AI Bots Read Your Website for Free. That Just Changed.

For thirty years the internet carried a payment system it never turned on. This week someone finally flipped the switch, and it changes who gets paid for what your business already knows.

AI Bots Are Already Your Biggest Unpaid Reader

It is a Tuesday afternoon in Manchester. Priya runs a small commercial kitchen equipment parts business, three staff, a warehouse, and a website with about four thousand spec sheets and compatibility guides she has built up over nine years. Last month she finally looked at her server logs properly. Nearly a third of the traffic hitting her spec sheet pages was not people. It was bots, GPTBot, PerplexityBot, ClaudeBot, Google-Extended, reading her pages one after another at two in the morning, never buying a single gasket.

Somewhere, a mechanic in Ohio typed a model number into ChatGPT and got the exact answer Priya spent nine years compiling. He never saw her name. He never visited her site. He got the answer and closed the tab.

Priya was not being hacked. She was being read, for free, at scale, by machines built by some of the best-funded companies on earth. Until this week, she had no real way to change that. Here is how the web has worked for the last two years:

• AI crawlers visit millions of small business websites every day.
• They read product pages, price lists, spec sheets, and how-to guides.
• They repackage the answer inside ChatGPT, Perplexity, or Google's AI Overviews.
• The person asking the question never clicks through to the source.

You have been an unpaid supplier to someone else's product. That is the plain version of a trend that has been building for two years. What is new is that the company sitting in front of roughly one in five websites on earth just built a till for it.

What Cloudflare Actually Shipped This Week

On July 1, 2026, Cloudflare opened the waitlist for a product called Monetization Gateway: a way for any Cloudflare customer to charge per request for content, an API, or a dataset instead of serving it for free. On August 4, it followed up with Cloudflare Wallets, the buyer-side half of the same system. Together they let a website owner set a price, and let an AI agent actually pay it, automatically, without a human clicking anything.

There are two kinds of wallet. An Account Wallet belongs to a person or a business. You fund it, you set the rules, you can withdraw from it. A Virtual Wallet belongs to an agent, operates through an API key, and can only spend what the Account Wallet owner allows, capped by an allowance, an approved-merchant list, and a maximum transaction size. Cloudflare's own framing is worth repeating plainly: if an agent is responsible for ten dollars, you worry a lot less about it than if it is responsible for a thousand.

Both sides plug into a payment standard called x402. This is the part that actually matters for your business, so it is worth understanding in plain English.

How x402 Works, In Plain English

The web has had an unused feature sitting in its plumbing since 1997: HTTP status code 402, officially reserved for "Payment Required," never actually built. Coinbase revived it in 2025, and it now runs under the nonprofit x402 Foundation, hosted by the Linux Foundation. The flow is four steps.

You can already see this running today. A small demo called AgentPay, built on Coinbase's Base network with a facilitator called KeeperHub, prices a live token-price lookup, a portfolio snapshot, and a market scan at five cents in USDC each. An AI agent fetches one file that lists every service, its price, and its schema, calls the one it needs, pays with its own wallet, and reads back a signed receipt, all with no sign-up, no dashboard, and no human in the loop. That is the mechanic Cloudflare is now wiring into a huge share of the ordinary web: your spec sheet, your price list, your product API.

Why This Is Bigger Than One Company

X402 is not a Cloudflare side project. The Linux Foundation operationally launched the x402 Foundation on July 14, 2026, with Coinbase contributing the original protocol and founding members that include Visa, Mastercard, American Express, Google, Amazon Web Services, and Circle. Stripe and the Tempo network shipped a competing agent-payment protocol of their own in March. Google has a parallel standard called AP2 for proving a human authorized an agent's purchase, and OpenAI and Stripe have one called ACP for agent checkout at a merchant. These are not rivals fighting for one winner. They are layers of the same emerging stack:

Whichever brand wins, the direction is the same: software is getting a native way to pay other software, and the first place it is landing is exactly where Priya's spec sheets live, ordinary web content and ordinary APIs.

Isn't This Just Crypto Hype?

It is fair to be skeptical of anything with a stablecoin attached. Here is the honest answer. You do not need to personally hold or understand cryptocurrency to use this. Cloudflare's Account Wallet is designed to be funded and managed the way you manage any other account setting, with conventional funding and withdrawal methods planned for supported countries, and self-funding via stablecoins as an option where that applies. The settlement underneath happens in USDC, a token pegged one-to-one to the US dollar, precisely because a payment rail that dodges volatility is the only kind an ordinary business would ever touch.

More importantly, none of this is mandatory. Blocking AI bots outright, through robots.txt or Cloudflare's existing bot management tools, is still there and still valid. Letting them read for free, the way things work today, is still there too. Charging is a third option that did not exist before this month. Nobody is forcing Priya to price her spec sheets. She now gets to decide, page by page, instead of the decision being made for her by default.

What To Actually Do About It This Week

1. Check who is already reading your site for free. Look at your server logs or Cloudflare Radar for GPTBot, ClaudeBot, PerplexityBot, and Google-Extended. Most owners have never looked. Most are surprised.
2. Decide your stance, page by page, not site-wide. A blog post that drives brand awareness might be worth leaving open. A proprietary spec sheet or a paid dataset is a different call.
3. If you are on Cloudflare, claim your cloudflare.pay handle now. It is free, takes two minutes, and locks in your name before someone else does, even though the paid features are still rolling out.
4. Put a number in your head for anything metered. If you run an API, a downloadable dataset, or a paid tool, decide roughly what a single call is worth to you, even a fraction of a cent. The billing infrastructure to actually collect it is arriving this year, whether you have thought about pricing or not.
5. If you already run your own AI agents, give them a Virtual Wallet mindset even outside Cloudflare. A fixed weekly allowance for the tools and data your agent is allowed to buy beats a blank company card every time, whichever platform you use.

What You Have After This

This week, you know exactly who is crawling your site, and your handle is claimed. This quarter, your highest-value pages have a price tag in your head, even if the checkout is not live yet everywhere you operate. Within a year, a slice of the traffic that used to cost you bandwidth for nothing starts paying you back instead, and any agent working on your behalf spends inside a limit you set, not a limit it discovers by accident.

The web spent thirty years carrying a payment code it never turned on. This week, someone finally switched it on. The only question left is whether your business is charging for what it built, or still giving it away.