hammadtq

OpenBotAuth helps publishers control automated access from AI crawlers and agents. It verifies requests using RFC 9421 HTTP Message Signatures (via a configurable verifier) and applies per-site or per-post policies like allow, deny, teaser previews, and 402 payment-required responses. It also publishes AI-friendly endpoints like llms.txt, a JSON feed, and per-post Markdown.
Instead of blocking all bots or allowing unrestricted access, you can:
<ul>
<li>See AI bot traffic – Local-only analytics showing which bots are crawling your site</li>
<li>Verify bot identity using cryptographic signatures (RFC 9421)</li>
<li>Show teasers to unverified bots (first N words)</li>
<li>Rate limit bot access per agent</li>
<li>Whitelist/blacklist specific bots</li>
</ul>
<h4>Key Features</h4>
<ul>
<li>Bot Traffic Analytics – See which AI bots (GPTBot, ClaudeBot, PerplexityBot, etc.) are visiting your site</li>
<li>Signature Verification – Verifies RFC 9421 HTTP Message Signatures using Ed25519 cryptography</li>
<li>Content Teasers – Show first N words to unverified bots with customizable per-post settings</li>
<li>Rate Limiting – Per-agent rate limits with configurable time windows</li>
<li>Access Control – Whitelist/blacklist with wildcard pattern matching</li>
<li>Local Analytics – Visual dashboard with charts, stats cards, and decision breakdowns (no external tracking)</li>
<li>AI-Ready Endpoints – Serve llms.txt, JSON feed, and markdown for AI crawlers</li>
<li>Tabbed Admin Interface – Clean organization with Analytics, AI Endpoints, and Configuration tabs</li>
</ul>
<h4>AI-Ready Endpoints</h4>
OpenBotAuth provides machine-readable endpoints for AI systems:
<ul>
<li>/llms.txt – Standardized AI feed discovery (also at /.well-known/llms.txt)</li>
<li>/.well-known/openbotauth-feed.json – JSON list of all published posts</li>
<li>/.well-known/openbotauth/posts/{ID}.md – Per-post markdown content</li>
</ul>
Configure which post types to include (posts, pages, or custom types) and set the feed limit (up to 500 items). All data is served locally from your WordPress database. No external tracking or telemetry. Only published, non-password-protected posts are exposed.
<h4>How It Works</h4>
<ol>
<li>AI agent signs HTTP request with its private key (RFC 9421 signature)</li>
<li>WordPress plugin extracts signature headers and sends them to a verifier service</li>
<li>Verifier fetches agent’s public key from registry and verifies signature</li>
<li>Plugin applies policy: allow full content, show teaser, require payment, or deny</li>
</ol>
<h4>External Service Disclosure</h4>
This plugin connects to an external verifier service. When a signed bot request is received, the plugin sends the following data to your configured verifier URL via <code>wp_remote_post</code>:
<ul>
<li>HTTP method (GET, POST, etc.)</li>
<li>The accessed URL (including query string, if present)</li>
<li>HTTP signature headers (Signature, Signature-Input, Signature-Agent)</li>
<li>Additional HTTP header values explicitly listed in the Signature-Input header (e.g., content-type, accept, user-agent)</li>
</ul>
Privacy protection: Sensitive headers (cookies, authorization, proxy-authorization, www-authenticate) are NEVER forwarded, even if present in the request. If a bot’s signature covers a sensitive header, verification will fail with a clear error.
No WordPress user accounts or personal data is transmitted. Only the headers explicitly covered by the bot’s signature are forwarded to enable cryptographic verification. Note that the URL may include query parameters depending on your site’s structure.
You can: 
* Use the hosted verifier at <code>https://verifier.openbotauth.org/verify</code> 
* Self-host the verifier service (see documentation) 
* The verifier service may log requests server-side depending on your configuration
Analytics are local-only. Decision counts (allow/teaser/deny/pay/rate_limit) and bot traffic observations (User-Agent based) are stored in your WordPress database. No analytics data is sent to external servers.
For more information, please review our <a href="https://openbotauth.org/terms" rel="nofollow ugc">Terms of Service</a> and <a href="https://openbotauth.org/privacy" rel="nofollow ugc">Privacy Policy</a>.
<h3>Developer Hooks</h3>
<h4>Filters</h4>
openbotauth_policy 
Modify policy before applying:
<pre><code>add_filter('openbotauth_policy', function($policy, $post) {
 if ($post->post_type === 'premium') {
 $policy['price_cents'] = 1000;
 }
 return $policy;
}, 10, 2);
</code></pre>
<h4>Actions</h4>
openbotauth_verified 
Triggered when a bot is verified:
<pre><code>add_action('openbotauth_verified', function($agent, $post) {
 error_log("Bot {$agent['jwks_url']} accessed post {$post->ID}");
}, 10, 2);
</code></pre>
openbotauth_payment_required 
Triggered when 402 is returned:
<pre><code>add_action('openbotauth_payment_required', function($agent, $post, $price) {
 // Track payment requests
}, 10, 3);
</code></pre>
<h4>AI Endpoint Filters (v0.1.2+)</h4>
openbotauth_should_serve_llms_txt 
Disable llms.txt endpoint (e.g., when using Yoast):
<pre><code>add_filter('openbotauth_should_serve_llms_txt', '__return_false');
</code></pre>
openbotauth_should_serve_feed 
Disable JSON feed endpoint:
<pre><code>add_filter('openbotauth_should_serve_feed', '__return_false');
</code></pre>
openbotauth_should_serve_markdown 
Disable markdown endpoints:
<pre><code>add_filter('openbotauth_should_serve_markdown', '__return_false');
</code></pre>
openbotauth_feed_item 
Modify feed items:
<pre><code>add_filter('openbotauth_feed_item', function($item, $post) {
 $item['custom_field'] = get_post_meta($post->ID, 'my_field', true);
 return $item;
}, 10, 2);
</code></pre>
openbotauth_markdown_content 
Post-process markdown output:
<pre><code>add_filter('openbotauth_markdown_content', function($markdown, $post) {
 return $markdown . "\n\n---\nCopyright notice here";
}, 10, 2);
</code></pre>

OpenBotAuth – AI Crawler Access Control

Verify AI crawlers with HTTP Signatures and enforce allow/deny/teaser policies; also serves llms.txt and AI-ready feeds.

aleemiqbal

The Crawl Optimization Plugin is designed to help optimize your website’s crawl rate by removing unnecessary links and information from your HTTP headers. By removing elements such as shortlinks, REST API links, RSD/WLW links, oEmbed links, generator tags, and X-Pingback headers, this plugin streamlines the navigation of your website and reduces the amount of data transferred. Additionally, it also removes the “powered by” HTTP header which reveals the software and plugins used on your website, keeping your site more secure. With the Crawl Optimization Plugin SEO plugin, your website will load faster and be more easily navigated by search engines, improving your overall SEO.
<h3>Features</h3>
<ul>
<li>Helps optimize your website’s crawl rate by removing unnecessary links and information from your HTTP headers.</li>
<li>Deactivates elements such as shortlinks, REST API links, RSD/WLW links, oEmbed links, generator tags, and X-Pingback headers to streamline website navigation and reduce the amount of data transferred.</li>
<li>Removes the “powered by” HTTP header to keep your website more secure.</li>
<li>Improves website loading speed by reducing unnecessary data transfer and streamlining navigation.</li>
<li>Enhances website SEO by making it more easily navigable by search engines.</li>
</ul>
Remove Unnecessary Metadata: 
WordPress is a popular content management system (CMS) used to create websites. One of the features of WordPress is that it adds several links and metadata to a website’s HTTP headers. While these links and metadata may be helpful in certain situations, they can also slow down a website’s performance by increasing the amount of data that needs to be transferred. To improve website performance, it may be necessary to remove unnecessary metadata from a WordPress site.
The “Remove Unnecessary Metadata” section in WordPress focuses on deactivating elements that are not required on a website, including the following sub-features:
Deactivate WordPress’ HTTP headers: This feature disables unnecessary hyperlinks and metadata that are added by WordPress. By deactivating these elements, you can reduce the amount of data that is transferred between the website and the user’s device, which can improve website performance.
Remove WordPress Generator Tag: WordPress adds a generator tag to a website’s HTML code, which references the CMS or plugins used on the website. This information can be useful for developers but is not necessary for website visitors. Removing the generator tag can improve website performance and also make it harder for attackers to identify vulnerabilities in the website’s software.
Remove Shortlinks Tag: WordPress adds hyperlinks to its internal ‘shortlink’ URLs for posts. While these links can be helpful for navigation within a website, they are not necessary for external visitors. Removing these links can streamline website navigation and improve website performance.
Remove REST API link Tag: WordPress adds hyperlinks to the location of a site’s REST API endpoints. This feature removes the REST API link tag, which is not necessary for most websites.
Remove RSD / WLW link Tags: WordPress adds references for external systems to publish content on the blog by adding associated hyperlinks. This feature removes the RSD / WLW link tags, which are not necessary for most websites.
Remove oEmbed link Tags: WordPress adds references for embedding content on external websites by adding associated hyperlinks. This feature removes oEmbed link tags, which are not necessary for most websites.
Remove Pingback HTTP header: WordPress allows external websites to ping a site when linked to by adding a pingback HTTP header. While this feature may be useful in some situations, it is not necessary for most websites. Removing the pingback HTTP header can improve website performance and also reduce the risk of security vulnerabilities.
Remove powered by HTTP header: WordPress adds a “powered by” HTTP header that displays information about plugins and software used on the website. While this information may be helpful for developers, it is not necessary for website visitors. Removing the “powered by” HTTP header can improve website performance and also make it harder for attackers to identify vulnerabilities in the website’s software.
Remove Unnecessary Feed Links: 
This section of optimization settings in WordPress focuses on removing unnecessary feed links from a website. WordPress disseminates website content in various formats and URLs, including RSS feeds for posts and categories. However, deactivating unused formats is considered best practice as it helps reduce the amount of data transferred, which can help to speed up a website.
Deactivate Global Feed: This feature removes URLs that provide an overview of recent posts. Global feeds are usually included in the website’s header or footer, and they offer users an easy way to view recent posts from anywhere on the site.
Deactivate Global Comment Feeds: This feature removes URLs that provide an overview of recent comments on the website. Comment feeds are used to syndicate comments from a particular post or page.
Deactivate Post Comments Feeds: This feature removes URLs that supply details about recent comments on each post. Post comment feeds are used to syndicate comments on a particular post.
Deactivate Post Authors Feeds: This feature removes URLs that furnish information about recent posts by certain authors. This feed is useful for readers who are interested in reading posts written by a particular author.
Deactivate Post Type Feeds: This feature removes URLs that supply details about recent posts for every post type. This feed is useful for readers who are interested in reading posts from a specific post type, such as a custom post type.
Deactivate Category Feeds: This feature removes URLs that furnish information about recent posts for each category. This feed is useful for readers who are interested in reading posts from a specific category.
Deactivate Tag Feeds: This feature removes URLs that provide information about recent posts for each tag. This feed is useful for readers who are interested in reading posts that have a particular tag.
Deactivate Custom Taxonomy Feeds: This feature removes URLs that supply details about recent posts for every custom taxonomy. Custom taxonomy feeds are used to syndicate posts that have been assigned to a custom taxonomy term.
Deactivate Search Results Feeds: This feature removes URLs that furnish information about search results. This feed is useful for readers who want to keep track of search results for a particular keyword or phrase.
Deactivate Atom/RDF Feeds: This feature removes URLs that offer alternate versions of the above-mentioned items in Atom or RDF formats.
Remove Unnecessary WordPress Resources 
The feature “Remove Unnecessary WordPress Resources” is designed to improve the performance of WordPress websites by removing unnecessary resources that are not required for the website to function properly.
Remove Emoji scripts: 
Remove Emoji scripts feature removes unnecessary JavaScript used to handle emojis in outdated browsers.
Optimize Internal Site Search 
This feature secures your internal site search to prevent confusion for search engines and potential attacks from SEO spammers, which is important for the overall performance and security of your website. Even if your website does not have a search feature, it is recommended to implement these measures for optimal performance.
Filter Spam Search terms: This feature enables advanced settings for protecting your internal site search URLs from SPAM attacks.
Limit the number of characters allowed in internal site searches: This feature implements a character limit for internal site search queries to improve security and organization of URLs. The suggested range is between 1 and 50.
Remove special characters and emojis from internal site search queries: This feature removes non-alphanumeric characters from internal site searches to prevent spam attacks.
Block internal site searches that contain patterns commonly used by spammers: This feature prevents spam attacks on internal site searches by filtering out common spam patterns.
Standardize Site Search URLs with ?s= Syntax Redirection: This feature standardizes WordPress site search URLs by redirecting all variations to the ?s= format.
Parameters Optimization 
This feature optimizes certain URL parameters to prevent them from being removed during website operation. This can be beneficial for tracking, filtering, and advanced functionality, but it also has a potential impact on website performance and search engine optimization. Websites that do not use URL parameters may see an improvement by utilizing these options.
Optimize Google Analytics by converting utm parameters: This feature converts utm tracking parameters to # fragment versions with a 301 redirect.
Remove all URL parameters through a 301 redirect: This feature removes unnecessary query parameters from URLs through a permanent redirect.
Additional URL parameters to allow: This feature prevents specific URL parameters from being removed. For example, adding example_parameter will prevent the URL from being redirected. Multiple parameters can be added and separated using a comma.
<h3>Need any Help?</h3>
<ul>
<li>Please email us at aleemiqbalbhatti@gmail.com</li>
<li>We provide live support</li>
</ul>
<h3>V 1.0.0</h3>
<ul>
<li>Initial release at 02/16/2023</li>
</ul>
<h3>V 1.1.0</h3>
<ul>
<li>Enabling Redirect removes references of feeds</li>
<li>Redirect all parameters option is now disabled for non supported themes and builders</li>
</ul>
<h3>V 1.1.1</h3>
<ul>
<li>Redirect all parameters will no longer work with woocommerce</li>
</ul>
<h3>V 1.1.2</h3>
<ul>
<li>Added Settings Link on plugins page</li>
</ul>
<h3>V 1.1.3</h3>
<ul>
<li>Jquery Conflict causing editors to crash fixed</li>
</ul>
<h3>V 1.1.4</h3>
<ul>
<li>Emoji Filter and spam filter now also remove from url</li>
</ul>
<h3>V 1.1.5</h3>
<ul>
<li>Feed Bugs Resolved and More Secure</li>
</ul>
<h3>V 1.1.6</h3>
<ul>
<li>Removed Feed due to instability and it could cause SEO Issues</li>
</ul>
<h3>V 1.2.0</h3>
<ul>
<li>Plugin Completely Revamped by including more Features</li>
<li>Shortlinks Redirect also removed</li>
<li>API Redirect Link Removed</li>
<li>Feeds completed revamped</li>
<li>Feeds are no longer created from scratch, Existing Feeds are removed</li>
<li>Filter Search Terms Option Added</li>
<li>Feeds now redirect after disabling</li>
<li>Remove all URL Parameters is now compatible with editors</li>
<li>Option to Additional URL Parameters to allow added</li>
<li>Jquery Removed</li>
</ul>
<h3>V 1.2.1</h3>
<ul>
<li>Security Update</li>
</ul>
<h3>V 1.2.2</h3>
<ul>
<li>Search Character Limit Bug Fixed</li>
</ul>
<h3>V 1.2.3</h3>
<ul>
<li>Function Fixed</li>
</ul>
<h3>V 1.2.4</h3>
<ul>
<li>Search Redirect Issue Resolved</li>
</ul>
<h3>V 1.2.5</h3>
<ul>
<li>Fatal Error Fixed</li>
</ul>

Crawl Optimization

The Crawl Optimization Plugin is designed to help optimize your website’s crawl rate by removing unnecessary links and information from your HTTP head …

OpenBotAuth – AI Crawler Access Control vs Crawl Optimization