SAFE-106Beside the path
Intent segmentation
Checks whether an agent is treated more strictly at checkout than on the product page, so agents can browse while the money step stays guarded.
What we check
This probe runs in the owner-requested safety test. We send two read-only GETs with a spoofed agent user-agent, one to a product page and one to checkout, and compare how each is treated.
Why it matters
Instead of "block all agents" or "allow all agents", aim to let agents read product information (which drives sales) while applying stricter controls at checkout (where fraud concentrates). This check tests whether your defences treat the two differently.
How we check
PASS: the checkout challenged or blocked the agent persona while the product page did not, so the money step is guarded and browsing is open. FAIL (MEDIUM): the product page and checkout treated the agent identically (both open or both blocked), so there is no segmentation. SKIPPED: a product page and a checkout URL were not both available, or one could not be read. The probe sends two read-only GETs.
How to fix it
- Apply stricter bot controls on cart and checkout than on product and category pages.
- Allow agents to read product data freely so they can recommend and compare your items.
- Reserve challenges for the payment step and other sensitive actions rather than the whole site.
What good looks like
Same agent persona, two routes: GET /products/anvil (agent UA) -> 200, full page GET /checkout (agent UA) -> managed challenge Browsing is open; checkout is guarded.
Sources
Could an agent buy from your store?
The free scan runs all 51 checks on your store in about five minutes.
Scan my store