TrafficPaywall

Description

Get paid when AI crawlers access your WordPress site.

AI companies send crawlers such as GPTBot, ClaudeBot, CCBot and Bytespider to read your articles and train their models. They take your content for free. TrafficPaywall makes them pay for it.

• AI crawlers pay per request. You set the price per 1,000 requests in your TrafficPaywall dashboard (for example $5). Crawlers that pay get your pages. Crawlers that don’t pay get a “402 Payment Required” response instead of your content.
• You keep 75%. Every payment goes to your balance and is paid out to your bank through Stripe. The plugin is free; there is no subscription.
• People and search engines are never charged. Visitors read exactly as before. Google, Bing and other search engines, ad crawlers (AdSense, Google Ads) and AI answer engines that send you visitors (ChatGPT search, Perplexity) pass for free, so your SEO and ads keep working.
• One click to connect. Click “Connect and start earning”, sign in, confirm your site. No DNS change, no Cloudflare account, no hosting change.
• See what AI takes. The TrafficPaywall screen in WordPress shows your AI revenue, paid requests, AI requests detected, unpaid requests stopped and the estimated amount of content that was not handed over, plus your top crawlers.

How it works

1. Each request is classified on your own server, using crawler rules the plugin downloads every hour. Nothing is sent to TrafficPaywall for normal page views.
2. Known AI training crawlers and scripted scrapers without payment get HTTP 402 with instructions on how to pay. Crawlers that pretend to be Googlebot from the wrong network are caught as well.
3. A crawler that pays sends its TrafficPaywall key with the request. The plugin confirms the payment with TrafficPaywall and serves the page.
4. If a real person is ever caught by mistake, they click “I’m human — continue”, pass a quick check and keep reading for 24 hours.

AI companies hold one prepaid balance that works on every TrafficPaywall site, so paying you takes them one line of code.

Built to never break your site

• If TrafficPaywall is unreachable, your site keeps working: decisions are made locally, and paid requests are let through when a payment cannot be confirmed.
• Logged-in users, wp-admin, logins, cron, AJAX, form posts, webhooks, robots.txt, sitemaps, ads.txt, llms.txt and /.well-known/ are never touched.
• 402 responses are never stored in page caches. A built-in site check tells you if a page cache answers before WordPress, and can fix WP Super Cache, W3 Total Cache and WP Rocket for you.

What is protected

All public pages, posts, archives and feeds for anonymous visitors, and the REST API (for example /wp-json/wp/v2/posts) for anonymous clients, because scrapers use it to pull full articles.

The plugin also publishes your license terms where AI companies look for them: a License: line in robots.txt, a <link rel="license"> tag in your pages and a Link header on responses to crawlers.

External services

This plugin connects to the TrafficPaywall service (trafficpaywall.com), operated by TrafficPaywall, to process crawler payments. Nothing is sent before you click “Connect and start earning” (or enter a site key under Advanced). Disconnecting stops all requests.

Terms of service: https://trafficpaywall.com/terms
Privacy policy: https://trafficpaywall.com/privacy

What is sent, when, and to which address (all under https://trafficpaywall.com):

• Connect – https://trafficpaywall.com/connect/wordpress opens in your browser with your site address, a random one-time state value and the address of the WordPress admin screen to return to. After you confirm, your server sends the one-time code it received and your site address to POST /api/v1/connect/wordpress/exchange and receives the site key and signing secret.
• Site settings – every 5 minutes, GET /api/v1/config/{site key} downloads your mode, price and license links. Only the site key is sent.
• Crawler rules – every hour and when you connect, GET /api/v1/rules downloads the public list of crawler user agents and network ranges. Nothing about your site or visitors is sent.
• Reporting – every 10 minutes, POST /api/v1/ingest sends aggregate counts per day of AI and bot requests (outcome, crawler category and crawler name, number of requests and estimated bytes not delivered), signed with your site key. No IP addresses, user agents, URLs, cookies or other visitor data are sent. Human visits are only included as one sampled daily total.
• Paid requests – only when a request carries TrafficPaywall payment credentials (an API key, license token or TrafficPaywall session cookie), POST /api/v1/spend sends the credential and the full URL of the page requested, signed with your site key, to charge the crawler. This call is made from your server while the request is handled.
• Dashboard – when you open the TrafficPaywall screen in wp-admin, GET /api/v1/site/summary loads this month’s revenue, paid requests and payout status (cached for 5 minutes). Only the site key and a signature are sent.

Visitors who click “I’m human — continue” on the 402 page go to https://trafficpaywall.com/access in their browser, pass a check, and are sent back to your site with a signed pass that is stored in a tp_access cookie for up to 24 hours and verified on your server.

For the site check and for estimating page size, your server also requests your own home page and up to three recent posts (loopback requests to your own site; nothing is sent to TrafficPaywall).