--- title: "WooCommerce and AI Shopping Agents: What the Store Actually Exposes" url: https://adityaarsharma.com/woocommerce-ai-shopping-agents-what-the-store-exposes/ date: 2026-09-04 modified: 2026-09-03 author: "Aditya Sharma" description: "One unauthenticated curl returned 1,717 products from WooCommerce's own store. Here is every surface an agent can read, and which agentic claims are built." categories: - "AI" - "WordPress" image: https://adityaarsharma.com/wp-content/uploads/2026/09/411cf2e1-ebe6-4133-9331-afffa6d96d16_1440x760-1024x540.png word_count: 2056 --- # WooCommerce and AI Shopping Agents: What the Store Actually Exposes I ran one command against WooCommerce's own store on 2 September 2026. No key, no token, no login. `curl -D - "https://woocommerce.com/wp-json/wc/store/v1/products?per_page=100" HTTP/2 200 content-type: application/json; charset=UTF-8 x-wp-total: 1717 x-wp-totalpages: 18 link: ; rel="next" cache-control: max-age=60` 1,717 products, 18 pages, 1,798,918 bytes in that one response, 3.1 seconds. Every product came back with price in minor units, stock status, review count, image URLs, category and brand terms, and an `add_to_cart` object. That is the whole catalogue of a store run by the company that makes the software, published to anyone who asks, in a format built for machines. ![The WooCommerce Store API returning full product JSON with no authentication.](https://adityaarsharma.com/wp-content/uploads/2026/09/411cf2e1-ebe6-4133-9331-afffa6d96d16_1440x760.png)woocommerce.com/wp-json/wc/store/v1/products?per_page=1 loaded in a browser with no credentials. Screenshot taken 2 September 2026. ### What is already true before any of this This is the part of the agentic commerce conversation that nobody starts with, because it is boring and already true. Your store already publishes a machine-readable catalogue. The interesting questions are what exactly is in it, what an agent can and cannot do with it, and which of the things vendors are promising this year are actually built. I went and read the specifications rather than the announcements. Here is the split. On this page - The honest starting point: iOS does most of this itself- A single screen: the ordinary screenshot- A long page: the full page capture- Turning that PDF into JPG images- Getting from PNG to JPG- An actual .html file, rather than a web page- Making the image fit whatever wants it- Frequently asked questions ## Surface one: the Store API, and it is on by default WooCommerce ships two REST APIs. The one people write about is [the authenticated wc/v3 API](https://developer.woocommerce.com/docs/apis/rest-api/) that needs a consumer key. The one that matters for agents is the Store API at `wc/store/v1`, and [its own documentation](https://developer.woocommerce.com/docs/apis/store-api/) is blunt about what it is: > This is an unauthenticated API. It does not require API keys or authentication tokens for access. > > WooCommerce Store API documentation, developer.woocommerce.com, read 2 September 2026 ### Why it is on It exists so the Cart and Checkout blocks can render on the client. It powers the block themes shipped with WooCommerce 11.0.1, which [the plugin directory](https://wordpress.org/plugins/woocommerce/) reports at 7,000,000+ active installations as of 2 September 2026. If you run the block checkout, this endpoint is live on your domain right now. The read endpoints an agent would care about: | Endpoint | What it returns | | -------- | --------------- | | `GET /wp-json/wc/store/v1/products` | Paginated catalogue. `per_page` defaults to 10, maximum 100. | | `GET /wc/store/v1/products/:id` | One product, including variations and attributes. | | `GET /wc/store/v1/products/collection-data` | Price range, attribute counts, rating counts for a filtered set. | | `GET /wc/store/v1/products/categories` | Category terms with counts. | | `GET /wc/store/v1/products/brands` | Brand terms. | | `GET /wc/store/v1/products/reviews` | Reviews, with reviewer name and rating. | ### The filters are the reason this is more than a dump The filter parameters are the reason this is more than a dump. From the same documentation page: `search`, `sku`, `min_price`, `max_price`, `on_sale`, `stock_status`, `rating`, `attributes[0][attribute]=pa_color&attributes[0][slug]=red`, `orderby=price`, and `related=34`. An agent asked for a red large shirt under forty dollars does not need to parse your theme. It needs one query string. `curl "https://example.com/wp-json/wc/store/v1/products?attributes[0][attribute]=pa_color&attributes[0][slug]=red&max_price=4000&stock_status[]=instock&orderby=price&order=asc"` ### Prices are in minor units Prices come back as integer strings in the currency's smallest unit, with `currency_minor_unit` alongside. `4000` with minor unit 2 is 40.00. Get that wrong in a script and you are off by a hundred. ### The field worth pausing on One field is worth pausing on. Every product object includes `low_stock_remaining` and `stock_availability`. If you have set a low stock threshold, your exact remaining quantity is public. ## The thing I did not expect: robots.txt says no WooCommerce's own robots.txt, fetched the same day, contains two groups for `User-agent: *`. The second one, written by Yoast, has this line: `# START YOAST BLOCK User-agent: * Disallow: /wp-admin/ Disallow: /wp-login.php* Disallow: /wp-json/ Disallow: /sso?*` ### How the two groups combine [RFC 9309](https://www.rfc-editor.org/rfc/rfc9309.html), the robots.txt standard published in September 2022, says that when more than one group matches the same product token, the matching groups' rules must be combined into one group. So the merged rule for every crawler on woocommerce.com disallows `/wp-json/`, which is the prefix of the endpoint I just pulled 1,717 products from. ### Why I got the data anyway I got the data because curl does not read robots.txt. Nothing does unless it chooses to. robots.txt is a request, and the request here is: do not read the catalogue feed that this store publishes for machines. That is almost certainly not a decision anybody made. It is the default output of an SEO plugin blocking the REST API, applied to a namespace that did not exist when that default was written. ### Who else has that line The same rule is on a large share of WordPress stores, because it ships with the plugin, not with the store. If you care whether an AI shopping surface can read your catalogue, that one line decides it for every crawler that obeys the file. Worth checking against how you handle the other WooCommerce URLs bots should not be walking, which I wrote up in [the piece on stopping add-to-cart URLs from being crawled](https://adityaarsharma.com/how-to-prevent-woocommerce-add-to-cart-dynamic-urls-from-crawling/). ## And robots.txt may not apply anyway OpenAI publishes [three separate agents](https://developers.openai.com/api/docs/bots) with three separate jobs. Read the entry for the one that fetches pages during a conversation: > ChatGPT-User is not used for crawling the web in an automatic fashion. Because these actions are initiated by a user, robots.txt rules may not apply. > > OpenAI, Overview of OpenAI Crawlers, read 2 September 2026 ### Three agents, three jobs So there are two different questions and one file cannot answer both. `OAI-SearchBot` decides whether your pages can appear in ChatGPT search answers, and OpenAI says blocking it removes you from those answers. `ChatGPT-User` is what fetches a page when a person asks about your product right now, and it treats robots.txt as advisory. `GPTBot` is training only. ### My own file, including its bug My own site allows all of them. Checking it while writing this, I found `adityaarsharma.com/robots.txt` is emitting the `Content-Signal` line three times, identically. It is harmless and it is still a bug in my own file, so I am naming it rather than pretending the audit came back clean. If you want the mechanism for controlling bots at the edge rather than in a text file, [the Cloudflare setup I use to stop email scraping](https://adityaarsharma.com/how-to-protect-emails-scraping-from-spam-bots-in-wordpress/) is the same idea applied to a different problem. Newsletter ## Agents in Production I check the things our industry takes on trust and publish what I actually found, including when it makes my own work look worse. One researched piece a week. Email address Get it weekly Free. One email a week. Unsubscribe in one click, and I do not send anything else. ## Surface two: the JSON-LD WooCommerce already writes WooCommerce generates Product structured data in core, in `includes/class-wc-structured-data.php`. I read the file on trunk on 2 September 2026. The Product node it builds contains: - `name`, `url`, `description`, `image`- `sku`, and if the SKU is empty it falls back to the numeric post ID- `gtin`, only if `global_unique_id` is set and passes a validity check- `offers` as an `Offer` with `priceSpecification`, `priceValidUntil`, `availability`, `url` and `seller`- `aggregateRating` and `review` when reviews exist- `inProductGroupWithID` when a specific variation is being rendered ### The absences are the part that matters Now the absences, because those are the part that matters. There is no `brand`. No `category`. No `color`, `size`, `material` or `pattern`. No `shippingDetails`. No `hasMerchantReturnPolicy`. Google's [merchant listing documentation, last updated 7 July 2026](https://developers.google.com/search/docs/appearance/structured-data/merchant-listing) lists all of those as recommended properties. WooCommerce core emits none of them. Your SEO plugin may add some. Core does not. ### Two details that will bite a machine reader Two more details from the source that will bite a machine reader. `priceValidUntil` is computed as `gmdate('Y-12-31', time() + YEAR_IN_SECONDS)`, which is 31 December of next year, invented, not something you set. And when a product has no SKU, the `sku` property in your structured data is the WordPress post ID, which is not an identifier any other system knows. ## Surface three: agentic commerce, separating the built from the announced The [Agentic Commerce Protocol](https://agenticcommerce.dev/) is real, open source under Apache 2.0, maintained by OpenAI and Stripe. The [GitHub repository](https://github.com/agentic-commerce-protocol/agentic-commerce-protocol) was created on 29 September 2025 and has 1,525 stars as of 2 September 2026. The latest released spec version is dated 2026-04-17 and it defines actual OpenAPI documents: | Spec file | Endpoints | | --------- | --------- | | `openapi.agentic_checkout.yaml` | `POST /checkout_sessions`, `POST|GET /checkout_sessions/{id}`, `POST /checkout_sessions/{id}/complete`, `POST /checkout_sessions/{id}/cancel` | | `openapi.cart.yaml` | `POST /carts`, `GET|PUT /carts/{id}`, `POST /carts/{id}/cancel` | | `openapi.feed.yaml` | `POST /feeds`, `GET /feeds/{id}`, `GET|PATCH /feeds/{id}/products` | | `openapi.delegate_payment.yaml` | `POST /agentic_commerce/delegate_payment` | ### Those endpoints live on your server Read that table again with one thing in mind: those endpoints live on the merchant's server. ACP is a specification for what you build, not a service you switch on. WooCommerce implements none of it in core. The honest limits are on the protocol's own home page, in its own FAQ, which is why I screenshotted it rather than paraphrasing it. ![The Agentic Commerce Protocol FAQ stating that discovery mechanisms are still being created.](https://adityaarsharma.com/wp-content/uploads/2026/09/32924cda-6cae-46e0-9c34-338564c6e483_1400x760.png)agenticcommerce.dev FAQ, screenshot taken 2 September 2026. The last answer is the one to read twice. Three sentences from that panel do most of the work: - **On listings:** "No, each AI platform will manage their own process for how businesses can participate. If your business wants to participate in ChatGPT, you'll need to apply."- **On discovery:** "We're working to create discovery mechanisms for AI platforms to identify businesses that have implemented ACP."- **On payments:** "Stripe is the first compatible PSP with its Shared Payment Token." ### What that means today A protocol whose maintainers say discovery is still being created is a protocol where implementing it does not make you findable. Today the path to being sold inside ChatGPT is an application form, not a specification. That is not a criticism of ACP. It is a correction to the marketing built on top of it, which reliably implies that adding a plugin puts your products in front of an agent. ## The adoption number nobody quotes The plugin directory is a cheap reality check, because install counts are published and cannot be spun. Searching wordpress.org for "agentic commerce" on 2 September 2026 returns 58 results. The largest one built specifically for WooCommerce is this: ![Agentic Commerce for WooCommerce on wordpress.org showing 50+ active installations.](https://adityaarsharma.com/wp-content/uploads/2026/09/2d7fb121-3837-40c1-b549-1f9c33ef720c_1440x1000.png)wordpress.org/plugins/agentic-commerce-for-woocommerce, screenshot taken 2 September 2026. Header art: "Shopping has moved to AI Chat. Is your Woo store there, yet?" Active installations, same screen: 50+. ![WooCommerce reports 7,000,000 plus installs, the largest agentic commerce plugin for it reports 50 plus.](https://adityaarsharma.com/wp-content/uploads/2026/09/5c733489-732c-452e-9c39-18497b3f424b_2912x1632-scaled.png)Built from the wordpress.org plugin directory figures in this post, read 2 September 2026. ### Two true things on one page The header says shopping has moved to AI chat. The sidebar on the same page says 50+ active installations. The next two ACP plugins in that search report 20+ each. WooCommerce reports 7,000,000+. Both halves of that page are true at once. Something is genuinely being built, and approximately nobody has installed it. If a claim about agentic commerce volume does not come with a number you can check, treat it as a projection. I could not find a published figure for orders placed through ACP against WooCommerce stores, and I am not going to estimate one. ## What is worth doing this week Four checks, all of them fast, none of them requiring you to believe anything about 2027. - **Find out what you are publishing.** `curl -s "https://yourstore.com/wp-json/wc/store/v1/products?per_page=1" | python3 -m json.tool`. Read every field. If `low_stock_remaining` or a price you thought was members-only is in there, decide that on purpose.- **Read your robots.txt for a `/wp-json/` disallow.** If it is there and you want AI surfaces reading your catalogue, that line is doing the opposite. If you want it there, keep it, but know you chose it.- **Check your Product JSON-LD for `brand` and a real `sku`.** Paste a product URL into Google's Rich Results Test. If `sku` is a five digit number that matches your post ID, your SKUs are empty.- **Look at your access log for `OAI-SearchBot`, `ChatGPT-User` and `ClaudeBot`.** Whether they are hitting you at all is a fact you can have today, unlike every forecast in this space. ### Where this connects If you are already running agents against your own WordPress install, the setup in [running Claude Code against WordPress](https://adityaarsharma.com/running-claude-code-against-wordpress-the-complete-setup/) covers the credential side, and [the piece on a scanner that missed cloaked spam](https://adityaarsharma.com/the-scanner-said-clean-the-site-was-serving-spam-to-googlebot/) is the same lesson in a different key: what a machine is served is not always what you are served. Two different readers, two different responses, one URL. If you want the vendor framing from the source rather than from a summary, OpenAI's own explainer is worth the fifteen minutes. https://www.youtube.com/watch?v=C6qcZdtIv54 **[Buy it in ChatGPT: Instant Checkout and the Agentic Commerce Protocol](https://www.youtube.com/watch?v=C6qcZdtIv54)**, on the OpenAI channel. Covers the buyer-side flow and where the merchant sits in it. Verified via the YouTube oEmbed endpoint on 2 September 2026. For the memory and retrieval side of building agents that act on store data, [the comparison of AI memory tools](https://adityaarsharma.com/ai-memory-tools-compared/) covers what actually persists between runs. ## Resources - [WooCommerce Store API documentation](https://developer.woocommerce.com/docs/apis/store-api/), including the unauthenticated statement and the full endpoint table- [Store API products endpoint](https://developer.woocommerce.com/docs/apis/store-api/resources-endpoints/products/), every filter parameter- [WooCommerce class-wc-structured-data.php on trunk](https://github.com/woocommerce/woocommerce/blob/trunk/plugins/woocommerce/includes/class-wc-structured-data.php), the source for what JSON-LD core emits- [Google merchant listing structured data](https://developers.google.com/search/docs/appearance/structured-data/merchant-listing), last updated 7 July 2026- [agenticcommerce.dev](https://agenticcommerce.dev/) and [the ACP specification repository](https://github.com/agentic-commerce-protocol/agentic-commerce-protocol)- [OpenAI crawler and user agent documentation](https://developers.openai.com/api/docs/bots)- [RFC 9309, Robots Exclusion Protocol](https://www.rfc-editor.org/rfc/rfc9309.html) ## More on WooCommerce and AI surfaces - [Product Feeds in 2026: Merchant Center and the AI Surfaces](https://adityaarsharma.com/product-feeds-2026-merchant-center-ai-surfaces/)