Mixed signal. Agents can reach the page, but guess from there.

Aesop scores 55 out of 100, a mixed signal that reflects a brand doing the schema-heavy plumbing well while leaving the front door bolted shut to the very agents that plumbing is meant to serve. The product data model is genuinely strong: every one of the ten sampled product pages ships full Product plus Offer JSON-LD, prices sit in raw HTML on all ten, and the robots.txt at aesop.com/robots.txt explicitly welcomes GPTBot, ClaudeBot, PerplexityBot, Google-Extended, Applebot-Extended, and six other tracked crawlers. Then the site turns around and returns 403 to those same agents at the URLs that matter most.

The single most damaging finding is the transactability collapse. Both /cart and /checkout returned 403, zeroing out the checkout flow structure check (0 of 6) and dragging guest checkout down with it (0 of 4). Ten points lost on a category where a Shopify backbone should have made this trivial. The cart API check confirms the Shopify form POST at sa.aesop.com/cart/add exists and works, so the underlying rails are fine. An agent that follows the welcome mat in robots.txt still hits a wall the moment it tries to actually buy something, which is the opposite of what the crawler allowlist advertises.

Trust signals are the second wound, and they compound the first. Returns policy (0 of 3), merchant verifiability (0 of 3), and third-party trust anchors (0 of 2) all failed. The verifiability classifier could not even extract a business name because the page it fetched returned a "Just a moment... Enable JavaScript and cookies to continue" interstitial. No Trustpilot, no Yotpo, no Bazaarvoice, no aggregate rating markup anywhere across eleven checked platforms. For a brand that trades on provenance and craft, having zero machine-readable trust anchors means an agent comparing Aesop to a competitor with a Judge.me widget will see the competitor as the more legitimate merchant. That is not a ranking Aesop should be losing on autopilot.

Bot detection posture reinforces the pattern: a 25 percent block rate across 32 fetches, with 403s on the apex homepage, /terms, /privacy, /about, /cart, /checkout, /sitemap.xml, and /llms.txt. This is the check that explains all the others. The sitemap check failed (0 of 4) not because Aesop lacks a sitemap (it declares sa.aesop.com/sitemap_index.xml inside robots.txt) but because aesop.com/sitemap.xml itself returns 403. The stated agent policy check failed (0 of 2) for the same reason: the classifier could not read terms or privacy because both were blocked. One overzealous edge rule is silently torpedoing four separate checks.

Smaller but fixable losses round it out. Decision-support metadata scored 0 of 3 with only two of ten pages carrying any use-case or suitability language beyond generic copy. Price stability signals scored 0 of 2 because not a single offer includes a priceValidUntil field, trivial to add in Shopify's Liquid layer. Variant enumeration hit only 1 of 10 pages despite five having variant pickers, meaning agents see the picker but cannot resolve the SKUs.

The single highest-leverage move is unblocking the apex domain and checkout paths for declared AI user-agents, which would immediately unlock roughly twenty points already earned by upstream infrastructure.