ChatGPT, Claude, Perplexity and Meta AI now browse stores and place orders for real customers. Google Analytics can't show you most of that traffic, and anything can call itself \"ChatGPT\".<\/p>\n\n
ShopBouncer adds an AI Shoppers<\/strong> dashboard to WooCommerce (or to Tools on any WordPress site):<\/p>\n\n Human requests cost one string check. Agent visits are written after the page has been sent. The plugin is compatible with WooCommerce High-Performance Order Storage and the Cart and Checkout blocks.<\/p>\n\n ShopBouncer connects to the services below, and only to them. None of these requests contains any data about your store's visitors, customers or orders. Like any web request, each one reveals your server's IP address and the user agent \"ShopBouncer\/1.1.0 (+https:\/\/shopbouncer.com)\". Everything downloaded is public data, cached on your site, and used only to check whether a visiting AI agent is who it claims to be.<\/p>\n\n What: the IP address lists OpenAI publishes for its agents (ChatGPT-User, OAI-SearchBot, GPTBot), and the public signing keys of ChatGPT's agent.\nWhy: to check whether a visitor calling itself ChatGPT really came from OpenAI.\nWhat is sent, and when: a plain download request, with no data from your site, to https:\/\/openai.com\/chatgpt-user.json, https:\/\/openai.com\/searchbot.json or https:\/\/openai.com\/gptbot.json when a visitor claiming to be that agent arrives and the cached copy is more than 6 hours old (also when you open the AI Shoppers setup check); and to https:\/\/chatgpt.com\/.well-known\/http-message-signatures-directory when a signed request names chatgpt.com and the cached keys are more than an hour old.\nTerms of use: https:\/\/openai.com\/policies\/row-terms-of-use\/\nPrivacy policy: https:\/\/openai.com\/policies\/row-privacy-policy\/<\/p>\n\n What: the IP address list Anthropic publishes for its agents (Claude-User, Claude-SearchBot, ClaudeBot). claude.com is Anthropic's website.\nWhy: to check whether a visitor calling itself Claude really came from Anthropic.\nWhat is sent, and when: a plain download request, with no data from your site, to https:\/\/claude.com\/crawling\/bots.json when a visitor claiming to be one of those agents arrives and the cached copy is more than 6 hours old (also when you open the setup check).\nTerms of service: https:\/\/www.anthropic.com\/legal\/consumer-terms\nPrivacy policy: https:\/\/www.anthropic.com\/legal\/privacy<\/p>\n\n What: the IP address lists Perplexity publishes for Perplexity-User and PerplexityBot.\nWhy: to check whether a visitor calling itself Perplexity really came from Perplexity.\nWhat is sent, and when: a plain download request, with no data from your site, to https:\/\/www.perplexity.ai\/perplexity-user.json or https:\/\/www.perplexity.ai\/perplexitybot.json when a visitor claiming to be that agent arrives and the cached copy is more than 6 hours old (also when you open the setup check).\nTerms of service: https:\/\/www.perplexity.ai\/hub\/legal\/terms-of-service\nPrivacy policy: https:\/\/www.perplexity.ai\/hub\/legal\/privacy-notice<\/p>\n\n What: the public signing keys of Google's AI agent (Google-Agent).\nWhy: to verify requests that Google's agent signs with Web Bot Auth.\nWhat is sent, and when: a plain download request, with no data from your site, to https:\/\/agent.bot.goog\/.well-known\/http-message-signatures-directory when a signed request names agent.bot.goog and the cached keys are more than an hour old.\nTerms of service: https:\/\/policies.google.com\/terms\nPrivacy policy: https:\/\/policies.google.com\/privacy<\/p>\n\n The dashboard links to shopbouncer.com: the free store scanner, the IP checker and the design-partner program. Nothing is sent unless you click a link. Privacy notice: https:\/\/shopbouncer.com\/privacy<\/p>\n\n The optional weekly report is sent by your own site with WordPress's mail function, to the address you enter. It does not go through ShopBouncer or any other service.<\/p>\n\n\n No. This plugin only observes and reports. It never changes what visitors or agents see.<\/p><\/dd>\n An agent is verified in one of two ways. If it signs its request with Web Bot Auth, the signature is checked against the public keys its operator publishes; ShopBouncer only uses the key directories of operators that document them (OpenAI for ChatGPT's agent, Google for Google-Agent), and the dashboard names the operator that signed. If it doesn't sign, its IP address is checked against the ranges its operator publishes: inside means verified by IP, outside means impostor. A user-agent string with nothing to check it against is recorded as \"unverified (name only)\", because anyone can send it.<\/p><\/dd>\n Yes, once you tell ShopBouncer where the visitor's IP arrives: open the AI Shoppers page and set \"Visitor IP comes from\" to Cloudflare, X-Forwarded-For or X-Real-IP. The page warns you when it detects a proxy header. Until then, requests from private addresses are left unchecked rather than flagged.<\/p><\/dd>\n From WooCommerce's built-in Order Attribution (WooCommerce 8.5 and later), which already records where each order came from. ShopBouncer counts the paid orders whose source is an AI assistant's website, such as chatgpt.com or perplexity.ai. If Order Attribution is switched off, the dashboard tells you where to turn it on.<\/p><\/dd>\n No measurable impact for human visitors. Agent visits are recorded after the response is finished.<\/p><\/dd>\n The visit table and settings are deleted. Evidence saved on agent orders stays on those orders, because it is part of the order record.<\/p><\/dd>\n\n<\/dl>\n\n\n\n
Privacy by design<\/h4>\n\n
\n
Built to stay out of the way<\/h4>\n\n
External services<\/h3>\n\n
OpenAI<\/h4>\n\n
Anthropic (claude.com)<\/h4>\n\n
Perplexity<\/h4>\n\n
Google<\/h4>\n\n
Links only (no data is sent)<\/h4>\n\n
\n
\n
Does it block anything?<\/h3><\/dt>\n
How do you know an agent is really ChatGPT?<\/h3><\/dt>\n
My site is behind Cloudflare or another proxy. Does the IP check still work?<\/h3><\/dt>\n
Where does the \"sales sent by AI assistants\" figure come from?<\/h3><\/dt>\n
Does it slow my store down?<\/h3><\/dt>\n
What happens when I uninstall?<\/h3><\/dt>\n
1.1.0<\/h4>\n\n
\n
1.0.0<\/h4>\n\n
\n