Title: Botmetria Author: Botmetria Published: August 10, 2026 Last modified: August 10, 2026 --- Search plugins ![](https://ps.w.org/botmetria/assets/banner-772x250.png?rev=3641091) ![](https://ps.w.org/botmetria/assets/icon.svg?rev=3641091) # Botmetria By [Botmetria](https://profiles.wordpress.org/botmetria/) [Download](https://downloads.wordpress.org/plugin/botmetria.1.9.1.zip) * [Details](https://wordpress.org/plugins/botmetria/#description) * [Reviews](https://wordpress.org/plugins/botmetria/#reviews) * [Installation](https://wordpress.org/plugins/botmetria/#installation) * [Development](https://wordpress.org/plugins/botmetria/#developers) [Support](https://wordpress.org/support/plugin/botmetria/) ## Description Shoppers increasingly ask ChatGPT, Perplexity and other AI assistants what to buy— and classic analytics records those visitors as “direct”, so store owners never see them. Botmetria makes this traffic visible and controllable: * **AI bot analytics** — every visit by a known AI crawler or assistant agent ( GPTBot, ChatGPT-User, ClaudeBot, PerplexityBot and more) is detected and counted, with the page, product and response time. * **Impostor detection** — a User-Agent string is trusted only after the visitor IP is verified against the bot vendor’s published IP ranges. Scrapers pretending to be GPTBot show up as impostors, not as AI traffic. * **AI referral attribution** — human visitors arriving from AI assistants (chatgpt. com, perplexity.ai, …) are tracked to first-touch source, including WooCommerce orders and revenue. * **AI firewall** — decide who gets in: Showcase (welcome all known AI bots), Allowlist( block everything except chosen vendors), Server relief (temporary 503 + Retry- After for all AI bots), or a per-bot Custom matrix. Classic search engines (Googlebot, Bingbot, …) are never blocked — a code-level safety. * **Machine readability** — valid JSON-LD Product markup, an `llms.txt` summary of your store, and a robots.txt helper, so AI agents can actually read your prices, availability and delivery terms. * **Weekly e-mail report** — AI visits, verified vs. impostor bots, top products by bot attention, AI-sourced orders, and plain-language recommendations. The hot path is a single User-Agent substring scan per request (a few milliseconds, no DB writes, no HTTP calls); events are buffered locally and shipped in batches in the background. If the cloud is unreachable, your store is never slowed down or blocked — the plugin fails open. #### External service (required reading) This plugin is a connector for **Botmetria**, an analytics service. Once you connect your store (by entering the Cloud URL, API key and HMAC secret from your Botmetria account), the plugin communicates with the Botmetria cloud — by default `https:// api.botmetria.com`, or a server you configure: * **Sent**: AI-bot visit events (bot name, bot user-agent, bot IP address, requested URL path, page type, product ID, HTTP status, response time), AI-referral events( source such as “chatgpt”, landing URL, an anonymized session hash, and for conversions the WooCommerce order ID, order total and currency; orders with no AI interaction are reported the same way with source “none” — the baseline needed to compute the AI share of revenue — and a refund, cancellation or failed payment sends a negative amount correcting the revenue previously reported for that order), results of one-click fix actions you triggered from your dashboard (action id, status and a short message), aggregate page-serve counters (how many pages the server served per time window — numbers only), and a product-feed quality summary after each feed rebuild (how many products lack a price, image or GTIN/SKU, with up to 10 SKU identifiers per gap as examples). Events are signed with your HMAC secret. * **Received**: the up-to-date AI bot detect list, official bot vendor IP ranges for impostor detection, your plugin configuration (including firewall settings if you manage them from the Botmetria dashboard), one-click fix commands you approved in your dashboard (the plugin only executes actions from the fixed list built into its code — the cloud cannot send code or arbitrary instructions), and question/answer pairs you approved for FAQPage markup. * **Not sent**: no shopper names, e-mails, addresses or payment data; no admin credentials. The session hash cannot be reversed into a person. Bot IP addresses( not human visitors’ IPs) are transmitted for verification purposes. Nothing is transmitted until you enter your API credentials. Terms of use: [https://botmetria.com/terms.html](https://botmetria.com/terms.html). Privacy policy: [https://botmetria.com/privacy.html](https://botmetria.com/privacy.html). The service is operated by Botmetria ([https://botmetria.com](https://botmetria.com)). The AI firewall, JSON-LD and llms.txt features also work **without** a cloud account, using the detect list and IP ranges bundled with the plugin. ## Installation 1. Upload the plugin ZIP via **Plugins Add New Upload Plugin**, then activate it. 2. Create a site in your Botmetria account. 3. Open **Settings Botmetria**, paste the Cloud URL, API key and HMAC secret, and press **Test connection**. 4. (Recommended) Disable WP-Cron and add a real cron job so buffered events ship on time, and exclude AI bots from your page cache — see the Status page hints. ## FAQ ### Does it slow my store down? No. The per-request work is one substring scan over a cached bot list (a few milliseconds). Events are written to a local buffer table and shipped in the background on shutdown and via cron. ### Does it work without WooCommerce? The analytics, firewall and llms.txt work on any WordPress site. Product JSON-LD and order/revenue attribution require WooCommerce. ### Will it block Google? Never. Classic search engine crawlers (Googlebot, Bingbot, YandexBot, DuckDuckBot and others) are exempt from every firewall mode at code level. ### What happens if the Botmetria cloud is down? Your store keeps working normally. Events stay in the local buffer and are retried later; firewall decisions use locally cached lists. The plugin never blocks the page render on a network call. ### Where does the AI bot list come from? A versioned detect list bundled with the plugin, refreshed twice a day from the Botmetria cloud once connected. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “Botmetria” is open source software. The following people have contributed to this plugin. Contributors * [ Botmetria ](https://profiles.wordpress.org/botmetria/) [Translate “Botmetria” into your language.](https://translate.wordpress.org/projects/wp-plugins/botmetria) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/botmetria/), check out the [SVN repository](https://plugins.svn.wordpress.org/botmetria/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/botmetria/) by [RSS](https://plugins.trac.wordpress.org/log/botmetria/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.9.1 * Question and answer markup. Q&A pairs you have reviewed and approved in your Botmetria dashboard are published as FAQPage structured data on the matching product page. The plugin writes nothing on its own — only pairs a human approved— and removing them is one click away. #### 1.9.0 * One-click fixes. Recommendations from your Botmetria audit can now be applied from the dashboard: the plugin picks the request up on its regular settings check and reports back what it did. The list of things the plugin will do is fixed in its own code — the cloud can only pick from that list, never send instructions of its own — and every action can be undone. #### 1.8.1 * Agent endpoint errors are now reported honestly. Until this release every request from an AI agent to the product or checkout endpoint was logged as a success, even when the shop answered with a rate limit or a server error — so the dashboard could never warn you that agents were unable to place orders. It can now. #### 1.8.0 * Quick connect: paste one connection string from your Botmetria dashboard instead of copying the Cloud URL, API key and HMAC secret one by one. The plugin fills the fields and tests the connection in the same step; a truncated paste is rejected on the spot instead of failing later as an authorization error. * Honest revenue: refunds, cancellations and failed payments now correct the AI- attributed revenue that was reported when the order was created. Partial refunds send only the difference, so repeated refunds cannot double-count. * Orders without an AI click are reported too, as the baseline the dashboard needs to answer “what share of revenue did AI influence” — no extra data about the shopper is sent. * Orders that started as an agent checkout session carry that session id, so the dashboard can show the whole chain from crawl to order. * Russian and Romanian admin translations are available again. On WordPress.org they are delivered through translate.wordpress.org; a community language pack always wins when one exists. #### 1.7.0 * Reliable delivery: an event the cloud cannot accept no longer blocks every event behind it. Such events are set aside with the reason shown on the Status page, while the rest keep flowing. * Smarter retries: temporary problems (network, server hiccups, rate limits) now back off gradually instead of retrying every 5 minutes forever. * If the API key stops working, delivery pauses and a notice in the admin tells you exactly what to fix — no more silently growing queue. * The Status page shows undeliverable events and why they were refused. * All AI Traffic controls are now available locally: custom blocked bots, blocked IP networks, unknown-automation and impostor policies got their own settings on the AI Traffic page, and cloud management became an explicit opt-in you can switch off at any time. * AI referral attribution now also recognises URL markers (for example ChatGPT’s utm_source tag) when the browser sends no Referer — visits from native AI apps and in-app browsers were previously uncounted. * Translations moved to translate.wordpress.org (community language packs); bundled translation files were removed. #### 1.6.2 * Hardening: the machine-readable endpoints (llms.txt, Markdown, product feed, UCP catalog and manifest) now send X-Content-Type-Options: nosniff, so a browser cannot MIME-sniff their responses into something executable. Defense-in-depth; no behavior change. #### 1.6.1 * Security: password-protected products (WooCommerce Visibility Password) are no longer exposed to AI agents. Their JSON-LD, agentic feed, UCP catalog and UCP checkout now skip them — matching the markdown twin — so an anonymous request can no longer read a product the owner hid behind a password. #### 1.6.0 * Feed performance for large catalogs (up to 50,000 products): the agentic feed and products.xml are now generated as files in a streamed, batched pass (flat memory use) and served from disk. Product edits no longer rebuild the feed immediately— one deferred rebuild is scheduled while the current feed keeps serving. * Faster UCP catalog list: variations are no longer expanded on the list endpoint( agents drill into a single product for offers), and normalized product data is cached (self-invalidating on product edit). * Honest sliding-window rate limiting (120 requests/minute per IP) on UCP endpoints, replacing the per-second counter. * Internal refactor: JSON-LD and the markdown twin now read product data through the same catalog serializer as the feed and UCP (one reader, consistent stock semantics via the short-TTL stock cache). #### 1.5.0 * Agentic commerce (phase 2): UCP checkout sessions. AI agents can now build a cart via POST/PATCH /ucp/v1/checkout-sessions and receive a signed hand-off URL; opening it pre-fills the native WooCommerce cart and redirects the shopper to the store’s own checkout. Payments stay entirely with the store — the plugin never sees card data. * Orders born from an agent session are attributed: order meta marks the source( chatgpt/perplexity/gemini/copilot/claude, or “ai_agent” when the agent is unknown) and known agents are counted as AI conversions in the dashboard. * The /.well-known/ucp manifest now advertises checkout capability (payment: false). #### 1.4.0 * Traffic-without-JS measurement: the plugin now reports how many pages the server actually served, so the dashboard can show what share of them never ran the pixel— traffic that claims no bot user-agent and executes no JavaScript was previously counted nowhere at all. Counters only, no personal data. * Not measured behind a page cache, on purpose: a full-page cache serves visitors HTML without running PHP, so the count would be wrong. The dashboard hides the tile instead of showing a plausible but false number. #### 1.3.0 * Page-cache integration: AI bots are automatically excluded from WP Rocket’s page cache (so their visits reach the plugin and get counted), and the Status page now detects other active caches (LiteSpeed, W3 Total Cache, WP Super Cache, WP Fastest Cache, Cloudflare) and shows the exact user-agents to exclude from them. #### 1.2.0 * Agentic commerce (phase 1): ACP product feed (/feed/agentic.json + /products. xml) with a data-quality validator, and read-only UCP endpoints (/.well-known/ ucp manifest + /ucp/v1/products catalog) built over one internal catalog format. New “Agentic feed” / “UCP” toggles in Settings. #### 1.1.0 * User-managed blocklist: custom unwanted bots (block by User-Agent substring) and blocked IP networks (CIDR), managed from the Botmetria dashboard and applied in any mode. Classic search engines are never blocked. * Cloud-controlled unknown-automation policy. robots.txt lists custom-blocked bots. #### 1.0.0 * Initial release: AI bot detection with impostor verification, AI referral and order attribution, AI firewall (Showcase / Allowlist / Server relief / Custom), JSON-LD and llms.txt layer, weekly e-mail reports, cloud-managed firewall via the Botmetria dashboard. ## Meta * Version **1.9.1** * Last updated **23 hours ago** * Active installations **Fewer than 10** * WordPress version ** 6.4 or higher ** * Tested up to **7.0.3** * PHP version ** 8.1 or higher ** * Tags * [AI](https://wordpress.org/plugins/tags/ai/)[analytics](https://wordpress.org/plugins/tags/analytics/) [bots](https://wordpress.org/plugins/tags/bots/)[llms.txt](https://wordpress.org/plugins/tags/llms-txt/) [woocommerce](https://wordpress.org/plugins/tags/woocommerce/) * [Advanced View](https://wordpress.org/plugins/botmetria/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/botmetria/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/botmetria/reviews/) ## Contributors * [ Botmetria ](https://profiles.wordpress.org/botmetria/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/botmetria/)