Why does my site return 403 to AI agents?
We request your homepage with an identified user agent and record whether a challenge or a 403 is returned instead of your page.
What it is
Most WAFs and CDN bot-management products classify any client that is not a mainstream browser as automation, and answer it with a 403 or a JavaScript interstitial that only a full browser can clear.
That policy predates agents acting for named buyers. It does not distinguish a scraper harvesting your content from an agent a customer asked to book an appointment with you.
We identify ourselves honestly on every request and record exactly what came back, so a block is a finding with evidence rather than an empty result.
Why an agent needs it
A block is the most complete failure on this list: no other Check can pass, because nothing was served. Your Score is produced from whatever we did reach, and the block is recorded as a Fail.
The same rule that stops us stops the agents your buyers use. Nothing on your site can be found, read or acted on until an identified agent is admitted.
The Fix
In your CDN or WAF bot rules, add an allow rule for the agents you are willing to admit, matched on user agent and ideally verified by reverse DNS or Web Bot Auth rather than user agent alone.
Keep rate limits: admitting an agent does not mean serving it unlimited requests. A 429 with a `Retry-After` header is a cooperative answer and a 403 is not.
Then state the same policy in robots.txt, so the rule an agent reads and the rule your edge enforces agree.
This one is a change in your own markup or edge configuration, so the Fix Pack cannot write it for you. A Report names every page it affects, with the Evidence.