Wix quietly installed NLWeb on 8 million sites. The endpoints are locked.

In March 2026, Wix quietly shipped the largest platform-level GEO change since robots.txt. Every eligible Wix site — 8 million live domains — got a new endpoint: `/_api/nlweb/mcp`. AI assistants can use this endpoint to query your site's content directly, without scraping HTML. The press called it a revolution. We fingerprinted 10 Wix domains using Hidden Layer's platform detector and called `/_api/nlweb/mcp` on each. All 9 premium custom-domain sites returned HTTP 401. Wix.com itself doesn't run NLWeb.

The infrastructure is there. The access is gated. Here's what it actually means for AI discovery — and what you need to do before agents can reach you.

What NLWeb actually is

NLWeb (Natural Language Web) is an open protocol conceived by R.V. Guha — the computer scientist who created Schema.org, RSS, and RDF — and announced at Microsoft Build on May 19, 2025. It has nothing to do with Wix specifically. Wix was simply the first major platform to ship it at scale.

The core idea: turn any website into a conversational endpoint that AI agents can query directly. Instead of an agent scraping your HTML and hallucinating summaries, it calls your `/ask` endpoint with a natural-language question and gets a structured, source-attributed answer drawn from your actual content. Your Schema.org markup, product feeds, and RSS become the data layer. The agent never touches your HTML.

Every NLWeb instance is also an MCP server. One endpoint (`/mcp`) serves both AI assistant integrations and direct agent queries. That's why it matters for GEO: a site with NLWeb running can be operated by Claude, ChatGPT, and Copilot natively — not just read by their crawlers.

The 9-month rollout that most people missed

NLWeb's path from announcement to mass deployment unfolded in three stages:

The initial adopters at Build 2025 were enterprise implementers: Tripadvisor wired NLWeb to their Qdrant vector database for natural-language travel search. O'Reilly exposed 59,000 technical books via conversational query. Eventbrite tested it for intent-based event discovery ('what should I do on a first date on a rainy day'). These were bespoke deployments requiring engineering work.

Yoast's November 2025 integration brought NLWeb to WordPress publishers without any custom code — install Yoast Premium, get a `/wp-json/yoast/v1/nlweb` endpoint. Then in March 2026, Wix automated it entirely: enable NLWeb from your SEO & GEO dashboard, and Wix handles the backend.

What we actually found: the 401 problem

Hidden Layer's platform detector fingerprinted 10 Wix domains (9 premium custom-domain sites + wix.com itself) and ran the full NLWeb endpoint check on each. Average GEO score across the 10 Wix sites: 54/100 — below the corpus median, reflecting gaps in agent integration and structured data.

401 Unauthorized means the endpoint exists and is responding — it's installed. It does not mean the endpoint is publicly accessible. The NLWeb backend is live behind a Wix authentication layer. An AI agent hitting your Wix site without a valid auth token gets a 401 and moves on.

The press coverage claiming Wix made sites 'agent-queryable' was technically inaccurate. What Wix shipped was NLWeb infrastructure installed by default. Public access requires an explicit toggle in the SEO & GEO dashboard: NLWeb → Install → enable the ASK protocol for public access. Without that toggle, agents cannot reach your content.

This distinction matters for your audit score. Hidden Layer's `nlweb_endpoint` check awards partial credit (warn, 1 of 2 points) for a 401 response — the infrastructure is there, which is more than most non-Wix sites have. A 200 response with valid MCP JSON earns full credit (pass).

Three competing agent-access standards — and why it matters

NLWeb is not the only game in town. While Wix and WordPress/Yoast adopted NLWeb, Shopify and Webflow went their own directions. The result is three parallel, incompatible agent-access standards:

Shopify's implementation deserves special attention because it's frequently conflated with NLWeb. Shopify's Storefront Catalog MCP uses the Universal Commerce Protocol (UCP) — Shopify's own open commerce specification, separate from NLWeb entirely. UCP defines its own semantic layer for product search and cart operations. Microsoft listed Shopify as an NLWeb collaborator at Build 2025, but Shopify's own documentation makes no mention of NLWeb — only UCP.

For a site owner, this fragmentation creates a real question: which protocol do you implement? The honest answer is that most AI agents (Claude, ChatGPT, Copilot) can speak MCP regardless of whether it's backed by NLWeb, UCP, or a custom implementation. The transport is the same; the semantic layer differs. But agent discovery — how an AI finds your endpoint in the first place — is still unsolved across all three.

What this means for GEO scores across 128 domains

Agent integration is the category where every domain in our corpus scores the worst. Across 397 live audits, agent integration passes at 13% — meaning roughly 1 in 8 checks in this category passes. The `nlweb_endpoint` check we shipped this week was missing from the auditor entirely. Every Wix site we'd previously audited showed worse agent integration scores than they actually deserved.

The broader picture: llms.txt has 49% adoption across our corpus. OpenAPI spec has 2%. A2A agent card has 10%. NLWeb endpoint (newly measured) — we're running the first wave of checks now. The pattern matches what we see everywhere: static-file signals adopt quickly; protocol-level signals require infrastructure work, and adoption lags by 12–24 months.

OtterlyAI's 90-day study (Feb 2026) found that llms.txt pages received 84 of 62,100 AI bot visits — 0.1% of all crawl activity, 3× worse than average pages. Being technically agent-accessible does not automatically mean being crawled. NLWeb endpoints face the same discovery problem: until AgentFinder (Microsoft's NLWeb discovery index) or AI assistants learn to probe for `/_api/nlweb/mcp` systematically, having the endpoint unlocked is necessary but not sufficient.

What to do — by platform

The action depends on your CMS:

• Wix (premium plan with custom domain): Go to SEO & GEO Dashboard → Tools & Settings → NLWeb → Install. Toggle ASK protocol to public. Then audit your Schema.org completeness — NLWeb answers are only as good as your structured data. A product site with no Product schema will return garbage responses even with NLWeb enabled.
• WordPress + Yoast Premium: You already have `/wp-json/yoast/v1/nlweb` if you're on Yoast Premium, WooCommerce SEO, or SEO AI+. Verify the endpoint returns valid JSON. Check that your Schema Aggregation output includes the content types you care most about.
• Shopify: Your UCP Storefront Catalog MCP endpoint (`/api/ucp/mcp`) is likely live and exposing product search. Test it. This is a separate implementation from NLWeb but equally useful to AI shopping agents.
• Everyone else: The NLWeb reference implementation is MIT-licensed and runs on any server (Python, any vector DB). If you're on a platform that hasn't shipped NLWeb natively, you can deploy it yourself. But first audit your Schema.org baseline — without clean structured data, NLWeb returns noise.

The prerequisite for all of the above: Schema.org markup. NLWeb ingests your existing structured data and turns it into queryable embeddings. A site with no JSON-LD gets no benefit from NLWeb even if the endpoint is fully public — the model has nothing to retrieve. The GEO hierarchy still applies: structured data first, then protocols.

The bigger pattern: platform-level GEO is accelerating

Three years ago, GEO meant adding an llms.txt file and hoping for the best. Today, it means your CMS vendor is making architectural decisions on your behalf — shipping NLWeb endpoints by default, auto-generating llms.txt for eCommerce plans, managing your robots.txt for AI crawlers. Wix's March 2026 rollout is the clearest example: 8 million sites got new infrastructure without a single site owner writing a line of code.

The catch, as our live tests show, is that 'installed' is not the same as 'active.' Platform-level defaults tend toward conservative: install the infrastructure, gate the access, let users opt in. Wix followed this playbook exactly. The result is 8 million sites with locked NLWeb endpoints — better than zero, but not what the headlines described.

The sites that will benefit from the NLWeb wave are the ones that actively unlock it, validate their Schema.org output, and test their agent integration. The sites that benefit passively — waiting for the platform to handle it — will stay at 401 until they don't.

Audit your own endpoint

Hidden Layer's auditor now checks for `nlweb_endpoint` across Wix (`/_api/nlweb/mcp`), WordPress/Yoast (`/wp-json/yoast/v1/nlweb`), and the generic NLWeb reference path (`/_ask`). A 200 response with valid MCP JSON earns pass (2 pts in Agent Integration). A 401 or 403 earns warn — the infrastructure is there, agents can't reach it yet. A 404 is the baseline: NLWeb not detected.

Run your own audit at hidden-layer-blogs.pages.dev. See where you stand on NLWeb, MCP, A2A, OpenAPI, and the full agent integration stack — and get a prioritized fix list. The agentic web isn't a future state. It arrived in March 2026. The question is whether your endpoints are open.

See how your domain scores against these checks →