CanItBuyBot and CanItBuyAgent
If you saw CanItBuyBot or CanItBuyAgent in your logs, someone entered your store address on canitbuy.com to check how an AI shopping agent copes with it. Here is what our visitors do, what they never do, and how to opt out.
Who visits
- CanItBuyBot runs a quick static scan. It loads the home page, robots.txt, llms.txt, /.well-known/ucp, the sitemap and up to one product page. User agent:
Mozilla/5.0 (compatible; CanItBuyBot/0.2; +https://canitbuy.com/bot). - CanItBuyAgent is a real Chrome browser guided by an AI model. It tries to reach checkout the way a customer would. Its user agent is a regular Chrome string ending in
CanItBuyAgent/1.0 (+https://canitbuy.com/bot).
When it visits
Only when a person starts a test on canitbuy.com. There is no crawling and no schedule. Each domain gets one free agent test. Repeated tests will only be offered to owners who verify their domain.
What the agent does and never does
- Up to 16 steps and about two and a half minutes per test: it browses, opens a product, picks a variant, adds it to the cart and goes to checkout.
- It always stops before payment.
- It never places an order, creates an account, logs in, or types personal or payment data.
- It does not solve CAPTCHAs or bypass bot protection. If it is blocked, the report says so.
- It blocks common ad networks, so it does not create ad impressions or clicks.
- Products it adds stay in an anonymous guest cart that is never completed. Our browser session is deleted after the test.
How to opt out
Add this to your robots.txt. We check it before every scan and every agent test:
User-agent: CanItBuyBot User-agent: CanItBuyAgent Disallow: /
We treat only rules addressed to CanItBuyBot or CanItBuyAgent as an opt-out. A rule for all robots (User-agent: *) is not one, because every test is started by a person, like a visit in a browser. You can also write to hello@canitbuy.com from an address at your domain and we will block the domain on our side.