Verify AI Agents & Block Fake AI Bots | AxioRank

Verify that ChatGPT, Claude, Perplexity, and other AI agents are genuine before serving premium content or executing AI actions. AxioRank checks each automated visitor's cryptographic signature, so you know whether an AI agent is the real thing or a fake AI bot wearing its name. A new kind of visitor is showing up on WordPress sites. Alongside people and the familiar search engine crawlers, there are now AI agents and bots like GPTBot, ClaudeBot, and PerplexityBot: automated tools that use the web on someone's behalf. They do not just read your public pages. They log in, run searches, submit forms, and talk to the behind-the-scenes connections that power your plugins, themes, and mobile apps. Some are genuine. Some are scrapers. And some are impostors: a script that simply typed "GPTBot" into a user agent header, because anyone can. Here is the problem: WordPress has no built-in way to tell who these automated visitors really are. The traditional method is to look at the "user agent", the name a visitor gives for itself. That name is easy to fake. Anyone can write a script that claims to be ChatGPT, and anyone can write a bot that claims to be an ordinary Chrome browser. AxioRank gives you a trustworthy answer. It uses a new open web standard called Web Bot Auth, in which reputable AI companies cryptographically sign the requests their agents make. Think of a signature as a passport rather than a name tag: it can be checked, and it cannot be forged. The plugin checks those signatures through the AxioRank service, so for every automated visit to the working parts of your site you can see whether the visitor is genuine, unknown, or pretending to be something it is not, and block the fakes. Block fake AI bots and scrapers Fake AI crawlers and scrapers are checked too. When a bot-like request reaches WordPress on a cache miss, AxioRank matches it against the known-agent directory (GPTBot, ClaudeBot, PerplexityBot, and more) and verifies its signature, and in Enforce mode a spoofed or unwanted agent gets a clean access-denied response instead of getting through. One honest note: pages served straight from a full-page cache or a CDN never reach WordPress, so the plugin cannot see those. To challenge crawlers on fully cached pages, verify at the edge, in front of the cache. Everything that reaches PHP, your dynamic pages, login, search, forms, and REST API, is covered. Running a store? Stop AI agent checkout fraud If you sell with WooCommerce, AI shopping agents are already adding to cart and checking out. Pair this plugin with the companion AxioRank for WooCommerce extension to verify AI agents at add to cart and checkout, block unverified agents before an order is created (the moment card testing and account takeover happen), and see at a glance which orders came from a verified agent, an unverified one, or an impostor. How it works, in plain terms

1. You install the plugin and connect it to your AxioRank account with a site key, a long code that identifies your site.
2. The plugin quietly watches the sensitive parts of your site: the login page, search, and the technical doorways that apps and integrations use to talk to WordPress (the REST API, admin-ajax, and XML-RPC).
3. When a request looks automated, because it carries an agent signature or a bot-style user agent, the plugin asks AxioRank one question: who is this, and are they really who they claim to be?
4. In Monitor mode, which is the default, the answer is simply recorded. Nothing is blocked. Your AxioRank dashboard builds up a picture of which AI agents visit your site, what they touch, and which of them are verified, unknown, or impostors.
5. When you have watched for a while and feel confident, you flip one switch to Enforce mode. From then on, agents that fail verification or break your rules receive a standard "access denied" response instead of getting through.

What you get

• A clear picture of the AI agents using your site, based on verifiable identity instead of easily faked names.
• Monitor mode by default: watch first, decide later. Nothing is blocked until you say so.
• Enforce mode when you are ready: verified agents pass, impostors and unwanted agents are turned away.
• A dedicated AxioRank menu in your WordPress admin with four tabs: an Overview, a live Activity log, a Rules manager, and Settings.
• A per-request activity log that shows each automated visit, its verdict, its risk score, the reason it was flagged, and the endpoint it reached, all without leaving WordPress.
• Rules you can set from WordPress: allow, challenge, or block a specific agent, a whole category, a verification status, or a risk threshold. One click on the activity log turns any agent into an allow or block rule.
• Simple scope controls: tick boxes decide which parts of the site are covered, and the recommended set is preselected.
• A branded, customizable page for blocked requests, with your own message.
• A dashboard glance widget, a Site Health check, and WP-CLI commands (wp axiorank status, test, activity, posture) for people who like the command line.
• A safety-first design: if AxioRank is ever slow or unreachable, your site keeps serving visitors as if the plugin were not there.

Manage agents right from WordPress Version 0.3.0 turns the plugin from a quiet monitor into a control room. The new Activity tab lists the most recent automated visits with the details you need to make a decision: who the agent claims to be, whether that claim checks out, a risk score, the specific signal that raised a flag, and the exact endpoint that was hit. Next to each one, a single click creates an allow or block rule. The new Rules tab manages the real rules on your AxioRank surface, so you do not need to open the dashboard for everyday decisions. Set the surface to monitor or enforce, then add rules that allow, challenge, or block by agent, by category (such as scrapers or training crawlers), by verification status, or by risk. Rule management uses a site key with the management permission, which the keys AxioRank issues already include. What this plugin does not do Honesty helps here, so two things up front. First, this is not a general firewall, malware scanner, or comment spam filter. It does one job well: verifying the identity of automated visitors on the parts of your site that do real work. Second, pages served straight from a full-page cache or a CDN never reach WordPress, so the plugin cannot see or block those. It stops fake AI bots and scrapers that reach the origin: a cache miss, your dynamic pages, login, search, form handlers, and app connections, which is where logins, form submissions, and data access actually happen. To police crawlers on fully cached pages too, verify at the edge, in front of the cache. What information is sent to AxioRank? The plugin is a small connector for the AxioRank service, so this deserves a plain answer. For each request the plugin decides to check, it sends AxioRank the basics needed to verify identity: the address that was requested, the request type (such as GET or POST), the visitor's stated user agent, the visitor's IP address, and the technical headers that carry the agent's signature. It never sends cookies, passwords, login credentials, or the contents of forms and posts. Ordinary logged-out page reads by people are not checked at all. Verification is provided by AxioRank. See the terms of service and the privacy policy. Requirements You need an AxioRank account and a site key for your website (it starts with axr_site_). The free plan is enough to get started.

0.4.0

• Repositioned the listing around the outcome: verify that AI agents like ChatGPT, Claude, and Perplexity are genuine, and block fake AI bots. No change to how verification works.
• Documented that the plugin also blocks bot-like AI crawlers and scrapers that reach WordPress on a cache miss, and clarified that fully cached or CDN pages need edge verification.
• Added guidance for WooCommerce stores: pair with AxioRank for WooCommerce to verify AI agents at checkout and stop unverified agents before an order is created.

0.3.0

• New AxioRank admin menu with four tabs: Overview, Activity, Rules, and Settings, in place of the single settings page.
• New Activity log: a per-request view of recent automated visits with verdict, risk score, verification method, the flagged signal, the endpoint reached, and a copyable request reference.
• New Rules manager: set the surface posture and add allow, challenge, or block rules by agent, category, verification status, or risk score, directly from WordPress through the AxioRank surface API. One-click allow or block from the Activity log.
• New branded block page for turned-away requests, with an optional custom message you can set in Settings. Blocked responses now honor the server's challenge status.
• New dashboard glance widget, a Site Health check, and WP-CLI commands (wp axiorank status, test, activity, posture).
• Old bookmarks to the previous settings page redirect to the new Settings tab.

0.2.3

• Rewrote the plugin description, setup guide, and FAQ in plain language, including a new section that spells out exactly what information is and is not sent to AxioRank. No functional changes.
• Fixed an internal version constant that had fallen behind the plugin version (it is used for cache busting of the admin styles and scripts).

0.2.2

• The WordPress.org listing now includes an animated walkthrough screenshot of the setup flow. No functional changes.

0.2.1

• Endpoint scoping now resolves the real admin-ajax, XML-RPC, and login paths from WordPress instead of assuming their default locations, so sites that relocate wp-admin or run WordPress in a subdirectory are matched correctly.

0.2.0

• Renamed to AxioRank Agent Verification.
• New branded admin experience: onboarding stepper, connection status, scope cards, guarded enforce switch, and a local activity panel.

0.1.0

• Initial release: monitor and enforce modes, scope controls, Web Bot Auth verification through AxioRank, fail-open transport.