Why it matters
These agents act on accounts, so the site has to tell a real agent from a scraper, let a customer grant access without handing over a password, and expose account jobs the agent can do.
Signed agents are let in
4 points
What we check. We request your homepage again, signed with Web Bot Auth (an Ed25519 HTTP Message Signature whose public key we publish). A site that serves signed agents can tell a customer's agent from a scraper wearing its user agent.
How to fix it. Have your firewall verify Web Bot Auth signatures (Cloudflare calls these signed agents) and let verified agents through. Block on behavior, not on being an agent.
A customer can give their agent access
4 points
What we check. OAuth discovery at your site root: protected resource metadata (RFC 9728), authorization server metadata, PKCE S256 and client registration. It is how a person grants an agent access without handing over a password. Only scored where customers have accounts.
How to fix it. Publish /.well-known/oauth-protected-resource and your authorization server metadata, with PKCE S256 and client registration. It is the same sign-in flow the Claude and ChatGPT connectors use, so one build serves every agent.
Sign-in page an agent can use
4 points
What we check. The sign-in linked from your homepage: autocomplete="username" and "current-password", a passkey or one-time code option, and no captcha. We read the page; we never submit it.
How to fix it. Add autocomplete="username" to the email box and autocomplete="current-password" to the password box, offer passkeys or a one-time code, and keep captchas for anonymous traffic only.
Account jobs an agent can do
3 points
What we check. Tools that act on the signed in account (list my bookings, reschedule, cancel, order status), or at least self-service links a person and their agent can follow.
How to fix it. Expose the jobs customers send an agent to do (list my bookings, reschedule, cancel, order status) as tools that run in the signed-in session. Anything that costs money or ends a membership should ask the customer to confirm.
Buttons and links an agent can read
3 points
What we check. The share of links and buttons with an accessible name, and clickable divs that are not real controls. Browser agents navigate by the accessibility tree.
How to fix it. Give every icon button and image link an aria-label that says what it does, and use real <button> elements instead of clickable divs. Agents navigate by these names.
Rules for agents are written down
2 points
What we check. A Content-Signal line in robots.txt, and an agents section in llms.txt or an agents.json saying what an agent may do for a customer.
How to fix it. Add an "## Agents" section to llms.txt saying what an agent may do for a customer and what needs confirming, and a Content-Signal line to robots.txt.
See how your site does.
A free scan takes about a minute and shows the evidence for every check.
Other areas: Reach · Comprehend · Act · Complete · Accurate · Locations · Commerce · How the score works