hammadtq

OpenBotAuth helps publishers control automated access from AI crawlers and agents. It verifies requests using RFC 9421 HTTP Message Signatures (via a configurable verifier) and applies per-site or per-post policies like allow, deny, teaser previews, and 402 payment-required responses. It also publishes AI-friendly endpoints like llms.txt, a JSON feed, and per-post Markdown.
Instead of blocking all bots or allowing unrestricted access, you can:
<ul>
<li>See AI bot traffic – Local-only analytics showing which bots are crawling your site</li>
<li>Verify bot identity using cryptographic signatures (RFC 9421)</li>
<li>Show teasers to unverified bots (first N words)</li>
<li>Rate limit bot access per agent</li>
<li>Whitelist/blacklist specific bots</li>
</ul>
<h4>Key Features</h4>
<ul>
<li>Bot Traffic Analytics – See which AI bots (GPTBot, ClaudeBot, PerplexityBot, etc.) are visiting your site</li>
<li>Signature Verification – Verifies RFC 9421 HTTP Message Signatures using Ed25519 cryptography</li>
<li>Content Teasers – Show first N words to unverified bots with customizable per-post settings</li>
<li>Rate Limiting – Per-agent rate limits with configurable time windows</li>
<li>Access Control – Whitelist/blacklist with wildcard pattern matching</li>
<li>Local Analytics – Visual dashboard with charts, stats cards, and decision breakdowns (no external tracking)</li>
<li>AI-Ready Endpoints – Serve llms.txt, JSON feed, and markdown for AI crawlers</li>
<li>Tabbed Admin Interface – Clean organization with Analytics, AI Endpoints, and Configuration tabs</li>
</ul>
<h4>AI-Ready Endpoints</h4>
OpenBotAuth provides machine-readable endpoints for AI systems:
<ul>
<li>/llms.txt – Standardized AI feed discovery (also at /.well-known/llms.txt)</li>
<li>/.well-known/openbotauth-feed.json – JSON list of all published posts</li>
<li>/.well-known/openbotauth/posts/{ID}.md – Per-post markdown content</li>
</ul>
Configure which post types to include (posts, pages, or custom types) and set the feed limit (up to 500 items). All data is served locally from your WordPress database. No external tracking or telemetry. Only published, non-password-protected posts are exposed.
<h4>How It Works</h4>
<ol>
<li>AI agent signs HTTP request with its private key (RFC 9421 signature)</li>
<li>WordPress plugin extracts signature headers and sends them to a verifier service</li>
<li>Verifier fetches agent’s public key from registry and verifies signature</li>
<li>Plugin applies policy: allow full content, show teaser, require payment, or deny</li>
</ol>
<h4>External Service Disclosure</h4>
This plugin connects to an external verifier service. When a signed bot request is received, the plugin sends the following data to your configured verifier URL via <code>wp_remote_post</code>:
<ul>
<li>HTTP method (GET, POST, etc.)</li>
<li>The accessed URL (including query string, if present)</li>
<li>HTTP signature headers (Signature, Signature-Input, Signature-Agent)</li>
<li>Additional HTTP header values explicitly listed in the Signature-Input header (e.g., content-type, accept, user-agent)</li>
</ul>
Privacy protection: Sensitive headers (cookies, authorization, proxy-authorization, www-authenticate) are NEVER forwarded, even if present in the request. If a bot’s signature covers a sensitive header, verification will fail with a clear error.
No WordPress user accounts or personal data is transmitted. Only the headers explicitly covered by the bot’s signature are forwarded to enable cryptographic verification. Note that the URL may include query parameters depending on your site’s structure.
You can: 
* Use the hosted verifier at <code>https://verifier.openbotauth.org/verify</code> 
* Self-host the verifier service (see documentation) 
* The verifier service may log requests server-side depending on your configuration
Analytics are local-only. Decision counts (allow/teaser/deny/pay/rate_limit) and bot traffic observations (User-Agent based) are stored in your WordPress database. No analytics data is sent to external servers.
For more information, please review our <a href="https://openbotauth.org/terms" rel="nofollow ugc">Terms of Service</a> and <a href="https://openbotauth.org/privacy" rel="nofollow ugc">Privacy Policy</a>.
<h3>Developer Hooks</h3>
<h4>Filters</h4>
openbotauth_policy 
Modify policy before applying:
<pre><code>add_filter('openbotauth_policy', function($policy, $post) {
 if ($post->post_type === 'premium') {
 $policy['price_cents'] = 1000;
 }
 return $policy;
}, 10, 2);
</code></pre>
<h4>Actions</h4>
openbotauth_verified 
Triggered when a bot is verified:
<pre><code>add_action('openbotauth_verified', function($agent, $post) {
 error_log("Bot {$agent['jwks_url']} accessed post {$post->ID}");
}, 10, 2);
</code></pre>
openbotauth_payment_required 
Triggered when 402 is returned:
<pre><code>add_action('openbotauth_payment_required', function($agent, $post, $price) {
 // Track payment requests
}, 10, 3);
</code></pre>
<h4>AI Endpoint Filters (v0.1.2+)</h4>
openbotauth_should_serve_llms_txt 
Disable llms.txt endpoint (e.g., when using Yoast):
<pre><code>add_filter('openbotauth_should_serve_llms_txt', '__return_false');
</code></pre>
openbotauth_should_serve_feed 
Disable JSON feed endpoint:
<pre><code>add_filter('openbotauth_should_serve_feed', '__return_false');
</code></pre>
openbotauth_should_serve_markdown 
Disable markdown endpoints:
<pre><code>add_filter('openbotauth_should_serve_markdown', '__return_false');
</code></pre>
openbotauth_feed_item 
Modify feed items:
<pre><code>add_filter('openbotauth_feed_item', function($item, $post) {
 $item['custom_field'] = get_post_meta($post->ID, 'my_field', true);
 return $item;
}, 10, 2);
</code></pre>
openbotauth_markdown_content 
Post-process markdown output:
<pre><code>add_filter('openbotauth_markdown_content', function($markdown, $post) {
 return $markdown . "\n\n---\nCopyright notice here";
}, 10, 2);
</code></pre>

OpenBotAuth – AI Crawler Access Control

Verify AI crawlers with HTTP Signatures and enforce allow/deny/teaser policies; also serves llms.txt and AI-ready feeds.

Sean Mullins

LLMs.txt Curator helps site owners generate and curate a high-quality <code>llms.txt</code> file for AI assistants and retrieval systems, ensuring only relevant, well-described content is exposed to large language models.
It generates and maintains <code>llms.txt</code> and <code>llms-full.txt</code> — the emerging standard for telling AI systems (ChatGPT, Claude, Perplexity, Gemini, and others) which pages on your site matter most and what they contain.
Unlike auto-generators that dump every URL into a flat file, LLMs.txt Curator takes a curation-first approach. You choose the pages, organise them into sections, fill descriptions, override titles for AI, validate quality, and see exactly which AI bots are reading your file — all from a single interface.
<h4>What makes this different</h4>
Most llms.txt plugins treat the file as a static output. LLMs.txt Curator treats it as a living asset:
<ul>
<li>Quality Score — every generated file shows your coverage percentage, which pages have descriptions, and which still need attention.</li>
<li>Description Suggestions — one click fills all missing descriptions from a five-step fallback chain (SEO meta → excerpt → Open Graph → page content). Never overwrites what you’ve set manually.</li>
<li>Change Detection — a banner appears in your admin when curated pages have been updated since the last generation, with a Regenerate Now button. Your llms.txt stays current without manual checking.</li>
<li>Per-Page Title Override — set a different title for each page specifically for AI consumption, without touching your on-site SEO.</li>
<li>Safety Mode — blocks generation if validation errors exist, preventing a broken file from going live. Includes an on-demand validator with plain-English results.</li>
<li>AI Crawler Analytics — see which bots visited in the last 7 days, with a visual bar chart. OpenAI, Anthropic, Perplexity, Google — know who is actually reading your file.</li>
</ul>
<h4>Core features</h4>
<ul>
<li>Drag-and-drop curation — reorder sections and pages visually; each section becomes an <code>##</code> heading per the spec</li>
<li>llms-full.txt generation — the companion file with full Markdown content for each curated page</li>
<li>Five SEO plugin integrations — Rank Math, Yoast SEO, All in One SEO, SEOPress, The SEO Framework</li>
<li>Schema-aware descriptions — uses structured data before falling back through the description chain</li>
<li>Scheduled regeneration — choose Instant (on publish), Daily, Weekly, or Manual</li>
<li>WooCommerce support — SKU, price, stock, categories, dimensions; respects product visibility</li>
<li>WordPress Multisite — network-activate across all sites; each site manages its own independent llms.txt; Network Admin overview with per-site and bulk regenerate</li>
<li>Pre-built templates — Business, E-commerce, SaaS, Blog, Local Business</li>
<li>Live preview — see your exact llms.txt output before saving</li>
<li>Import / export — move your configuration between sites as JSON</li>
<li>WP-CLI — <code>wp llms-txt regenerate</code>, <code>wp llms-txt status</code>, <code>wp llms-txt crawler-log</code></li>
<li>REST API — <code>POST /wp-json/llms-txt/v1/regenerate</code>, <code>GET /wp-json/llms-txt/v1/status</code></li>
<li>Atomic file writes — temp file → rename; no half-written files served to bots</li>
<li>ETag/304 caching — proper HTTP headers for CDN revalidation</li>
<li>Subdirectory / Bedrock support — correctly finds the site root on non-standard installs</li>
<li>Robots.txt reference — automatically adds a spec-compliant comment</li>
</ul>
<h4>Description Suggestions in detail</h4>
When pages lack descriptions, AI systems get less context. The suggestion engine fills the gap automatically:
<ol>
<li>Schema markup (Rank Math, custom <code>_schema_json</code>)</li>
<li>SEO plugin meta description</li>
<li>WordPress excerpt</li>
<li>Open Graph description (<code>_og_description</code> / <code>og_description</code>)</li>
<li>First 160 characters of post content</li>
</ol>
Already-set descriptions are never touched. Pages that can’t be filled automatically are listed for manual review.
<h4>Quality Score</h4>
Every generated <code>llms.txt</code> ends with a coverage report:
<pre><code>Quality Score: 94%
Pages included: 48
Pages with descriptions: 45
Pages missing descriptions: 3
</code></pre>
This is visible to the AI systems reading your file, and to you in the Preview tab.
<h4>AI Crawler Analytics</h4>
Track 12 known bots: GPTBot, ChatGPT-User, ClaudeBot, PerplexityBot, Google-Extended, Applebot-Extended, Meta-ExternalAgent, Bytespider, CCBot, Cohere, DeepSeek, Amazonbot.
The 7-day analytics card shows a visual bar chart of recent activity. All-time totals are kept separately. IP addresses are anonymised before storage — last octet zeroed for IPv4, last 80 bits for IPv6. No data leaves your server.
<h4>Safety Mode</h4>
Before generation, the validator checks:
<ul>
<li>Pages missing or unpublished</li>
<li>Duplicate URLs across sections</li>
<li>Noindex conflicts</li>
<li>Canonical mismatches</li>
<li>Password-protected pages</li>
<li>Thin content (< 100 words, no meta, no excerpt)</li>
<li>File size > 50 KB</li>
<li>Too many pages (> 80)</li>
</ul>
When Safety Mode is on, errors block generation and the results are shown immediately. Warnings are surfaced but don’t block. Everything is explained in plain English.
<h4>Scheduled regeneration</h4>
<ul>
<li>Instant — regenerates ~30 seconds after any page is published or trashed (default)</li>
<li>Daily — once per day, via WP-Cron recurring event</li>
<li>Weekly — once per week</li>
<li>Manual — only when you click Save & Generate</li>
</ul>
<h4>How to get started</h4>
<ol>
<li>Install and activate. The plugin auto-scans your content and creates initial sections.</li>
<li>Curate: drag, drop, add, remove. Aim for 20-60 pages that best represent your site.</li>
<li>Click Generate Missing Descriptions to fill gaps automatically.</li>
<li>Fix any warnings shown in the Safety Mode card.</li>
<li>Set the update mode that suits your workflow.</li>
<li>Save & Generate. Your files are live at <code>/llms.txt</code> and <code>/llms-full.txt</code>.</li>
<li>Enable the AI Crawler Log to see which bots start visiting.</li>
</ol>
<h4>WooCommerce integration</h4>
When WooCommerce is active, the plugin automatically includes SKU, price, and stock status in <code>llms.txt</code> descriptions, and full product details in <code>llms-full.txt</code>. Products with “hidden” visibility are excluded, and you can optionally exclude out-of-stock products.
<h4>Developer hooks</h4>
<ul>
<li><code>llmscu_capability</code> filter — override the required capability (default: <code>manage_options</code>)</li>
<li><code>llmscu_post_limit</code> filter — scanner post limit per type (default: 500)</li>
<li><code>llmscu_full_word_limit</code> filter — per-page word cap in <code>llms-full.txt</code> (default: unlimited)</li>
<li><code>llmscu_regenerated</code> action — fires after each successful regeneration with the content string</li>
</ul>

LLMs.txt Curator

Curate, score, and maintain your llms.txt with quality scoring, description suggestions, change detection, and AI crawler analytics.

OpenBotAuth – AI Crawler Access Control vs LLMs.txt Curator