Description

AMDT AI Traffic Analytics watches; it does not touch. It records two things your usual analytics do not show:

The AI bots that read your pages (GPTBot, ClaudeBot, PerplexityBot, Googlebot, Bingbot and the rest), and whether each one is who it says it is. It checks the bot’s IP address against the lists its operator publishes and against its reverse DNS, and flags as an impostor any visitor that uses another bot’s name. The Bot catalog shows how big each list is and the date its operator gave it, so you can tell a list kept up to date from one left untouched for a year.
The people who arrive from an AI assistant (ChatGPT, Claude, Perplexity, Gemini, Copilot…) after clicking a citation, and the page they land on.

With that it gives you a dashboard, a log you can filter and export, and an analysis of the addresses it could not identify, with blocking rules already written for Apache, Nginx, Cloudflare or Wordfence. You apply those rules in your firewall: the plugin does not block anyone.

It also publishes your site’s llms.txt (an index of your content for language models), counts who reads it, and lets you leave posts out of it from the editor.

A complete edition, with more modules, also serves your content to AI agents through an API and an MCP server, publishes the files that announce them, declares AI usage permissions, protects that API and analyses your content. Both editions share the same tables and settings: you can move from one to the other without losing data.

What it stores

In your own database, for the retention you choose (30, 60 or 90 days):

For the bots in its catalogue and for whoever reads your llms.txt: the IP address, the User-Agent and the page requested.
For people who arrive from an AI assistant: only the network of their IP address (IPv4 up to the third block, IPv6 the first 48 bits), never the full address, plus the User-Agent, the page and the address of the assistant they came from.
For automated browsers that pretend to be an iPhone (possibly Grok): the request, with its IP address.

Nothing is stored about ordinary visitors. If you turn on the debug log (Settings Diagnostics), its entries also contain IP addresses and User-Agents. It is written to its own folder in uploads, amdt-ai-traffic-analytics/, in a file with a random key in its name; the folder denies direct access on servers that read .htaccess, such as Apache. It is deleted on uninstall if you choose to delete the data. Settings Privacy Policy guide has a suggested text for your privacy policy.

What it leaves in your visitors’ browsers

Nothing: no cookies, nothing stored in the browser. Pages carry a small script that, only when the visitor comes from an AI assistant, tells your own server about it.

External services

The plugin sends nothing to its author and has no telemetry. It connects to the services below. The IP lists are off on a new install until you turn them on.

Why the IP lists. To confirm that a visit from GPTBot, OAI-SearchBot, ChatGPT-User, OAI-AdsBot, ClaudeBot, Claude-User, Claude-SearchBot, PerplexityBot or Perplexity-User really comes from its operator, the plugin can download, once a day, the lists of IP addresses those operators publish. It is off until you turn it on: a notice asks you when you activate the plugin, and Settings has the switch.

What is sent, and when. Once a day while the switch is on, and once when you turn it on, the plugin makes a plain HTTPS GET request for each public file below. The request carries the plugin’s name and version as its user agent and nothing else: no data about your site, your visitors or you.

OpenAI (GPTBot, OAI-SearchBot, ChatGPT-User, OAI-AdsBot)

Files downloaded: https://openai.com/gptbot.json, https://openai.com/searchbot.json, https://openai.com/chatgpt-user.json, https://openai.com/adsbot.json
What they are: Overview of OpenAI Crawlers
Provided by OpenAI: terms of use, privacy policy

Anthropic (ClaudeBot, Claude-User, Claude-SearchBot)

File downloaded: https://claude.com/crawling/bots.json. claude.com is Anthropic’s domain for Claude; its own pages link Anthropic’s terms and privacy policy, below.
What it is: Does Anthropic crawl data from the web, and how can site owners block the crawler?
Provided by Anthropic: consumer terms, privacy policy, Anthropic Privacy Center

Perplexity (PerplexityBot, Perplexity-User)

Files downloaded: https://www.perplexity.ai/perplexitybot.json, https://www.perplexity.ai/perplexity-user.json. These are the addresses Perplexity’s documentation gives; until 2.7.13 the plugin used www.perplexity.com, which redirects to them.
What they are: Perplexity Crawlers
Provided by Perplexity: terms of service, privacy notice

Reverse DNS

To tell which network a bot’s address belongs to, the plugin asks the DNS resolver your server uses for the name of the IP address of the bots and of whoever reads your llms.txt (never of the people who arrive from an assistant). This goes through your server’s own resolver, as any reverse lookup does.

Your own site

When you open the Dashboard or Settings, the plugin requests your own home page, at most twice a day, to find out whether a cache sits in front of WordPress, and your own /llms.txt, at most once a day, to check that visitors get it. Both are requests to your own server; the “Check again” buttons repeat them on demand.

Third-party library

The Dashboard charts use Chart.js 4.6.1 (MIT license), bundled in admin/js/chart.umd.min.js: the minified build its authors publish on npm, without the line that points to its source map. Its source code: https://github.com/chartjs/Chart.js

Screenshots

Dashboard: visits of AI bots by bot and by day, how many were verified, and the people who arrived from an AI assistant.

Logs: every recorded visit, filtered by type, bot or date, with its verification result. Exportable to CSV. — Dashboard: visits of AI bots by bot and by day, how many were verified, and the people who arrived from an AI assistant.

Installation

Install the plugin from Plugins Add New, or upload the amdt-ai-traffic-analytics folder to /wp-content/plugins/.
Activate it.
Decide whether to download the operators’ IP lists (the notice after activation, or Settings). Without them, visits from OpenAI’s and Perplexity’s bots are logged as unverified.
If a CDN or a proxy other than Cloudflare sits in front of your site, declare it in AI Traffic Settings Visitor IP. Otherwise every visit is logged with the proxy’s address.
If you use a page cache plugin, see AI Traffic Settings Sync with cache plugins.

FAQ

Does it block bots?: No. It reports, and gives you the rule already written; deciding and applying it is up to you.
I use a cache plugin. Does it still measure?: Not entirely, and it is worth knowing: a page the cache serves without running WordPress does not go through the plugin, so that bot visit is not logged. With WP Rocket, LiteSpeed Cache or W3 Total Cache, Settings Sync with cache plugins offers to keep bots out of the cache with one button, and tells you what it costs. With a server cache (nginx, Varnish, your host’s, Cloudflare caching HTML) or with WP Super Cache it cannot be done; the screen explains it when it detects one, which is not always. Visits of people from AI assistants are measured on cached pages too: the browser reports them. If WP Rocket (Delay JavaScript execution) or LiteSpeed Cache (Load JS Deferred: Delayed) hold scripts back until the visitor touches the page, the plugin lets its own small script through, so a visitor who reads and leaves without scrolling is still counted. Other optimizers with a similar option have not been tested; if yours holds scripts back, exclude the one with the id amdt-ait-referral-tracker. The Dashboard also warns you when it finds a cache in front of WordPress, says where to act, and checks again when you ask it to.
What if Yoast SEO or Rank Math already serves my llms.txt?: Then that plugin serves it, and this one neither generates its own nor can count who reads it; the Dashboard says so.
Why are visits from GPTBot or PerplexityBot “unverified”?: Because the download of the operators’ IP lists is off. Turn it on in AI Traffic Settings Operator IP lists. ClaudeBot, Googlebot and Bingbot are still checked by reverse DNS without the lists.
Is the data deleted when I uninstall it?: Not by default. Only if you untick “Keep data on uninstall” in Settings, and never while the other edition is still installed.

Reviews

There are no reviews for this plugin.

Contributors & Developers

“AMDT AI Traffic Analytics” is open source software. The following people have contributed to this plugin.

Juan Moyano Ecenarro

Translate “AMDT AI Traffic Analytics” into your language.

Interested in development?

Browse the code, check out the SVN repository, or subscribe to the development log by RSS.

Changelog

2.7.14

Changes asked for in the third WordPress.org review:
- The plugin’s tables are declared in the format dbDelta() reads: the primary key on a line of its own (PRIMARY KEY (id)), KEY for the indexes and the column types as the database reports them (int(10) unsigned). With the key written next to its column, every reactivation on MariaDB made dbDelta() add the primary key again; the query failed with “Multiple primary key defined”, shown on screen with WP_DEBUG_DISPLAY and written to the log otherwise. The tables keep the same columns and indexes, and existing tables need no change.
- Each setting is registered by a register_setting() call of its own, with its name and its sanitize_callback written in it (includes/settings/core.php and includes/settings/llms.php). The callbacks are the same as in 2.7.13.
- Perplexity’s two IP lists are downloaded from www.perplexity.ai, the address Perplexity’s documentation gives; www.perplexity.com, used until now, redirects there. A site updated from an earlier version moves its two Perplexity lists to the new addresses; an address changed by hand is left as it is.
readme: under External services, Anthropic’s entry links its Privacy Center too, and Perplexity’s lists are given at their new addresses.
Tested on the ZIPs of this version: every earlier battery, all passing, and 68 checks of this release on this edition. They compare the table statements of 2.7.13 and 2.7.14: the same tables, and nothing for dbDelta() to change in the old ones, where those of 2.7.13 fail five times with “Multiple primary key defined” on MariaDB. They activate the plugin from Plugins with WP_DEBUG and find no output, no database error and no PHP notice, read every register_setting() call of this edition with its sanitize_callback, and check the update of Perplexity’s lists and this readme. 275 deliberate faults, all caught by the tests. Plugin Check 2.1.0: 0 errors (182 warnings, 179 in 2.7.13: the three new ones are the queries of the update of Perplexity’s lists, on the plugin’s own table).

2.7.13

Changes asked for in the second WordPress.org review:
- The plugin’s cron events (the daily cleanup of the log and, when it is turned on, the daily download of the IP lists) are scheduled on init instead of while the plugins load. Scheduling an event reads the list of cron schedules, and other plugins translate the names of their own schedules there (WooCommerce does). Asked for that early, WordPress 6.7 and later report those translations as loaded too early, which the review saw on the first screen after activation.
- register_setting() is called with the sanitize_callback written in the call. Each setting keeps the callback its module declares; one without it would be sanitized as text.
- The page that shows the progress of a reclassification of the log loads its style from a file and its redirect through the script functions of WordPress, and the help texts of Settings are added to the admin script. No script or style tag is written by hand in the plugin’s code.
readme: under External services, each service lists the files the plugin downloads from it as links, with its documentation, terms and privacy policy, in the format of the plugin guidelines. Perplexity’s privacy link points to its current address.
Tested on the ZIPs of this version: every earlier battery, all passing, and 45 checks of this release on this edition. They activate the plugin on WordPress 7.1 with WP_DEBUG next to a plugin that translates the name of its cron schedule as WooCommerce does, and find no notice on activation, the WordPress dashboard, the plugin’s screens or a public page. They also cover the cron events, the settings’ callbacks, the absence of hand-written tags and this readme. 261 deliberate faults, all caught by the tests. Plugin Check 2.1.0: 0 errors (179 warnings, as in 2.7.12).

2.7.12

No changes in what this edition does: 2.7.12 changes the complete edition’s WebMCP, its files for agents and its audit screens. Both editions carry the same version number. The shared files change only where this edition never reaches: the Dashboard leaves out WebMCP test rows (which only the complete edition writes), and the Spanish translation has the complete edition’s new strings.
Tested on the ZIPs of this version: every earlier battery, all passing, 5 checks of this release on this edition (none of the new screens or files is here), and Plugin Check 2.1.0 with 0 errors (179 warnings, 175 in 2.7.11: two new queries of the shared Dashboard).

2.7.11

Changes asked for in the WordPress.org review:
- The debug log (off by default) moves from the root of the uploads folder to its own folder, uploads/amdt-ai-traffic-analytics/. The folder has an empty index.php and an .htaccess that denies direct access on servers that read it, such as Apache. A log left at the root is moved there after the update. Uninstalling with “Keep data on uninstall” unticked removes the folder too.
- The referral script’s endpoint no longer answers to the action name used before 2.7.0 (ag_track_referral), whose prefix was not the plugin’s. Pages served since 2.7.0 use amdt_ait_track_referral.
- Admin notices only appear on the plugin’s own screens and on Plugins. Until now, seven of them showed on every admin screen: the six that report what an update or the automatic reclassification did, until dismissed, and the one about the rewrite rules.
- Every setting declares its sanitization callback where it is registered; one that did not would be sanitized as text.
- On requests for llms.txt, the names of the query parameters passed to Yoast SEO’s allowlist (so that it does not strip them) are sanitized, and only names made of the characters of a parameter name, up to 64, are passed.
- Request parameters read only to decide what a screen shows (the notice after a redirect, the filters of the log, the window of the IP analysis) are unslashed, and say why they need no nonce.
- Chart.js, bundled for the Dashboard charts, updated from 4.4.4 to 4.6.1.
readme: the External services section lists OpenAI’s adsbot.json (OAI-AdsBot), which was missing, and the plugin’s daily request for its own llms.txt; the Anthropic privacy link points to its current address; a new section names the bundled library.
Tested on the ZIPs of this version: 78 checks of this release on this edition, every earlier battery, all passing, and Plugin Check 2.1.0 with 0 errors (175 warnings, from 211). The checks cover the debug log’s folder, also on a real Apache 2.4, uninstall, the old action name, the settings’ callbacks, the notices, Chart.js and this readme.

2.7.10

No changes in this edition: 2.7.10 only changes the complete edition’s AIO analysis. Both editions carry the same version number.

2.7.9

No changes in this edition: 2.7.9 only adds the complete edition’s A2A interface and rewrites its agent card. Both editions carry the same version number.

2.7.8

llms.txt can say what your site is for: a new setting, “What the site is for”, one use per line (up to 8, of 200 characters each). It is published as a “When to use this site” section under the description. Left empty, as it comes, nothing is published: the plugin does not make it up. With WPML it is translated in String Translation. When an SEO plugin serves llms.txt, the section is added to its file.
WebMCP detections, which only the complete edition records, are no longer counted as consumption on the Dashboard, and the rows it wrote are relabelled from “(agéntico)” to “(WebMCP)” once, on update. In a site that only ever had this edition, nothing changes.
Tested on the ZIP of this version: the “When to use this site” section with and without text, WordPress’s redirects for every client, and Plugin Check 2.1.0 with 0 errors.

2.7.7

No changes in this edition: 2.7.7 only changes the complete edition’s MCP server, its WebMCP tools and its files for AI agents. Both editions carry the same version number.

2.7.6

llms.txt leaves out the entries your SEO plugin marks noindex: Yoast SEO, Rank Math and All in One SEO (the entry’s own setting, or else that of its content type and, in Rank Math and All in One SEO, the global one), and SEOPress (the entry’s setting). An SEO plugin counts only while it is active. WordPress’s “Discourage search engines” setting does not count.
The products section of llms.txt now respects the “Exclude from the AI surfaces” box, like the other sections.
The “AI access” box in the editor says when the SEO plugin already leaves the entry out.

2.7.5

No changes in this edition: 2.7.5 only adds checks to the complete edition’s content analysis. Both editions carry the same version number.

2.7.4

Marks on the Dashboard’s chart: dated changes of the AI ecosystem that can move the figures (model changes in ChatGPT and Gemini, Search Console’s AI report, Cloudflare’s new defaults, Google’s spam update), each with its reach and its source, and marks of your own that you can add and delete. The list comes with the plugin; no server is asked for it.
A notice when an operator’s agent that reads for people (ChatGPT-User, Claude-User, Perplexity-User…) stops reading while its search crawler keeps reading, after reading every week of the three before: the trace of a block on the way, such as Cloudflare’s new defaults. It says when the site seems to be behind Cloudflare, and it can be hidden for 7 days.

2.7.3

Every bot in the catalog says what it reads for (search, a person’s request, training, ads, or a mix), and the Dashboard adds up the reads by function and filters by one. Google-Extended and Applebot-Extended are switched off and marked as robots.txt tokens: no crawler sends them. Applebot and OAI-AdsBot are added.
Visits from AI assistants: copilot.com, deepseek.com and meta.ai are added, and a visit without a Referer but with the utm_source=chatgpt.com that ChatGPT adds to its links counts as ChatGPT.
Settings Diagnostics checks once a day that /llms.txt answers as Lighthouse expects (a title, a link and 50 characters), and the Dashboard warns when it does not.
A blocking snippet never includes the range of an operator with search or user agents (OpenAI, Anthropic, Perplexity, Google, Microsoft, Apple, Meta, Amazon, DuckDuckGo), and one made for such an operator starts with a warning.
Help texts that claimed more than is known were corrected: llms.txt, the help of three bots, and the one of human visits from assistants.

2.7.2

The notice about a cache in front of WordPress names the header that gives it away and says what to do in that case: Cloudflare keeping the HTML, the nginx cache of the hosting (with where Plesk turns it off), or another hosting or CDN cache. It has a “Check again” button: after that cache was turned off, the notice used to stay for up to 12 hours.
“More details in Settings” now goes to the panel of that cache.

2.7.1

Visits from AI assistants are counted even when WP Rocket (Delay JavaScript execution) or LiteSpeed Cache (Load JS Deferred: Delayed) hold scripts back until the visitor touches the page: the plugin lets its own small script through, and nothing else of theirs is touched.

2.7.0

First public release.