WordPress.org
Get WordPress

Plugin Directory

Changeset 3604627


Ignore:
Timestamp:
07/12/2026 09:55:36 AM (4 months ago)
Author:
kamenzy
Message:

Release 0.2.3

Location:
axiorank-agent-verification
Files:
2 edited
7 copied

Legend:

Unmodified
Added
Removed

  • axiorank-agent-verification/tags/0.2.3/axiorank-agent-verification.php

    r3604231 r3604627  
    33 * Plugin Name:       AxioRank Agent Verification
    44 * Plugin URI:        https://axiorank.com/inbound-verification/wordpress
    5  * Description:       Verify the AI agents that reach your WordPress REST API, admin, and dynamic endpoints. Cryptographic Web Bot Auth verification with monitor and enforce modes, backed by AxioRank.
    6  * Version:           0.2.2
     5 * Description:       See which AI agents are using your site's login, search, and app connections, verify who they really are, and block the ones you do not trust. Backed by AxioRank.
     6 * Version:           0.2.3
    77 * Requires at least: 5.8
    88 * Requires PHP:      7.4
    … …  
    2424}
    2525
    26 define( 'AXR_AV_VERSION', '0.2.1' );
     26define( 'AXR_AV_VERSION', '0.2.3' );
    2727define( 'AXR_AV_FILE', __FILE__ );
    2828define( 'AXR_AV_DIR', plugin_dir_path( __FILE__ ) );

  • axiorank-agent-verification/tags/0.2.3/readme.txt

    r3604231 r3604627  
    55Tested up to: 7.0
    66Requires PHP: 7.4
    7 Stable tag: 0.2.2
     7Stable tag: 0.2.3
    88License: GPLv2 or later
    99License URI: https://www.gnu.org/licenses/gpl-2.0.html
    1010
    11 Verify the AI agents that reach your WordPress REST API, admin, and dynamic endpoints. Web Bot Auth verification, monitor and enforce modes.
     11AI tools now visit your login, search, and app connections. See who they really are, watch what they do, and block the ones you do not trust.
    1212
    1313== Description ==
    1414
    15 AxioRank Agent Verification checks the AI agents that reach into your site. Instead of guessing from a user-agent string, it verifies Web Bot Auth signatures (RFC 9421) and known-agent identity through AxioRank, then lets you monitor or block on the result.
     15A new kind of visitor is showing up on WordPress sites. Alongside people and the familiar search engine crawlers, there are now AI agents: automated tools like ChatGPT and other assistants that use the web on someone's behalf. They do not just read your public pages. They log in, run searches, submit forms, and talk to the behind-the-scenes connections that power your plugins, themes, and mobile apps.
    1616
    17 It is built for the surface that actually reaches PHP: the REST API (/wp-json), admin-ajax, XML-RPC, login, search, and any request with a signature or a bot-like user-agent. Full-page-cached visits are served before PHP loads and are not seen by the plugin, which is expected. This protects your API and dynamic endpoints, not cached pages.
     17Here is the problem: WordPress has no built-in way to tell who these automated visitors really are. The traditional method is to look at the "user agent", the name a visitor gives for itself. That name is easy to fake. Anyone can write a script that claims to be ChatGPT, and anyone can write a bot that claims to be an ordinary Chrome browser.
    1818
    19 The plugin is a thin client. Each protected request is forwarded as one authenticated POST to the AxioRank verify endpoint, and the verdict is applied locally. There is no heavy SDK and no local model.
     19AxioRank Agent Verification gives you a trustworthy answer. It uses a new open web standard called Web Bot Auth, in which reputable AI companies cryptographically sign the requests their agents make. Think of a signature as a passport rather than a name tag: it can be checked, and it cannot be forged. The plugin checks those signatures through the [AxioRank](https://axiorank.com) service, so for every automated visit to the sensitive parts of your site you can see whether the visitor is genuine, unknown, or pretending to be something it is not.
     20
     21= How it works, in plain terms =
     22
     231. You install the plugin and connect it to your AxioRank account with a site key, a long code that identifies your site.
     242. The plugin quietly watches the sensitive parts of your site: the login page, search, and the technical doorways that apps and integrations use to talk to WordPress (the REST API, admin-ajax, and XML-RPC).
     253. When a request looks automated, because it carries an agent signature or a bot-style user agent, the plugin asks AxioRank one question: who is this, and are they really who they claim to be?
     264. In Monitor mode, which is the default, the answer is simply recorded. Nothing is blocked. Your AxioRank dashboard builds up a picture of which AI agents visit your site, what they touch, and which of them are verified, unknown, or impostors.
     275. When you have watched for a while and feel confident, you flip one switch to Enforce mode. From then on, agents that fail verification or break your rules receive a standard "access denied" response instead of getting through.
    2028
    2129= What you get =
    2230
    23 * Cryptographic verification of signed agents (Web Bot Auth), plus known-agent identity.
    24 * Monitor mode by default: verdicts are logged in your AxioRank dashboard, nothing is blocked.
    25 * Enforce mode: apply block (403) and challenge (401) verdicts, gated by your surface posture.
    26 * Scope controls: choose which endpoints are verified.
    27 * Fail-open by design: if AxioRank cannot be reached, requests are allowed, so a verification outage never takes your site down.
     31* A clear picture of the AI agents using your site, based on verifiable identity instead of easily faked names.
     32* Monitor mode by default: watch first, decide later. Nothing is blocked until you say so.
     33* Enforce mode when you are ready: verified agents pass, impostors and unwanted agents are turned away.
     34* Simple scope controls: tick boxes decide which parts of the site are covered, and the recommended set is preselected.
     35* An activity panel right in your WordPress admin, plus a fuller dashboard on AxioRank.
     36* A safety-first design: if AxioRank is ever slow or unreachable, your site keeps serving visitors as if the plugin were not there.
     37
     38= What this plugin does not do =
     39
     40Honesty helps here, so two things up front.
     41
     42First, this is not a general firewall, malware scanner, or comment spam filter. It does one job well: verifying the identity of automated visitors on the parts of your site that do real work.
     43
     44Second, if you use a caching plugin or your host caches pages (most do), your ordinary public pages are served straight from that cache, before WordPress even wakes up. The plugin never sees those visits, and that is by design. It is not a tool for stopping crawlers from reading your public pages. It protects the parts of your site that accept input and hand out data: logins, searches, form handlers, and app connections.
     45
     46= What information is sent to AxioRank? =
     47
     48The plugin is a small connector for the AxioRank service, so this deserves a plain answer.
     49
     50For each request the plugin decides to check, it sends AxioRank the basics needed to verify identity: the address that was requested, the request type (such as GET or POST), the visitor's stated user agent, the visitor's IP address, and the technical headers that carry the agent's signature.
     51
     52It never sends cookies, passwords, login credentials, or the contents of forms and posts. Ordinary logged-out page reads by people are not checked at all.
     53
     54Verification is provided by [AxioRank](https://axiorank.com). See the [terms of service](https://axiorank.com/terms) and the [privacy policy](https://axiorank.com/privacy).
    2855
    2956= Requirements =
    3057
    31 An AxioRank account and a website surface site key (axr_site_...). Create one in AxioRank under Settings, Surfaces.
     58You need an AxioRank account and a site key for your website (it starts with axr_site_). The free plan is enough to get started.
    3259
    3360== Installation ==
    3461
    35 1. Install and activate the plugin.
    36 2. In AxioRank, register a website surface and copy its site key (axr_site_...).
    37 3. Open Settings, AxioRank, paste the site key, or define it in wp-config.php:
     621. Install the plugin from your Plugins screen and activate it.
     632. Create an account at [axiorank.com](https://axiorank.com) if you do not have one. In AxioRank, register your site as a website surface and copy the site key it gives you. The key starts with axr_site_.
     643. Back in WordPress, go to Settings, then AxioRank, paste the site key, and save. If you prefer to keep keys out of the database, you can instead add this line to wp-config.php:
    3865   `define( 'AXIORANK_SITE_KEY', 'axr_site_...' );`
    39 4. Leave the mode on Monitor, save, and use "Test connection" to confirm.
    40 5. Watch the AxioRank dashboard, then switch to Enforce when you are confident.
     664. Press "Test connection" to confirm everything is wired up.
     675. Leave the mode on Monitor for a few days and watch the dashboard to see who is actually visiting.
     686. When you are comfortable with what you see, switch to Enforce.
    4169
    4270== Frequently Asked Questions ==
    4371
    44 = Will this block real visitors? =
     72= What exactly is an AI agent? =
    4573
    46 No. Only requests that are signed, hit an enabled sensitive endpoint, or carry a bot-like user-agent are verified, and the plugin only blocks in Enforce mode when AxioRank returns an enforced non-allow verdict. Logged-out human page views are never forwarded.
     74Software that uses the web on a person's or a company's behalf. Examples include the assistants behind ChatGPT and Claude fetching a page to answer a question, shopping assistants comparing products, and automation tools that fill in forms. Some are welcome guests, some are noisy scrapers, and some are impostors dressed up as the welcome ones. This plugin helps you tell the difference.
    4775
    48 = What happens if AxioRank is unreachable? =
     76= Will this block real people visiting my site? =
    4977
    50 Verification fails open. The request is allowed and the site keeps serving.
     78No. Ordinary page views by people are never even checked. The plugin looks at requests that appear automated, plus traffic to the sensitive endpoints you selected, and it blocks nothing until you switch from Monitor to Enforce. Even in Enforce mode, blocking is aimed at agents that fail verification or break your rules. A real person going about their day is simply allowed through.
    5179
    52 = Does it slow down my site? =
     80= Will it hurt my SEO or block Google? =
    5381
    54 The plugin skips ordinary traffic, so most requests never call out. Verified requests add one short, capped HTTP round trip.
     82No. Search engines spend nearly all of their time reading your public pages, which are usually served from cache and never touch this plugin. Nothing at all is blocked in Monitor mode. In Enforce mode, verified crawlers that follow your rules are allowed; blocking targets agents that fail verification or pretend to be something they are not.
     83
     84= Do I need to be technical to set this up? =
     85
     86No. Setup is copy and paste: create an AxioRank account, copy the site key, paste it into the settings page, and press "Test connection". The recommended protection scope is preselected, and the plugin starts in the watch-only Monitor mode.
     87
     88= Does it work with caching plugins? =
     89
     90Yes, happily. Cached pages are served exactly as before. The plugin focuses on the dynamic parts of the site that caching does not cover, so the two do complementary jobs.
     91
     92= Will it slow down my site? =
     93
     94You should not notice it. Most traffic is never checked at all. When a request is checked, the plugin makes one quick call to AxioRank with a strict time limit of about a second. If the answer does not arrive in time, the request is allowed through so nobody is kept waiting.
     95
     96= What happens if AxioRank is down or unreachable? =
     97
     98Your site keeps working normally. The plugin is designed to fail open: whenever it cannot get an answer, it allows the request and steps aside. A verification problem will never take your site offline.
     99
     100= What data is sent about my visitors? =
     101
     102Only the basics needed to verify identity, and only for requests the plugin decides to check: the address requested, the request type, the stated user agent, the IP address, and the headers that carry the agent's signature. Cookies, passwords, and the contents of forms and posts are never sent. The Description has the full breakdown.
     103
     104= How much does it cost? =
     105
     106The plugin is free. It connects to the AxioRank service, which has a free plan that covers getting started with a website, and paid plans with more capacity and features.
     107
     108= I switched on Enforce and something I rely on stopped working. What do I do? =
     109
     110Switch back to Monitor. That immediately stops all blocking. Then check the activity panel or your AxioRank dashboard to see what was blocked and why, adjust your scope or rules, and try Enforce again.
    55111
    56112== Screenshots ==
    57113
    58 1. The settings screen: the onboarding stepper, connection status, scope controls, and the monitor or enforce switch.
    59 2. Connected, with the local activity panel showing verified, unverified, and spoofed counts.
     1141. The settings screen: a three-step setup guide, connection status, protection scope, and the Monitor or Enforce switch.
     1152. Connected and watching: the activity panel counts verified, unverified, and spoofed visits.
    601163. A successful connection test against AxioRank.
    61 4. An animated walkthrough of the setup, from pasting a site key to switching on enforce.
     1174. An animated walkthrough of the whole setup, from pasting a site key to switching on Enforce.
    62118
    63119== Changelog ==
     120
     121= 0.2.3 =
     122* Rewrote the plugin description, setup guide, and FAQ in plain language, including a new section that spells out exactly what information is and is not sent to AxioRank. No functional changes.
     123* Fixed an internal version constant that had fallen behind the plugin version (it is used for cache busting of the admin styles and scripts).
    64124
    65125= 0.2.2 =

  • axiorank-agent-verification/trunk/axiorank-agent-verification.php

    r3604231 r3604627  
    33 * Plugin Name:       AxioRank Agent Verification
    44 * Plugin URI:        https://axiorank.com/inbound-verification/wordpress
    5  * Description:       Verify the AI agents that reach your WordPress REST API, admin, and dynamic endpoints. Cryptographic Web Bot Auth verification with monitor and enforce modes, backed by AxioRank.
    6  * Version:           0.2.2
     5 * Description:       See which AI agents are using your site's login, search, and app connections, verify who they really are, and block the ones you do not trust. Backed by AxioRank.
     6 * Version:           0.2.3
    77 * Requires at least: 5.8
    88 * Requires PHP:      7.4
    … …  
    2424}
    2525
    26 define( 'AXR_AV_VERSION', '0.2.1' );
     26define( 'AXR_AV_VERSION', '0.2.3' );
    2727define( 'AXR_AV_FILE', __FILE__ );
    2828define( 'AXR_AV_DIR', plugin_dir_path( __FILE__ ) );

  • axiorank-agent-verification/trunk/readme.txt

    r3604231 r3604627  
    55Tested up to: 7.0
    66Requires PHP: 7.4
    7 Stable tag: 0.2.2
     7Stable tag: 0.2.3
    88License: GPLv2 or later
    99License URI: https://www.gnu.org/licenses/gpl-2.0.html
    1010
    11 Verify the AI agents that reach your WordPress REST API, admin, and dynamic endpoints. Web Bot Auth verification, monitor and enforce modes.
     11AI tools now visit your login, search, and app connections. See who they really are, watch what they do, and block the ones you do not trust.
    1212
    1313== Description ==
    1414
    15 AxioRank Agent Verification checks the AI agents that reach into your site. Instead of guessing from a user-agent string, it verifies Web Bot Auth signatures (RFC 9421) and known-agent identity through AxioRank, then lets you monitor or block on the result.
     15A new kind of visitor is showing up on WordPress sites. Alongside people and the familiar search engine crawlers, there are now AI agents: automated tools like ChatGPT and other assistants that use the web on someone's behalf. They do not just read your public pages. They log in, run searches, submit forms, and talk to the behind-the-scenes connections that power your plugins, themes, and mobile apps.
    1616
    17 It is built for the surface that actually reaches PHP: the REST API (/wp-json), admin-ajax, XML-RPC, login, search, and any request with a signature or a bot-like user-agent. Full-page-cached visits are served before PHP loads and are not seen by the plugin, which is expected. This protects your API and dynamic endpoints, not cached pages.
     17Here is the problem: WordPress has no built-in way to tell who these automated visitors really are. The traditional method is to look at the "user agent", the name a visitor gives for itself. That name is easy to fake. Anyone can write a script that claims to be ChatGPT, and anyone can write a bot that claims to be an ordinary Chrome browser.
    1818
    19 The plugin is a thin client. Each protected request is forwarded as one authenticated POST to the AxioRank verify endpoint, and the verdict is applied locally. There is no heavy SDK and no local model.
     19AxioRank Agent Verification gives you a trustworthy answer. It uses a new open web standard called Web Bot Auth, in which reputable AI companies cryptographically sign the requests their agents make. Think of a signature as a passport rather than a name tag: it can be checked, and it cannot be forged. The plugin checks those signatures through the [AxioRank](https://axiorank.com) service, so for every automated visit to the sensitive parts of your site you can see whether the visitor is genuine, unknown, or pretending to be something it is not.
     20
     21= How it works, in plain terms =
     22
     231. You install the plugin and connect it to your AxioRank account with a site key, a long code that identifies your site.
     242. The plugin quietly watches the sensitive parts of your site: the login page, search, and the technical doorways that apps and integrations use to talk to WordPress (the REST API, admin-ajax, and XML-RPC).
     253. When a request looks automated, because it carries an agent signature or a bot-style user agent, the plugin asks AxioRank one question: who is this, and are they really who they claim to be?
     264. In Monitor mode, which is the default, the answer is simply recorded. Nothing is blocked. Your AxioRank dashboard builds up a picture of which AI agents visit your site, what they touch, and which of them are verified, unknown, or impostors.
     275. When you have watched for a while and feel confident, you flip one switch to Enforce mode. From then on, agents that fail verification or break your rules receive a standard "access denied" response instead of getting through.
    2028
    2129= What you get =
    2230
    23 * Cryptographic verification of signed agents (Web Bot Auth), plus known-agent identity.
    24 * Monitor mode by default: verdicts are logged in your AxioRank dashboard, nothing is blocked.
    25 * Enforce mode: apply block (403) and challenge (401) verdicts, gated by your surface posture.
    26 * Scope controls: choose which endpoints are verified.
    27 * Fail-open by design: if AxioRank cannot be reached, requests are allowed, so a verification outage never takes your site down.
     31* A clear picture of the AI agents using your site, based on verifiable identity instead of easily faked names.
     32* Monitor mode by default: watch first, decide later. Nothing is blocked until you say so.
     33* Enforce mode when you are ready: verified agents pass, impostors and unwanted agents are turned away.
     34* Simple scope controls: tick boxes decide which parts of the site are covered, and the recommended set is preselected.
     35* An activity panel right in your WordPress admin, plus a fuller dashboard on AxioRank.
     36* A safety-first design: if AxioRank is ever slow or unreachable, your site keeps serving visitors as if the plugin were not there.
     37
     38= What this plugin does not do =
     39
     40Honesty helps here, so two things up front.
     41
     42First, this is not a general firewall, malware scanner, or comment spam filter. It does one job well: verifying the identity of automated visitors on the parts of your site that do real work.
     43
     44Second, if you use a caching plugin or your host caches pages (most do), your ordinary public pages are served straight from that cache, before WordPress even wakes up. The plugin never sees those visits, and that is by design. It is not a tool for stopping crawlers from reading your public pages. It protects the parts of your site that accept input and hand out data: logins, searches, form handlers, and app connections.
     45
     46= What information is sent to AxioRank? =
     47
     48The plugin is a small connector for the AxioRank service, so this deserves a plain answer.
     49
     50For each request the plugin decides to check, it sends AxioRank the basics needed to verify identity: the address that was requested, the request type (such as GET or POST), the visitor's stated user agent, the visitor's IP address, and the technical headers that carry the agent's signature.
     51
     52It never sends cookies, passwords, login credentials, or the contents of forms and posts. Ordinary logged-out page reads by people are not checked at all.
     53
     54Verification is provided by [AxioRank](https://axiorank.com). See the [terms of service](https://axiorank.com/terms) and the [privacy policy](https://axiorank.com/privacy).
    2855
    2956= Requirements =
    3057
    31 An AxioRank account and a website surface site key (axr_site_...). Create one in AxioRank under Settings, Surfaces.
     58You need an AxioRank account and a site key for your website (it starts with axr_site_). The free plan is enough to get started.
    3259
    3360== Installation ==
    3461
    35 1. Install and activate the plugin.
    36 2. In AxioRank, register a website surface and copy its site key (axr_site_...).
    37 3. Open Settings, AxioRank, paste the site key, or define it in wp-config.php:
     621. Install the plugin from your Plugins screen and activate it.
     632. Create an account at [axiorank.com](https://axiorank.com) if you do not have one. In AxioRank, register your site as a website surface and copy the site key it gives you. The key starts with axr_site_.
     643. Back in WordPress, go to Settings, then AxioRank, paste the site key, and save. If you prefer to keep keys out of the database, you can instead add this line to wp-config.php:
    3865   `define( 'AXIORANK_SITE_KEY', 'axr_site_...' );`
    39 4. Leave the mode on Monitor, save, and use "Test connection" to confirm.
    40 5. Watch the AxioRank dashboard, then switch to Enforce when you are confident.
     664. Press "Test connection" to confirm everything is wired up.
     675. Leave the mode on Monitor for a few days and watch the dashboard to see who is actually visiting.
     686. When you are comfortable with what you see, switch to Enforce.
    4169
    4270== Frequently Asked Questions ==
    4371
    44 = Will this block real visitors? =
     72= What exactly is an AI agent? =
    4573
    46 No. Only requests that are signed, hit an enabled sensitive endpoint, or carry a bot-like user-agent are verified, and the plugin only blocks in Enforce mode when AxioRank returns an enforced non-allow verdict. Logged-out human page views are never forwarded.
     74Software that uses the web on a person's or a company's behalf. Examples include the assistants behind ChatGPT and Claude fetching a page to answer a question, shopping assistants comparing products, and automation tools that fill in forms. Some are welcome guests, some are noisy scrapers, and some are impostors dressed up as the welcome ones. This plugin helps you tell the difference.
    4775
    48 = What happens if AxioRank is unreachable? =
     76= Will this block real people visiting my site? =
    4977
    50 Verification fails open. The request is allowed and the site keeps serving.
     78No. Ordinary page views by people are never even checked. The plugin looks at requests that appear automated, plus traffic to the sensitive endpoints you selected, and it blocks nothing until you switch from Monitor to Enforce. Even in Enforce mode, blocking is aimed at agents that fail verification or break your rules. A real person going about their day is simply allowed through.
    5179
    52 = Does it slow down my site? =
     80= Will it hurt my SEO or block Google? =
    5381
    54 The plugin skips ordinary traffic, so most requests never call out. Verified requests add one short, capped HTTP round trip.
     82No. Search engines spend nearly all of their time reading your public pages, which are usually served from cache and never touch this plugin. Nothing at all is blocked in Monitor mode. In Enforce mode, verified crawlers that follow your rules are allowed; blocking targets agents that fail verification or pretend to be something they are not.
     83
     84= Do I need to be technical to set this up? =
     85
     86No. Setup is copy and paste: create an AxioRank account, copy the site key, paste it into the settings page, and press "Test connection". The recommended protection scope is preselected, and the plugin starts in the watch-only Monitor mode.
     87
     88= Does it work with caching plugins? =
     89
     90Yes, happily. Cached pages are served exactly as before. The plugin focuses on the dynamic parts of the site that caching does not cover, so the two do complementary jobs.
     91
     92= Will it slow down my site? =
     93
     94You should not notice it. Most traffic is never checked at all. When a request is checked, the plugin makes one quick call to AxioRank with a strict time limit of about a second. If the answer does not arrive in time, the request is allowed through so nobody is kept waiting.
     95
     96= What happens if AxioRank is down or unreachable? =
     97
     98Your site keeps working normally. The plugin is designed to fail open: whenever it cannot get an answer, it allows the request and steps aside. A verification problem will never take your site offline.
     99
     100= What data is sent about my visitors? =
     101
     102Only the basics needed to verify identity, and only for requests the plugin decides to check: the address requested, the request type, the stated user agent, the IP address, and the headers that carry the agent's signature. Cookies, passwords, and the contents of forms and posts are never sent. The Description has the full breakdown.
     103
     104= How much does it cost? =
     105
     106The plugin is free. It connects to the AxioRank service, which has a free plan that covers getting started with a website, and paid plans with more capacity and features.
     107
     108= I switched on Enforce and something I rely on stopped working. What do I do? =
     109
     110Switch back to Monitor. That immediately stops all blocking. Then check the activity panel or your AxioRank dashboard to see what was blocked and why, adjust your scope or rules, and try Enforce again.
    55111
    56112== Screenshots ==
    57113
    58 1. The settings screen: the onboarding stepper, connection status, scope controls, and the monitor or enforce switch.
    59 2. Connected, with the local activity panel showing verified, unverified, and spoofed counts.
     1141. The settings screen: a three-step setup guide, connection status, protection scope, and the Monitor or Enforce switch.
     1152. Connected and watching: the activity panel counts verified, unverified, and spoofed visits.
    601163. A successful connection test against AxioRank.
    61 4. An animated walkthrough of the setup, from pasting a site key to switching on enforce.
     1174. An animated walkthrough of the whole setup, from pasting a site key to switching on Enforce.
    62118
    63119== Changelog ==
     120
     121= 0.2.3 =
     122* Rewrote the plugin description, setup guide, and FAQ in plain language, including a new section that spells out exactly what information is and is not sent to AxioRank. No functional changes.
     123* Fixed an internal version constant that had fallen behind the plugin version (it is used for cache busting of the admin styles and scripts).
    64124
    65125= 0.2.2 =
Note: See TracChangeset for help on using the changeset viewer.