AI assistants now send people to websites. Some of those visits arrive with a referrer that names the assistant. Many arrive with no referrer at all and look like direct traffic. This plugin records your visits in your own database, works out which ones came from an AI assistant, and puts them next to everyone else on the same metrics. A small AI Traffic box on your WordPress Dashboard shows this week's numbers at a glance. It is built to be light: under 1 ms added to a page render, one script under 3 KB, nothing about your site or your visitors sent anywhere, and nothing extra at all on pages served from a cache. The only outside downloads are the public crawler lists described under Privacy.<\/p>\n\n
What you get<\/strong><\/p>\n\n Confirmed and Likely are two different numbers<\/strong><\/p>\n\n A visit is Confirmed AI<\/em> when its referrer or a UTM tag names an assistant. A visit is Likely AI<\/em> when it arrived with no referrer, on a first visit, landing straight on an inner page that a verified AI crawler had read within the past 7 days. It is an estimate, so it is always kept apart from Confirmed AI; when in doubt a visit is counted as not AI. Every Likely visit shows its reason in plain words. The two are never added into one number without saying so, and a small sample is marked \"Too few sessions\" instead of showing a percentage. When in doubt, the plugin classifies down.<\/p>\n\n Assistants recognised<\/strong><\/p>\n\n ChatGPT, Perplexity, Gemini, Claude, Microsoft Copilot, DeepSeek, Grok, Meta AI, Mistral, You.com and Poe. The list is a data file inside the plugin; see \"Source list\" below.<\/p>\n\n What Google Analytics already shows<\/strong><\/p>\n\n If you use GA4, visits that arrive with an assistant referrer already appear in your referral reports with the assistant's domain as the source. What this plugin adds is the Likely layer for visits that arrive with no referrer, the reason for each one, the crawler report, the WooCommerce order link, and the fact that everything stays on your own server.<\/p>\n\n Limitations, stated plainly<\/strong><\/p>\n\n Performance<\/strong><\/p>\n\n If page speed is why you hesitate to add another plugin, here is what this one costs on a visit, measured with the plugin's own benchmark script on WordPress 7.1, PHP 8.4, with WooCommerce active, over four runs of 50 to 200 page renders each:<\/p>\n\n Source list<\/strong><\/p>\n\n The addresses of the assistants and crawlers live in a data file shipped inside the plugin and are refreshed by plugin updates. The Settings screen shows the version in use and what it covers.<\/p>\n\n Built by Zluck Solutions. Support is on this plugin's wordpress.org forum.<\/p>\n\n Everything this plugin records stays in your own WordPress database. It sends nothing to Zluck or to anyone else. The one optional exception, off by default, is downloading the crawlers' public IP lists; see External services.<\/p>\n\n What it stores about a visit: the page, the time, the referring website, UTM tags if present, coarse device type (phone, tablet or desktop), time on page and scroll depth, and the plugin's own verdict on whether the visit came from an AI assistant.<\/p>\n\n What it never stores: IP addresses, names, email addresses, WordPress user accounts, or the browser's full identification string. It does not fingerprint visitors and cannot recognise a visitor from one day to the next without the cookie.<\/p>\n\n The cookie: by default the plugin sets one first-party cookie, Opting out: the plugin honours the Global Privacy Control signal. A visitor whose browser sends it is not recorded and gets no cookie.<\/p>\n\n WooCommerce: when a visitor places an order, the plugin keeps the order number together with the AI verdict for that visit. This is the only value that can be linked to a person, because the order itself has the buyer's details. The plugin registers with WordPress's personal-data export and erase tools, so a request under Tools \u2192 Export Personal Data or Erase Personal Data includes and removes this link. Removing personal data from an order in WooCommerce removes the link too.<\/p>\n\n Crawlers: requests from known AI crawlers are counted by the crawler name and the page. The crawler's address is checked against the operator's published list in memory and only the result is kept. AI lookups are counted from the same crawler records: the crawler name and the page, nothing else.<\/p>\n\n Outbound requests: the plugin downloads the public IP-address lists that crawler operators publish, once a week, only for crawlers that actually visit, for verification. Each request is a plain download of a public file and carries nothing about your site or your visitors. Nothing else is fetched. The lists are: https:\/\/openai.com\/gptbot.json, https:\/\/openai.com\/searchbot.json, https:\/\/openai.com\/chatgpt-user.json, https:\/\/claude.com\/crawling\/bots.json, https:\/\/www.perplexity.com\/perplexitybot.json, https:\/\/www.perplexity.com\/perplexity-user.json, https:\/\/developers.google.com\/static\/crawling\/ipranges\/common-crawlers.json, https:\/\/www.bing.com\/toolbox\/bingbot.json, https:\/\/index.commoncrawl.org\/ccbot.json and https:\/\/search.developer.apple.com\/applebot.json.<\/p>\n\n Deleting the plugin: turn on \"Delete all data on uninstall\" in the settings before deleting, and every table and setting the plugin created is removed.<\/p>\n\n Opt-in, off by default.<\/strong> Nothing is downloaded unless an administrator ticks \"Verify AI crawlers\" on the plugin's Settings screen. While it is off, the plugin makes no outside request at all, and crawler visits are shown as \"Unverified (not checked)\" instead of \"Verified\".<\/p>\n\n When the setting is on, this plugin connects to outside services only to check that a visit from an AI or search crawler really came from the company it claims. Each company publishes a public file listing the IP addresses its crawlers use. The plugin downloads that file and compares it with the crawler's address. Without it, a visit could only be shown as \"claimed\", never \"verified\".<\/p>\n\n What is sent: a plain request for a public file. It carries no data about your site, your visitors or your account: no site address, no cookies, no query string, no IP address of a visitor. The company that hosts the file sees the IP address of your web server, as with any download, and the plugin's name and version in the user agent (for example When: at most once a week per file, and only for a crawler that has actually visited your site. A crawler that never visits is never looked up. Nothing is downloaded when you view a screen, and no visitor can cause a download from the page itself.<\/p>\n\n The files, by company:<\/p>\n\n The plugin does not use any other outside service. Visitor statistics are never sent anywhere; they stay in your own database.<\/p>\n\n The report screens draw their charts with Chart.js version 4.5.1, released under the MIT License. The plugin ships the official build file The plugin makes no other use of external code or services. The public IP-address lists it downloads for crawler verification are listed under External services.<\/p>\n\n\n Three common reasons. The site has had few visitors from assistants yet, which the empty state on each screen says plainly. The scheduled jobs have not run yet; they run about once an hour when the site has visitors, so on a quiet site the first numbers take two to three hours to appear after the first visit, and the Settings screen has a \"Process now\" button if you do not want to wait. Or the tracking script is not reaching the plugin; see the next question.<\/p><\/dd>\n A visit is Likely AI when two things are true together: a first-time visitor arrived with no referrer and landed straight on an inner page, and a verified AI crawler had read that same page within the past 7 days (a filter can change the window). Either one alone is not enough: a bookmarked inner page, or a direct visit to a home page that crawlers read all the time, stays \"everyone else\".<\/p>\n\n It is an estimate, so the plugin classifies down when unsure and never adds Likely into the Confirmed number. Where a total appears it is a range, for example \"12 to 19 sessions\". The working target is that fewer than 2 in 100 visits that really came from a search engine would be called Likely.<\/p>\n\n To see why a particular visit was called Likely, export the sessions file from the Overview screen; its \"Reason\" column reads, for example, \"Landed deep on a page ChatGPT-User read 2 days earlier, with no referrer\". On WooCommerce the \"AI traffic\" panel on an order shows the same reason. Every report screen also has a small help icon beside \"Likely AI\" and a \"Help\" tab at the top right with this explanation.<\/p><\/dd>\n Something between the visitor's browser and the plugin. The usual causes: a caching or optimisation plugin that delays or strips inline scripts; a security plugin that blocks the REST API for visitors who are not logged in; a theme that does not call The plugin relies on the WordPress scheduler (WP-Cron) for three small jobs: turning page views into sessions, writing the daily totals the screens read, and deleting old rows. The built-in scheduler only runs when someone visits the site, and some hosts and security plugins block it. The notice names the job and what it means. To fix it, ask your host to call No. On the server it adds under 1 ms to building a page, and nothing at all when a page cache serves the page. In the browser it adds one script under 3 KB that loads nothing else and sends one small request to your own site when the visitor leaves. There is no database write while the page is built, and nothing about your site or your visitors is sent anywhere. The only outside downloads are the public crawler lists described under Privacy, fetched in the background, never while a page is built. The full numbers, and how they were measured, are under Performance in the description.<\/p><\/dd>\n Usually not. The script is part of the cached page and already carries the attributes that WP Rocket, LiteSpeed Cache, Autoptimize and Cloudflare Rocket Loader use to leave a script alone. Two things to know: if a \"delay JavaScript until interaction\" feature is on and the numbers look low, add Administrators are never tracked, so that a site owner previewing the site does not pollute the numbers. To test order attribution, place the order in a private browser window where you are not logged in.<\/p><\/dd>\n A hit is \"verified\" when the visitor's address is on the list the crawler's operator publishes. If your site sits behind a proxy or CDN that does not pass the real visitor address through, every hit is checked against the proxy's own address and shows as claimed only. Your host can usually pass the real address through; a developer can also supply it with the An AI lookup is one verified request from an assistant's live answer bot: ChatGPT-User, Claude-User or Perplexity-User. These bots fetch a page while the assistant is answering a person's question, so a lookup means the assistant read your page to help with an answer. It is not a citation. The plugin can see that the page was read; it cannot see the question, the answer, or whether the answer mentioned or linked to your site. Search-index bots such as OAI-SearchBot and training bots such as GPTBot are not lookups; they appear in the crawler table instead. Requests that could not be verified against the operator's published addresses are never counted as lookups.<\/p><\/dd>\n Administrators always. On the settings screen you can tick other roles; a ticked role can open the report screens and export CSV files, but not change settings.<\/p><\/dd>\n\n
\n
\n
Privacy<\/h3>\n\n
aitraf_s<\/code>, holding a random value, so that page views can be grouped into a visit and a WooCommerce order can be matched to the visit that led to it. It is set by your own site, never by a third party. Cookieless mode in the settings turns it off; visits are then grouped by a code that changes every day and cannot be traced back to anyone.<\/p>\n\nExternal services<\/h3>\n\n
zluck-ai-traffic-insights\/1.0<\/code>).<\/p>\n\n\n
External resources<\/h3>\n\n
vendor\/chartjs\/chart.umd.min.js<\/code>, unchanged, with its license. Source code: https:\/\/github.com\/chartjs\/Chart.js\/tree\/v4.5.1. It is loaded only on the plugin's own admin screens, never on your site's front end.<\/p>\n\n\n
\n
Why do I see no AI traffic?<\/h3><\/dt>\n
What does Likely AI mean?<\/h3><\/dt>\n
The settings screen says no page views have arrived. What stops them?<\/h3><\/dt>\n
wp_footer()<\/code>; Cloudflare bot protection challenging POST requests; or a consent tool set to block unknown inline scripts. The plugin cannot fix any of these from its side, but the settings screen tells you the last time a page view arrived so you can tell whether a change helped.<\/p><\/dd>\nA notice says a job is not running or the scheduler is not running. What do I do?<\/h3><\/dt>\n
wp-cron.php<\/code> every 15 minutes (most hosts have a setting for this), or install a plugin such as WP Crontrol to see the plugin's aitraf_<\/code> events and run one by hand. The \"Process now\" button on the Settings screen runs the session and daily-totals jobs immediately, which is the quickest way to confirm the fix worked.<\/p><\/dd>\nWill this slow my site down?<\/h3><\/dt>\n
I use a caching plugin. Do I need to change anything?<\/h3><\/dt>\n
aitraf-beacon<\/code> to its exclusion list; and after switching cookieless mode on or off, clear the page cache so cached pages pick up the change.<\/p><\/dd>\nWhy does my own test order say \"No visit recorded\"?<\/h3><\/dt>\n
The Crawlers screen says \"claimed\" for every hit. Why?<\/h3><\/dt>\n
aitraf_client_ip<\/code> filter.<\/p><\/dd>\nWhat is an AI lookup? Is it a citation?<\/h3><\/dt>\n
Who can see the reports?<\/h3><\/dt>\n