We Scored 193 Local Business Websites for AI Readiness. The Average Was 16 Out of 100
What a public agent-readiness checker actually measures, which of its checks matter for a local service business, and the short list of changes worth making — including the two that cost nothing and outrank every file.
Digital Funnels Team
Founder-led field note
Between August and September 2026 we ran 193 US local business websites through a free public agent-readiness checker while building a prospect list. All 193 returned a result. The 180 that carried a numeric score averaged 16 out of 100, and roughly 96% never moved past the band the tool calls Basic Web Presence.
Before that number gets quoted anywhere, two caveats belong with it. This is a convenience sample, not a survey: the businesses came out of Google Places and skew toward home services in a handful of metros. And a low score is not the indictment it looks like, because most of what the rubric measures was never designed for a five-page service website.
This article is the honest version of what we found and what we now recommend.
What passed, and what did not
Across the 180 scored sites, the pass rates fell into three clear groups.
- Widely adopted: robots.txt 83%, sitemap 82%, robots.txt AI rules 73%.
- Rare: Link headers 20%, UCP 11%, Content Signals 8%, Markdown negotiation 7%, OAuth discovery 4%.
- Absent entirely: fourteen further checks passed on zero of the 180 sites, including DNS-AID, Web Bot Auth, API Catalog, MCP server card, A2A agent card, WebMCP and four agent-payment protocols.
That third group is the reason the average sits at 16. Those are emerging machine-to-machine standards aimed at software platforms — an appliance repair company is not implementing an agent payment protocol, and should not be sold one.
Two numbers we want to correct
Two of these checks are routinely misread, including in our own earlier write-up, so we will state the correction plainly.
A missing robots.txt does not block anything
No robots.txt means everything is allowed. The 17% of sites without one are not being penalised; they are simply missing the one line that points crawlers at their sitemap. The version that genuinely causes harm is a robots.txt that returns a server error, which can pause crawling altogether.
A failed markdown-negotiation check does not mean your content is unreadable
Every HTML page is text, and extractors read it. Markdown negotiation is a narrower thing: whether your server returns a Markdown representation when something requests one via an Accept header. The clients asking for that today are largely coding agents, not the assistant a customer is holding.
What the evidence supports, and what it does not
Google states in its own documentation that no new machine-readable files or special structured data are required to appear in its AI features, and Search Central has said that maintaining an llms.txt neither helps nor harms Google Search rankings because Search ignores it. We are not going to argue with the vendor about its own product.
The narrower claim we will defend is this: nothing in a file makes an assistant cite you. What determines whether an assistant can use you at all is whether it can fetch your pages, whether you exist in the sources these systems retrieve from, whether anything off your own site corroborates you, and whether your copy survives a text extractor. The work below addresses those four things, costs an afternoon, and forces your own facts into one place.
We have no data linking any single file to a citation, a phone call or a booked job, and we are not going to invent any.
The two changes that matter most cost nothing
Neither of these is billable work, which is precisely why they come first.
1. Your Google Business Profile
When somebody asks an assistant for a plumber or an appliance technician nearby, the answer is assembled from the Maps place record and its reviews — not from a text file on your website. Primary category, hours, service area, phone number and service list are the fields that matter. If that record is stale, nothing else on this page compensates.
2. Confirm a crawler can actually reach you
This is the most common real failure and it is invisible from your own desk. Bot protection on shared hosting, along with common security plugins and CDN rules, routinely returns a 403 or a JavaScript challenge to AI fetchers while your browser loads the same page normally. Crawlers do not execute JavaScript, so a challenge page is a dead end.
You want HTTP 200. Repeat it for Claude-SearchBot, PerplexityBot and Bingbot. If a terminal is not available to you, the same question to your host works: are you blocking AI search crawlers?
The three files, in the order we would add them
robots.txt
Goes at the root of your domain. The Sitemap line is the useful part; the Content-Signal line records what you permit AI systems to do with your pages, and 92% of the sites we scanned express no preference at all.
LocalBusiness structured data
This is the one that converts your name, address, phone number and hours from pixels into facts a machine can quote. It goes inside the head of your homepage.
llms.txt
Last, and deliberately so. It is an unproven convention rather than a standard, and Google ignores it. It costs ten minutes, it is plain text so nothing can be misparsed, and the exercise of writing it usually surfaces facts that are missing from the website itself.
The section that is not a file
The most useful part of that template is the list of what you do not do, and it does not need llms.txt at all.
Most of the bad calls owners complain about are not caused by invisibility. They are caused by being sent the job they do not take: the commercial unit, the address outside the service area, the brand they will not touch. Almost nobody writes that down. Put it in the visible text of your services page and in the services list on your Google Business Profile, which is what extractors read and what local answers are assembled from.
What score to expect
These changes move roughly four checks. Three of the four are already passed by most sites, so for many businesses this work buys exactly one row. Realistically it lifts a local service site from the bottom band to the top of Basic Web Presence, and no further. You will still see a column of red with names like MCP server card and Web Bot Auth. Leave those alone, and do not pay anyone to add them to a five-page website.
Past these files, the remaining work is server and CDN configuration: content negotiation, Link headers, and making sure your edge returns 200 to a crawler user agent rather than a challenge page. That is the honest boundary between what you can do from an admin panel in an afternoon and what needs an engineer.
How to verify
- Open your file URLs in a private browser window. That proves your browser can read them, not that a bot can.
- Run the curl check above. A 200 response matters more than any file on this page.
- Validate structured data with validator.schema.org, which answers whether your JSON is valid. Google's Rich Results Test answers a different question — eligibility for a specific rich result — and plain LocalBusiness usually is not eligible, so a null result there is not an error.
- Re-run the public checker. If it reports files as missing that you can plainly see in your browser, your host or security plugin is blocking bots, and that is the real finding.