
mediumIf the minimum is deliberate, keep it, and state it where an agent reads before it adds anything: on product pages and in your delivery or shipping policy, with the amount.
- Say the minimum in the cart in plain words with the amount, as you already may, so an agent can tell its shopper exactly what is missing.
- If one item on its own should be enough to order, lower or remove the minimum.
See it on your own store
- Open your store in a private window and add one low priced item to the cart.
- Open the cart and try to check out.
- If checkout stays closed and the cart asks you to spend more, this is the finding. Then look for the minimum on a product page and in your delivery policy, where an agent reads before it shops.
A control an agent needs is not exposed as one
lowBuild the option picker from a select list, or from buttons or radio inputs with labels.
- If the picker has to be custom, give the list role="listbox" and each choice role="option", with the chosen one marked aria-selected.
- Give the product a real add to cart button, labelled "Add to cart", and keep a quantity stepper for changing the amount once it is in the cart.
See it on your own store
- Open the product page with a screen reader, or the accessibility tree in your browser’s developer tools, and look for the option picker and the add to cart by role. A select list, a radio group or a button should be listed. A generic element is not.
- Try to reach both with the keyboard alone, using Tab and Enter. A control a keyboard cannot reach is usually one an agent cannot find either.
A simpler agent stopped at a step an AI agent got past
lowBuild the control from the standard element for the job: a select or radio buttons for options, a submit button inside a form for add to cart.
- Give every control an accessible name that says what it does.
- Follow the fix the finding carries for the step it names, which is the same fix the stall on that step would carry.
See it on your own store
- Open the step named in the finding in a browser and do what the finding says the AI agent did.
- Inspect the control the scripted walk could not use and check whether it is a real form control, such as a select, a radio button or a submit button.
- Try the same step with the keyboard alone. A step that needs a pointer or a guess is the step to change.
An agent can buy only the option already selected
lowBuild the options from real form controls: a select, or radio buttons with visible labels.
- Make every option respond to a click and to the keyboard, not only to a hover.
- Keep the preselected default, which is what lets agents buy at all while the options are fixed.
See it on your own store
- Open the product page and note which option is selected when it loads.
- Try to choose a different option using only the keyboard: Tab to the options and press Enter or Space.
- If the selection does not change, an agent is limited to the default in the same way.
A cookie banner covers the page until it is answered
lowShow the banner as a bar along the bottom or top of the page that leaves the page usable, not as a layer over it.
- Put Reject all on the banner’s first screen, beside Accept, with the same weight.
- Give every control on the banner a name a screen reader would announce, including the close icon.
See it on your own store
- Open your store in a private window, so no earlier answer is remembered.
- Without answering the banner, try to click a product or the add to cart button.
- If nothing responds until the banner is answered, check that Reject all is on its first screen, beside Accept.
Nothing we picked could be bought
infoNothing to fix in the store itself. The next scan picks again and tests buying when a product can be bought.
- If products that are on sale are missing from your product feed, or marked out of stock there, correct the feed’s stock values so the scan can pick them.
- If you sell only through dealers or by enquiry and your product feed lists products as available to buy, mark them as not available there, so AI agents do not try to buy them on your site.
See it on your own store
- Open the products named in the scan’s buy attempt and check whether any option can be added to a cart.
- Compare with your product feed or products.json: a product listed as in stock there and sold out on the page is one the scan will keep picking.
- Check whether the products were drops or pre-orders with a date still to come when the scan ran.
- Check whether the products can be bought on your site at all, or only through a dealer, a demo booking or an enquiry.
Scan your store to find out which of these 19 it actually hits, rather than working through all of them.