Can AI assistants read your Shopify store? A crawlability audit

A Shopify store is audited differently from a self-hosted site, because on a standard store Shopify runs the network edge and you do not. Much of what blocks a crawler on other platforms, a firewall rule or a CDN setting, is not yours to edit here. What is yours: robots.txt, store access mode, market and redirect settings, apps, and theme code. This audit walks those layers, then tests from outside, and says plainly what each test cannot prove.

Why bother? In the October 2026 edition we sampled answers through OpenAI's API with web search (gpt-6-luna) and Perplexity's Agent API with the Sonar model (perplexity/sonar). These are API samples, not what the apps show. Across all question types, including the alternative-to-a-brand question, and all three markets, the source list held a domain matching a recommended brand's name in 46.6% of OpenAI's 800 answers (pages the answer links) and 62.0% of Perplexity's 787 answers (pages its search retrieved). The match is a strict first-label rule that misses country domains and parent companies. Those are per-answer rates, not your odds, and they do not show that access caused anything. They do show that brand sites sit in the source lists, which is reason enough to make sure yours can be fetched.

What can you control on a Shopify store?

The last row is the one that surprises people. Shopify says its Cloudflare protection requires no action from you, and it says it does not support a Cloudflare proxy in front of a store. We did not find a Shopify setting for allowing particular bots at its edge. So the edge cannot be your fix, and a test from outside is the only way to see what it does.

Step 1: What does your robots.txt say, and to whom?

Open yourstore.com/robots.txt. In Shopify's help center, the default file lets crawlers request public content and keeps crawlers out of admin and cart pages. Look for four things.

1. A Disallow: / under User-agent: *, which blocks everything.
2. A group naming one of the agents in the table below.
3. Path rules that reach /products or /collections.
4. A robots.txt.liquid file in your theme. Shopify's developer documentation says the template takes the place of the generated file, so keep a saved copy of the current output and compare it with the rendered file before and after any edit.

Write down your policy for each agent before editing, and why. The crawlers and robots.txt guide covers the trade-offs. Both companies give a lead time near a day: OpenAI says about 24 hours for search results, and Perplexity says it may take up to 24 hours. Wait that long before judging a change.

Step 2: Is the store public?

The simplest block is a store that is not public. In the Store access section under Online Store, Preferences, check that private mode is off. In Shopify's description, every page is hidden from visitors and search engines while it is on, and a store in private mode cannot be in Shopify Catalog.

Step 3: Do redirects or market settings change what a bot sees?

For markets set up with their own domain, subdomain or subfolder, Shopify's automatic redirection detects a customer's geolocation and sends them to that market's URL. For markets that share a domain, Shopify says the content is not indexed by search engines. Two checks follow.

• Open your pages with the market selector set to your default market and make sure the facts a shopper needs, price, currency, availability and shipping regions, are complete there. We found no Shopify statement on which market version a crawler is shown, so treat the default market as the first thing to check, then repeat the check for each market and from a second location.
• List every app that redirects, geo-blocks or shows an age gate. Open its settings and look for what it does to search bots. A test from your own country only shows your own country's behavior, so use a different location or the app's preview mode.

Step 4: Is the information in the raw HTML?

Fetch a product page with a command-line tool, save the response, and search it for the price, the product name, the variant options and one review. For example, curl -s https://yourstore.com/products/your-product -o page.html saves the raw response to a file you can open in a text editor. Then compare with the page as a browser renders it.

Anything visible in the browser but missing from the raw response is built by a script after load. Common candidates are prices injected by an app, specs inside tabs that load on click, and review widgets. Google documents that it renders JavaScript with a headless Chromium once its resources allow. We found no statement on the OpenAI or Perplexity crawler pages about whether their crawlers run scripts. Until one says so, put core facts in the initial HTML your theme outputs.

Step 5: Do the sitemaps work?

Shopify says sitemap files are generated automatically at the root of your domain and updated when you add pages, products or collections. The main file links to separate sitemaps for products, collections, blogs and pages.

Open /sitemap.xml, open each child sitemap, and fetch a sample of product URLs from it. Each should answer with a normal page, not an error or a long chain of redirects. If a product is missing from the sitemap, check whether it is published to the online store.

Step 6: What status code does each bot's user agent get?

Request one product page, one collection page, your home page and your sitemap, once per agent in the table, with that agent's name in the user agent header. Use the full user agent strings from each company's documentation. Record the status code and the first lines of the body. For example, curl -s -o /dev/null -w "%{http_code}" -A "FULL-USER-AGENT-STRING" https://yourstore.com/products/your-product prints only the status code, where FULL-USER-AGENT-STRING is the string from the company's documentation. Test only your own store.

Step 7: What do the logs say?

If you have access logs, filter them for each agent's name and then check that the source addresses are in the company's published ranges. OpenAI publishes JSON lists of ranges for its bots, and Perplexity publishes lists for PerplexityBot and Perplexity-User. Perplexity advises combining user agent matching with IP verification. A name in a header is easy to forge, which is why both are used. Do not assume you have raw logs: check what your plan, your apps or a separately hosted front end provide. Without logs, steps 1 to 6 are the audit.

What can this audit not prove?

• A spoofed request is not the real bot. Your test comes from your IP address with a name in a header. A real crawler arrives from its published IP ranges, so a rule that checks both the bot name and the range passes the real bot and blocks a spoofed one.
• A 200 is not indexing. It shows your store answered. Whether an engine then uses the page is outside what a test can show.
• User-initiated fetches may differ. ChatGPT-User and Perplexity-User are documented as acting for a person, with robots.txt rules that may not apply or that are generally ignored.
• Access is not a recommendation. Our data cannot say what the engines could have read, only which pages appeared in source lists. The how to get recommended playbook starts with measurement and puts search-bot access second, so you can tell whether a change helped, and the product page audit covers what to say once a bot arrives.

Re-run the audit after any theme change, app install or market change. The 30-day plan places this audit inside a month of work. The methodology explains our source-list data.

Frequently asked questions

How often should I re-run the audit?

After any theme change, app install or market change, since each can alter what a bot is served. After editing robots.txt, wait about a day before judging the result, because both OpenAI and Perplexity say their systems can take around 24 hours to adjust. For network-level bot questions on a standard store, Shopify Support is the place to ask.

Should I block GPTBot?

That is a policy choice about training use, not a crawlability fix. OpenAI says its bot settings are independent of one another, so a site can allow OAI-SearchBot and disallow GPTBot.