Overview
JavaScript and Rate Limiting both elevate Retail's active barrier profile
| Value | |
|---|---|
| WAF | 96% |
| Antibot | 19% |
| CAPTCHA | 15% |
| JavaScript | 51% |
| Rate Limiting | 33% |
| TLS | 20% |
WAF leads at 96%. JavaScript (51%) and Rate Limiting (33%) together form a multi-layer active stack — more than most sectors deploy alongside WAF.
Barrier Landscape
JavaScript and Rate Limiting define Retail's layered active defences
| Value | |
|---|---|
| WAF | 96% |
| Antibot | 19% |
| CAPTCHA | 15% |
| JavaScript | 51% |
| Rate Limiting | 33% |
| TLS | 20% |
| Has robots.txt | 85% |
| Blocks AI crawlers | 29% |
WAF leads at 96%. JavaScript (51%) and Rate Limiting (33%) are both well above the cross-sector norm, giving Retail a markedly heavier active barrier profile than most sectors.
Two-barrier stacks are Retail's most common security posture
| % of sites | |
|---|---|
| 0 barriers | 1% |
| 1 barrier | 24% |
| 2 barriers | 40% |
| 3 barriers | 17% |
| 4 barriers | 11% |
| 5 barriers | 7% |
| 6 barriers | 0% |
40% of Retail sites carry exactly 2 barriers. 35% stack three or more. 1% carry none — a low share of unprotected sites for this sector.
Retail is moderately challenging to access — harder than most sectors
| Mean recommended tier | |
|---|---|
| All sites | 2.60 |
A mean recommended tier of 2.60 and a median of Easy place Retail toward the harder end of the sectors surveyed. 15% of sites are Simple to access; 48% require Moderate or above.
Easy is the most common access tier across Retail sites
| % of sites | |
|---|---|
| 1 - Simple | 15.2% |
| 2 - Easy | 37.4% |
| 3 - Moderate | 27.3% |
| 4 - Complex | 13.1% |
| 5 - Advanced | 7.1% |
Easy (37%) is the most common tier. Simple and Easy together account for 53% of sites, while 27% land at Moderate and 20% at Complex or Advanced.
robots.txt
Most Retail sites publish a robots.txt — coverage above the norm
| % of sites | |
|---|---|
| Publish a valid robots.txt | 85% |
85% of Retail sites publish a valid robots.txt. The 15% without a file leave crawl policy undefined — a lower gap than the cross-sector average of around 24%.
Retail's robots.txt files show moderate engagement with named bot policy
| % of sites | |
|---|---|
| 0 | 16% |
| 1 | 20% |
| 2–4 | 27% |
| 5–9 | 12% |
| 10–15 | 7% |
| 16+ | 18% |
A mean of 15.4 named agents reflects moderate bot-policy investment in Retail. 16% of sites name no agents; 18% name 16 or more. The median of 3 suggests a bimodal split.
AI crawlers draw the most robots.txt attention in Retail
| % of sites | |
|---|---|
| AI crawlers | 31% |
| SEO / search indexing | 25% |
| SEO audit tools | 21% |
| Commercial scrapers | 16% |
| Social / content scrapers | 10% |
| Archive / research crawlers | 5% |
| Monitoring / uptime bots | 0% |
AI crawlers are mentioned by 31% of Retail sites — the leading bot category. SEO / search indexing follows at 25%. Figures are percentages of all 100 Retail sites including those with no robots.txt.
Path-level mixed rules dominate Retail robots.txt posture
| % of sites | |
|---|---|
| Uniform per-agent rules | 35% |
| Path-level mixed rules | 49% |
| Allow-only (no Disallow rules) | 0% |
| Mixed AI posture | 5% |
| Blanket Disallow: / | 1% |
Path-level mixed rules lead at 49%, with uniform per-agent rules at 35%. Mixed AI posture reaches 5%.
AI crawlers are among the most-targeted agents in Retail robots.txt
| Disallowed | Allowed (whitelisted) | |
|---|---|---|
| * | 83% | 45% |
| GPTBot | 21% | 4% |
| Googlebot | 17% | 8% |
| PerplexityBot | 20% | 4% |
| ChatGPT-User | 16% | 3% |
| OAI-SearchBot | 14% | 5% |
| Bytespider | 18% | — |
| ClaudeBot | 18% | — |
| Google-Extended | 14% | 3% |
| CCBot | 17% | — |
| PetalBot | 17% | — |
| omgili | 14% | 1% |
| AdsBot-Google | 8% | 6% |
| Perplexity-User | 14% | — |
| Claude-User | 13% | — |
| Diffbot | 13% | — |
| cohere-ai | 13% | — |
| AI2Bot | 12% | — |
| EtaoSpider | 12% | — |
| PanguBot | 12% | — |
| Twitterbot | 5% | 7% |
| bingbot | 7% | 5% |
| Claude-SearchBot | 11% | — |
| Devin | 11% | — |
| FriendlyCrawler | 11% | — |
Values are percentages of all 100 Retail sites surveyed. The wildcard (*) leads at 83% Disallow. Among named agents, GPTBot, PerplexityBot lead the Disallow list — reflecting direct targeting of AI training and indexing bots.
Industry Cohort
Retail sits mid-table within the Retail & E-commerce cohort
| WAF | Antibot | CAPTCHA | JavaScript | Rate Limit | TLS | robots.txt | Blocks AI | Tier | |
|---|---|---|---|---|---|---|---|---|---|
| Apparel & Fashion | 91% | 21% | 15% | 49% | 54% | 32% | 69% | 4% | Tier 3 |
| Beauty & Cosmetics | 91% | 30% | 36% | 40% | 31% | 30% | 76% | 13% | Tier 2 |
| Computer & Video Games | 94% | 27% | 26% | 44% | 22% | 13% | 81% | 23% | Tier 1 |
| Computer Hardware | 93% | 30% | 20% | 42% | 33% | 15% | 73% | 13% | Tier 2 |
| Computers & Electronics | 86% | 13% | 17% | 34% | 18% | 15% | 73% | 9% | Tier 2 |
| Consumer Electronics | 92% | 27% | 27% | 46% | 29% | 20% | 83% | 9% | Tier 2 |
| Equipment & Supplies | 96% | 27% | 31% | 41% | 26% | 14% | 68% | 8% | Tier 2 |
| Food & Beverages | 92% | 24% | 26% | 51% | 31% | 11% | 68% | 23% | Tier 2 |
| Furniture | 97% | 33% | 28% | 49% | 40% | 21% | 67% | 5% | Tier 2 |
| Jewelry & Luxury | 83% | 28% | 23% | 41% | 42% | 34% | 80% | 9% | Tier 2 |
| Packaging & Containers | 95% | 18% | 35% | 42% | 17% | 11% | 80% | 6% | Tier 1 |
| Retail | 96% | 19% | 15% | 51% | 33% | 20% | 85% | 29% | Tier 2 |
| Sporting Goods | 89% | 26% | 24% | 41% | 49% | 32% | 78% | 7% | Tier 2 |
| Sports | 98% | 11% | 15% | 61% | 23% | 11% | 89% | 33% | Tier 1 |
| Textiles & Nonwovens | 92% | 6% | 38% | 35% | 17% | 14% | 78% | 7% | Tier 1 |
| Tobacco | 98% | 30% | 52% | 38% | 30% | 15% | 76% | 3% | Tier 1 |
| Wholesalers & Liquidators | 94% | 24% | 22% | 44% | 30% | 13% | 80% | 7% | Tier 2 |
| Wine & Spirits | 95% | 24% | 28% | 47% | 32% | 15% | 84% | 14% | Tier 1 |
Across Retail & E-commerce, Retail's barrier rates are broadly in line with peers. WAF at 96%, JavaScript at 51%, and AI blocking at 29% all sit near the cohort median. Tier difficulty (mean 2.29) is above the group average.