LLMAffiliate AI Traffic Monetizer

LLMAffiliate AI Traffic Monetizer is a WordPress plugin that detects Large Language Model (LLM) traffic and dynamically serves enhanced content while ensuring compliance with search engine parity requirements. It mirrors the behavior of an interception layer (e.g., Cloudflare Worker) directly inside WordPress, enabling controlled content delivery for AI crawlers and agents. CORE FEATURES

• Detects major LLM user agents including ChatGPT, Claude, Gemini, Copilot, Perplexity, Pi, LLaMA, Grok, Cohere, Mistral, Anthropic, and OpenAI.
• Ensures Googlebot and search engine crawlers always receive original content (configurable parity enforcement).
• Serves enhanced HTML responses via a remote content service.
• Automatically falls back to native WordPress rendering if the external service fails.
• Adds cache-control and interceptor diagnostic headers.

HOW IT WORKS The plugin intercepts incoming HTTP requests and:

1. Identifies whether the request originates from an LLM or standard browser.
2. If LLM traffic is detected:
3. Fetches enhanced content from a configured external service.
4. Applies headers and response transformations.
5. If the service fails:
6. Falls back to WordPress rendering safely.
7. Ensures search engines always receive unmodified content.

USE CASES

• AI traffic handling and request analysis
• Controlled content delivery for LLM vs. human visitors
• Response parity handling (search engines receive origin content)
• Experimentation with LLM-specific rendering in compliant deployments

OPERATIONAL LOGGING & PRIVACY By default, the plugin may store operational logs to support debugging, security analysis, and request classification for its own LLM-detection logic. These may include:

• IP address
• User agent
• Requested URL
• Referer
• Selected HTTP headers
• Detection and decision metadata
• Request decision logs Data is stored within your WordPress database and is never transmitted off your site. Retain it in accordance with your privacy policy and applicable regulations.

AI TERMS PAGE The plugin can serve a public /ai-terms page (or equivalent) that displays your site's AI usage and content terms. It functions as a site-published policy page that visitors—including AI systems and human readers—can view. Site owners are responsible for the contents and legal suitability of the terms. The plugin includes a default template; you may customize it to match your needs. GOOGLE SEARCH CONSOLE AND BING WEBMASTER TOOLS (OPTIONAL) The LLMAffiliate service can provide a Google Search Console token and a Bing Webmaster Tools token on llmaffiliate.com for connected sites (see your dashboard or integration docs). If you choose to use them, open Settings → LLMAffiliate AI Traffic in WordPress and paste each token into its matching field, then save:

• Google Search Console verification token → outputs <meta name="google-site-verification" content="…">
• Bing Webmaster Tools verification token → outputs <meta name="msvalidate.01" content="…">

Paste only the token value (the content part), not the whole meta tag, and do not swap the two tokens. Each token is stored only in your site's database and its tag is printed on your public frontend. You can clear either field at any time to remove its tag. Why this helps: With your consent, LLMAffiliate can verify the site in Search Console and Bing Webmaster Tools tied to those tokens, which helps the service monitor indexing coverage and page performance for your integration and support you more effectively. This is fully optional; if you leave the field empty, nothing is added to your HTML. No extra HTTP request is made to Google or Bing from the plugin for this feature—the meta tags are for their crawlers when they visit your site.

Automatic installation

1. Go to Plugins → Add New in your WordPress dashboard.
2. Search for LLMAffiliate AI Traffic Monetizer.
3. Click Install Now and then Activate.
4. Go to Settings → LLMAffiliate AI Traffic, generate a token, and complete onboarding/integration on LLM Affiliate.
5. Optionally paste the Google and Bing verification tokens (from LLMAffiliate or your own Google Search Console / Bing Webmaster Tools) into their matching fields at the top of that settings screen.

Manual installation

1. Upload the plugin to /wp-content/plugins/ using the folder name llmaffiliate-ai-traffic-monetizer (this must match the Text Domain header so automated checks and translations stay aligned).
2. Activate the plugin via the WordPress Plugins screen.
3. Go to Settings → LLMAffiliate AI Traffic.
4. Generate a token (click Generate Token) and complete onboarding/integration on LLM Affiliate.
5. Optionally paste the Google and Bing verification tokens in the plugin settings if you use LLMAffiliate’s optional verification flow (see readme).

1.0.13

• Settings: added an optional Bing Webmaster Tools verification token field next to the Google Search Console one. It outputs <meta name="msvalidate.01"> on the public site only when a token is saved; clear the field to remove it.
• Settings: shorter verification text that says which token goes in which field. Each field has its own Save and Clear buttons.
• Settings: removed the Advanced Detection Settings screen (detection threshold, request decision logs) from the admin UI; it is an internal diagnostics tool, not a site-owner setting.
• External services: the Enhanced Content Render, User sitemaps, llms.txt, and llms-full.txt requests now authenticate with the site's own per-site token (the same one sent to onboarding) via an Authorization: Bearer header, since the API now requires it. No new credential is introduced; sites without a generated token are unaffected.
• Readme: Google and Bing verification documented in the description, installation steps and FAQ.

1.0.11

• Request classification now matches the Cloudflare Worker: search indexers and OAI-AdsBot receive origin content; Gemini/Google AI fetchers, explicit LLM user-agents, AI-assistant referers, markdown Accept, and the anonymous DeepSeek fingerprint receive enhanced content.
• Generic datacenter/IP scoring no longer forces enhanced content. Unknown cloud traffic and ordinary browsers receive origin.
• Detection threshold is saved and applied on each request; page-like requests at or above the threshold now receive enhanced content.
• Anonymous DeepSeek detection works without Cloudflare Worker ASN/TLS metadata. Gemini GoogleAgent-URLContext is treated as an LLM fetcher.
• Sitemap generation skips /buy/ URLs. robots.txt includes Google-InspectionTool and no longer adds an llms.txt comment.
• Removed leftover /buy/{asin} plugin redirects. Affiliate URLs now live in enhanced content; the plugin no longer intercepts buy paths or counts clicks.
• Settings: Advanced Detection Settings now shows request decision logs only; suspicious-event logging and its admin table were removed.
• Compatibility: tested with WordPress 7.1.
• Assets: admin page CSS and JavaScript moved out of inline output into assets/admin.css and assets/admin.js, registered and enqueued through the WordPress asset API.
• Internationalization: admin screen labels and AJAX response messages are now translatable, with JavaScript strings passed through wp_localize_script().
• Hardening: ABSPATH guards added to every PHP file; $_POST values are run through wp_unslash() before sanitizing.
• Housekeeping: removed dead code and the unused client-side human-token script; consolidated duplicated client-IP, current-URL, request-path, and llms document helpers.

1.0.10

• Same-domain buy links: /buy/{asin} requests are handled on init (like /llms.txt and the plugin sitemap) and resolve to the merchant URL via the LLMAffiliate buy-redirect API, with a 307 fallback to amazon.com/dp/{asin} when the API is unavailable. Buy paths bypass LLM interception.

1.0.9

• LLM crawlability: expanded robots.txt crawler list from 14 to 28 user-agents (added Bingbot, Applebot, Meta-ExternalAgent, Amazonbot, cohere-ai, Bytespider, CCBot, DuckDuckBot, YandexBot, and others). Added llms.txt reference comment.
• Smart sitemap: /sitemap.xml now uses products_count and total_traffic from the API to compute per-URL <priority> (0.5–1.0) and <changefreq> (daily/weekly/monthly) instead of static values.
• New /llms.txt endpoint: serves a structured Markdown site overview (auto-generated description, product categories, brands, price ranges, enhanced page listings) via the LLMAffiliate API.
• New /llms-full.txt endpoint: serves a detailed full product catalog in Markdown with complete product specs, prices, and buy links inline.
• Both new endpoints fall back gracefully when the API is unreachable.

1.0.8

• Fix /sitemap.xml and robots.txt: read site_url from the public user-sitemaps API response (replacing the old sitemap_url field) so submitted integration URLs appear in the plugin sitemap and monetized paths are listed correctly in robots.txt.

1.0.7

• Settings: prominent optional field to save Google Search Console HTML-tag content (LLMAffiliate-issued token from llmaffiliate.com), stored in llmafftm_gsc_verification_token, with Save / Clear and AJAX handler llmafftm_save_gsc_verification.
• Readme: optional Search Console verification section, FAQ, and installation steps; Tested up to header updated.
• Sitemap and robots.txt integration with public/user-sitemaps API (documented under External services).

1.0.0

• Initial release.

1.0.1

• Prefixed plugin identifiers (options, hooks, scripts, classes) with llmafftm_ / LLMAFFTM_. Legacy llm_interceptor_* options are migrated on upgrade. Response headers use X-LLMAFFTM-*.

1.0.2

• readme: point legal/privacy reference to the public https://llmaffiliate.com/ URL (verified).
• Removed heredoc templates; AI Terms HTML and admin inline JS use output buffering so variables are escaped in normal PHP flow. JSON-LD built with wp_json_encode().

1.0.3

• Text domain and settings screen slug aligned with the plugin repository slug: llmaffiliate-ai-traffic-monetizer.

1.0.4

• AI Terms page stylesheet now uses the proper WordPress asset API (wp_register_style() + wp_enqueue_style() + wp_print_styles()) instead of a direct <link rel="stylesheet"> tag, per the WordPress Plugin Review Team's guidance on correctly enqueuing CSS and JavaScript.

1.0.5

• Added a dedicated == External services == section to the readme that fully discloses the LLM Affiliate cloud service (onboarding and enhanced-content render endpoints), the data transmitted, the conditions under which each request is made, and links to the service's Terms of Service and Privacy Policy — per the WordPress Plugin Review Team's third-party-service disclosure requirement.
• Output escaping: every echoed variable in the plugin now flows through an appropriate WordPress escaping function. Proxied HTML documents (the enhanced-content response and the standalone /ai-terms page) are passed through wp_kses() with a full-document allow-list, which is exposed via the new filter llmafftm_allowed_full_html so the list can be extended without modifying plugin files. The JSON-LD structured-data block uses wp_json_encode() inline with the JSON_HEX_TAG|JSON_HEX_AMP|JSON_HEX_APOS|JSON_HEX_QUOT flags so it is safe to inline inside a <script type="application/ld+json"> tag.
• Replaced remaining raw json_encode() calls with wp_json_encode() (onboarding POST body and suspicious-event debug log) per the WordPress Coding Standards preference for the WP-safe JSON encoder.
• Replaced urlencode() in the enhanced-content URL builder with rawurlencode() so query-string values are encoded per RFC 3986, as recommended by the WordPress Plugin Review Team and WordPress.PHP.DiscouragedPHPFunctions.urlencode_urlencode.
• Verified publicly reachable Terms of Service (https://llmaffiliate.com/terms) and Privacy Policy (https://llmaffiliate.com/privacy) URLs referenced from the == External services == section of this readme.

1.0.6

• Readme: document the public/user-sitemaps external API used when serving the plugin sitemap URL.
• Policy / privacy: remove hardcoded default Google Search Console verification token; verification is opt-in only via the llmafftm_google_site_verification filter.
• Sitemap XML: late esc_url() on <loc> output for WordPress EscapeOutput compliance.