AxioRank Agent Verification

A new kind of visitor is showing up on WordPress sites. Alongside people and the familiar search engine crawlers, there are now AI agents: automated tools like ChatGPT and other assistants that use the web on someone's behalf. They do not just read your public pages. They log in, run searches, submit forms, and talk to the behind-the-scenes connections that power your plugins, themes, and mobile apps. Here is the problem: WordPress has no built-in way to tell who these automated visitors really are. The traditional method is to look at the "user agent", the name a visitor gives for itself. That name is easy to fake. Anyone can write a script that claims to be ChatGPT, and anyone can write a bot that claims to be an ordinary Chrome browser. AxioRank Agent Verification gives you a trustworthy answer. It uses a new open web standard called Web Bot Auth, in which reputable AI companies cryptographically sign the requests their agents make. Think of a signature as a passport rather than a name tag: it can be checked, and it cannot be forged. The plugin checks those signatures through the AxioRank service, so for every automated visit to the sensitive parts of your site you can see whether the visitor is genuine, unknown, or pretending to be something it is not. How it works, in plain terms

1. You install the plugin and connect it to your AxioRank account with a site key, a long code that identifies your site.
2. The plugin quietly watches the sensitive parts of your site: the login page, search, and the technical doorways that apps and integrations use to talk to WordPress (the REST API, admin-ajax, and XML-RPC).
3. When a request looks automated, because it carries an agent signature or a bot-style user agent, the plugin asks AxioRank one question: who is this, and are they really who they claim to be?
4. In Monitor mode, which is the default, the answer is simply recorded. Nothing is blocked. Your AxioRank dashboard builds up a picture of which AI agents visit your site, what they touch, and which of them are verified, unknown, or impostors.
5. When you have watched for a while and feel confident, you flip one switch to Enforce mode. From then on, agents that fail verification or break your rules receive a standard "access denied" response instead of getting through.

What you get

• A clear picture of the AI agents using your site, based on verifiable identity instead of easily faked names.
• Monitor mode by default: watch first, decide later. Nothing is blocked until you say so.
• Enforce mode when you are ready: verified agents pass, impostors and unwanted agents are turned away.
• Simple scope controls: tick boxes decide which parts of the site are covered, and the recommended set is preselected.
• An activity panel right in your WordPress admin, plus a fuller dashboard on AxioRank.
• A safety-first design: if AxioRank is ever slow or unreachable, your site keeps serving visitors as if the plugin were not there.

What this plugin does not do Honesty helps here, so two things up front. First, this is not a general firewall, malware scanner, or comment spam filter. It does one job well: verifying the identity of automated visitors on the parts of your site that do real work. Second, if you use a caching plugin or your host caches pages (most do), your ordinary public pages are served straight from that cache, before WordPress even wakes up. The plugin never sees those visits, and that is by design. It is not a tool for stopping crawlers from reading your public pages. It protects the parts of your site that accept input and hand out data: logins, searches, form handlers, and app connections. What information is sent to AxioRank? The plugin is a small connector for the AxioRank service, so this deserves a plain answer. For each request the plugin decides to check, it sends AxioRank the basics needed to verify identity: the address that was requested, the request type (such as GET or POST), the visitor's stated user agent, the visitor's IP address, and the technical headers that carry the agent's signature. It never sends cookies, passwords, login credentials, or the contents of forms and posts. Ordinary logged-out page reads by people are not checked at all. Verification is provided by AxioRank. See the terms of service and the privacy policy. Requirements You need an AxioRank account and a site key for your website (it starts with axr_site_). The free plan is enough to get started.

0.2.3

• Rewrote the plugin description, setup guide, and FAQ in plain language, including a new section that spells out exactly what information is and is not sent to AxioRank. No functional changes.
• Fixed an internal version constant that had fallen behind the plugin version (it is used for cache busting of the admin styles and scripts).

0.2.2

• The WordPress.org listing now includes an animated walkthrough screenshot of the setup flow. No functional changes.

0.2.1

• Endpoint scoping now resolves the real admin-ajax, XML-RPC, and login paths from WordPress instead of assuming their default locations, so sites that relocate wp-admin or run WordPress in a subdirectory are matched correctly.

0.2.0

• Renamed to AxioRank Agent Verification.
• New branded admin experience: onboarding stepper, connection status, scope cards, guarded enforce switch, and a local activity panel.

0.1.0

• Initial release: monitor and enforce modes, scope controls, Web Bot Auth verification through AxioRank, fail-open transport.