A New Kind of Visitor
A customer tells ChatGPT "order me more printer paper," and the agent handles it: finds the shop, adds the paper to the cart, goes through checkout. On your site, without a human ever touching the mouse.
Until now, websites knew two kinds of visitors: humans, who do things, and bots, that read. AI agents are a third kind — bots that do things. They search, compare, fill out forms, and buy, on behalf of real users.
For your site, this splits into two questions that have little to do with each other. Does the AI even recommend you? That's GEO, a field of its own and not the topic here. And: can the agent actually use your site once it's there? That's what this is about. The second part only pays off if the first one works, because the agent first reasons about where to go at all, just like with a normal chat question, and only ends up wherever the AI sends it.
GEO, AEO, AIO — Sorted Out Briefly
The acronyms swirl together. GEO (Generative Engine Optimization) means showing up in AI answers — in other words, being found. AEO here means Agentic Engine Optimization: making sure an agent can actually operate your site. (Older usage also had AEO stand for "Answer Engine Optimization," practically a synonym for GEO.) AIO and LLMO are further variants around being found. This article covers the agentic side.
The One Question: How Does the Agent Touch Your Site?
Everything hinges on this. You can rank at the very top of the AI's answer and still lose the sale if the agent trips over your checkout, your variant picker, or an unlabeled button. There are two ways an agent touches your site.
The agent clicks like a human
It looks at the rendered page and clicks the way a human would. The default case today.
What you optimize: usability — the accessibility tree, semantic HTML, server-rendered content.
The agent calls an interface
Here it doesn't click at all — it calls a defined endpoint directly. No browser, no interface.
What you optimize: the interfaces themselves — callable actions, protocol implementation.
Path A: Where the Browser Runs
The only real distinction is where the browser lives:
Dedicated AI browser
The agent is itself a browser. ChatGPT Atlas, Perplexity Comet, Dia, Opera Neon.
Browser extension
An add-on turns an existing Chrome/Edge browser agentic. Claude for Chrome, Gemini's "auto browse."
Cloud sandbox
The agent controls a remote browser. The original ChatGPT Agent.
Amazon "Buy for Me"
A closed-off variant that browses third-party shops via browser control and fills in the standard checkout form using stored customer data.
What you're optimizing here is usability. Agents mostly read the accessibility tree — the same one screen readers rely on. Semantic HTML, labeled buttons, server-rendered core content instead of a page that stays blank until JavaScript runs: these are the things that decide whether an agent completes the purchase or abandons it.
CAPTCHAs on every interaction, hover-only menus, and infinite scroll without pagination. Since almost all agents work this way today, this is the most important lever in the short term.
WebMCP: an early way to actively help the agent instead of merely not getting in its way. Alongside clean accessibility, the page here declares its actions directly, so the agent doesn't have to guess what a given button does. Still early, but it points in the direction things are heading.
Path B: The Agent Calls an Interface
Commerce protocols
UCP (Google), ACP (OpenAI), and the authorization protocol AP2 govern discovery, cart, and payment outside the UI. Payment runs through agent-specific tokens, so the agent never sees actual card data.
Direct HTML/API calls
The agent simply pulls content over HTTP, with no browser at all. Reliable, but barely used in practice today.
Whether You Even See It Depends on the Type
How well you can spot an agent depends on how it arrives.
Browser extension
Practically invisible — same session, same IP, ordinary Chrome
Dedicated AI browser
A rough signal — installation hints at agentic use
Cloud agent
Easiest to detect — data-center IPs, sometimes a distinct user agent
If it runs as an extension inside the user's own browser (Claude for Chrome, Gemini), it becomes practically indistinguishable: the agentic activity can't be separated from that same person's normal browsing, and the referrer barely helps, since depending on the case it's missing, shows as "direct," or comes from the AI platform.
Doesn't reliably help
- Standard analytics
- Referrer analysis
- Install counts alone
Actually helps
- Log file analysis
- Behavioral analysis
- Web Bot Auth (from outside)
- WebMCP (from inside)
Where to Start
Once visibility is in place:
Make key paths usable and test them
Keep search, cart, booking, and inquiry flows clean and robust. Look at the accessibility of these paths, and — above all — test them for real: have an AI browser like Comet actually work through the tasks. This can even be automated, showing you how often the agent gets through and exactly where it gets stuck.
Keep an eye on the interfaces
If you can't or don't want to build this yourself, wait and see what your shop system and payment provider bring in terms of UCP/ACP support. If you have the resources, you can get in early and position yourself as a first mover. That can be an advantage — but it isn't guaranteed to be.
Start measuring
Making all agent traffic visible simply isn't possible today. But you can take first steps: try out WebMCP, log whatever can be logged, and at least catch the early signs of this channel taking off.
English 
German