{"id":398624,"date":"2026-11-09T21:06:31","date_gmt":"2026-11-09T21:06:31","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/agentrue-verified-ai-agents-for-woocommerce\/"},"modified":"2026-11-09T21:06:04","modified_gmt":"2026-11-09T21:06:04","slug":"agentrue","status":"publish","type":"plugin","link":"https:\/\/wordpress.org\/plugins\/agentrue\/","author":23599031,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"0.1.1","stable_tag":"0.1.1","tested":"7.1.4","requires":"6.5","requires_php":"7.4","requires_plugins":null,"header_name":"Agentrue \u2013 Verified AI Agents for WooCommerce","header_author":"Ashraf Aqela","header_description":"Verify AI shopping agents on your own server with Web Bot Auth (HTTP Message Signatures, RFC 9421). Label every order as verified agent, forged signature or unsigned impostor, and optionally block fakes at checkout.","assets_banners_color":"313439","last_updated":"2026-11-09 21:06:04","external_support_url":"","external_repository_url":"","donate_link":"","header_plugin_uri":"","header_author_uri":"","rating":0,"author_block_rating":0,"active_installs":0,"downloads":45,"num_ratings":0,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"0.1.1":{"tag":"0.1.1","author":"ashrafaqela","date":"2026-11-09 21:06:04","revision":3793257}},"upgrade_notice":[],"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3793257,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3793257,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3793257,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3793257,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["0.1.1"],"block_files":[],"assets_screenshots":{"screenshot-1.png":{"filename":"screenshot-1.png","revision":3793257,"resolution":"1","location":"assets","locale":"","width":1280,"height":1648},"screenshot-2.png":{"filename":"screenshot-2.png","revision":3793257,"resolution":"2","location":"assets","locale":"","width":1280,"height":900},"screenshot-3.png":{"filename":"screenshot-3.png","revision":3793257,"resolution":"3","location":"assets","locale":"","width":1280,"height":941}},"screenshots":{"1":"Agent traffic: verified agents, forged signatures and impostors.","2":"Orders list with the Agent column.","3":"Settings: mode, trusted operators and checkout rules."}},"plugin_section":[],"plugin_tags":[246305,272293,12891,290714,286],"plugin_category":[45],"plugin_contributors":[291709],"plugin_business_model":[],"class_list":["post-398624","plugin","type-plugin","status-publish","hentry","plugin_tags-ai-agents","plugin_tags-bot-verification","plugin_tags-fraud","plugin_tags-web-bot-auth","plugin_tags-woocommerce","plugin_category-ecommerce","plugin_contributors-ashrafaqela","plugin_committers-ashrafaqela"],"banners":{"banner":"https:\/\/ps.w.org\/agentrue\/assets\/banner-772x250.png?rev=3793257","banner_2x":"https:\/\/ps.w.org\/agentrue\/assets\/banner-1544x500.png?rev=3793257","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/agentrue\/assets\/icon-128x128.png?rev=3793257","icon_2x":"https:\/\/ps.w.org\/agentrue\/assets\/icon-256x256.png?rev=3793257","generated":false},"screenshots":[{"src":"https:\/\/ps.w.org\/agentrue\/assets\/screenshot-1.png?rev=3793257","caption":"Agent traffic: verified agents, forged signatures and impostors."},{"src":"https:\/\/ps.w.org\/agentrue\/assets\/screenshot-2.png?rev=3793257","caption":"Orders list with the Agent column."},{"src":"https:\/\/ps.w.org\/agentrue\/assets\/screenshot-3.png?rev=3793257","caption":"Settings: mode, trusted operators and checkout rules."}],"raw_content":"<!--section=description-->\n<p>AI assistants are starting to browse and buy on behalf of shoppers. Anyone can put an AI agent's name in a User-Agent header, so a request that <em>says<\/em> it comes from an AI agent proves nothing.<\/p>\n\n<p>Major agent operators now sign their requests with <strong>Web Bot Auth<\/strong> \u2013 HTTP Message Signatures (RFC 9421) with Ed25519 keys published in a key directory on the operator's own domain. Agentrue checks those signatures directly on your WordPress server. No third-party service sees your traffic and no account is needed.<\/p>\n\n<p><strong>What it does<\/strong><\/p>\n\n<ul>\n<li><strong>Verifies every signed request<\/strong> against the operator's published public keys (<code>\/.well-known\/http-message-signatures-directory<\/code>), with caching.<\/li>\n<li><strong>Labels each request<\/strong> as Verified agent, Forged signature or Unsigned impostor (a request that uses a known AI agent name but carries no signature).<\/li>\n<li><strong>Tags WooCommerce orders<\/strong> \u2013 an \"Agent\" column in the orders list (HPOS and legacy), an \"AI agent check\" box on each order and an order note.<\/li>\n<li><strong>Monitor or enforce<\/strong> \u2013 start in monitor mode (log only). In enforce mode, forged signatures are blocked with HTTP 403 and unsigned impostors can be blocked at cart and checkout.<\/li>\n<li><strong>Trusted operators list<\/strong> \u2013 choose which operator origins you accept, or accept any operator with a valid key directory.<\/li>\n<li><strong>Self-test button<\/strong> \u2013 signs a request with a temporary key and confirms that a valid signature passes and a tampered one fails.<\/li>\n<li><strong>Developer helper<\/strong> \u2013 <code>agentrue_is_verified_agent()<\/code> lets other plugins skip CAPTCHA or bot challenges for verified agents only. Filters: <code>agentrue_should_block<\/code>, <code>agentrue_pre_directory_keys<\/code>.<\/li>\n<\/ul>\n\n<p><strong>Also included<\/strong><\/p>\n\n<ul>\n<li>Agent readiness checks for your product data, a product feed, an optional <code>llms.txt<\/code> and simple AI-referral sales reporting.<\/li>\n<\/ul>\n\n<p><strong>Honest limitations<\/strong><\/p>\n\n<ul>\n<li>Only agents that sign with Web Bot Auth can be verified. Unsigned bots from smaller tools will show as unverified.<\/li>\n<li>A captured signed request could be replayed within its short validity window; nonce tracking is planned.<\/li>\n<li>If you use a CDN that already verifies bots at the edge, Agentrue still adds order-level labelling and checkout rules inside WooCommerce.<\/li>\n<li>AI agent orders are still a small share of e-commerce today. Monitor mode lets you see your real numbers before changing anything.<\/li>\n<\/ul>\n\n<h3>External services<\/h3>\n\n<p>Agentrue connects to the public key directories of AI agent operators. This is needed to check the cryptographic signature on requests from AI agents.<\/p>\n\n<p><strong>When:<\/strong> only when a request arrives with a Web Bot Auth signature from an operator that you trust (or from any operator, if you turn on \"Accept any operator\"). Results are cached, so a directory is fetched at most about once an hour.<\/p>\n\n<p><strong>What is sent:<\/strong> one plain HTTPS GET request from your server to <code>https:\/\/&lt;operator&gt;\/.well-known\/http-message-signatures-directory<\/code>. No visitor, customer or order data is sent. The operator receives only the request itself (your server's IP address and a standard WordPress user agent).<\/p>\n\n<p><strong>Default operator \u2013 ChatGPT agent (OpenAI):<\/strong> the directory at <code>https:\/\/chatgpt.com\/.well-known\/http-message-signatures-directory<\/code> is provided by OpenAI. Terms of use: https:\/\/openai.com\/policies\/terms-of-use \u2013 Privacy policy: https:\/\/openai.com\/policies\/privacy-policy<\/p>\n\n<p><strong>Operators you add yourself:<\/strong> if you add other operator origins in Settings, Agentrue fetches their directories in the same way. Each of those services is provided by that operator, under its own terms and privacy policy.<\/p>\n\n<p>No other external service is used.<\/p>\n\n<!--section=installation-->\n<ol>\n<li>Upload the plugin and activate it. WooCommerce must be active.<\/li>\n<li>Go to WooCommerce \u2192 Agentrue and click \"Run verification self-test\".<\/li>\n<li>Leave mode on Monitor for a week and check the Agent traffic tab.<\/li>\n<li>When you are happy, switch to Enforce in Settings.<\/li>\n<\/ol>\n\n<!--section=faq-->\n<dl>\n<dt id=\"will%20this%20block%20search%20engines%20or%20normal%20visitors%3F\"><h3>Will this block search engines or normal visitors?<\/h3><\/dt>\n<dd><p>No. Only requests that claim to be an AI agent are evaluated. Normal browsers and search crawlers are not affected. Monitor mode blocks nothing.<\/p><\/dd>\n<dt id=\"does%20it%20need%20an%20account%20or%20api%20key%3F\"><h3>Does it need an account or API key?<\/h3><\/dt>\n<dd><p>No. Everything runs on your server.<\/p><\/dd>\n<dt id=\"which%20agents%20can%20be%20verified%3F\"><h3>Which agents can be verified?<\/h3><\/dt>\n<dd><p>Any operator that publishes a Web Bot Auth key directory. Add the operator origins you trust in Settings.<\/p><\/dd>\n\n<\/dl>\n\n<!--section=changelog-->\n<h4>0.1.1<\/h4>\n\n<ul>\n<li>Stricter sanitization of request data.<\/li>\n<li>Removed the experimental agent checkout endpoints.<\/li>\n<li>Clearer external services documentation.<\/li>\n<\/ul>\n\n<h4>0.1.0<\/h4>\n\n<ul>\n<li>First release.<\/li>\n<\/ul>","raw_excerpt":"Know which AI agent orders are real. Verify signed AI shopping agents on your own server and flag impostors before they reach checkout.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/398624","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=398624"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/ashrafaqela"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=398624"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=398624"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=398624"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=398624"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=398624"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=398624"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}