hammadtq

OpenBotAuth helps publishers control automated access from AI crawlers and agents. It verifies requests using RFC 9421 HTTP Message Signatures (via a configurable verifier) and applies per-site or per-post policies like allow, deny, teaser previews, and 402 payment-required responses. It also publishes AI-friendly endpoints like llms.txt, a JSON feed, and per-post Markdown.
Instead of blocking all bots or allowing unrestricted access, you can:
<ul>
<li>See AI bot traffic – Local-only analytics showing which bots are crawling your site</li>
<li>Verify bot identity using cryptographic signatures (RFC 9421)</li>
<li>Show teasers to unverified bots (first N words)</li>
<li>Rate limit bot access per agent</li>
<li>Whitelist/blacklist specific bots</li>
</ul>
<h4>Key Features</h4>
<ul>
<li>Bot Traffic Analytics – See which AI bots (GPTBot, ClaudeBot, PerplexityBot, etc.) are visiting your site</li>
<li>Signature Verification – Verifies RFC 9421 HTTP Message Signatures using Ed25519 cryptography</li>
<li>Content Teasers – Show first N words to unverified bots with customizable per-post settings</li>
<li>Rate Limiting – Per-agent rate limits with configurable time windows</li>
<li>Access Control – Whitelist/blacklist with wildcard pattern matching</li>
<li>Local Analytics – Visual dashboard with charts, stats cards, and decision breakdowns (no external tracking)</li>
<li>AI-Ready Endpoints – Serve llms.txt, JSON feed, and markdown for AI crawlers</li>
<li>Tabbed Admin Interface – Clean organization with Analytics, AI Endpoints, and Configuration tabs</li>
</ul>
<h4>AI-Ready Endpoints</h4>
OpenBotAuth provides machine-readable endpoints for AI systems:
<ul>
<li>/llms.txt – Standardized AI feed discovery (also at /.well-known/llms.txt)</li>
<li>/.well-known/openbotauth-feed.json – JSON list of all published posts</li>
<li>/.well-known/openbotauth/posts/{ID}.md – Per-post markdown content</li>
</ul>
Configure which post types to include (posts, pages, or custom types) and set the feed limit (up to 500 items). All data is served locally from your WordPress database. No external tracking or telemetry. Only published, non-password-protected posts are exposed.
<h4>How It Works</h4>
<ol>
<li>AI agent signs HTTP request with its private key (RFC 9421 signature)</li>
<li>WordPress plugin extracts signature headers and sends them to a verifier service</li>
<li>Verifier fetches agent’s public key from registry and verifies signature</li>
<li>Plugin applies policy: allow full content, show teaser, require payment, or deny</li>
</ol>
<h4>External Service Disclosure</h4>
This plugin connects to an external verifier service. When a signed bot request is received, the plugin sends the following data to your configured verifier URL via <code>wp_remote_post</code>:
<ul>
<li>HTTP method (GET, POST, etc.)</li>
<li>The accessed URL (including query string, if present)</li>
<li>HTTP signature headers (Signature, Signature-Input, Signature-Agent)</li>
<li>Additional HTTP header values explicitly listed in the Signature-Input header (e.g., content-type, accept, user-agent)</li>
</ul>
Privacy protection: Sensitive headers (cookies, authorization, proxy-authorization, www-authenticate) are NEVER forwarded, even if present in the request. If a bot’s signature covers a sensitive header, verification will fail with a clear error.
No WordPress user accounts or personal data is transmitted. Only the headers explicitly covered by the bot’s signature are forwarded to enable cryptographic verification. Note that the URL may include query parameters depending on your site’s structure.
You can: 
* Use the hosted verifier at <code>https://verifier.openbotauth.org/verify</code> 
* Self-host the verifier service (see documentation) 
* The verifier service may log requests server-side depending on your configuration
Analytics are local-only. Decision counts (allow/teaser/deny/pay/rate_limit) and bot traffic observations (User-Agent based) are stored in your WordPress database. No analytics data is sent to external servers.
For more information, please review our <a href="https://openbotauth.org/terms" rel="nofollow ugc">Terms of Service</a> and <a href="https://openbotauth.org/privacy" rel="nofollow ugc">Privacy Policy</a>.
<h3>Developer Hooks</h3>
<h4>Filters</h4>
openbotauth_policy 
Modify policy before applying:
<pre><code>add_filter('openbotauth_policy', function($policy, $post) {
 if ($post->post_type === 'premium') {
 $policy['price_cents'] = 1000;
 }
 return $policy;
}, 10, 2);
</code></pre>
<h4>Actions</h4>
openbotauth_verified 
Triggered when a bot is verified:
<pre><code>add_action('openbotauth_verified', function($agent, $post) {
 error_log("Bot {$agent['jwks_url']} accessed post {$post->ID}");
}, 10, 2);
</code></pre>
openbotauth_payment_required 
Triggered when 402 is returned:
<pre><code>add_action('openbotauth_payment_required', function($agent, $post, $price) {
 // Track payment requests
}, 10, 3);
</code></pre>
<h4>AI Endpoint Filters (v0.1.2+)</h4>
openbotauth_should_serve_llms_txt 
Disable llms.txt endpoint (e.g., when using Yoast):
<pre><code>add_filter('openbotauth_should_serve_llms_txt', '__return_false');
</code></pre>
openbotauth_should_serve_feed 
Disable JSON feed endpoint:
<pre><code>add_filter('openbotauth_should_serve_feed', '__return_false');
</code></pre>
openbotauth_should_serve_markdown 
Disable markdown endpoints:
<pre><code>add_filter('openbotauth_should_serve_markdown', '__return_false');
</code></pre>
openbotauth_feed_item 
Modify feed items:
<pre><code>add_filter('openbotauth_feed_item', function($item, $post) {
 $item['custom_field'] = get_post_meta($post->ID, 'my_field', true);
 return $item;
}, 10, 2);
</code></pre>
openbotauth_markdown_content 
Post-process markdown output:
<pre><code>add_filter('openbotauth_markdown_content', function($markdown, $post) {
 return $markdown . "\n\n---\nCopyright notice here";
}, 10, 2);
</code></pre>

OpenBotAuth – AI Crawler Access Control

Verify AI crawlers with HTTP Signatures and enforce allow/deny/teaser policies; also serves llms.txt and AI-ready feeds.

Erik

The md4AI plugin provides a powerful, multi-layered approach to Generative Engine Optimization (GEO).
<h3>1. Automatic AI Bot Detection (Zero-Config)</h3>
md4AI automatically detects requests from a comprehensive list of known AI agents (like GPTBot, ClaudeBot, Google-Extended, etc.) and serves them a lightweight, on-the-fly Markdown version of your content instead of the standard HTML theme. This ensures a clean, parsable data feed for LLMs right out of the box.
<h3>2. Per-Post Custom Markdown (Metabox)</h3>
The plugin adds a new metabox to your post and page editor, giving you full control over the AI-optimized version of your content. 
Serving an md version of the website is particular useful if your website has editors like Elementor / Beaver Builder / Divi Builder / other div bloated editors because bots usually skips complex and too much nested content.
<ul>
<li>Generate Custom Markdown: Convert your post’s content into Markdown with one click.</li>
<li>Manually Edit: Modify and enhance the Markdown to be exactly as you want AIs to see it.</li>
<li>(Optional) Enhance with AI: If you also use the <a href="https://wordpress.org/plugins/ai-services/" rel="ugc">AI Services</a> plugin, you can use the “Generate with AI” button to automatically add FAQs, discussion questions, or key takeaways extracted from your post.</li>
<li>Serve Enhanced Content: When an AI bot visits this specific post, it will be served your new, custom-tailored Markdown version, giving it far richer data.</li>
<li>Automatic Fallback: If you don’t create a custom version, the plugin falls back to the automatic on-the-fly conversion.</li>
</ul>
<h3>3. Site-Wide AI Instructions (llms.txt)</h3>
The plugin adds a new main page under ‘Utilities’ with dedicated tabs for configuration and insights. From here, you can create and manage a <code>llms.txt</code> file for your entire site.
<ul>
<li>What is <code>llms.txt</code>? This is a file, similar to <code>robots.txt</code>, that provides general instructions, context, and useful links to AI crawlers. It’s a new standard to help guide LLMs in understanding your site’s content and purpose.</li>
<li>Manage Content: Use the settings page to write your <code>llms.txt</code> content, which will then be served automatically to bots that look for it.</li>
<li>Learn More: You can find more details on this new standard at <a href="https://llmstxt.org/" rel="nofollow ugc">https://llmstxt.org/</a>.</li>
</ul>
This combination gives you full control, from automatic optimization to granular, AI-enhanced, per-post content and site-wide AI directives.
<h3>4. GEO/AIO Insights & Validation</h3>
The dedicated GEO/AIO Insights tab provides a unique validation mechanism for your site’s AI presence, offering measurable scores (0-100) on how well your brand is understood by Generative Engines.
<ul>
<li>The Validation Process: We ask a Large Language Model (LLM) to complete a “knowledge card” about your site (e.g., brand name, main topics, product categories).</li>
<li>Ground Truth Check: The AI response is immediately compared with real data extracted from your WordPress database (e.g., site title, author names, WooCommerce categories)</li>
<li>Final Score: Based on this cross-check, the insight provides a score for brand identity and technical relevance, highlighting exactly where the AI provided incorrect or insufficient data (hallucinations or missing data).</li>
</ul>

md4AI

Optimise content for generative engines (GEO) by serving custom Markdown and a site-wide llms.txt.

OpenBotAuth – AI Crawler Access Control vs md4AI