Security fix \u2014 stops rendering the API key into storefront HTML. Recommended upgrade for all installs.<\/p>","1.0.1":"
WP.org compliance pass \u2014 script enqueueing is now spec-compliant. No functional changes; safe to upgrade.<\/p>","1.0.0":"
First public release.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3541972,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3541972,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3541972,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3541972,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.0.2"],"block_files":[],"assets_screenshots":[],"screenshots":{"1":"Plugin settings page \u2014 paste API key and verify connection.","2":"Tactical dashboard at tactical-app.work showing real-time agent traffic.","3":"Agent type breakdown by day.","4":"Intent funnel \u2014 browse vs. evaluate vs. buy."}},"plugin_section":[],"plugin_tags":[2353,232,216196,233352,286],"plugin_category":[36,45],"plugin_contributors":[263820],"plugin_business_model":[],"class_list":["post-308436","plugin","type-plugin","status-publish","hentry","plugin_tags-ai","plugin_tags-analytics","plugin_tags-chatgpt","plugin_tags-perplexity","plugin_tags-woocommerce","plugin_category-analytics","plugin_category-ecommerce","plugin_contributors-sourabhnk","plugin_committers-sourabhnk"],"banners":{"banner":"https:\/\/ps.w.org\/tactical-agent-detection\/assets\/banner-772x250.png?rev=3541972","banner_2x":"https:\/\/ps.w.org\/tactical-agent-detection\/assets\/banner-1544x500.png?rev=3541972","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/tactical-agent-detection\/assets\/icon-128x128.png?rev=3541972","icon_2x":"https:\/\/ps.w.org\/tactical-agent-detection\/assets\/icon-256x256.png?rev=3541972","generated":false},"screenshots":[],"raw_content":"\n
AI shopping agents from ChatGPT, Perplexity, Claude, and Google AI visit your storefront every day \u2014 browsing products, comparing prices, deciding what to recommend. They're invisible to standard analytics.<\/p>\n\n
This plugin connects your WooCommerce store to Tactical<\/strong>, a third-party agent-traffic intelligence service operated at https:\/\/tactical-app.work. The plugin handles install, snippet injection, and WooCommerce webhook registration; the dashboard, alerts, and reporting live in your Tactical account on tactical-app.work.<\/p>\n\n What you get:<\/strong><\/p>\n\n Why agent traffic matters now:<\/strong><\/p>\n\n Standard analytics filter agent traffic out as \"bot noise\". As of Q2 2026, AI agents make up an estimated 8\u201312% of e-commerce site visits \u2014 and that share is growing month over month. The merchants who see this traffic are the ones positioned to capture the buyers it represents.<\/p>\n\n Tactical pricing \u2014 managed at tactical-app.work:<\/strong><\/p>\n\n Tactical is a tiered SaaS product. The plugin works on every tier, including the free one.<\/p>\n\n Annual plans save ~25%.<\/p>\n\n Multi-platform:<\/strong><\/p>\n\n This plugin is for WooCommerce. The same Tactical account also works on Shopify (via the Shopify App Store) and on any custom storefront (via JS snippet at tactical-app.work).<\/p>\n\n This plugin connects to Tactical<\/strong> at https:\/\/tactical-app.work \u2014 a third-party agent-traffic intelligence service operated by the plugin author. The plugin requires an active Tactical account (free Scout tier is sufficient) to function. Without an API key configured on the settings page, no requests are made.<\/p>\n\n Endpoints used:<\/strong><\/p>\n\n Conditions:<\/strong> events are only sent after you paste a valid API key on the settings page. Without a key, the snippet does not load, no requests are made, and no webhooks are registered.<\/p>\n\n Service terms:<\/strong><\/p>\n\n The plugin auto-registers WooCommerce webhooks for Yes \u2014 sign up free at tactical-app.work. The free Scout tier is 100 agent sessions per week with no credit card.<\/p><\/dd>\n Anonymised session metadata only: user-agent, page URL, referrer, scroll\/mouse heuristics, and product context. No PII, no IP addresses, no cart contents, no customer identifiers.<\/p><\/dd>\n Tactical's edge classifier uses user-agent patterns, IP-derived signals (datacenter flag, country \u2014 the IP itself is not stored), request behaviour, and known agent fingerprints to identify ChatGPT, Perplexity, Claude, Google AI, and other AI agents in real time.<\/p><\/dd>\n No. The script loads asynchronously with the Cancel from the Tactical dashboard's billing page at tactical-app.work. The plugin keeps working on the free Scout tier after cancellation.<\/p><\/dd>\n In Tactical's Postgres database (US\/EU regions). Aggregated and purged on a 90-day rolling window.<\/p><\/dd>\n Tactical processes data under the legitimate-interest legal basis. We don't store PII or browser fingerprints, and merchants can request data deletion at any time from the dashboard or by emailing hello@tactical-app.work. A Data Processing Addendum is available on request.<\/p><\/dd>\n\n<\/dl>\n\n\n\n
\n
External services<\/h3>\n\n
\n
https:\/\/tactical-app.work\/api\/ingest<\/code>. The detection script (https:\/\/tactical-app.work\/snippet.js<\/code>) loads on every storefront page view and posts an event payload containing: an anonymised session ID, page URL (path + query string only), referrer domain, user-agent string, scroll\/mouse\/timing heuristics, and your store's API key. No customer PII (no names, emails, IP addresses, payment data, or form contents) is sent.<\/li>\nhttps:\/\/tactical-app.work\/api\/verify-connection<\/code>. Triggered only when an admin clicks \"Verify connection\" on the settings page. Sends only your API key (in a request header) so Tactical can confirm the key belongs to this store. No event data.<\/li>\nhttps:\/\/tactical-app.work\/api\/wc-webhook\/<topic><\/code>. On plugin activation, three webhook subscriptions are registered with WooCommerce (order.created<\/code>, order.updated<\/code>, product.created<\/code>, product.updated<\/code>). WooCommerce delivers these payloads directly to Tactical with WC's standard HMAC signature when matching events occur on your store. Payload contents are WooCommerce's standard webhook bodies (order or product objects).<\/li>\n<\/ul>\n\n\n
\n
tactical-agent-detection<\/code> folder to \/wp-content\/plugins\/<\/code>, or install via the Plugins \u2192 Add New screen.<\/li>\norder.created<\/code>, order.updated<\/code>, product.created<\/code>, and product.updated<\/code> so order and catalog activity is correlated with agent sessions.<\/p>\n\n\n\n
Do I need a Tactical account to use this plugin?<\/h3><\/dt>\n
What data does the plugin collect?<\/h3><\/dt>\n
How is agent traffic detected?<\/h3><\/dt>\n
Will this slow down my site?<\/h3><\/dt>\n
defer<\/code> attribute and weighs under 5 KB. Classification happens at Tactical's edge, off your origin.<\/p><\/dd>\nHow do I cancel?<\/h3><\/dt>\n
Where's my data stored?<\/h3><\/dt>\n
Is this GDPR-compliant?<\/h3><\/dt>\n
1.0.2<\/h4>\n\n
\n
data-key<\/code> attribute from the storefront <script><\/code> tag. The Tactical API key is a server-side secret used to sign WooCommerce webhook deliveries and authenticate plugin-to-server API calls \u2014 it must not appear in browser-rendered HTML. The snippet identifies the tenant by data-shop<\/code> plus the request Origin, so no key is required client-side. Recommended upgrade for all installs.<\/li>\n<\/ul>\n\n1.0.1<\/h4>\n\n
\n
wp_enqueue_script<\/code> with the defer<\/code> strategy, decorated via the script_loader_tag<\/code> filter. No more inline <script><\/code> injection.<\/li>\nassets\/admin-settings.js<\/code>, enqueued via wp_enqueue_script<\/code> + wp_localize_script<\/code>. No more inline <script><\/code> in the admin page.<\/li>\nRequires Plugins: woocommerce<\/code> so WP correctly blocks activation without WooCommerce.<\/li>\nRequires at least<\/code> to WP 6.3 (needed for wp_enqueue_script<\/code> defer\/async strategy).<\/li>\n<\/ul>\n\n1.0.0<\/h4>\n\n
\n