Adds OAuth Protected Resource metadata (RFC 9728), a discovery Link header, Markdown responses for agents, and projects your declared usage policy into robots.txt and a Content-Signal header. Additive and filterable; your robots.txt rules are never changed.<\/p>","0.4.2":"
Compatibility and housekeeping release: the plugin now runs cleanly on its declared minimums (PHP 8.0, WordPress 6.0), and the optional Abilities \/ AI Client integrations are explicitly guarded. No configuration changes.<\/p>","0.4.1":"
Adds an NLWeb-compatible Adds ACP (Agentic Commerce Protocol) checkout with a Stripe Shared Payment Token handler, an opt-in AP2 (Agent Payments Protocol) merchant surface, richer product data, and local privacy-preserving analytics (a new events table, created on activation). Backward compatible.<\/p>","0.3.0":" Adds agent checkout, llms.txt and agent.json surfaces, and WordPress 7.0 Abilities integration. Backward compatible; review Settings -> AI2Web to toggle the new agent checkout.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3620541,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3620541,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3620541,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3620541,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["0.4.2","0.4.3"],"block_files":[],"assets_screenshots":{"screenshot-1.png":{"filename":"screenshot-1.png","revision":3620541,"resolution":"1","location":"assets","locale":"","width":3205,"height":1846},"screenshot-2.png":{"filename":"screenshot-2.png","revision":3620541,"resolution":"2","location":"assets","locale":"","width":2961,"height":1548},"screenshot-3.png":{"filename":"screenshot-3.png","revision":3620541,"resolution":"3","location":"assets","locale":"","width":3220,"height":1627}},"screenshots":{"1":"The AI2Web settings page: a live AI Readiness Score and compliance tier, with links to your discovery manifest and MCP endpoint.","2":"Feature toggles: MCP, the agent service, OAuth2 (PKCE), WooCommerce actions, agent checkout, and the ACP and AP2 agentic-commerce surfaces.","3":"The Agent Sales dashboard: agent-driven revenue, orders by protocol (agent checkout, ACP, AP2) and engagement, computed entirely from local data."}},"plugin_section":[],"plugin_tags":[15643,2353,216196,242115,286],"plugin_category":[45],"plugin_contributors":[228208],"plugin_business_model":[],"class_list":["post-344405","plugin","type-plugin","status-publish","hentry","plugin_tags-agents","plugin_tags-ai","plugin_tags-chatgpt","plugin_tags-mcp","plugin_tags-woocommerce","plugin_category-ecommerce","plugin_contributors-rolandfarkas","plugin_committers-rolandfarkas"],"banners":{"banner":"https:\/\/ps.w.org\/ai2web\/assets\/banner-772x250.png?rev=3620541","banner_2x":"https:\/\/ps.w.org\/ai2web\/assets\/banner-1544x500.png?rev=3620541","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/ai2web\/assets\/icon-128x128.png?rev=3620541","icon_2x":"https:\/\/ps.w.org\/ai2web\/assets\/icon-256x256.png?rev=3620541","generated":false},"screenshots":[{"src":"https:\/\/ps.w.org\/ai2web\/assets\/screenshot-1.png?rev=3620541","caption":"The AI2Web settings page: a live AI Readiness Score and compliance tier, with links to your discovery manifest and MCP endpoint."},{"src":"https:\/\/ps.w.org\/ai2web\/assets\/screenshot-2.png?rev=3620541","caption":"Feature toggles: MCP, the agent service, OAuth2 (PKCE), WooCommerce actions, agent checkout, and the ACP and AP2 agentic-commerce surfaces."},{"src":"https:\/\/ps.w.org\/ai2web\/assets\/screenshot-3.png?rev=3620541","caption":"The Agent Sales dashboard: agent-driven revenue, orders by protocol (agent checkout, ACP, AP2) and engagement, computed entirely from local data."}],"raw_content":"\n Describe your website once. AI2Web makes it understandable to every AI.<\/strong><\/p>\n\n AI agents are starting to use the web, but the web was built for human eyes. Agents scrape HTML, guess at forms, and render whole pages just to find one price or one button. AI2Web fixes that by publishing a single, structured description of what your site can do, and serving backend-first endpoints agents can call directly. No scraping, no per-vendor rebuild.<\/p>\n\n AI2Web is a vendor-neutral capability layer. It sits above<\/em> protocols like MCP and ACP and speaks whichever one an assistant understands, rather than competing with them.<\/p>\n\n On activation the plugin serves, from your own domain:<\/p>\n\n The last two mean agents that speak With WooCommerce active, AI2Web can expose an Agentic Commerce Protocol (ACP) checkout<\/strong> so a shopper's AI agent (for example ChatGPT Instant Checkout) can buy from your store. The agent drives a real WooCommerce cart through a checkout session at Payment stays safe by design. Completing a session hands the store a delegated payment token. AI2Web ships a Stripe Shared Payment Token<\/strong> handler: when a Stripe secret key is available (set an AI2Web can also expose a Google AP2<\/strong> merchant surface (opt-in). AP2 represents a purchase as signed \"mandates\": the store answers a buyer agent's Intent Mandate with a merchant-signed Cart Mandate<\/strong> that guarantees the items and price for a short window, then settles a user-signed Payment Mandate into a WooCommerce order. It is served at When WooCommerce is active, AI2Web exposes safe commerce actions:<\/p>\n\n If Contact Form 7, Gravity Forms, WPForms, Fluent Forms or Elementor Forms is active, AI2Web exposes a single approval-gated submit_contact<\/strong> action. On confirmation the enquiry is emailed to your support address (never an arbitrary recipient, so it is not an open relay) and is rate limited per IP.<\/p>\n\n On WordPress 6.9+\/7.0, AI2Web also registers its actions as native WordPress Abilities<\/strong>, with AI annotations (read vs. write, destructive). This exposes the same ownership-verified, approval-gated actions to WordPress's own AI Client and MCP Adapter, so a connected assistant can use them through WordPress too. Two surfaces, one definition:<\/p>\n\n If you connect an AI provider in WordPress 7.0's Connectors hub, AI2Web exposes Agents can authenticate via an OAuth2 authorization-code + PKCE flow, where a logged-in user approves access on a consent screen. Codes are single-use and short-lived, tokens are stored hashed, PKCE uses S256, and the flow is served over HTTPS. Anonymous, ownership-gated access remains the fallback, so a token is never required. OAuth is a security-sensitive feature; review it for your threat model before relying on it, and it can be turned off on the settings page.<\/p>\n\n A settings page (Settings -> AI2Web) shows a live AI Readiness Score out of 100<\/strong> and a compliance tier, lets you toggle each feature (MCP, agent service, OAuth2, WooCommerce actions, returns\/refunds, agent checkout, ACP, AP2), and set a public support email.<\/p>\n\n A separate Agent Sales<\/strong> screen (Settings -> AI2Web Agent Sales) tracks what AI agents actually do on your store, computed entirely from local data - no external service and nothing to set up. It attributes every order an agent created (through agent checkout, ACP or AP2) and shows agent-driven revenue, order count, average order value and pending value for a period you choose, broken down by protocol, with a recent-orders table. It also surfaces engagement from the AI2Web events table: discovery hits, queries, action calls, and query \"misses\" - searches an agent ran that returned nothing, i.e. demand you are not yet meeting, which a read-only crawl of your site could never reveal.<\/p>\n\n The most important part is what an agent cannot<\/em> do without asking. See the security section below.<\/p>\n\n AI2Web is backend-first and API-driven. It does not scrape your frontend or rely on browser tools.<\/p>\n\n Everything is generated from your live site and detected integrations, and the manifest is filterable so themes and plugins can extend it.<\/p>\n\n This plugin does not send any data to an external service by default. One optional feature relies on a third party:<\/p>\n\n Stripe<\/strong> (agent-completed payments)<\/p>\n\n When, and only when, you (a) enable ACP checkout, (b) enter your own Stripe secret key in Settings -> AI2Web, and (c) a shopper's agent completes an order using a delegated Stripe payment token, the plugin sends a single request to the Stripe API ( Data sent to Stripe with that request: the order amount and currency, an order description, the delegated payment token supplied by the agent, the order ID and checkout-session ID, and (if present) the customer's billing email as the receipt address. It is sent over HTTPS at the moment the agent completes payment. No data is sent at any other time.<\/p>\n\n Stripe is a service provided by Stripe, Inc. Please review their terms and privacy policy:<\/p>\n\n No. The manifest and discovery endpoints expose only public metadata. Order tracking requires the correct billing email for that order, lookups are rate limited, and a wrong email is indistinguishable from a missing order, so nothing can be enumerated.<\/p><\/dd>\n No. Refund and return actions only log a request as an order note for you to action in WooCommerce. Checkout creates a pending order and returns a secure payment link; the customer pays in the browser and the agent never handles payment details. No money moves without a human.<\/p><\/dd>\n Enable the MCP endpoint on the settings page (on by default), then add Yes, if you enable ACP checkout (Settings -> AI2Web; it needs Agent checkout on). AI2Web implements the Agentic Commerce Protocol 2026-04-17 checkout sessions and a product feed, backed by a real WooCommerce cart, so a shopper's agent can assemble a cart, choose a variation, add a shipping address and coupon, and see live shipping and tax. To charge in-agent, provide a Stripe secret key (an Both let AI agents buy from your store; they are complementary and you can enable either or both. ACP (OpenAI\/Stripe) is a session-based checkout that powers ChatGPT Instant Checkout - the agent drives a live cart and completes with a Shared Payment Token. AP2 (Google) is mandate-based: your store signs a Cart Mandate guaranteeing the price, and the buyer's agent settles it with a signed Payment Mandate. AI2Web implements the merchant side of both from the same WooCommerce catalogue.<\/p><\/dd>\n They are alternative projections of the same manifest, for agents that read those formats. You do not maintain them separately; they are generated from On WordPress 6.9+\/7.0, the plugin registers its actions with the native Abilities API so WordPress's own AI Client and MCP Adapter can use them. This surface is authenticated (gated by WordPress permissions), separate from the public No. WooCommerce 10.9+ ships its own canonical abilities (product and order query, create, update, etc.) into the same Abilities API. Those are merchant-facing and authenticated, for a store operator driving their shop from an AI client. AI2Web's actions are the opposite: customer-facing, anonymous, and ownership-gated (an external shopper's agent with no WordPress account), served from No. The manifest, feeds and endpoints are useful today, and the MCP endpoint works with current assistant connectors without any AI key on your side.<\/p><\/dd>\n Subdomain multisite works: each subsite serves its own manifest. Subdirectory multisite also works for On Apache with the standard WordPress .htaccess, requests reach WordPress and the plugin serves the anchor. On some nginx setups a Enable OAuth2 (PKCE) on the settings page. An agent sends the user to Use the \/ai2w\/nlweb\/ask<\/code> endpoint so agents that speak NLWeb (nlweb.ai) can query your content and catalogue. Backward compatible; toggle under Settings -> AI2Web.<\/p>","0.4.0":"What it serves<\/h4>\n\n
\n
\/.well-known\/ai2w<\/code> - the discovery anchor agents look for<\/li>\n\/ai2w<\/code> - your site's AI2Web manifest: identity, capabilities, transports, declared actions, events, governance<\/li>\n\/ai2w\/mcp<\/code> - a Model Context Protocol endpoint. Add it to Claude, ChatGPT, Grok or any MCP client and your declared actions become tools the assistant can call<\/li>\n\/ai2w\/content<\/code>, \/ai2w\/search<\/code>, \/ai2w\/products<\/code>, \/ai2w\/events<\/code> - live, structured content and catalog<\/li>\n\/ai2w\/actions\/*<\/code> - the secure action endpoints<\/li>\n\/ai2w\/negotiate<\/code> - capability negotiation (agree a capability set and transport)<\/li>\n\/llms.txt<\/code> - a plain-text summary and links, projected from the same manifest<\/li>\n\/.well-known\/agent.json<\/code> - a generic agent-capability document, also projected from the manifest<\/li>\n<\/ul>\n\nllms.txt<\/code> or a generic agent.json<\/code> can use your site without understanding AI2Web first, while \/ai2w<\/code> stays the authoritative source.<\/p>\n\nAgentic checkout (ACP)<\/h4>\n\n
\/ai2w\/acp\/checkout_sessions<\/code> - adding items and a chosen variation, setting a shipping address, picking a delivery option, applying a coupon - and sees your live WooCommerce pricing, shipping rates and tax as it goes. A product feed at \/ai2w\/acp\/feed<\/code> lets agents ingest your catalogue. The same flow is available as MCP tools, so any MCP client can run it.<\/p>\n\nAI2WEB_STRIPE_SECRET_KEY<\/code> constant in wp-config.php, or configure the WooCommerce Stripe gateway), it confirms a Stripe PaymentIntent for the order total and the buyer is charged in-agent. With no key configured, completion creates a pending order and returns that order's own secure payment link for the customer to pay in the browser. Either way the agent never handles card details, and the whole payment step is filterable (ai2web_acp_complete_payment<\/code>) if you use a different processor. Turn ACP on under Settings -> AI2Web (it requires Agent checkout).<\/p>\n\nAP2 (Agent Payments Protocol)<\/h4>\n\n
\/ai2w\/ap2<\/code> as a REST binding and a minimal A2A JSON-RPC endpoint, with an agent card and a JWKS that publishes the cart-signing public key so any party can verify the merchant's signature. Enable it under Settings -> AI2Web (it generates an RSA signing key on first use).<\/p>\n\nWooCommerce<\/h4>\n\n
\n
Contact forms<\/h4>\n\n
WordPress 7.0 AI: Abilities API<\/h4>\n\n
\n
\/ai2w<\/code> - the public, anonymous, open-protocol surface (ownership and approval gated).<\/li>\nAgent service<\/h4>\n\n
\/ai2w\/agent<\/code>, a natural-language endpoint answered by WordPress's built-in AI Client using your provider. The plugin never handles an AI key.<\/p>\n\nOAuth2 (PKCE)<\/h4>\n\n
AI Readiness Score<\/h4>\n\n
Agent Sales dashboard<\/h4>\n\n
Safe by design<\/h4>\n\n
How it works<\/h3>\n\n
\n
\/.well-known\/ai2w<\/code>, which points to \/ai2w<\/code>. Reading the manifest never changes anything.<\/li>\nPOST \/ai2w\/negotiate<\/code> to agree a capability set and a transport (REST or MCP).<\/li>\n\/ai2w\/actions\/{name}<\/code>) or as an MCP tool. Requests are validated against the declared schema. Sensitive actions return a preview and require explicit confirmation.<\/li>\n<\/ol>\n\nPrivacy and security<\/h3>\n\n
\n
External services<\/h3>\n\n
https:\/\/api.stripe.com\/v1\/payment_intents<\/code>) to charge that order. If you do not enter a Stripe key, no request is ever made and no data leaves your site.<\/p>\n\n\n
\n
ai2web<\/code> folder to \/wp-content\/plugins\/<\/code>, or install the zip from Plugins -> Add New -> Upload.<\/li>\nhttps:\/\/your-site.com\/ai2w<\/code> to see your manifest.<\/li>\nhttps:\/\/your-site.com\/ai2w\/mcp<\/code> as a custom MCP connector.<\/li>\n<\/ol>\n\n\n\n
Does this expose private customer data?<\/h3><\/dt>\n
Can an AI issue a refund or take payment on my store?<\/h3><\/dt>\n
How do I connect this to Claude, ChatGPT or Grok?<\/h3><\/dt>\n
https:\/\/your-site.com\/ai2w\/mcp<\/code> as a custom connector \/ MCP server in the assistant. Your declared actions appear as tools.<\/p><\/dd>\nCan a shopper check out through an AI agent (ACP \/ ChatGPT Instant Checkout)?<\/h3><\/dt>\n
AI2WEB_STRIPE_SECRET_KEY<\/code> constant in wp-config.php, or the WooCommerce Stripe gateway): AI2Web then confirms a Stripe PaymentIntent from the Shared Payment Token the agent supplies. Without a key, completing a checkout creates a pending order and returns its secure payment link for the customer to pay in the browser. Either way the agent never handles card details.<\/p><\/dd>\nWhat is the difference between ACP and AP2?<\/h3><\/dt>\n
What is \/llms.txt and \/.well-known\/agent.json?<\/h3><\/dt>\n
\/ai2w<\/code>.<\/p><\/dd>\nWhat are the WordPress Abilities it registers?<\/h3><\/dt>\n
\/ai2w<\/code> surface.<\/p><\/dd>\nDoes it clash with WooCommerce 10.9's own agent abilities?<\/h3><\/dt>\n
\/ai2w\/mcp<\/code> and REST. To keep the native, authenticated surface tidy, AI2Web stops registering its read actions that WooCommerce now covers canonically (search_products<\/code>, check_stock<\/code>, track_order<\/code>) as WordPress abilities when WooCommerce 10.9+ is active. They stay available on the public \/ai2w<\/code> surface, which WooCommerce's abilities do not serve.<\/p><\/dd>\nDo I need OpenAI\/Anthropic to use AI2Web?<\/h3><\/dt>\n
Does it work with multisite?<\/h3><\/dt>\n
\/ai2w<\/code> and its routes (the request path is resolved against each site's home URL); the domain-root \/.well-known\/<\/code> anchor belongs to the network's main site, so subsites are discovered via \/ai2w<\/code> and the <link rel=\"ai2w\"><\/code> tag.<\/p><\/dd>\n\/.well-known\/ai2w returns a 404 on my server<\/h3><\/dt>\n
location ^~ \/.well-known\/<\/code> block serves that path directly and never reaches WordPress; add a rule to pass \/.well-known\/ai2w<\/code> to WordPress, or serve it as a static pointer to \/ai2w<\/code>.<\/p><\/dd>\nHow do I authenticate an agent (OAuth2)?<\/h3><\/dt>\n
\/ai2w\/oauth\/authorize<\/code>, the user approves on a consent screen, and the agent exchanges the code for a token at \/ai2w\/oauth\/token<\/code> (PKCE S256). The token is then sent as an Authorization: Bearer<\/code> header. Anonymous, ownership-gated access still works without a token.<\/p><\/dd>\nHow do I customise the manifest?<\/h3><\/dt>\n
ai2web_manifest<\/code> filter, or the targeted ai2web_support_contact<\/code>, ai2web_governance<\/code>, ai2web_usage_policy<\/code>, ai2web_legal<\/code>, ai2web_knowledge<\/code>, ai2web_oauth_allowed_clients<\/code> and ai2web_oauth_allow_insecure<\/code> filters.<\/p><\/dd>\n\n<\/dl>\n\n\n0.4.3<\/h4>\n\n
\n
\/.well-known\/oauth-protected-resource<\/code> document telling agents (and MCP clients) which authorization server guards the AI2Web endpoints. Served only when OAuth2 is enabled.<\/li>\nusage_policy<\/code> you already declare in the manifest is now projected into robots.txt as a Content-Signal<\/code> directive and sent as a Content-Signal<\/code> response header, so crawlers can actually read your stated preferences. Additive only - your existing robots.txt rules are never modified - and filterable via ai2web_project_robots_txt<\/code>.<\/li>\nLink<\/code> header<\/strong>: every front-end response advertises the manifest via Link: <...\/ai2w>; rel=\"ai2w\"<\/code> (RFC 8288), so non-HTML clients discover it without parsing a page. Filterable via ai2web_send_discovery_headers<\/code>.<\/li>\n\/ai2w\/content<\/code> returns Markdown when the request sends Accept: text\/markdown<\/code> (with Vary: accept<\/code>); JSON remains the default.<\/li>\n<\/ul>\n\n0.4.2<\/h4>\n\n
\n
array_is_list()<\/code>, so it runs on its declared minimums (PHP 8.0, WordPress 6.0) rather than needing PHP 8.1 \/ WordPress 6.5.<\/li>\nLicense URI<\/code> header, escaped an admin readiness glyph, trimmed an over-long upgrade notice, and documented the OAuth redirect and table-name query annotations.<\/li>\n0.4.1<\/h4>\n\n
\n
\/ai2w\/nlweb\/ask<\/code>, an NLWeb-compatible natural-language query over your posts, pages and WooCommerce products, returning schema.org-style results. Agents that speak NLWeb can now search your site through AI2Web, and the surface is advertised in the manifest under transports.nlweb<\/code> (plus a conversational<\/code> capability). It is a keyword projection over WordPress search, not NLWeb's own semantic engine. Toggle under Settings -> AI2Web.<\/li>\n<\/ul>\n\n0.4.0<\/h4>\n\n
\n
\/ai2w\/acp\/checkout_sessions<\/code> (create, retrieve, update, complete, cancel), a product feed at \/ai2w\/acp\/feed<\/code>, and the five matching MCP tools (create\/get\/update\/complete\/cancel_checkout_session). Live WooCommerce pricing, shipping rates, coupons and tax are projected as ACP totals in minor units. Includes a Stripe Shared Payment Token handler<\/strong>: when a Stripe secret key is available (an AI2WEB_STRIPE_SECRET_KEY<\/code> constant or the WooCommerce Stripe gateway), completing a checkout charges the buyer in-agent by confirming a Stripe PaymentIntent; with no key it degrades safely to a pending order plus that order's secure pay link, so the agent never handles card data. Toggle under Settings -> AI2Web (requires Agent checkout).<\/li>\n\/ai2w\/ap2<\/code> as both a REST binding (\/cart<\/code>, \/payment<\/code>) and an A2A JSON-RPC message\/send<\/code> endpoint that returns proper A2A Task artifacts, with an agent card discoverable at both \/ai2w\/ap2\/agent-card<\/code> and \/.well-known\/agent-card.json<\/code> (advertising the AP2 extension) and a JWKS (\/ai2w\/ap2\/jwks<\/code>) publishing the cart-signing key. Carts support multiple items and quantities. Carts are signed as RS256 JWTs (an RSA key is generated on first use, or supplied via an AI2WEB_AP2_PRIVATE_KEY<\/code> constant). Settlement runs through the ai2web_ap2_settle_payment<\/code> filter, falling back to a pending order + pay link. Enable under Settings -> AI2Web.<\/li>\ncheck_stock<\/code> and the catalogue now report product type, attributes (size\/colour\/etc.), and, for variable products, each purchasable variation with its own id, SKU, price, selecting attributes and stock, plus the price range. start_checkout<\/code> accepts a variation_id<\/code> (to buy a specific variant) and an optional coupon<\/code> code.<\/li>\n