The complete AI readiness setup for Squarespace in 2026

Squarespace hands you a finished website and a finished discovery layer at the same time. The robots.txt is written for you, the sitemap is generated for you, and the RSS feed already exists and is already declared in your page head. None of those three files can be opened, edited or replaced, because a Squarespace site has no folder you can put a file into.

For a few checks that is a real limit. The more useful way to read it is that your AI readiness here is decided by settings you have probably never opened: two checkboxes, one text field, and one code box that three of the four plans include. This guide covers what each changes, in what order to touch them, and how to prove the result rather than assume it.

Quick summary

Nothing on a Squarespace site is a file you own

Every other platform in this series gives you somewhere to put a file: Webflow an upload field, Ghost a theme folder, Next.js public/. Squarespace has none, and does not pretend otherwise. Its guide on viewing your sitemap answers "Can I edit my sitemap for SEO?" with a flat "No. You can't edit the sitemap or a page's source code."

So the mental model that works everywhere else fails here. You are not writing files that a crawler then reads. You are toggling settings, and Squarespace writes the files. The advantage is that they are always valid and always current: when you add a page the sitemap updates within an hour, according to the same guide, and priorities are assigned for you at 1.00 for the homepage, 0.75 for other pages and 0.50 for blog posts. A sitemap fetched from a live Squarespace-hosted site on 5 September 2026 carried those exact values.

The disadvantage arrives the moment a convention needs a file Squarespace has not built a switch for. There is no upload panel, so /.well-known/mcp/server-card.json, /.well-known/agent-skills/index.json, agents.md and llms-full.txt are all out of reach. All four returned a hard 404 on www.squarespace.com when probed on 5 September 2026, and no setting changes that.

Your robots.txt already names 26 AI crawlers

Here is the part almost nobody has looked at. Fetch the robots.txt of any Squarespace site and you will find a header comment reading # Squarespace Robots Txt, then a long stack of User-agent: lines: AI2Bot, Ai2Bot-Dolma, aiHitBot, Amazonbot, anthropic-ai, Applebot-Extended, Bytespider, CCBot, ClaudeBot, cohere-ai, cohere-training-data-crawler, DuckAssistBot, FacebookBot, Google-Extended, GoogleOther, GoogleOther-Image, GoogleOther-Video, GPTBot, img2dataset, Meta-ExternalAgent, MyCentralAIScraperBot, omgili, omgilibot, Quora-Bot, TikTokSpider and YouBot. Three Google AdsBot agents follow, then User-agent: *, then the rules.

Read that structure carefully, because it matters. Consecutive User-agent: lines with no blank line between them form a single group. All 26 AI crawler names, the three ad crawlers and the wildcard are in one group, sharing one set of rules. So on a default Squarespace site, GPTBot receives exactly the rules that every other visitor receives. The names are present. The policy attached to them is not.

This was verified on 5 September 2026 against two Squarespace-hosted properties, both identified by the server: Squarespace response header, and the crawler block was byte-identical on both. Squarespace's own guide, "Request that AI models exclude your site", updated 17 July 2026, lists those same 26 bots and says, verbatim, that checking the box "updates your robots.txt file to tell the following bots not to crawl your site." The checkbox adds the exclusion. The names sit in the file either way.

The practical consequence: a quick eyeball of your robots.txt, or a checker that greps for GPTBot, will report an AI crawler policy where none exists. Our own B2 check looks for a rule rather than a name, which is the distinction that matters here. For who these agents are and which company operates each, our AI crawler user-agent list breaks them down.

Path 1: the four built-in switches, in order

These are available on every current plan unless noted, and none of them require code.

1. Open Settings, then Crawlers. Two checkboxes live here: "Block Search engine crawlers" and "Block known artificial intelligence crawlers." Both are unchecked by default.
2. Decide the AI checkbox deliberately, and in most cases leave it unchecked. Checking it adds the exclusion request for all 26 bots. Squarespace is unusually direct about the trade-off, writing that it defaults to unchecked because it does not "want to potentially impact your site's traffic by excluding it from chat answers and sources." Check it only if you want out of AI answers as well as AI training, because the list makes no distinction between the two.
3. Turn on llms.txt. Open the SEO/AI Visibility panel, click SEO Settings, then the LLMS.txt tab. Squarespace's guide, updated 24 July 2026, states that "the llms.txt file is disabled by default. To enable it, add text for your llms.txt file to the text field," then Save. It is a text field, not an upload, and the guide is explicit that "you can create an llms.txt file on version 7.1 sites." Older 7.0 sites have no route to C2 at all. Slot C covered this one surface in depth in how to publish a valid llms.txt on Squarespace, including what happens to the URL, so I will not repeat the detail here.
4. Write the file's contents somewhere you can edit them. The panel is a plain text box with no validation, so malformed Markdown saves silently, and Squarespace says in its own words that it "can't offer specific advice on creating text for your llms.txt file." Draft it in our llms.txt generator, paste the result in, and keep the source. For a model of the shape, the file fetched from www.squarespace.com/llms.txt on 5 September 2026 is 2,088 bytes: an H1, a one-paragraph blockquote summary, then H2 sections of [name](url): description bullets. One of its own entries admits that the human pricing page "requires JavaScript to render" and points agents at a plain-text file instead.
5. Check your 404 page is still the system default. Pages panel, scroll to System Pages, click 404 Page. More on why in a moment.
6. Confirm your feed. Any blog, products, events, gallery or album page has a feed at its own URL with ?format=rss appended, per Squarespace's "Finding your RSS feed URL" guide. Nothing to enable.

That is the whole native surface. Four panels, and two of them you only visit to confirm.

Path 2: what code injection reaches, and what it never will

Code injection is the escape hatch, and it is smaller than people assume. Squarespace's guide says it is "available in the Core, Plus, Advanced, and some legacy billing plans", so the entry-level Basic plan has no code route at all.

1. Open the Code Injection panel. The Header field is injected into the <head> tag on every page; the Footer field goes in before the closing </body> tag.
2. Add only the JSON-LD you need. Squarespace already emits schema on its own: a blog post fetched from its blog on 5 September 2026 carried Article, BlogPosting, WebPage, Organization and ImageObject types across two JSON-LD blocks with no configuration. Add a block only for something the platform does not model, such as Offer pricing on a services page.
3. Add a <link rel="alternate"> for a second feed if you publish more than one collection, since only the current page's feed is declared automatically.
4. Stop there. Header injection cannot create a URL. It cannot serve /llms-full.txt, cannot answer a /.well-known/ path, and cannot change robots.txt, because none of those are pages.

The 404 page Squarespace warns you about

Squarespace returns a real 404 by default, which several hosted platforms do not. Five nonexistent paths probed on www.squarespace.com on 5 September 2026 all returned HTTP 404 with the same rendered error page. That is why an agent can trust a missing file on a Squarespace site to mean missing.

The risk is self-inflicted. Squarespace's "Creating a custom 404 page" guide, updated 17 August 2026, warns that a custom 404 page can trigger a "Soft 404" alert in Google Search Console, explaining that Google flags "a contradiction: an indexable page that says it doesn't exist," and recommends either the system default or a noindex tag on the custom one. An indexable custom 404 is the one way a Squarespace site starts looking, to a crawler, like every path exists.

One caution from measurement rather than documentation: on one of the two sites probed, every unknown path returned HTTP 200 and a byte-identical copy of the homepage. That is per-site configuration, not platform behaviour, and it is invisible from the editor. Testing it on your own domain is the next section, and the wider pattern is in our comparison of llms.txt, robots.txt and sitemaps.

Prove it from outside the editor

Start with a scan, because it answers every question above in one pass and costs nothing. Run npx aiscan-cli yoursite.com, or paste the URL into AIScan with no account. The result names D1 and D2 for the generated robots.txt and sitemap, B2 for whether a crawler rule exists rather than a crawler name, C2 for llms.txt, C3 and E3 for rendered HTML, E5 for the declared feed, and E1 for the 404 behaviour you cannot see from inside the editor. The dimension pages are discoverability, content and bot access.

If you would rather check by hand, three commands cover the same ground.

The third one is the important one. Compare the byte count against your homepage fetched the same way. Identical sizes mean your site is answering every request with the homepage, and no discovery file you add afterwards will be believed.

Where AIScan fits, and where it doesn't

A scan reads what your site returns over HTTP. It cannot see which checkbox produced that result, so it will not tell you the Crawlers panel is untouched or the llms.txt field is empty. It reports the outcome and you map it back to a panel.

It also cannot grade two things no Squarespace setting exposes. No response measured on 5 September 2026 carried a Link: discovery relation, and there is no Markdown alternative: Accept: text/markdown returned text/html, and /index.md returned 404. Framer is the one hosted builder in this series that answers both honestly, which is why the Framer setup guide reads so differently from this one.

Fix these three first

Open Settings → Crawlers and look at the AI checkbox, so its state is a decision rather than a default. Turn on the LLMS.txt tab and put a real file in it, drafted in the llms.txt generator rather than typed in from scratch. Then run the byte-count comparison above against a nonexistent path, because a site that answers everything with 200 makes the other two pointless.

On a different stack, the equivalents are different products. For WordPress, ThinkRank is the one we recommend first: it handles robots.txt, robots meta, schema, sitemaps and llms.txt from a single plugin instead of leaving three plugins to overwrite the same file, and it imports existing settings from Rank Math, Yoast, All in One SEO and SEOPress, so switching costs no re-entry. Rank Math has the stronger keyword workflow and Yoast the larger support ecosystem, and both are honest choices if that is what you need most. For a Shopify store, StoreSEO is the one to start with, because it builds llms.txt from live products, collections, pages and articles instead of a hand-typed list, and ships an agents.md editor alongside it.

Then scan the result. npx aiscan-cli yoursite.com reports D1, D2, B2, C2, C3, E3, E5 and E1 together, and the rest of the platform walkthroughs are collected in our guides.