One merchant in four is closed to a robot that says who it is
Published . Figures computed from the readiness barometer measured on 2026-09-09.
Short answer: 60/250 French and 61/250 US merchant homepages (24% and 24%) answer HTTP 403 to a scanner that declares itself as ACPInfoPublicSignalScanner/1.0 (+https://agenticcommerceprotocol.info/scan). Add timeouts, server errors, rate limits and off-site redirects, and 84 French and 80 US stores out of 250 each are closed to that robot. Agentic commerce assumes an agent can at least read the store; for a quarter to a third of the most visited merchants in both countries, an unknown agent cannot.
What “closed” means here
The barometer sends one request to the resolved homepage with an identified, non-browser user agent, follows same-site redirects, and records the answer. A store is counted as closed when the answer is not a 2xx HTML page. The breakdown for France: 60 HTTP 403, 16 timeouts after ten seconds, 2 server errors or rate limits, 4 redirects that leave the merchant’s own domain. For the United States: 61 HTTP 403, 2 timeouts, 14 server errors or rate limits, 2 off-site redirects. Nothing is retried with a browser identity, and no protection is bypassed. This is what an agent that plays by the rules sees.
Where it happens
By category, the share of closed stores in France runs from 7% (Consumer electronics) to 51% (Apparel and fashion). In the United States, from 11% (Consumer electronics) to 44% (Retail).
| Category | Closed, FR | Closed, US |
|---|---|---|
| Apparel and fashion | 25/49 (51%) | 14/44 (32%) |
| Retail | 13/27 (48%) | 11/25 (44%) |
| Sporting goods | 17/46 (37%) | 21/49 (43%) |
| Beauty and cosmetics | 11/40 (28%) | 5/39 (13%) |
| Furniture and home | 9/38 (24%) | 16/49 (33%) |
| Jewelry and luxury | 8/34 (24%) | 12/31 (39%) |
| Consumer electronics | 1/15 (7%) | 1/9 (11%) |
Categories are the Semrush Trending Websites categories in which the merchant was ranked (best rank kept).
The file is public, the pages are not
The Robots Exclusion Protocol (RFC 9309) lets a site tell crawlers which paths they may fetch. It is a request, not a wall. In the panel, 20 French and 13 US merchants serve a perfectly readable robots.txt and then answer 403 on the homepage itself. The two mechanisms live at different layers: the file is served by the origin, the block comes from a bot-management layer in front of it. An agent that reads the file, respects it, and then requests the page it was allowed to read still gets nothing.
The same split appears with UCP. sezane.com and backcountry.com block the homepage and serve a valid discovery profile at /.well-known/ucp: the door to negotiation is open, the shop window is closed. A platform-level integration can work through that door; an agent that starts by reading the page cannot.
Why this matters more than the protocol counts
The barometer’s protocol signals are low everywhere: 9% and 16% valid UCP profiles, 16% and 28% real llms.txt files. Those numbers can rise fast, because a platform can publish them for thousands of merchants at once, as Shopify did. The 403 share is different in nature. It is a choice each merchant’s security stack makes about unknown automation, and it is not undone by adopting a protocol. A merchant can have a valid profile, accurate product data and a documented checkout, and still be unreachable by any agent it has not explicitly recognised.
This is where agent verification frameworks earn their place. Visa’s Trusted Agent Protocol and the signature-based approaches described in how merchants verify AI agents exist precisely so that a bot wall can let a known agent through while keeping unknown scrapers out. Until those are deployed on both sides, a blanket 403 is a blanket 403 for agents too.
What a merchant should decide
- Know what your bot layer does to an identified, non-browser user agent. Run the public scanner on your own homepage; the result is the same request the barometer sent.
- Decide explicitly which agents you want to serve: none, verified agents only, or any agent that declares itself. Each answer is defensible; the default one is not a decision.
- If you choose verified agents, document the verification path you support and keep the discovery surface (
/.well-known/ucp,robots.txt,llms.txt) reachable even when the storefront is protected, as the two merchants above already do. - If you choose to serve declared agents, allow-list identified user agents at the bot layer and rate-limit them instead of blocking them; the barometer counts 429 as closed too, but a rate limit is at least a conversation.
Limits
A single request per merchant on one date, from one address per country. Some 403s are geographic, some are triggered by the first visit only, and a store that answers 200 today can be closed tomorrow after a security change. The barometer will replay the same 500 addresses in October 2026 and report which stores opened or closed.