Title: Agentrue – Verified AI Agents for WooCommerce
Author: ashrafaqela
Published: November 9, 2026
Last modified: November 9, 2026
---
Search plugins
# Agentrue – Verified AI Agents for WooCommerce
By [ashrafaqela](https://profiles.wordpress.org/ashrafaqela/)
[Download](https://downloads.wordpress.org/plugin/agentrue.0.1.1.zip)
* [Details](https://wordpress.org/plugins/agentrue/#description)
* [Reviews](https://wordpress.org/plugins/agentrue/#reviews)
* [Installation](https://wordpress.org/plugins/agentrue/#installation)
* [Development](https://wordpress.org/plugins/agentrue/#developers)
[Support](https://wordpress.org/support/plugin/agentrue/)
## Description
AI assistants are starting to browse and buy on behalf of shoppers. Anyone can put
an AI agent’s name in a User-Agent header, so a request that _says_ it comes from
an AI agent proves nothing.
Major agent operators now sign their requests with **Web Bot Auth** – HTTP Message
Signatures (RFC 9421) with Ed25519 keys published in a key directory on the operator’s
own domain. Agentrue checks those signatures directly on your WordPress server.
No third-party service sees your traffic and no account is needed.
**What it does**
* **Verifies every signed request** against the operator’s published public keys(`/.
well-known/http-message-signatures-directory`), with caching.
* **Labels each request** as Verified agent, Forged signature or Unsigned impostor(
a request that uses a known AI agent name but carries no signature).
* **Tags WooCommerce orders** – an “Agent” column in the orders list (HPOS and
legacy), an “AI agent check” box on each order and an order note.
* **Monitor or enforce** – start in monitor mode (log only). In enforce mode, forged
signatures are blocked with HTTP 403 and unsigned impostors can be blocked at
cart and checkout.
* **Trusted operators list** – choose which operator origins you accept, or accept
any operator with a valid key directory.
* **Self-test button** – signs a request with a temporary key and confirms that
a valid signature passes and a tampered one fails.
* **Developer helper** – `agentrue_is_verified_agent()` lets other plugins skip
CAPTCHA or bot challenges for verified agents only. Filters: `agentrue_should_block`,`
agentrue_pre_directory_keys`.
**Also included**
* Agent readiness checks for your product data, a product feed, an optional `llms.
txt` and simple AI-referral sales reporting.
**Honest limitations**
* Only agents that sign with Web Bot Auth can be verified. Unsigned bots from smaller
tools will show as unverified.
* A captured signed request could be replayed within its short validity window;
nonce tracking is planned.
* If you use a CDN that already verifies bots at the edge, Agentrue still adds
order-level labelling and checkout rules inside WooCommerce.
* AI agent orders are still a small share of e-commerce today. Monitor mode lets
you see your real numbers before changing anything.
### External services
Agentrue connects to the public key directories of AI agent operators. This is needed
to check the cryptographic signature on requests from AI agents.
**When:** only when a request arrives with a Web Bot Auth signature from an operator
that you trust (or from any operator, if you turn on “Accept any operator”). Results
are cached, so a directory is fetched at most about once an hour.
**What is sent:** one plain HTTPS GET request from your server to `https:///.well-known/http-message-signatures-directory`. No visitor, customer or order
data is sent. The operator receives only the request itself (your server’s IP address
and a standard WordPress user agent).
**Default operator – ChatGPT agent (OpenAI):** the directory at `https://chatgpt.
com/.well-known/http-message-signatures-directory` is provided by OpenAI. Terms
of use: https://openai.com/policies/terms-of-use – Privacy policy: https://openai.
com/policies/privacy-policy
**Operators you add yourself:** if you add other operator origins in Settings, Agentrue
fetches their directories in the same way. Each of those services is provided by
that operator, under its own terms and privacy policy.
No other external service is used.
## Screenshots
[⌊Agent traffic: verified agents, forged signatures and impostors.⌉⌊Agent traffic:
verified agents, forged signatures and impostors.⌉[
Agent traffic: verified agents, forged signatures and impostors.
[⌊Orders list with the Agent column.⌉⌊Orders list with the Agent column.⌉[
Orders list with the Agent column.
[⌊Settings: mode, trusted operators and checkout rules.⌉⌊Settings: mode, trusted
operators and checkout rules.⌉[
Settings: mode, trusted operators and checkout rules.
## Installation
1. Upload the plugin and activate it. WooCommerce must be active.
2. Go to WooCommerce Agentrue and click “Run verification self-test”.
3. Leave mode on Monitor for a week and check the Agent traffic tab.
4. When you are happy, switch to Enforce in Settings.
## FAQ
### Will this block search engines or normal visitors?
No. Only requests that claim to be an AI agent are evaluated. Normal browsers and
search crawlers are not affected. Monitor mode blocks nothing.
### Does it need an account or API key?
No. Everything runs on your server.
### Which agents can be verified?
Any operator that publishes a Web Bot Auth key directory. Add the operator origins
you trust in Settings.
## Reviews
There are no reviews for this plugin.
## Contributors & Developers
“Agentrue – Verified AI Agents for WooCommerce” is open source software. The following
people have contributed to this plugin.
Contributors
* [ ashrafaqela ](https://profiles.wordpress.org/ashrafaqela/)
[Translate “Agentrue – Verified AI Agents for WooCommerce” into your language.](https://translate.wordpress.org/projects/wp-plugins/agentrue)
### Interested in development?
[Browse the code](https://plugins.trac.wordpress.org/browser/agentrue/), check out
the [SVN repository](https://plugins.svn.wordpress.org/agentrue/), or subscribe
to the [development log](https://plugins.trac.wordpress.org/log/agentrue/) by [RSS](https://plugins.trac.wordpress.org/log/agentrue/?limit=100&mode=stop_on_copy&format=rss).
## Changelog
#### 0.1.1
* Stricter sanitization of request data.
* Removed the experimental agent checkout endpoints.
* Clearer external services documentation.
#### 0.1.0
* First release.
## Meta
* Version **0.1.1**
* Last updated **8 hours ago**
* Active installations **Fewer than 10**
* WordPress version ** 6.5 or higher **
* Tested up to **7.1.4**
* PHP version ** 7.4 or higher **
* Tags
* [ai agents](https://wordpress.org/plugins/tags/ai-agents/)[bot verification](https://wordpress.org/plugins/tags/bot-verification/)
[fraud](https://wordpress.org/plugins/tags/fraud/)[web bot auth](https://wordpress.org/plugins/tags/web-bot-auth/)
[woocommerce](https://wordpress.org/plugins/tags/woocommerce/)
* [Advanced View](https://wordpress.org/plugins/agentrue/advanced/)
## Ratings
No reviews have been submitted yet.
[Your review](https://wordpress.org/support/plugin/agentrue/reviews/#new-post)
[See all reviews](https://wordpress.org/support/plugin/agentrue/reviews/)
## Contributors
* [ ashrafaqela ](https://profiles.wordpress.org/ashrafaqela/)
## Support
Got something to say? Need help?
[View support forum](https://wordpress.org/support/plugin/agentrue/)