Agentic Commerce Statistics 2026: How Many Stores Are Ready?

Agentic commerce statistics for 2026 show a readiness gap. Only 4.7% of 115,468 popular websites publish a Universal Commerce Protocol (UCP) manifest, the file AI shopping agents read to learn what a store can do. In our probe of 19,044 storefronts, 73.0% of Shopify stores publish one, because Shopify switched it on by default.

The pages that rank for this term explain what agentic commerce is. None of them counts how many stores an AI agent could shop today, so we did, from two sources: Cloudflare Radar's agent-readiness scan of 2 November 2026, and our own probe on 7 November 2026 of /.well-known/ucp on 19,044 storefronts that TechnologyChecker detects on nine ecommerce platforms.

Websites have answered "may an AI read me?": 82.8% of popular domains write AI rules into robots.txt. Most haven't answered "can an AI buy from me?", and where the answer is yes, the platform gave it. I run the crawling infrastructure behind TechnologyChecker's detection; below, I read what those manifests contain and where the numbers mislead.

Agentic commerce statistics: how many websites are ready for AI shopping agents in 2026?

About one in twenty popular websites publishes the file a shopping agent looks for first. Cloudflare Radar's scan of 2 November 2026 found a UCP manifest on 5,429 of the 115,468 domains it scanned successfully, or 4.7%. The same scan found AI-crawler rules in robots.txt on 95,630 of them.

Cloudflare launched its Agent Readiness score in April 2026 with a weekly Radar dataset of popular domains. The scanner fetches a fixed list of files and headers from each site, from robots.txt to commerce manifests. Radar reports domain counts; the percentages below are ours.

The table splits in two. Checks about reading a site pass on most domains; checks about acting on it (calling a tool, searching a catalog, checking out, paying) pass on a few percent at most. UCP leads the commerce and agent-tool checks by a wide margin.

Which kinds of websites publish UCP?

Shops, and almost nobody else. Radar tags each domain with content categories, and UCP shows up on 22.1% of its Ecommerce domains and 20.6% of Society & Lifestyle, where fashion and beauty stores land, against 0.11% of News & Media. Vehicles (7.1%) and Sports (5.4%) follow, both categories with plenty of hosted shops.

Source: Cloudflare Radar, radar/agent_readiness/summary/check with domainCategory, scan of 2 November 2026; the 16 largest categories. Each rate uses that category's own domain count, and a domain can sit in several categories.

Ecommerce domains are the likeliest of all to have AI rules in robots.txt (93.0%), yet more than three in four publish no UCP manifest. OAuth discovery follows UCP almost category for category (22.8% of Ecommerce, 22.3% of Society & Lifestyle, under 10% everywhere else), which fits UCP's identity-linking capability: an agent that buys has to sign the shopper in. MCP server cards, meanwhile, are commonest on technology sites (1.44%), not shops.

Radar's 22.1% and our 73% in the next section measure different things: ours is a rate among stores we already know run Shopify, while Radar's covers every ecommerce domain, whatever it runs on. The two are consistent.

Which ecommerce platforms publish UCP? Our storefront probe

Three hosted platforms publish UCP for most of their stores; the other six, hosted Squarespace included, almost never do. On 7 November 2026, 85.7% of BigCommerce, 73.0% of Shopify and 65.0% of Wix storefronts that gave us a clear answer served a valid manifest at /.well-known/ucp. Magento was at 3.8%, Salesforce Commerce Cloud at 2.3% and WooCommerce at 1.8%.

Source: TechnologyChecker probe of /.well-known/ucp, 7 November 2026. Undeterminable means a 401, 403, 429, 5xx or timeout.

The split follows the platform. Shopify said in its Spring '26 Edition that Shopify Catalog and UCP "are enabled by default" for its merchants. We found no matching statement from BigCommerce or Wix in our sources, but BigCommerce stores at 85.7% and Wix stores at 65.0% publish at rates that look like a platform setting, not thousands of separate merchant decisions. On WooCommerce stores and the other five platforms, the rate never reaches 5%.

Undeterminable answers cluster on self-hosted platforms: 1,067 of 2,785 Magento probes and 815 of 2,895 WooCommerce probes hit a bot wall, a rate limit, a server error or a timeout. They tell us nothing about a manifest, so the headline rate leaves them out. On either rate, the nine platforms rank in the same order.

What is agentic commerce, and what does an AI agent need from a store?

Agentic commerce is buying and selling in which an AI agent acts for a person or business: it searches products, compares offers, builds a cart and completes checkout within limits the buyer sets. Unlike a chatbot that only answers questions, the agent calls the store's systems directly, so the store has to expose them in a machine-readable way.

That turns one shopping trip into a chain of machine requests, each with its own standard:

1. Find out what the store supports: a UCP manifest, an MCP server card or an A2A agent card.
2. Read the catalog: UCP's catalog capabilities, or product pages served as markdown.
3. Build a cart and check out: UCP's cart and checkout capabilities, or ACP.
4. Pay with proof of consent: AP2 mandates, ACP's Shared Payment Token, or HTTP 402 payments through x402 and MPP.
5. Show who the agent is: Web Bot Auth signatures and OAuth.

Demand is arriving before the plumbing. According to Adobe, traffic from generative AI tools to US retail sites rose 693.4% year over year between 1 November and 31 December 2025. In Radar's data, "user action" crawling, where an AI fetches a page because a person asked it to, was 4.5% of AI bot crawl purpose in the 28 days to 6 November 2026, up from 2.7% a year earlier. Our AI crawler statistics break down the other purposes.

Checkout is the least finished link. Shopify's ChatGPT channel hands buyers to the store's own checkout in an in-app browser or a new tab. OpenAI reportedly said in March 2026 that the first version of Instant Checkout "did not offer the level of flexibility" it wanted, and shifted ChatGPT shopping toward product discovery.

Which AI agents are already browsing stores?

OpenAI's do, by a wide margin. In the 28 days to 6 November 2026, OpenAI ran 70.5% of the requests Cloudflare classes as AI assistants, the bots that fetch pages because a person asked them to, and its ChatGPT agent alone sent 69.4%. These agents browse the store the way a person does, page by page, rather than calling a commerce protocol.

Source: Cloudflare Radar, radar/bots/summary/bot and bot_operator with botCategory=AI_ASSISTANT, 28 days to 6 November 2026. Anthropic's assistant bots made up 0.13%.

The category has grown fast. AI assistants sent 12.4% of all verified-bot requests in the four weeks to 6 November 2026, against 1.1% in the same weeks of 2025, and they now sit close to AI training and search crawlers (17.0%). Part of that growth is classification: Cloudflare Browser Run went from 0% to 32.6% of the category between mid-August and early November 2026, and DuckDuckGo's share fell from 9.7% to 0.4%, as Cloudflare added and relabelled agents. Read the jump as direction, not as a precise growth rate.

Retail is where crawlers spend their time. Retail sites took 21.5% of all crawler traffic in the 28 days to 6 November 2026, the largest share of any industry, ahead of Computer Software at 17.5%. On retail sites, 12.4% of AI crawling was for search and 1.3% was user action, a person's agent fetching a page on request.

The user-action slice is growing across the web. It rose from 2.5% of AI crawler traffic in the week of 18 May 2026 to 3.7% in the week of 26 October, while AI search crawling nearly tripled, from 4.4% to 12.1%.

Which agentic commerce protocols matter: UCP, ACP, AP2, x402, MPP, MCP and A2A?

Only one has real storefront adoption. UCP sits on 5,429 popular domains because platforms publish it for their merchants; the payment protocols have large backers and almost no presence on websites.

Radar count: domains out of 115,468 in the 2 November 2026 scan.

UCP is the discovery and checkout layer. Google announced it on 11 January 2026, with Mastercard, Stripe and Visa among its endorsers. Under the UCP specification, a manifest declares a version, services by transport, optional capabilities and payment handlers. Amazon, Meta, Microsoft, Salesforce and Stripe reportedly joined its Tech Council on 24 April 2026.

ACP came from OpenAI and payments processor Stripe, released on 29 September 2025 with Instant Checkout in ChatGPT, and each payment's token is scoped to one merchant and one cart total. Only the 2026-04-17 release added a discovery document, so the file Radar looks for has existed since April.

AP2 asks whether the buyer authorised the payment. Google announced it on 16 September 2025 with more than 60 organisations and in April 2026 handed it to the FIDO Alliance, releasing a v0.2 that adds "Human Not Present" payments.

x402 and MPP put payment inside HTTP. The Linux Foundation launched the x402 Foundation on 2 April 2026 with 22 supporting organisations, Shopify, Stripe and Visa among them. Stripe and Tempo launched MPP with Tempo's mainnet on 18 March 2026, and Cloudflare's MPP documentation says MPP clients can use existing x402 services unchanged.

The MCP server card, WebMCP and A2A rows describe tools and agents, not shops. The server card spec, SEP-2127, recommends a location that differs from the one Cloudflare's scanner checks, so read the 699 with care. WebMCP is in Chrome as an early preview, and the A2A agent card is a JSON profile of an agent.

Where does agent readiness break between announcement and storefront?

In four places. The biggest stores publish UCP least, most UCP hits on other platforms turn out to be Shopify stores, manifests differ by platform, and payment and identity signals are close to empty.

Merchant intent isn't the problem. In Checkout.com's 2026 agentic commerce research, 42% of merchants said they're already testing agentic commerce, and 70% called it the most disruptive force their industry has ever seen. What their storefronts publish depends on the platform.

Do the biggest stores publish UCP?

Less often than smaller ones. On Shopify, 65.2% of determinable stores in Radar's top 100,000 publish a manifest, against 83.9% of those ranked 100,000 to 1,000,000. Wix and BigCommerce show the same gap.

Share of determinable responses. Source: TechnologyChecker probe, 7 November 2026.

A probe can't tell us why. Three explanations fit: large brands more often run custom front ends that don't serve the platform's manifest, more sit behind bot protection that answers with a challenge page, and some turn agent channels off. Headless alone isn't the cause: in a ten-domain spot check, stores on Hydrogen, Shopify's own headless framework, served full manifests.

Shopify does give merchants a switch: its ChatGPT channel documentation explains how to turn off catalog access or direct checkout per channel under Sales channels > Agentic. It doesn't say whether that also removes /.well-known/ucp.

Are UCP hits on Magento or Salesforce Commerce Cloud native?

Mostly not. All 28 UCP hits on Salesforce Commerce Cloud stores are domains we also detect on Shopify, as are 46 of 65 hits on Magento stores, 21 of 38 on WooCommerce and 27 of 31 on Squarespace. Most of those manifests carry Shopify's own capability namespace, dev.shopify.*, which points to dual stacks or stores partway through a migration.

Take those out and native UCP outside Shopify, BigCommerce and Wix is close to zero.

Do all UCP manifests offer the same capabilities?

No. Each platform serves a different spec version and a different capability set, so "has a manifest" means something different on each.

For an agent, that matters. On a Shopify or Wix store it can search the catalog through UCP; on BigCommerce it has to find products some other way before using UCP for the cart. Shopify storefronts we checked also send a Link header pointing at /.well-known/ucp on HTML responses, so an agent can find the manifest from any page instead of guessing the path.

Are payments and agent identity ready?

Not on storefronts. The payment counts are in the protocol table, and identity signals are just as thin: Web Bot Auth, which lets a bot sign its requests (IETF working group), appears on 118 domains and auth.md on 116. OAuth metadata is more common, but it serves any API client, not agents in particular.

That leaves open the question no manifest answers: who's accountable when an agent buys the wrong thing? The protocols put the controls into the payment. AP2 records what the buyer approved in signed mandates, and ACP's token limits a payment to one merchant and one cart total. Neither shows up on storefronts at any scale yet.

How to prepare a store for AI shopping agents

Start with what your platform already publishes, then close the gaps it leaves. Each step comes from something we measured.

The timing is close. Adobe forecasts that AI traffic to US retail sites will rise 130% year over year this holiday season, and Kearney reports that AI-referred traffic to US retail sites converted 42% better than other channels in early 2026. Our Black Friday traffic and bot statistics cover last year's peak and what to watch this year.

1. Request /.well-known/ucp on your own domain. Try the apex and the www host, as our probe did. A valid response is JSON with a top-level ucp object holding a version, services, capabilities and payment handlers. A 401, 403 or 429 means something blocks automated requests first.
2. Know your platform's default. On BigCommerce, Shopify or Wix, the manifest is probably there, so check its spec version and capabilities against the table above. On WooCommerce, Magento, PrestaShop, Shopware, Squarespace or Salesforce Commerce Cloud, assume it isn't.
3. Give headless and custom stacks their own manifest. A platform default covers the storefront the platform serves. If a custom front end answers on your domain, /.well-known/ucp has to reach whatever generates the manifest, or agents get a 404.
4. Don't block the agents you want. In the 28 days to 6 November 2026, 39.5% of crawler requests in Radar's data got a 4xx response. A manifest behind a wall that turns agents away might as well not exist.
5. Keep robots.txt AI rules and commerce readiness apart. robots.txt decides who may read your pages (see which AI crawlers sites block). It doesn't tell an agent what it can buy.
6. Use Content Signals to state how content may be used. They add usage preferences for fetched content to robots.txt, and Cloudflare's scanner counts them under bot access control.
7. Serve markdown to agents that ask for it. Radar measures a 7.7× smaller payload when markdown replaces HTML, which leaves an agent less to download and parse on every product page.

If you sell to merchants rather than run a store, the platform was the strongest predictor of agent readiness we measured. A prospect's ecommerce platform, which TechnologyChecker detects from the storefront, tells you whether they likely publish UCP already or would have to build it.

Methodology

Radar scan. The first section uses Cloudflare Radar's agent-readiness check summary (radar/agent_readiness/summary/check) for the scan of 2 November 2026. Radar attempted 161,832 popular domains and scanned 115,468 successfully; that is our denominator, and the percentages are our calculation from Radar's domain counts. Category rows use each category's own domain count, and categories overlap. Radar context figures (crawl purpose, markdown payload, crawler response codes) cover the 28 days to 6 November 2026.

Radar bot data. The AI-agent section uses radar/bots/summary/{bot,bot_operator,bot_category} (verified-bot requests, filtered by botCategory=AI_ASSISTANT where noted), radar/bots/crawlers/summary/industry and radar/ai/bots/summary/crawl_purpose, 28 days to 6 November 2026 unless a week is named. Bot categories come from Cloudflare's verified-bot directory, and Cloudflare adds and relabels bots over time, so category shares move for reasons other than traffic. Cloudflare also changed its bot classification in late September 2026.

Probe sample. We joined Radar's top-1,000,000 domain bucket (26 October to 2 November 2026) to TechnologyChecker's live detection for nine ecommerce platforms: 113,619 domain-platform rows, so a domain detected on two platforms can appear under both. We probed every platform domain in the top 100,000 plus a random sample of up to 1,500 per platform from ranks 100,000 to 1,000,000 (seed 20261107), 19,044 storefronts in all, on 7 November 2026. Because a sampled domain can count under two platforms, a few lower buckets, Shopify's among them, exceed 1,500. Platform counts in the top million: Shopify 45,691, WooCommerce 34,387, Magento 13,345, PrestaShop 11,364, BigCommerce 3,083, Wix 1,753, Salesforce Commerce Cloud 1,568, Squarespace 1,389, Shopware 1,039.

The check. One HTTPS GET of /.well-known/ucp on the apex, then on www. if the apex failed. A store "publishes UCP" when the response is valid JSON with a top-level ucp object. 401, 403, 429, 5xx and timeouts are undeterminable and excluded from the headline rate, with the all-probed rate shown beside it. A bot wall answering 200 with a challenge page counts as "no manifest", which can pull rates down on large sites.

What a manifest proves. A store declares agent-facing commerce capabilities. It doesn't prove an agent can complete a purchase or that the store appears in any AI assistant, and we ran no agent purchases. In a separate ten-domain spot check on 7 November, all nine confirmed Shopify storefronts served a manifest and shopify.com, which isn't a storefront, returned 404.

Scope and detection. The sample is popular sites, not the long tail: TechnologyChecker counts 2,246,824 live Shopify stores (as of 27 August 2026), most of them outside Radar's top million. Detection counts domains, not companies.

Agentic commerce FAQ

What is agentic commerce?

Agentic commerce is shopping carried out by an AI agent on someone's behalf: it finds products, compares offers, fills a cart and checks out within limits the buyer sets. For a store, that means being callable by software, and the most common signal of it today is a UCP manifest.

What is the Universal Commerce Protocol (UCP)?

UCP is an open, Apache 2.0 protocol Google announced in January 2026 with Shopify, Etsy, Wayfair, Target and Walmart. A store publishes a JSON manifest at /.well-known/ucp listing its version, services and capabilities, such as cart and checkout, so an AI agent can call them.

Does Shopify support agentic commerce?

Yes, by default. Shopify enables Shopify Catalog and UCP for its merchants, and in our November 2026 probe about three in four Shopify storefronts that gave a clear answer published a manifest, almost all on spec 2026-08-25. The largest Shopify stores publish less often.

Does Salesforce Commerce Cloud support UCP?

Salesforce reportedly joined the UCP Tech Council in April 2026, but its storefronts don't show it yet. Only 28 Salesforce Commerce Cloud stores in our probe published a manifest, and every one of those domains also runs Shopify.

How does Stripe support agentic commerce?

Stripe co-developed the Agentic Commerce Protocol with OpenAI in September 2025, using a Shared Payment Token scoped to one merchant and cart total. It co-authored MPP with Tempo and is listed among UCP's shopping co-developers. On websites, ACP and MPP are still rare.

What companies are using agentic commerce?

Google, Shopify, Etsy, Wayfair, Target and Walmart built UCP; OpenAI and Stripe built ACP; Coinbase started x402; Stripe and Tempo launched MPP. On storefronts, the measurable adopters are stores on BigCommerce, Shopify and Wix, where most publish a UCP manifest.

Does Amazon use agentic commerce?

Amazon reportedly joined the UCP Tech Council in April 2026 with Meta, Microsoft, Salesforce and Stripe, and the UCP site lists it among shopping co-developers. Our data measures merchant storefronts, not Amazon's own agents, so it can't say how Amazon uses them.

What percentage of websites are ready for agentic commerce in 2026?

In Cloudflare Radar's 2 November 2026 scan, 4.7% of 115,468 popular domains published a UCP manifest, and just over a fifth of ecommerce domains did. ACP, MPP, x402 and AP2 each appear on fewer than 35 domains.

Which AI agents shop on websites today?

OpenAI's ChatGPT agent sends 69.4% of the AI-assistant bot requests Cloudflare sees (28 days to 6 November 2026), followed by Cloudflare Browser Run (22.0%), Meta's Muse (5.7%) and Shopify's Cloudsurf (0.59%). Most of them browse pages like a person rather than calling a commerce protocol.

Is agentic commerce the same as an AI shopping assistant?

No. An assistant answers questions and recommends products while a person does the buying; an agent completes steps itself, such as building a cart or checking out. Much of today's AI shopping sits in between, handing the buyer to the store's own checkout.

How do I check if my store is ready for AI shopping agents?

Request /.well-known/ucp on your domain and its www host. Valid JSON with a top-level ucp object means you publish a manifest; then check its spec version and capabilities. Also confirm your bot rules don't block the agents you sell through.