hammadtq

OpenBotAuth helps publishers control automated access from AI crawlers and agents. It verifies requests using RFC 9421 HTTP Message Signatures (via a configurable verifier) and applies per-site or per-post policies like allow, deny, teaser previews, and 402 payment-required responses. It also publishes AI-friendly endpoints like llms.txt, a JSON feed, and per-post Markdown.
Instead of blocking all bots or allowing unrestricted access, you can:
<ul>
<li>See AI bot traffic – Local-only analytics showing which bots are crawling your site</li>
<li>Verify bot identity using cryptographic signatures (RFC 9421)</li>
<li>Show teasers to unverified bots (first N words)</li>
<li>Rate limit bot access per agent</li>
<li>Whitelist/blacklist specific bots</li>
</ul>
<h4>Key Features</h4>
<ul>
<li>Bot Traffic Analytics – See which AI bots (GPTBot, ClaudeBot, PerplexityBot, etc.) are visiting your site</li>
<li>Signature Verification – Verifies RFC 9421 HTTP Message Signatures using Ed25519 cryptography</li>
<li>Content Teasers – Show first N words to unverified bots with customizable per-post settings</li>
<li>Rate Limiting – Per-agent rate limits with configurable time windows</li>
<li>Access Control – Whitelist/blacklist with wildcard pattern matching</li>
<li>Local Analytics – Visual dashboard with charts, stats cards, and decision breakdowns (no external tracking)</li>
<li>AI-Ready Endpoints – Serve llms.txt, JSON feed, and markdown for AI crawlers</li>
<li>Tabbed Admin Interface – Clean organization with Analytics, AI Endpoints, and Configuration tabs</li>
</ul>
<h4>AI-Ready Endpoints</h4>
OpenBotAuth provides machine-readable endpoints for AI systems:
<ul>
<li>/llms.txt – Standardized AI feed discovery (also at /.well-known/llms.txt)</li>
<li>/.well-known/openbotauth-feed.json – JSON list of all published posts</li>
<li>/.well-known/openbotauth/posts/{ID}.md – Per-post markdown content</li>
</ul>
Configure which post types to include (posts, pages, or custom types) and set the feed limit (up to 500 items). All data is served locally from your WordPress database. No external tracking or telemetry. Only published, non-password-protected posts are exposed.
<h4>How It Works</h4>
<ol>
<li>AI agent signs HTTP request with its private key (RFC 9421 signature)</li>
<li>WordPress plugin extracts signature headers and sends them to a verifier service</li>
<li>Verifier fetches agent’s public key from registry and verifies signature</li>
<li>Plugin applies policy: allow full content, show teaser, require payment, or deny</li>
</ol>
<h4>External Service Disclosure</h4>
This plugin connects to an external verifier service. When a signed bot request is received, the plugin sends the following data to your configured verifier URL via <code>wp_remote_post</code>:
<ul>
<li>HTTP method (GET, POST, etc.)</li>
<li>The accessed URL (including query string, if present)</li>
<li>HTTP signature headers (Signature, Signature-Input, Signature-Agent)</li>
<li>Additional HTTP header values explicitly listed in the Signature-Input header (e.g., content-type, accept, user-agent)</li>
</ul>
Privacy protection: Sensitive headers (cookies, authorization, proxy-authorization, www-authenticate) are NEVER forwarded, even if present in the request. If a bot’s signature covers a sensitive header, verification will fail with a clear error.
No WordPress user accounts or personal data is transmitted. Only the headers explicitly covered by the bot’s signature are forwarded to enable cryptographic verification. Note that the URL may include query parameters depending on your site’s structure.
You can: 
* Use the hosted verifier at <code>https://verifier.openbotauth.org/verify</code> 
* Self-host the verifier service (see documentation) 
* The verifier service may log requests server-side depending on your configuration
Analytics are local-only. Decision counts (allow/teaser/deny/pay/rate_limit) and bot traffic observations (User-Agent based) are stored in your WordPress database. No analytics data is sent to external servers.
For more information, please review our <a href="https://openbotauth.org/terms" rel="nofollow ugc">Terms of Service</a> and <a href="https://openbotauth.org/privacy" rel="nofollow ugc">Privacy Policy</a>.
<h3>Developer Hooks</h3>
<h4>Filters</h4>
openbotauth_policy 
Modify policy before applying:
<pre><code>add_filter('openbotauth_policy', function($policy, $post) {
 if ($post->post_type === 'premium') {
 $policy['price_cents'] = 1000;
 }
 return $policy;
}, 10, 2);
</code></pre>
<h4>Actions</h4>
openbotauth_verified 
Triggered when a bot is verified:
<pre><code>add_action('openbotauth_verified', function($agent, $post) {
 error_log("Bot {$agent['jwks_url']} accessed post {$post->ID}");
}, 10, 2);
</code></pre>
openbotauth_payment_required 
Triggered when 402 is returned:
<pre><code>add_action('openbotauth_payment_required', function($agent, $post, $price) {
 // Track payment requests
}, 10, 3);
</code></pre>
<h4>AI Endpoint Filters (v0.1.2+)</h4>
openbotauth_should_serve_llms_txt 
Disable llms.txt endpoint (e.g., when using Yoast):
<pre><code>add_filter('openbotauth_should_serve_llms_txt', '__return_false');
</code></pre>
openbotauth_should_serve_feed 
Disable JSON feed endpoint:
<pre><code>add_filter('openbotauth_should_serve_feed', '__return_false');
</code></pre>
openbotauth_should_serve_markdown 
Disable markdown endpoints:
<pre><code>add_filter('openbotauth_should_serve_markdown', '__return_false');
</code></pre>
openbotauth_feed_item 
Modify feed items:
<pre><code>add_filter('openbotauth_feed_item', function($item, $post) {
 $item['custom_field'] = get_post_meta($post->ID, 'my_field', true);
 return $item;
}, 10, 2);
</code></pre>
openbotauth_markdown_content 
Post-process markdown output:
<pre><code>add_filter('openbotauth_markdown_content', function($markdown, $post) {
 return $markdown . "\n\n---\nCopyright notice here";
}, 10, 2);
</code></pre>

OpenBotAuth – AI Crawler Access Control

Verify AI crawlers with HTTP Signatures and enforce allow/deny/teaser policies; also serves llms.txt and AI-ready feeds.

Mark McNeece of 365i

AI systems are answering questions about your business right now. When someone asks ChatGPT, Claude, Gemini, or Perplexity about your services, they either get it right or they guess. Most of the time, they guess wrong — confusing you with competitors, fabricating services you don’t offer, and recommending someone else entirely.
AI Discovery Files fix this. They are machine-readable files at the root of your website that tell AI systems exactly who you are, what you do, and how to refer to your brand. Think of them as <code>robots.txt</code> for AI — except instead of telling crawlers what to ignore, you tell AI systems what to get right.
This is the only WordPress plugin that generates all 10 AI Discovery Files defined in the <a href="https://www.ai-visibility.org.uk/specifications/" rel="nofollow ugc">AI Discovery Files Specification</a>.
<h4>Why your website needs AI Discovery Files</h4>
Without AI Discovery Files, your website is invisible to AI — not ranking poorly, completely absent from AI responses. With AI Discovery Files, you give every major AI system a single, authoritative source of truth about your business. You get mentioned. You get cited. You get recommended.
This is not traditional SEO. This is AI visibility — also called generative engine optimisation (GEO) or answer engine optimisation (AEO). Whatever you call it, it starts with AI Discovery Files.
<h4>All 10 AI Discovery Files</h4>
The <a href="https://www.ai-visibility.org.uk/specifications/" rel="nofollow ugc">AI Discovery Files Specification</a> defines 10 file types across three implementation tiers:
Essential (start here)
<ul>
<li><code>llms.txt</code> — AI-readable business identity (Markdown)</li>
<li><code>ai.txt</code> — AI usage permissions (plain text)</li>
</ul>
Recommended
<ul>
<li><code>identity.json</code> — Structured business identity (JSON)</li>
<li><code>ai.json</code> — Machine-parseable permissions (JSON)</li>
<li><code>brand.txt</code> — Brand naming and terminology rules</li>
<li><code>faq-ai.txt</code> — Pre-answered questions for AI systems</li>
</ul>
Complete
<ul>
<li><code>llm.txt</code> — Compatibility redirect to llms.txt</li>
<li><code>llms.html</code> — Human-readable reference version</li>
<li><code>developer-ai.txt</code> — Technical context for developers</li>
<li><code>robots-ai.txt</code> — AI crawler-specific directives</li>
</ul>
Most competing plugins only generate <code>llms.txt</code>. This plugin generates all 10 files, giving you complete coverage across ChatGPT, Claude, Gemini, Perplexity, Copilot, and every other major AI system.
<h4>How it works</h4>
<ol>
<li>Install and activate the plugin</li>
<li>Fill in your business details on the settings page</li>
<li>Choose which files to enable</li>
<li>The plugin serves the files at the correct root URLs (e.g., <code>yoursite.com/llms.txt</code>)</li>
</ol>
Files are generated dynamically from your settings — no files are written to disk, and everything updates automatically when you change your settings.
<h4>Key features</h4>
<ul>
<li>Auto-detection — pulls your site name, tagline, pages, theme, and WordPress version automatically</li>
<li>All 10 file types — the only plugin that generates every AI Discovery File, not just llms.txt</li>
<li>Three implementation tiers — start with Essential and expand when ready</li>
<li>Live preview — see exactly what each file contains before enabling it</li>
<li>Validation — checks files against the specification and flags issues</li>
<li>AI Crawler Analytics — see which AI bots read your AI Discovery Files, with visual dashboards and CSV export</li>
<li>Discovery File Access tracking — proof that AI bots are reading the files this plugin generates</li>
<li>robots.txt conflict detection — warns when your robots.txt contradicts your AI visibility settings</li>
<li>Conflict detection — warns if physical files already exist at the same URLs</li>
<li>Directory verification — verify domain ownership for the <a href="https://www.ai-visibility.org.uk/" rel="nofollow ugc">AI Visibility Directory</a> without FTP</li>
<li>No lock-in — disable the plugin and the files simply stop being served</li>
<li>Developer-friendly — filters for every generated file and collected data point</li>
</ul>
<h4>Who needs this?</h4>
Every WordPress site that wants to be found, mentioned, and correctly cited by AI systems. Local businesses, agencies, ecommerce stores, SaaS companies, professional services — if AI is answering questions about your industry, you need to control what it says about you.
Built by <a href="https://www.ai-visibility.org.uk/" rel="nofollow ugc">AI Visibility</a>, the publisher of the AI Discovery Files Specification and the team behind the <a href="https://www.ai-visibility.org.uk/ai-visibility-checker/" rel="nofollow ugc">AI Visibility Checker</a>.

AI Discovery Files – llms.txt & AI Visibility

The only WordPress plugin that generates all 10 AI Discovery Files and shows which AI bots read them. Built by 365i.

OpenBotAuth – AI Crawler Access Control vs AI Discovery Files – llms.txt & AI Visibility