[Skip to main content](#vessel-content)
☰ Documentation
# Selling to AI shopping agents
Details Written by: Administrator Category: [Tutorials](/support/documentation/hikashop/tutorials) Published: 22 October 2026 Hits: 20
- [What AI shopping agents are](#what)
- [The checklist](#checklist)
- [1. Let customers buy as a guest](#guest)
- [2. Accept cards typed in the checkout](#card)
- [3. Do not block automated browsers on the cart and checkout](#bots)
- [4. Set up your products cleanly](#products)
- [5. Be findable](#findable)
- [6. Give agents a clean version of your pages](#markdown)
- [7. Write an llms.txt](#llmstxt)
- [8. Say who you are](#business)
- [9. Close what you do not use](#api)
- [Test it yourself](#test)
- [Online agent-readiness scanners](#scanners)
- [Agents that do not use your pages](#protocols)
- [FAQ](#faq)
### What AI shopping agents are
More and more people ask an AI assistant to buy something for them: "order a navy throw blanket under 250 euros", "reorder the coffee filters from last month". Assistants such as Claude Duet, ChatGPT's agent or the agent built into Chrome do this with a web browser of their own: they open your shop, find the product, add it to the cart and go through your checkout, the way a customer would.
To pay, they do not use the customer's real card. The customer approves the purchase in their wallet (for example Link from Stripe, or Shop Pay from Shopify) and the agent receives a single-use virtual card for that amount, which it types in your checkout like any card. For you, it is an ordinary card payment: you do not need a Link or Shop Pay account.
So there is nothing to install for these agents. What matters is that your shop lets a customer you do not know buy quickly with a card, which is also what your human customers want. The checklist below lists the settings that make the difference.
### The checklist
#### 1. Let customers buy as a guest
An agent buys for its user; it will not create an account with a password on your shop. If your checkout only offers to log in or to register, the agent stops there.
In **System > Configuration**, on the **Checkout** tab:
- **Registration**: tick **Guest**. You can keep **Registration** ticked as well for the customers who want an account.
- **Display method for registration**: with several registration modes, choose **Selector**, so that the customer (or the agent) picks Login, Registration or Guest.
- **Default registration view**: **Guest** opens the guest form directly, which saves a step to everybody who does not have an account yet.
In the Starter edition one registration mode is offered at a time: choose **Guest** there.
A guest only gives an email address and the addresses. This also works when that email already belongs to an account of your shop.
#### 2. Accept cards typed in the checkout
The single-use card the agent receives is an ordinary Visa or Mastercard number. Any payment method where a card number is typed works: the card fields of **PayPal Checkout**, Stripe, or the payment page of your bank.
A wallet button alone (the PayPal button, Apple Pay, Google Pay) asks the customer to log in to their wallet, which the agent does not do for them. Keep such buttons, but offer card payment next to them.
Bank transfer, check or cash on delivery orders can be placed by an agent too; the customer then pays them the usual way.
#### 3. Do not block automated browsers on the cart and checkout
HikaShop's checkout has no captcha of its own. Check what you added on top of it:
- a captcha extension on the checkout, the registration or the cart;
- the bot protection of your host or of a service such as Cloudflare ("Bot Fight Mode" and similar), which can refuse a browser it considers automated;
- a security extension or a firewall (CrowdSec, fail2ban, a "bad bots" list) that blocks visitors after a few quick pages or a few missing pages;
- rules in your robots.txt that keep out the agents and AI search engines (ChatGPT-User, OAI-SearchBot, Claude-User, PerplexityBot and the like). A rule for the crawlers that collect training data (GPTBot, ClaudeBot) is your choice and does not stop the agents that shop.
Firewalls are the most common trap. An agent, or a scanner checking your site for agents, starts by asking for the files that describe a site to AI (llms.txt, the files under /.well-known/, openapi.json...). Most of them do not exist on a shop, so the firewall sees a burst of missing pages and bans the address for hours, and every page after that fails. We saw it happen on our own site: CrowdSec's "http-probing" rule banned an agent-readiness scanner one second into its scan. If you run such a firewall, let these file names through, and look at its list of bans after a scan.
Keep the protections your shop needs against fraud and spam, but test the checkout after changing them (see [Test it yourself](#test)).
#### 4. Set up your products cleanly
An agent reads your pages and compares them with what its user asked for. Clear product names, a description, the price and the stock help it choose the right product.
For products with characteristics (colour, size...), create a variant for each combination you sell and make sure the default value of each characteristic has a variant: otherwise the product page shows a warning and the choice displayed first cannot be bought. The variants are listed in the edit page of the product.
#### 5. Be findable
Before buying, the agent has to find your shop. Agents use web search and the shopping catalogs of Google and OpenAI:
- the [Google Products plugin](/support/documentation/86-integration-with-google-products.html) generates the Google Shopping feed and the OpenAI (ChatGPT Shopping) feed of your products, and adds the structured data (price, stock, return policy) to your product pages;
- search engine friendly URLs and a published sitemap help as for any visitor.
#### 6. Give agents a clean version of your pages
A web page is mostly menus, scripts and layout; an agent only wants the text. More and more agents ask for a Markdown version of a page (plain text with a few marks for titles, lists and links), and Cloudflare's checks count it among the basics. A Markdown product page is a few kilobytes with the name, the price, the stock, the options and the description, instead of a hundred kilobytes of HTML.
On Joomla, our free [**LLM** plugin](/marketplace/integration/product/345-llm) does it for every page of your site, products, categories, articles and the home page, while your visitors keep getting the normal pages. It also takes care of points 7 and 8 below: it links your llms.txt from every page and completes the description of your business in your structured data. If your site is behind Cloudflare, its "Markdown for Agents" option converts your pages for the agents that ask for it, whatever your CMS.
#### 7. Write an llms.txt
llms.txt is a short text file at the root of your site (yoursite.com/llms.txt) that tells AI assistants what your shop is and where the important pages are. It is the first file agents and scanners ask for. It is yours to write, since only you know what matters in your shop; keep it short:
```
# Maison Verde
> Plants, pots and care products for indoor gardens, shipped across Europe from Lyon, France.
## When to use this shop
- Someone looks for indoor plants that are easy to keep, pet safe or suited to low light.
- Someone wants pots and care products matched to a plant.
## Shop
- [Indoor plants](https://www.example.com/plants): the full range, with filters by light and size
- [Pots](https://www.example.com/pots)
- [Delivery and returns](https://www.example.com/delivery): countries, prices, delays, returns
## About
- [About us](https://www.example.com/about)
- [Contact](https://www.example.com/contact)
```
Upload it next to your robots.txt. On Joomla, extensions can also write it for you, and the LLM plugin links it from every page once it is there; on WordPress, several llms.txt plugins are available on WordPress.org.
#### 8. Say who you are
Before sending its user's money to a shop it does not know, an agent looks for signs that it is a real business:
- an **About** page, a **Contact** page and a **Privacy** page, linked from every page (usually the footer) under those names;
- the description of your business in the structured data of your home page (the "Organization" of schema.org): a description, a contact page or email, your address (the city and the country are enough if you prefer) and your pages on other sites. Many templates only write your name and logo there; the LLM plugin adds the rest from its settings.
#### 9. Close what you do not use
Joomla answers at yoursite.com/api/ (its Web Services API), even when no application of yours uses it. Scanners then take your shop for a software service and expect API documentation from it, and it is a door attackers try: on our own site, every request to /api/ came from scanners and exploit attempts. If nothing of yours uses it, block /api/ in your web server (a rule in .htaccess on Apache, a location on nginx) or ask your host to.
### Test it yourself
In a private window of your browser, where you are not logged in:
1. open a product page from a search result or from your listing, choose its options and add it to the cart;
2. go to the checkout and continue as a guest with an email address of your own;
3. choose the shipping and the card payment, and pay with the test card of your payment provider in its test mode (or with a real card, then refund the order);
4. check that you reach the thank you page and receive the order email.
If you never had to create an account or solve a captcha on the way, an agent will get through too.
To check the Markdown version of a page (point 6), add ?tmpl=markdown to its address.
### Online agent-readiness scanners
Free online services check your site the way agents see it, and say what to improve:
- [isitagentready.com](https://isitagentready.com/), by Cloudflare: robots.txt, sitemap, Markdown, bot rules, and the agent commerce protocols for information;
- [is-agentic.com](https://is-agentic.com/), by Vercel and Ora: a score out of 100 and an agent trying to understand your site, with what it read;
- [agentgrade.com](https://agentgrade.com/): llms.txt, structured data, Markdown and content negotiation, with a grade.
Read their scores with care. Most of their checks are written for software services, not shops: an API with its documentation (OpenAPI), OAuth, an MCP server, payments made by a program for each request (x402, MPP). A shop does not need them, and you can leave those red. What matters for a shop is what this page lists: that agents can reach your pages, read them, find your products and buy as a guest with a card. The LLM plugin tells is-agentic.com that your site is a store, so its report puts the right checks first.
These scanners fetch dozens of pages in a few seconds: if the scan fails or stops halfway, look at your firewall first (point 3).
### Agents that do not use your pages
Some platforms do not browse your shop: they talk to it through an API. Google's agents use the **Universal Commerce Protocol**, which the [UCP plugin of HikaShop](/support/documentation/529-universal-commerce-protocol.html) provides. ChatGPT finds products through the OpenAI feed of the Google Products plugin and, at the time of writing, sends the customer to your shop to finish the purchase.
### FAQ
**Do I need a Link or Shop Pay account?**
No. The wallet belongs to the customer; your shop receives an ordinary card payment.
**Can an agent place an order without the customer agreeing?**
The assistants that buy ask their user to approve each purchase in the wallet before they receive the card. On your side, the order is like any other: you can cancel and refund it as usual.
**How do I recognise the orders placed by an agent?**
You do not: the agent fills in the customer's name, email and address and pays by card, as the customer would.
[](#top)