A business owner in Birmingham has a well-optimised website. Products, pricing, service areas, case studies, contact form. Good SEO. Decent traffic. Conversion rate that keeps the sales team busy enough.

Then an AI agent for a potential customer in Bristol scans the site. The agent reads the product specs, checks the pricing, cross-references it against three competitors, looks at the service guarantees, reads the case studies and then routes the qualified lead to a different supplier because that supplier's product data is structured, accurate and machine-readable.

The Birmingham business never knew the agent visited. Never knew the lead existed. Never got the sale.

That is not a visibility problem. That is an extraction problem.

And it is about to get more complicated.

The received wisdom

Most businesses still think of AI website visitors in one of two ways.

Either they are friendly crawlers: search engines, answer engines, chatbots citing sources. You want them to find you, read you, reference you. If they cite you properly, that is marketing.

Or they are hostile crawlers: scrapers, training bots, content pirates. You want to block them, throttle them, make it harder to extract value at scale.

Both reactions are understandable. Both are incomplete.

The honest picture is messier. Some AI visitors are genuine leads. Some are your best customers using agents as a first filter. Some are competitive intelligence systems. Some are training crawlers. Some are buyer agents working for someone who never lands on your site at all. Some are middleware that extracts your content and serves it alongside competitor ads.

The person who built your website probably did not ask which machines were going to use it, what they would use it for, or whether that use was worth anything to you.

That question was not on the brief.

It is now.

The actual truth

Cloudflare made a quiet move in July 2026 that deserves more attention than it is getting.

Its Monetization Gateway, built on the x402 protocol, is designed to let resources behind Cloudflare charge for access. Not a checkout page. Not a subscription form. A machine-readable payment requirement that an AI agent can honour automatically, settle, and continue the request. No human in the loop.

The practical implications are more immediate than the crypto framing suggests.

What Cloudflare has actually done is propose a standard way for websites to distinguish between the different things machines do with your content and tools, and to treat some of them as billable events rather than free marketing.

Apify has already integrated x402 into its actor marketplace. CPAY and eco.com have written detailed breakdowns. Reptile.haus called it the HTTP status code that finally makes AI agents pay for things. Whether stablecoin settlement is the long-term answer or not, the direction is clear: the infrastructure for machine-to-machine paid web requests is arriving.

The question most businesses have not answered is what they would charge.

Here is the short version of the problem. A typical business website now contains:

To a human visitor, those are different things on the same site.

To an AI agent, they are resources. Some it takes for free. Some it might pay for. Some it should not access at all. Some it uses to serve a buyer. Some it uses to undercut your prices or poach your customers.

Most businesses have not mapped which is which.

The companies that will do well in the next phase of the web are the ones that have already decided:

That is a machine price sheet. Not a literal menu pinned to the homepage. A clear internal classification of every commercial asset on the site by value, risk and buyer type.

The implication

You do not need to implement x402 tomorrow. You almost certainly should not. Stablecoin settlement, accounting treatment, tax implications and fraud protection for machine payments are all genuinely unresolved for most SMEs.

What you do need is the map.

Ask the question for every significant asset on your site: if a machine uses this, is that a lead, a cost, a risk, or a sale?

If it is a lead, make it easy to find, clean, well-structured, properly cited. That is SEO and content work you should already be doing.

If it is a cost, meter it or throttle it. Do not let one hungry crawler burn through your API at no return.

If it is a risk, require identity, authentication and approval before anything changes on the customer side.

If it is a sale, design the transaction properly, keep the receipt and make sure the buyer agent knows what it is paying for.

The two lazy responses are leaving everything open and hoping the right traffic finds you, or blocking everything and wondering why you have disappeared from AI overviews and buyer agent recommendations.

Neither is a strategy. Both are increasingly dangerous.

The close

The web is moving from pages and visitors to resources, requests and receipts.

If you have not decided what your machines can use, for what, and at what price, you are not invisible. You are just unpriced.

And in a world where agents are already making buying decisions on behalf of real customers, unpriced is the same as giving it away.

Further reading

FAQ

What is a machine price sheet?

A machine price sheet is an internal classification of website assets by value, risk and buyer type. It defines what machines can access freely, what should be metered or paid, what needs identity and approval, and what should stay off limits.

Does every business need to implement x402 now?

No. Foundry Works' view is that most SMEs should not rush into machine payment infrastructure before they have mapped their content, data, APIs, tools and risks. The first job is deciding what each asset is worth and what kind of access is acceptable.

Why do AI agents change website strategy?

AI agents can evaluate, compare and act without a human landing on the site. That makes website assets more than pages for visitors. They become resources machines can use, meter, pay for, misuse, or recommend.

How should a business prepare for AI agents visiting its website?

Start by making high-value commercial information accurate, structured, current and attributable. Then classify which assets should be open for discovery, which should be metered, which need authentication, and which should not be available to automated systems.