hammadtq

OpenBotAuth helps publishers control automated access from AI crawlers and agents. It verifies requests using RFC 9421 HTTP Message Signatures (via a configurable verifier) and applies per-site or per-post policies like allow, deny, teaser previews, and 402 payment-required responses. It also publishes AI-friendly endpoints like llms.txt, a JSON feed, and per-post Markdown.
Instead of blocking all bots or allowing unrestricted access, you can:
<ul>
<li>See AI bot traffic – Local-only analytics showing which bots are crawling your site</li>
<li>Verify bot identity using cryptographic signatures (RFC 9421)</li>
<li>Show teasers to unverified bots (first N words)</li>
<li>Rate limit bot access per agent</li>
<li>Whitelist/blacklist specific bots</li>
</ul>
<h4>Key Features</h4>
<ul>
<li>Bot Traffic Analytics – See which AI bots (GPTBot, ClaudeBot, PerplexityBot, etc.) are visiting your site</li>
<li>Signature Verification – Verifies RFC 9421 HTTP Message Signatures using Ed25519 cryptography</li>
<li>Content Teasers – Show first N words to unverified bots with customizable per-post settings</li>
<li>Rate Limiting – Per-agent rate limits with configurable time windows</li>
<li>Access Control – Whitelist/blacklist with wildcard pattern matching</li>
<li>Local Analytics – Visual dashboard with charts, stats cards, and decision breakdowns (no external tracking)</li>
<li>AI-Ready Endpoints – Serve llms.txt, JSON feed, and markdown for AI crawlers</li>
<li>Tabbed Admin Interface – Clean organization with Analytics, AI Endpoints, and Configuration tabs</li>
</ul>
<h4>AI-Ready Endpoints</h4>
OpenBotAuth provides machine-readable endpoints for AI systems:
<ul>
<li>/llms.txt – Standardized AI feed discovery (also at /.well-known/llms.txt)</li>
<li>/.well-known/openbotauth-feed.json – JSON list of all published posts</li>
<li>/.well-known/openbotauth/posts/{ID}.md – Per-post markdown content</li>
</ul>
Configure which post types to include (posts, pages, or custom types) and set the feed limit (up to 500 items). All data is served locally from your WordPress database. No external tracking or telemetry. Only published, non-password-protected posts are exposed.
<h4>How It Works</h4>
<ol>
<li>AI agent signs HTTP request with its private key (RFC 9421 signature)</li>
<li>WordPress plugin extracts signature headers and sends them to a verifier service</li>
<li>Verifier fetches agent’s public key from registry and verifies signature</li>
<li>Plugin applies policy: allow full content, show teaser, require payment, or deny</li>
</ol>
<h4>External Service Disclosure</h4>
This plugin connects to an external verifier service. When a signed bot request is received, the plugin sends the following data to your configured verifier URL via <code>wp_remote_post</code>:
<ul>
<li>HTTP method (GET, POST, etc.)</li>
<li>The accessed URL (including query string, if present)</li>
<li>HTTP signature headers (Signature, Signature-Input, Signature-Agent)</li>
<li>Additional HTTP header values explicitly listed in the Signature-Input header (e.g., content-type, accept, user-agent)</li>
</ul>
Privacy protection: Sensitive headers (cookies, authorization, proxy-authorization, www-authenticate) are NEVER forwarded, even if present in the request. If a bot’s signature covers a sensitive header, verification will fail with a clear error.
No WordPress user accounts or personal data is transmitted. Only the headers explicitly covered by the bot’s signature are forwarded to enable cryptographic verification. Note that the URL may include query parameters depending on your site’s structure.
You can: 
* Use the hosted verifier at <code>https://verifier.openbotauth.org/verify</code> 
* Self-host the verifier service (see documentation) 
* The verifier service may log requests server-side depending on your configuration
Analytics are local-only. Decision counts (allow/teaser/deny/pay/rate_limit) and bot traffic observations (User-Agent based) are stored in your WordPress database. No analytics data is sent to external servers.
For more information, please review our <a href="https://openbotauth.org/terms" rel="nofollow ugc">Terms of Service</a> and <a href="https://openbotauth.org/privacy" rel="nofollow ugc">Privacy Policy</a>.
<h3>Developer Hooks</h3>
<h4>Filters</h4>
openbotauth_policy 
Modify policy before applying:
<pre><code>add_filter('openbotauth_policy', function($policy, $post) {
 if ($post->post_type === 'premium') {
 $policy['price_cents'] = 1000;
 }
 return $policy;
}, 10, 2);
</code></pre>
<h4>Actions</h4>
openbotauth_verified 
Triggered when a bot is verified:
<pre><code>add_action('openbotauth_verified', function($agent, $post) {
 error_log("Bot {$agent['jwks_url']} accessed post {$post->ID}");
}, 10, 2);
</code></pre>
openbotauth_payment_required 
Triggered when 402 is returned:
<pre><code>add_action('openbotauth_payment_required', function($agent, $post, $price) {
 // Track payment requests
}, 10, 3);
</code></pre>
<h4>AI Endpoint Filters (v0.1.2+)</h4>
openbotauth_should_serve_llms_txt 
Disable llms.txt endpoint (e.g., when using Yoast):
<pre><code>add_filter('openbotauth_should_serve_llms_txt', '__return_false');
</code></pre>
openbotauth_should_serve_feed 
Disable JSON feed endpoint:
<pre><code>add_filter('openbotauth_should_serve_feed', '__return_false');
</code></pre>
openbotauth_should_serve_markdown 
Disable markdown endpoints:
<pre><code>add_filter('openbotauth_should_serve_markdown', '__return_false');
</code></pre>
openbotauth_feed_item 
Modify feed items:
<pre><code>add_filter('openbotauth_feed_item', function($item, $post) {
 $item['custom_field'] = get_post_meta($post->ID, 'my_field', true);
 return $item;
}, 10, 2);
</code></pre>
openbotauth_markdown_content 
Post-process markdown output:
<pre><code>add_filter('openbotauth_markdown_content', function($markdown, $post) {
 return $markdown . "\n\n---\nCopyright notice here";
}, 10, 2);
</code></pre>

OpenBotAuth – AI Crawler Access Control

Verify AI crawlers with HTTP Signatures and enforce allow/deny/teaser policies; also serves llms.txt and AI-ready feeds.

gavindarkvisitors

Track crawlers, scrapers, LLM assistants, and AI agents on your website. Generate a robots.txt that blocks AI bots. Formerly Dark Visitors.
<h3>Track, control, and optimize your website for AI agents and bots</h3>
You have <a href="https://knownagents.com/insights" rel="nofollow ugc">40% more visitors than you think</a>. Protect your content from unwanted AI scraping and crawling, and turn the rising wave of AI agents, LLM assistants, and other bots crawling your website into a new growth channel for your business. For full details, visit the <a href="https://knownagents.com/" rel="nofollow ugc">Known Agents</a> website.
<h3>1. Agent Analytics</h3>
Get realtime insight into the hidden ecosystem of crawlers, scrapers, and AI agents browsing your website.
<ul>
<li>Monitor traffic from crawlers and scrapers: Track the hidden activity of <a href="https://knownagents.com/agents" rel="nofollow ugc">all known artificial agents</a> visiting your website in real time.</li>
<li>Analyze how AI agents browse your website: Review sessions from AI models autonomously navigating and interacting with your website. Optimize their experience to increase conversions and human referrals.</li>
<li>Detect bots spoofing legitimate agents: Identify bad actors and unauthorized scrapers pretending to be legitimate agents like Googlebot or Bingbot.</li>
<li>Get alerted to bot traffic spikes: Stay informed when an agent’s traffic starts surging or overloading your server.</li>
<li>See which agents visit most frequently and which pages they target: Break down bot traffic by agent and URL to understand where crawlers and scrapers are focused.</li>
<li>Export reports to CSV: Download agent activity reports for custom analysis.</li>
</ul>
<h3>2. LLM Referral Tracking</h3>
Measure human conversions from AI chat and search platforms like ChatGPT, Perplexity, Gemini, Claude, and more.
<ul>
<li>Find out which AI platforms are sending you traffic: See which LLMs are recommending your website and measure how many humans click through to visit.</li>
<li>Export reports to CSV: Download LLM referral reports for custom analysis.</li>
</ul>
<h3>3. Automatic Robots.txt</h3>
Protect IP, reduce server cost, and save time by serving a robots.txt that updates continuously.
<ul>
<li>Block crawlers and scrapers by category: Control access for entire agent categories including AI crawlers, scrapers, SEO bots, and more. One selection covers every current and future agent in that group.</li>
<li>Stop tracking new bots manually: Your robots.txt is updated as new agents emerge, so you never have to manage them yourself or make manual edits.</li>
<li>Enforce robots.txt rules with the WordPress plugin: The WordPress plugin detects and blocks bots that ignore your robots.txt rules, protecting your content from unauthorized access.</li>
</ul>
<h3>Demos</h3>
Demos can be found on the <a href="https://knownagents.com/" rel="nofollow ugc">home page</a>.
<h3>Further Details</h3>
This plugin connects your website to <a href="https://knownagents.com/" rel="nofollow ugc">Known Agents</a>. It uses the Known Agents API to connect to your account and provide functionality.
By signing up, you agree to the <a href="https://knownagents.com/terms-of-service" rel="nofollow ugc">Terms of Service</a> and <a href="https://knownagents.com/privacy-policy" rel="nofollow ugc">Privacy Policy</a>.
Are you finding this plugin useful? Please <a href="https://wordpress.org/support/plugin/dark-visitors/reviews/#new-post" rel="ugc">leave us a ★★★★★ review</a>! Otherwise, please <a href="https://wordpress.org/support/plugin/dark-visitors/" rel="ugc">ask us for help</a>.

Known Agents – Track AI Bots and Crawlers, Block Scrapers, Analyze LLM Referral Traffic


Please remind me in a month to provide an update on the performance of this plugin on a heavily visited website.


Begun my review...


An easy improvement would be to link to the settings page from the plugin entry like other plugins, other than that, in general this plugin and its online dashboard is generally well thought out and useful. My website is small and has limited resources that get overrun by crawlers making it unavailable. This plugin helps identify the culprits and decide if I should block them or not. For free you can block them in robots.txt, as I have a physical file, the plugin won't touch that but its easy to add manually. It will report those crawlers that ignore the robots file and the paid version will enforce those rules, but I just update ".htaccess" myself.



I'm reducing my rating by a star since you won't get much "Agent Analytics" (per month) and for my tiny site it quickly ran out, we are a NFP so don't have money to burn on subscriptions.  The the description for the plan incorrectly states "Unlimited Agent Analytics" when the plan only includes 100,000 events.


Very Useful Plugin


Very good: shows all bot-crawlers.Our website was sometimes down due to bot-crawlers, with this tool it is easy to solve. Very good logging of bots.This was the only good plugin I could find for this purpose.Some bots ignore robots.txt. So I manually changed htaccess, that worked very good.


Very very helpful

Track crawlers, scrapers, LLM assistants, and AI agents on your website. Generate a robots.txt that blocks AI bots. Formerly Dark Visitors.

OpenBotAuth – AI Crawler Access Control vs Known Agents – Track AI Bots and Crawlers, Block Scrapers, Analyze LLM Referral Traffic