The same website scored 95 on our technical audit and 20 on Cloudflare's

Both scores had an explanation. Three of the faults were ours.

What each score measures

The isitagentready.com score is the number of checks passed out of 15: three passed give a 20 and four give a 27. They fall under discoverability (robots.txt, sitemap, Link headers, DNS records for agents), content (serving Markdown to whoever asks for it), bot access control (AI crawler rules and Content-Signal) and a block of 8 checks on APIs, OAuth and MCP that only makes sense if you offer something an agent can use. For a clinic or a factory, more than half the score depends on things it does not need.

Our score looks at something else: whether AI crawlers can get in, whether the page has structured data, content that can be cited and authorship signals. A website can be very well prepared for an AI search engine to read it and have nothing for an agent to operate. The three websites were exactly that.

What was wrong with ours

• It did not read noindex or nosnippet. With noindex a page drops out of Google and Bing, and Google documents that nosnippet and max-snippet:0 stop its text being used as a direct source for AI Overviews and AI Mode. A page carrying that tag could walk away with a 95. None of the 23 homepages had it, but the audit would not have noticed.
• It only looked for the sitemap at /sitemap.xml. A website with five sitemaps declared in its robots.txt was told it had none, because on its www version that path returned 404. And a sitemap index was counted as if each sitemap were a page: a site with more than a hundred pages came out as "3 URLs". Across the portfolio, 16 of the 23 homepages publish an index.
• Checks that "do not score" did weigh on the recommendations. The score ignored them, but the calculation that orders the actions turned their weight of 0 into 1.

And one more that does not affect the score: audits saved in June and July were still showing in the dashboard a citation multiplier we withdrew in July for having no source.

How much the score changed once fixed

Very little, and upwards. On the same audits, 13 of the 23 homepages went up and none went down; the largest rise was 4 points. That makes sense: fixing a false negative raises the score of whoever suffered it, and every site passes the new check.

Median 81 · 17 of 23 at 70 or above · 9 at the top level

That leaves the underlying criticism standing. Correcting the instrument does not make it more demanding: among websites that are reasonably well built, our score still separates them poorly. So we changed the method that same day. In version 2, whatever mechanically stops an AI from using the page (not responding, a noindex or nosnippet, search crawlers blocked in robots.txt, or a robots.txt returning a server error) no longer adds or subtracts points: it blocks, and the audit puts it first even if everything else scores 95. The top level stopped being called "Leader" and is now "Well prepared", and from there the audit says that improving the site moves little. The figures on this page come from the 10 September capture, taken before that change.

Agent signals, counted across the portfolio

The agent layer of our audit reviews 12 signals: serving Markdown, Content-Signal, Link headers, WebMCP, an MCP server card, a skills index, an API catalog, OAuth, protected resource metadata, an ARD catalog, auth.md and the bot signature directory. On 23 of 23 homepages there was not one. That matches what Cloudflare published in April 2026 when it launched its scanner: 3.9% of sites negotiate Markdown, 4% declare AI usage preferences and fewer than 15 published an MCP server card.

That is why this layer does not score. A grade that fails every website does not help tell them apart, and no AI search engine has confirmed it uses these signals to decide whom to cite.

What turned up without looking for it

• 4 of 23 websites rejected GPTBot, the crawler OpenAI uses to collect content for training its models, while serving the page to a browser: three with a 503 and one with a 406, every time, over five alternating attempts. The robots.txt of all four lets GPTBot in. With search crawlers all 4 returned 200: OAI-SearchBot, ChatGPT-User, PerplexityBot, Claude-SearchBot and Bingbot. One also rejected ClaudeBot, Anthropic's training crawler. This does not stop ChatGPT citing them. What there is, is a contradiction between what their robots.txt says and what their server does, and whoever decides should know which of the two they want.
• 2 homepages took more than 1.8 seconds to start responding, web.dev's slowness threshold for people. No AI crawler publishes how long it waits, so we do not turn it into a score.
• 2 websites have a sitemap but do not declare it in robots.txt, which is where crawlers that do not probe paths blindly look for it.

Correction of 10 September 2026, hours after publishing: the first version said these four websites rejected "the request that presented itself as GPTBot" without making clear that GPTBot is the training crawler. When the test was repeated with the search crawlers, all of them got through. It read as a block that does not exist.

And ours

vilnux.com scored a 20 on Cloudflare's scanner. We sell an audit that checks whether a website publishes its MCP server card, and our own MCP server had no card. Since 10 September the site publishes that card at /.well-known/mcp.json, an API catalog, Link headers on the homepage and a Content-Signal that allows its content to be used for search, for answers and for training. Run through the scanner again that same morning, it scored a 47 (7/15 checks). It does not serve Markdown on request yet. Our own audit score did not move: none of those signals counts towards it.