Profound

<p>Profound Agent Analytics is a powerful WordPress plugin that integrates with Profound’s edge log analysis service to identify, classify, and provide reporting on bot and human traffic to your website. The plugin works by efficiently collecting and sending request data from public pages to Profound’s analytics platform. Read more <a href="https://docs.tryprofound.com/agent-analytics/wordpress/introduction" rel="nofollow ugc">here</a></p>
<h4>Key Features</h4>
<ul>
<li><strong>Non-blocking Performance</strong>: Uses an asynchronous queue system to ensure zero impact on page load times</li>
<li><strong>Privacy-Focused</strong>: Query parameter redaction to protect sensitive data</li>
<li><strong>Smart Batching</strong>: Efficiently sends logs in batches to minimize network overhead</li>
<li><strong>Circuit Breaker</strong>: Automatic protection against API failures to prevent cascading issues</li>
<li><strong>Flexible Configuration</strong>: Extensive settings for customizing what data is collected and sent</li>
<li><strong>Enterprise Ready</strong>: Supports environment variables and constants for API key configuration</li>
</ul>
<h4>How It Works</h4>
<ol>
<li>The plugin captures essential HTTP request metadata (method, path, status, timing)</li>
<li>Data is immediately queued in a local database table with minimal overhead</li>
<li>A background process sends batched logs to Profound’s API endpoint</li>
<li>Failures are automatically retried with exponential backoff</li>
<li>Your Profound dashboard provides real-time insights into your traffic</li>
</ol>
<h4>Privacy & Security</h4>
<p>Profound Agent Analytics is designed with privacy and security at its core:</p>
<ul>
<li><strong>Complete IP Tracking</strong>: Captures full IP addresses for accurate traffic analysis and reverse DNS lookups (required for bot detection)</li>
<li><strong>Sensitive Data Protection</strong>: Automatically redacts passwords, tokens, and credit card information from query parameters</li>
<li><strong>Public Traffic Only</strong>: Excludes all WordPress admin, REST API, and system paths – only tracks public visitor traffic</li>
<li><strong>Encrypted Storage</strong>: API keys are encrypted using WordPress salts when Sodium extension is available</li>
<li><strong>No Cookie Tracking</strong>: Server-side only – does not use cookies or client-side tracking</li>
</ul>
<h4>Performance Optimized</h4>
<ul>
<li>Adds less than 1ms to request processing time</li>
<li>Efficient database operations with proper indexing</li>
<li>Automatic cleanup of old log entries</li>
<li>Memory-aware batching to prevent large payloads</li>
<li>Configurable queue size limits</li>
</ul>
<h3>Privacy Policy</h3>
<p>This plugin sends data to Profound’s analytics service (https://artemis.api.tryprofound.com). The data sent includes:<br />
– Full IP addresses (required for bot detection and traffic analysis)<br />
– Request URLs from public pages only (admin and system paths are excluded)<br />
– HTTP headers (user agent, referer)<br />
– Response metadata (status code, size, duration)<br />
– Query parameters (with sensitive values redacted)</p>
<p>The plugin only tracks public visitor traffic. WordPress admin activity, user actions, and system operations are not collected. All data is processed in accordance with Profound’s privacy policy available at https://tryprofound.com/privacy-policy</p>
<h3>System Requirements</h3>
<ul>
<li>WordPress 6.0 or higher</li>
<li>PHP 7.4 or higher</li>
<li>MySQL 5.7+ or MariaDB 10.2+</li>
<li>Ability to make outbound HTTPS requests</li>
<li>WP-Cron enabled (or real cron configured)</li>
<li>Sodium PHP extension (recommended for encryption)</li>
</ul>
<h3>Development & Testing</h3>
<p>This plugin includes a <code>.wp-env.json</code> configuration for local testing using <a href="https://developer.wordpress.org/block-editor/reference-guides/packages/packages-env/" rel="nofollow ugc">wp-env</a>. This requires Docker (or OrbStack) and Node.js.</p>
<h4>Running Compatibility Tests</h4>
<ol>
<li>
<p>Start the environment:<br />
npx @wordpress/env start</p>
</li>
<li>
<p>Verify the plugin activates without errors:<br />
npx @wordpress/env run cli wp plugin deactivate agent-analytics-wp-plugin<br />
npx @wordpress/env run cli wp plugin activate agent-analytics-wp-plugin</p>
</li>
<li>
<p>Verify all classes instantiate and core functionality works:<br />
npx @wordpress/env run cli wp eval ‘new AgentAnalytics\Settings(); new AgentAnalytics\Queue(); echo “OK”;’</p>
</li>
<li>
<p>Check for PHP errors, warnings, or deprecation notices (WP_DEBUG is enabled):<br />
npx @wordpress/env run cli cat /var/www/html/wp-content/debug.log<br />
If the file does not exist, there are no errors.</p>
</li>
<li>
<p>Stop the environment:<br />
npx @wordpress/env stop</p>
</li>
</ol>
<p>To test against a different WordPress version, edit the <code>core</code> value in <code>.wp-env.json</code> (e.g. <code>"WordPress/WordPress#7.0"</code>) and restart.</p>
<h4>Deploying to WordPress.org</h4>
<p>See <code>DEPLOY.md</code> for instructions on publishing releases and updating the “Tested up to” value via SVN.</p>
<h3>Support</h3>
<p>For support, please contact support@tryprofound.com</p>


Profound Agent Analytics

Profound Agent Analytics sends lightweight HTTP request logs to Profound's analytics platform for advanced bot detection and traffic analysis.

ldesuque

<p>Server-side, non-blocking request logging with a local queue, batched delivery,<br />
exponential-backoff retries, a circuit breaker, query-parameter redaction, and<br />
path filtering. Admin actions use the WordPress REST API.</p>
<h3>Configuration</h3>
<p>Settings -> nBlick Signal Agent. Set the API key (or define NBLICK_SIGNAL_API_KEY<br />
in wp-config.php), enable logging, and use the Status tab to send a test event.</p>
<h3>External services</h3>
<p>This plugin connects to the nBlick Signal API, a third-party service, to provide<br />
bot detection and traffic analysis. This connection is essential to the plugin’s<br />
purpose: request data collected on your site is transmitted to nBlick for<br />
analysis, and the plugin does nothing useful without it.</p>
<p>What is sent, and when:</p>
<ul>
<li>The plugin sends batches of request metadata to the nBlick Signal ingest<br />
endpoint (default: https://api.trynblick.com/signals/wordpress) on a recurring<br />
background schedule (via WP-Cron) whenever logging is enabled and queued data<br />
exists, and once when you click “Send Test Event”.</li>
<li>Each request record may contain: the visitor’s IP address, the request method,<br />
host, path, HTTP status code, user agent, referer, response size, request<br />
duration, a timestamp, query-string parameters (with sensitive keys such as<br />
passwords and tokens redacted), a per-site identifier (UUID), and a schema<br />
version number.</li>
<li>Only public front-end traffic is sent. WordPress admin, login, REST API, AJAX,<br />
cron, WP-CLI, and any paths you exclude are never collected or transmitted.</li>
<li>Authentication uses an API key you provide, sent in the X-NBlick-Signal-Key<br />
request header.</li>
</ul>
<p>The IP address is transmitted in full because it is required for the service’s<br />
bot-detection and reverse-DNS analysis.</p>
<p>This service is provided by nBlick. By using the plugin you are sending the data<br />
described above to nBlick. Please review their terms and privacy policy:</p>
<ul>
<li>Terms of service: https://trynblick.com/terms-of-service</li>
<li>Privacy policy: https://trynblick.com/privacy-policy</li>
</ul>
<h3>Privacy</h3>
<ul>
<li>The plugin is server-side only. It sets no cookies and performs no client-side<br />
or browser tracking.</li>
<li>Sensitive query parameters (configurable; by default password, pass, token,<br />
auth, authorization, apikey, api_key, secret, card, cc, ssn and similar) are<br />
redacted to “[REDACTED]” before storage and transmission.</li>
<li>Captured data is queued in a local database table and removed after it is sent<br />
successfully, or purged after the configured retention period (default 7 days).</li>
<li>When the Sodium PHP extension is available, the API key is encrypted at rest<br />
using your site’s authentication salts; defining NBLICK_SIGNAL_API_KEY in<br />
wp-config.php avoids database storage entirely.</li>
<li>Because the plugin transmits visitor IP addresses to a third party, you may<br />
need to disclose this in your own site’s privacy policy depending on your<br />
jurisdiction (e.g. GDPR/CCPA).</li>
</ul>


nBlick Signal Agent

Captures public request metadata and ships it in batches to the nBlick Signal API for bot detection and traffic analysis.

Profound Agent Analytics vs nBlick Signal Agent