STRATEGIES COMPARED
Five ways to handle AI agents on your store
AI crawlers, assistants and agent browsers already visit online stores, and some of them buy. A store can ignore them, block them, use its CDN’s controls, use its platform’s, or add Tactical. Here is what each one sees, attributes and lets you control, what it costs, and where each is the better choice. Most stores will want more than one.
01Side by side
| Strategy | What it sees | What it attributes | What it controls | Cost and undo | Works with the others? |
|---|---|---|---|---|---|
| Do nothing | Little. AI crawlers never fire an analytics tag; agent browsers are counted as people. | Nothing, by agent. An order placed in an agent checkout fires no browser pixel. | None. Agents come on your platform's default terms. | Free. No setup, nothing to undo. | It is the default the other four change. |
| Block allrobots.txt, bot-fight modes, WAF rules | Nothing new. At most, a log of what was blocked. | Nothing. | On or off for every bot it catches. robots.txt is a request, not a lock. | Free or cheap, and easy to reverse. It costs AI search visibility and whatever those agents would have bought. | It overrides the finer controls, and doesn't reach a platform's own AI channels. |
| CDN controlse.g. Cloudflare | Bots that declare themselves, checked against its verified list. Granular scores for other bots are an Enterprise add-on. | Nothing. It sees requests, not orders. | Search, Agent and Training crawlers, each blocked or allowed; rules on URLs and request fields. | Free on every Cloudflare plan. One setting to undo. | Yes. Tactical's Cloudflare connection leaves these settings as they are. |
| Platform nativee.g. Shopify Agentic | Traffic from the platform's own AI channels. | Sales, orders, online store sessions and conversion per AI channel. | Catalog access and direct checkout per AI channel; hide single products. | Free and built in. On by default for eligible stores. | Yes, for that platform's channels. It doesn't come with you to another platform. |
| Tactical | AI crawlers (with a server-side install), agent browsers scored on behaviour, and AI-referred buyers. | Agent orders, including agent-checkout orders pixels never see, and AI-referred orders, kept apart. Order data comes from WooCommerce today. | Not yet. Drop protection and agent-checkout rules, coming. | Scout is free; Radar ($39/mo), Command ($129/mo). Uninstall to undo. | Yes. It runs beside your CDN and platform controls and doesn't change their settings. |
02Do nothing
- Good at: costing nothing. There is nothing to install, maintain or undo, and on some platforms agents can already buy from you without any work on your side: Shopify’s agentic storefronts are active by default for eligible stores.
- Falls short: you can’t tell what is happening. Google Analytics excludes known bots, and you can’t turn that off (Google Analytics Help). AI crawlers don’t run JavaScript, so no analytics tag fires for them, and an agent browser that does run it is counted as a person. An order placed inside an AI platform’s own checkout never loads your storefront: on Shopify, Google Analytics and custom pixels don’t fire in Meta’s direct checkout. The agents come either way; you just don’t see them.
03Block all
robots.txt rules, a CDN’s bot-fight mode, or firewall rules that turn bots away.
- Good at: being simple. A robots.txt line or a firewall rule takes minutes, costs little or nothing, and is easy to take back.
- Falls short: it is blunt. The agent that would buy is treated like the crawler that only copies. robots.txt is a request, not a lock: the standard says its rules are not a form of access authorization. Blocking search crawlers costs you AI search: OpenAI says sites that opt out of OAI-SearchBot won’t be shown in ChatGPT search answers. Agent browsers that behave like people pass blanket bot rules, unless the rules are strict enough to catch people too. And on Shopify, the AI channels get your products through Shopify Catalog, so robots.txt doesn’t decide that; Shopify’s channel settings do.
04CDN controls (e.g. Cloudflare)
- Better than Tactical at: keeping declared AI crawlers out, at the edge, for free. Since July 2026 every Cloudflare plan, the free one included, can set Search, Agent and Training crawlers to be blocked on all pages, blocked on pages that show ads, or not blocked. Cloudflare verifies a bot that declares itself through a cryptographic signature, a published IP list or reverse DNS (verified bots), a stronger check than a user-agent match. If what you want is to keep training crawlers out, use this.
- Falls short: its AI crawler controls act on bots that declare themselves. Cloudflare also scores undeclared automation, from heuristics, machine learning and JavaScript detections, but granular bot scores are an Enterprise product (Bot Management). It knows requests, not commerce: rules match URLs and request fields, so a product, a cart, a checkout or a drop window is a path rule you write and keep up to date, within the plan’s budget (five custom rules on the free plan). And it sees no orders, so it can’t tell you what an agent bought.
05Platform native (e.g. Shopify Agentic)
- Better than Tactical at: the platform’s own AI channels. Shopify’s Agentic home reports sales, orders, online store sessions and conversion per AI channel, free and built in. Tactical can’t match that today: on Shopify it needs order access the app doesn’t have yet. With “Allow Shopify to manage for me” turned off, you set catalog access and direct checkout per AI channel.
- Falls short: it covers the platform’s own channels. An agent browser that shops your storefront the way a person does isn’t one of them; it arrives like any other visitor. Hiding a single product is broad: an Unlisted product (or one with the
seo.hiddenmetafield) is hidden from every AI channel, and from search engines too. And it is Shopify’s: it doesn’t come with you to WooCommerce or a custom store.
06Tactical
- Good at: the agents the other options don’t show you. It counts AI crawlers, which don’t run JavaScript, so seeing them needs a server-side install (the WooCommerce plugin, the Cloudflare connection or the Node middleware); crawler hits are marked verified only when the IP matches the operator’s published range. It scores agent browsers on behaviour, including the ones that never name themselves. And it shows you the people AI assistants send. How detection works.
- Orders: agent orders, including agent-checkout orders pixels never see, and AI-referred orders, attributed last-touch and labeled estimated. The two are kept apart. How attribution works.
- Works with the others: it runs beside your CDN and platform controls and doesn’t change their settings. The Cloudflare connection adds a Worker that reports crawlers and leaves your AI crawler settings and firewall rules as they are.
- Falls short: Order data comes from WooCommerce today; on Shopify it needs order access the app doesn’t have yet, and seeing crawlers on Shopify takes Cloudflare in front of the store. A behavioural score is a probability, not a verdict, and we haven’t published accuracy figures. No rules yet: drop protection and agent-checkout rules, coming. Past the free Scout plan (100 agent sessions/week) it costs money: Radar ($39/mo), Command ($129/mo).
07Use them together
These aren’t either-or. Your CDN sees declared bots. Your platform sees its own AI channels. Tactical is for what’s left: agent browsers that don’t announce themselves, the buyers AI sends you, and what both do on your store.
- Set your CDN’s AI crawler groups to what you want. Leave Search allowed if you want to appear in AI search answers.
- On Shopify, choose per AI channel whether it gets your catalog and direct checkout.
- Add Tactical to see the rest and, on WooCommerce, what agents buy.
Comparing Tactical with your analytics rather than your controls? Tactical vs Google Analytics.