shadowscan

<p>ShadowScan Security Link pairs your site to the ShadowScan portal and keeps it in sync with heartbeat status, Guard Layer signals, login abuse detection, and security commands.</p>
<p>ShadowScan does not install, activate, or configure third-party security tools. If another security plugin is present, the connector only records its presence as metadata.</p>
<h3>External services</h3>
<p>This plugin connects to external services to sync status, process security workflows, and support optional diagnostics.</p>
<ul>
<li>Service: ShadowScan API (hosted at Supabase Edge Functions)</li>
<li>URL: https://foemwjtosslaiynduiyt.supabase.co/functions/v1/</li>
<li>Used for: site pairing, heartbeat sync, command polling, command-result upload, subscription/policy sync, and support contact submissions.</li>
<li>Data sent and when: site URL, WordPress version, PHP version, connector version, Guard Layer/control status, heartbeat timestamps, and command execution metadata whenever the connector syncs with ShadowScan; contact form fields only when an admin submits support contact.</li>
<li>Terms: https://shadowscan.com.au/terms</li>
<li>
<p>Privacy: https://shadowscan.com.au/privacy</p>
</li>
<li>
<p>Service: Have I Been Pwned Passwords API</p>
</li>
<li>URL: https://api.pwnedpasswords.com</li>
<li>Used for: optional breached-password checks in password policy enforcement.</li>
<li>Data sent and when: k-anonymity password hash prefix (first 5 SHA-1 characters, no raw passwords) only when a password is checked by the policy flow.</li>
<li>Terms: https://haveibeenpwned.com/TermsOfUse</li>
<li>
<p>Privacy: https://haveibeenpwned.com/Privacy</p>
</li>
<li>
<p>Service: Sentry</p>
</li>
<li>URL: https://sentry.io</li>
<li>Used for: optional error and fatal-event telemetry to assist troubleshooting.</li>
<li>Data sent and when: error event metadata (such as exception messages, stack traces, and runtime context) only after an admin explicitly enables Sentry telemetry in plugin settings and a Sentry DSN is configured; the optional MU diagnostics helper can send early-startup fatal errors only while both Sentry telemetry and remote diagnostics are enabled.</li>
<li>Terms: https://sentry.io/terms/</li>
<li>Privacy: https://sentry.io/privacy/</li>
</ul>
<h3>Third-Party Libraries</h3>
<p>This plugin bundles:<br />
* pragmarx/google2fa (MIT License)<br />
* bacon/bacon-qr-code (BSD-2-Clause; Copyright (c) 2017-present, Ben Scholzen “DASPRiD”)</p>
<h3>Hooks</h3>
<p>shadowscan_log<br />
Fires when the plugin emits an internal log message. You can hook this in a must‑use plugin or theme if you want to capture logs.</p>


ShadowScan Security Link

Connects your WordPress site to the ShadowScan portal for heartbeats, guard signals, and security commands.

AlmaWeb

<p><strong>Two sides of AI traffic, one powerful plugin.</strong></p>
<p>With the rise of AI platforms like ChatGPT, Claude, Gemini, and Perplexity, your website faces two new realities:<br />
1. <strong>AI bots scraping your content</strong> for training and indexing<br />
2. <strong>Real human visitors discovering your site through AI tools</strong> and clicking through to visit</p>
<p><strong>AlmaWeb AI Visitor Analytics</strong> is the only WordPress plugin that tracks BOTH:</p>
<p><strong>AI Bot Detection</strong><br />
Identify bots from major AI companies (OpenAI, Google, Anthropic, Meta, Amazon), SEO crawlers (Ahrefs, Semrush), aggressive scrapers, and even “stealth” bots hiding behind standard User-Agents. Detect GPTBot, ClaudeBot, Google-Extended, Gemini, Bytespider, Perplexity and 200+ more.</p>
<p><strong>AI Referrer Tracking</strong><br />
Track real human visitors coming FROM AI platforms! When someone asks ChatGPT a question and clicks a link to your site, you will see it. Understand which AI tools are sending you traffic, which pages they land on, and how diverse your AI traffic sources are.</p>
<h4>Why AlmaWeb AI Visitor Analytics?</h4>
<p>In a world where AIs massively consume AND distribute web content, it is crucial to know:</p>
<ul>
<li><strong>Who’s scraping your content</strong> – Precisely identify each AI bot (GPTBot, ClaudeBot, Google-Extended, Gemini, etc.)</li>
<li><strong>Whether ChatGPT is training on your data</strong> – Detect OpenAI crawlers in real time and block them if needed</li>
<li><strong>Which pages are being targeted</strong> – Discover what content interests AI bots the most</li>
<li><strong>Hidden bots</strong> – Detect even bots that mask their identity with standard User-Agents (stealth detection)</li>
<li><strong>Which AI platforms send you traffic</strong> – Track human visitors referred by ChatGPT, Claude, Perplexity, etc.</li>
</ul>
<h4>Key Features</h4>
<p><strong>🔍 Multi-Level Bot Detection</strong></p>
<ul>
<li><strong>Level 1 – User-Agent:</strong> Detects 200+ AI bot signatures (OpenAI, Anthropic, Google, Meta, Amazon, Apple, xAI, Mistral, Cohere, Perplexity, DeepSeek, and more)</li>
<li><strong>Level 2 – IP Range:</strong> Verifies official IP ranges from OpenAI, Anthropic, and Google to catch masked bots</li>
<li><strong>Level 3 – Stealth Detection:</strong> Detects invisible bots like ChatGPT Atlas that use standard browser User-Agents by cross-referencing IP addresses</li>
</ul>
<p><strong>📊 Comprehensive Dashboard</strong></p>
<ul>
<li>Real-time statistics (human visits vs bots)</li>
<li>Evolution charts with Chart.js</li>
<li>Distribution by AI family (OpenAI, Google, Anthropic, etc.)</li>
<li>Top 10 most active bots</li>
<li>Top 10 most scraped pages</li>
<li>Comparison with previous period</li>
<li>Business KPIs: growth rate, peak hours, intent distribution</li>
</ul>
<p><strong>📋 Detailed Logs</strong></p>
<ul>
<li>Advanced filtering by bot type, IP, date</li>
<li>Real-time search</li>
<li>Full CSV export</li>
<li>Complete details: User-Agent, IP, URL, detection method, AI family, bot intent</li>
<li>Special badge for “invisible” bots</li>
</ul>
<p><strong>⚙️ Flexible Configuration</strong></p>
<ul>
<li>Enable/disable tracking</li>
<li>Bad bot blocking option (disabled by default)</li>
<li>Configurable data retention (90 days by default)</li>
<li>Automatic daily cleanup of old data</li>
<li>Exclude logged-in users (optional)</li>
</ul>
<p><strong>🔒 Privacy Respectful</strong></p>
<ul>
<li>No data sent to third-party services</li>
<li>All data stays in your WordPress database</li>
<li>GDPR compliant</li>
<li>No cookies or client-side tracking</li>
<li>Only downloads public data (IP ranges)</li>
</ul>
<h4>Detected Bots</h4>
<p>The plugin detects over 200 different bots in the following categories:</p>
<p><strong>AI Bots (AI Training & Inference):</strong><br />
OpenAI (GPTBot, ChatGPT-User, OAI-SearchBot, Operator, ChatGPT Agent), Anthropic (ClaudeBot, Claude-Web, Claude-SearchBot), Google AI (Google-Extended, Gemini, NotebookLM, GoogleAgent-Mariner), Meta AI, Amazon (Amazonbot, Bedrock, Nova Act), Apple Intelligence, Perplexity, Mistral, xAI (Grok), Cohere, DeepSeek, Character.AI, Kagi, Exa, Tavily, Apify, and 150+ others.</p>
<p><strong>Search Engines:</strong><br />
Google, Bing, Yahoo, DuckDuckGo, Yandex, Baidu, etc.</p>
<p><strong>SEO Crawlers:</strong><br />
Ahrefs, Semrush, Moz, Majestic, etc.</p>
<p><strong>Scrapers & Malicious Bots:</strong><br />
Content scrapers, email collectors, attack bots, etc.</p>
<h4>Advanced Stealth Bot Detection</h4>
<p>Some AI bots like <strong>ChatGPT Atlas</strong> use standard browser User-Agents (Chrome, Safari) to go unnoticed. AlmaWeb AI Visitor Analytics detects them by cross-referencing IP addresses against official IP ranges from <strong>OpenAI, Anthropic, and Google</strong> — all stored locally, no external calls required.</p>
<p><strong>Example:</strong><br />
A visitor with User-Agent “Mozilla/5.0 Chrome/…” from an IP in the OpenAI range will be identified as “ChatGPT Atlas” and marked with an “INVISIBLE” badge in the logs.</p>
<h4>Firewall — Block Unwanted Bots</h4>
<p>Since v1.2.0, the plugin includes a built-in <strong>Firewall</strong> to block bots before they access your content:</p>
<ul>
<li><strong>Block by intention</strong> — Stop training crawlers (GPTBot, ClaudeBot), scrapers, or inference bots</li>
<li><strong>Block by family</strong> — Block all bots from a specific company (ByteDance, Meta, OpenAI, etc.)</li>
<li>Blocked bots receive a <strong>403 response</strong> and are still logged for analysis</li>
</ul>
<h4>Performance</h4>
<ul>
<li><strong>Zero external calls:</strong> IP ranges for OpenAI, Anthropic and Google are stored locally</li>
<li><strong>Minimal impact:</strong> Optimized to not slow down your site</li>
<li><strong>Optimized queries:</strong> Indexes on all important columns</li>
<li><strong>Automatic cleanup:</strong> Daily deletion of old data</li>
</ul>
<p>Protect your content and understand your traffic like never before.</p>
<h3>Official Plugin Page</h3>
<p>Visit the official plugin page for additional resources and support:<br />
<strong>https://almaweb.fr/ai-visitor-analytics</strong></p>
<h3>Privacy & Data Protection</h3>
<p>AlmaWeb AI Visitor Analytics takes your privacy seriously:</p>
<h4>Data Storage</h4>
<ul>
<li>All data is stored locally in your WordPress database</li>
<li>No external services receive any data from your site</li>
<li>You have full control over data retention (configurable from 1 to 365 days)</li>
<li>Automatic daily cleanup removes old data based on your settings</li>
</ul>
<h4>What Data is Collected</h4>
<p>The plugin collects the following information for each visit:<br />
* User-Agent string<br />
* IP address<br />
* Requested URL<br />
* HTTP referrer<br />
* Request method (GET, POST, etc.)<br />
* HTTP headers (Accept, Accept-Language, Accept-Encoding)<br />
* Timestamp</p>
<p>This data is used solely for bot detection and traffic analysis on your own site.</p>
<h4>GDPR Compliance</h4>
<ul>
<li>No cookies are set by this plugin</li>
<li>No client-side tracking or JavaScript-based analytics</li>
<li>IP addresses are stored for bot identification purposes only</li>
<li>You can configure data retention to comply with your privacy policy</li>
<li>Users can request data deletion through standard WordPress data export/erasure tools</li>
</ul>
<h4>What This Plugin Does NOT Do</h4>
<ul>
<li>Does NOT send your data to external servers</li>
<li>Does NOT track end-user behavior for advertising</li>
<li>Does NOT use third-party analytics services</li>
<li>Does NOT set cookies</li>
<li>Does NOT require user consent (server-side logging only)</li>
</ul>
<h3>Third-Party Services</h3>
<p>This plugin may connect to the following third-party services <strong>only</strong> to download publicly available bot IP ranges:</p>
<h4>OpenAI IP Ranges</h4>
<ul>
<li><strong>GPTBot:</strong> https://openai.com/gptbot.json</li>
<li><strong>ChatGPT-User:</strong> https://openai.com/chatgpt-user.json</li>
<li><strong>SearchBot:</strong> https://openai.com/searchbot.json</li>
</ul>
<p><strong>Purpose:</strong> Verify IP addresses to detect OpenAI bots, including stealth bots like ChatGPT Atlas<br />
<strong>Data sent:</strong> None – the plugin only downloads public IP range information<br />
<strong>Caching:</strong> IP ranges are cached for 24 hours to minimize requests<br />
<strong>Privacy Policy:</strong> https://openai.com/privacy</p>
<h4>Important Notes</h4>
<ul>
<li><strong>No data from your site is ever sent to these services</strong></li>
<li>The plugin only downloads publicly available IP range lists</li>
<li>These requests happen server-side (not from visitors’ browsers)</li>
<li>IP ranges are cached locally for 24 hours</li>
<li>If the external service is unavailable, the plugin continues to work using User-Agent detection</li>
</ul>
<h4>Bundled Libraries</h4>
<p><strong>Chart.js v4.5.1</strong> (bundled locally)<br />
* Used for dashboard visualizations<br />
* No external connections required<br />
* Loaded only on admin pages<br />
* License: MIT</p>
<p>All third-party code is included in the plugin and does not require external CDN connections.</p>
<h3>Support & Documentation</h3>
<h4>Getting Help</h4>
<p>If you need help with the plugin, here are your options:</p>
<ol>
<li><strong>Documentation:</strong> Check the plugin settings page for inline help and tooltips</li>
<li><strong>WordPress Support Forum:</strong> Post your questions on the WordPress.org support forum</li>
<li><strong>Official Page:</strong> Visit https://almaweb.fr/ai-visitor-analytics for contact and support</li>
</ol>
<h4>Reporting Bugs</h4>
<p>If you find a bug, please report it on the WordPress.org support forum with:<br />
* WordPress version<br />
* PHP version<br />
* Steps to reproduce the issue<br />
* Any error messages you’re seeing</p>
<p>You can also contact us directly through our official page at https://almaweb.fr/ai-visitor-analytics</p>
<h4>Feature Requests</h4>
<p>We welcome feature suggestions! Please submit them on the WordPress.org support forum or contact us through https://almaweb.fr/ai-visitor-analytics</p>
<h3>Contributing</h3>
<p>This plugin is open source and welcomes contributions!</p>
<h4>Translation</h4>
<p>The plugin is available in French and English. To add a new language:</p>
<ol>
<li>Copy <code>languages/almaweb-ai-visitor-analytics.pot</code></li>
<li>Translate using Poedit or similar tool</li>
<li>Save as <code>almaweb-ai-visitor-analytics-{locale}.po</code> and compile to <code>.mo</code></li>
<li>Contact us through https://almaweb.fr/ai-visitor-analytics to submit your translation</li>
</ol>
<h3>Credits</h3>
<p><strong>Developed by:</strong> Yohan Ziri<br />
<strong>Company:</strong> AlmaWeb (https://almaweb.fr)<br />
<strong>License:</strong> GPLv3 or later</p>
<p><strong>Special Thanks:</strong><br />
* Chart.js for beautiful visualizations<br />
* The WordPress community for feedback and support<br />
* All users who help improve the bot detection library</p>


AlmaWeb AI Visitor Analytics

Detect GPTBot, ClaudeBot, Gemini and 200+ AI crawlers. Track which AI bots scrape your content and block unwanted scrapers.

ShadowScan Security Link vs AlmaWeb AI Visitor Analytics