P2Flux Agent Paywall

FAQ

Do my visitors notice anything?

No. People with a browser, logged-in users and search engines (Google, Bing, Apple, DuckDuckGo) read everything as before.

How does the plugin know a request comes from an AI agent?

The request carries an x402 payment, signs itself as a bot (Web Bot Auth), or its user agent names an AI crawler (GPTBot, ClaudeBot, PerplexityBot and others) or a program rather than a browser. The list can be changed with the p2flux_ap_agent_signatures filter. A bot that pretends to be a normal browser is not detected; it reads your site as it does today.

Which wallet do I need?

Any wallet that can receive USDC on the Base network – for example Coinbase Wallet, MetaMask, or an exchange account that supports Base deposits. Check that your exchange accepts USDC on Base before you use its address.

Can someone pay once and read many pages?

An agent can pay once into a prepaid balance and then read many pages from it, each with a signature instead of a transaction. Each page is still paid at its price, from that balance. Each payment opens one page once: the same payment sent again – by the same agent or by anyone it was passed to – is refused, as the x402 standard requires. Prepaid can be switched off in the settings; then every page is paid on its own.

A membership plugin can sell access for a period instead (for example a subscription): it uses the hooks below to price the page, answers the payment with an access token, and lets later requests that carry the token through. Tipster Script does this for its predictions.

For plugin developers: hooks

• p2flux_ap_price (filter) – ( string|null $price, WP_Post $post, string $url ): what a request costs an agent. Return a price such as “0.05”, or null for free or already entitled.
• p2flux_ap_requirement (filter) – ( array $required, string $price, string $url ): the HTTP 402 before it is sent. Only resource (for example description, what the payment buys) can be changed; what is settled cannot.
• p2flux_ap_paid (action) – ( array $payment ): a payment settled, before the content is served. Keys: price, units, url, post_id, payer, tx, network, scheme, agent.
• P2Flux_AP_Gate::access_tokens() – the tokens the agent sent in the P2Flux-Access-Token request header (base64url, 43 characters, up to 10, comma separated).
• p2flux_ap_agent_signatures (filter) – the user-agent substrings treated as AI agents.

Single pages answered to agents are never cached, so a page opened by a token is not served to others.

What happens if P2Flux is down?

You choose: agents are asked to come back later (default), or they read for free until it is back. Your visitors are never affected.

I use a page cache or a CDN.

A cache that stores whole pages may serve a paid post to an agent before WordPress runs. The plugin marks every answer to an agent as not cacheable and tells WP Rocket to skip AI agents. Other page caches and CDNs that cache whole pages must be told to bypass requests from AI crawlers. Press “Check my setup” on the settings page: it tells you whether an agent is asked to pay. The steps for common caches and CDNs: https://p2flux.com/docs/agent-paywall.html#caches

Are images and files protected?

Files you give a price are. Open the file in the Media Library and fill in “Price for AI agents”. WordPress does not see requests for uploaded files, so the plugin writes a rule into the uploads folder (.htaccess, for Apache and LiteSpeed) that sends AI agents’ requests for the priced files – and no others – through WordPress. On nginx, add the rule from the guide to your server configuration; until then the paid address of a file is /?p2flux_ap_file=<id>. Images inside a paid post are not paid unless you give them a price.

Can an agent get its unused prepaid balance back?

Yes. Once it has used at least 0.10 USDC of it, or after 24 hours without use, it can ask for it back (the x402 refund request); your site passes the request to P2Flux, which returns the balance to the agent’s wallet. Unused balances also come back on their own after 7 days, and an agent can always withdraw from the escrow directly. What the agent already spent is yours.

What is Web Bot Auth?

A way for an AI agent to prove who it is: it signs each request, and publishes its keys. The plugin checks the signature (Ed25519) when the agent pays and shows the agent’s name next to the payment. For this it reads the agent’s public key list from the agent’s own site. It never lets anyone read for free.

Is this a payment service? Who holds the money?

No one holds it. The agent’s payment is a signed USDC transfer to a contract address that belongs to your wallet; the P2Flux contract pays you and the fee in the same transaction. P2Flux cannot move the payment anywhere else.