Royal AI Firewall

https://youtu.be/QKktpbTwyLU Royal AI Firewall logs and controls AI bot traffic at the WordPress layer. Every site on the public web is now visited by AI crawlers — GPTBot, ClaudeBot, PerplexityBot, ByteSpider, CCBot, and dozens of others — and most site owners have no way to see what's happening or decide who gets through. This plugin gives you:

• A live dashboard of which AI agents have visited your site in the last 24 hours
• A per-bot dropdown to allow, block, or log-only any of 60+ recognized AI bots
• A master "Block all AI bots" panic button on every dashboard load
• A first-run setup wizard that detects your CDN (Cloudflare, Bunny CDN, Fastly, KeyCDN, Sucuri, StackPath, or Akamai) and, when it finds Cloudflare, tells you exactly which CF settings to dial down so this plugin can take over the AI-bot layer
• Compatibility detection for GuardPress and other popular security plugins
• A bundled bot fingerprint catalog that refreshes on every plugin update, with an optional opt-in to fetch fresher catalogs daily from fingerprints.royalplugins.com (see External Services below)

Free, Self-Hosted, Fully Featured Royal AI Firewall is fully featured in its free, GPL-licensed release. There is no Pro version — every feature ships in the wp.org plugin, and updates go through the standard WordPress plugin updater. Your data stays on your server. The plugin makes no outbound network calls by default. The bundled bot catalog ships with each plugin release and refreshes automatically when you update Royal AI Firewall, so customers who never opt in to live updates still get fresh bot definitions on every plugin update. If you want even fresher catalogs between releases, an optional toggle in Settings (and on the final wizard step) opts in to one HTTP GET per day to fingerprints.royalplugins.com. The plugin never sends your site's traffic, customer data, IP addresses, or credentials to any third party regardless of toggle state. AI Bots Recognized (68 as of v1.0.2) The bundled catalog covers the major AI bot families. Each entry includes the bot's owner, intended purpose, default policy, and the blocking consequences (for example, "blocking GPTBot may remove your site from ChatGPT search results"). Training crawlers: GPTBot, ClaudeBot, anthropic-ai, Bytespider, TikTokSpider, FacebookBot, Meta-ExternalAgent, GoogleOther, GoogleOther-AI, Google-Extended, Google-CloudVertexBot, MistralBot, KimiBot, cohere-ai, cohere-training-data-crawler, ai2bot, ai2bot-dolma, Amazonbot, PetalBot Retrieval bots (on-demand): ChatGPT-User, OAI-AdsBot, ClaudeBot-User, Claude-Web, claude-code, Perplexity-User, Kimi-User, YandexAdditionalBot, Meta-ExternalFetcher, facebookexternalhit, APIs-Google AI search engines: OAI-SearchBot, PerplexityBot, Claude-SearchBot, Kimi-SearchBot, MistralAI-Index, YandexAdditional, meta-webindexer, Applebot-Extended, MicrosoftCopilotBot, DuckAssistBot, YouBot, PhindBot, iAsk, Komo, Liner, Brave Leo, Andi Search engines (always-allow guarded): Googlebot, Googlebot-Image, Googlebot-Video, Googlebot-News, Bingbot, BingPreview, Applebot, DuckDuckBot Other search engines: Baiduspider Agent browsers (newer category): OperatorAgent, ChatGPT-Atlas, Claude-Computer-Use Dataset scrapers: CCBot (Common Crawl), Diffbot, ImagesiftBot, Omgilibot, Timpibot Other Google crawlers: Storebot-Google, Mediapartners-Google, AdsBot-Google, adidxbot The Dashboard Open the AI Firewall menu in your WordPress admin to see:

• A hero metric — total AI bot hits in the last 24 hours and the number of distinct bots involved
• A per-bot list with hit count, bandwidth used, and a one-click policy dropdown for each row
• An MCP / Abilities API activity widget when an MCP server plugin (Royal MCP or any plugin implementing the WordPress Abilities API) is detected on your site
• A Cloudflare visibility status card with an honest estimate of how many AI bots may have been filtered by Cloudflare at the edge before reaching WordPress
• Click any bot row to expand a drill-down view: top URLs the bot hit, recent activity, and what blocking the bot would cost you

Per-Bot Policy Controls Each recognized bot row has a dropdown with four options:

• Use default policy — falls back to your global mode (Log only, Block training, or Block all)
• Always allow — bot is allowed regardless of default mode
• Log only — bot is allowed and recorded; never blocked
• Block — bot receives a 403 response immediately, before WordPress runs any heavy work

Major search engines (Googlebot, Bingbot, Applebot, DuckDuckBot) are protected from accidental blocking. The per-bot dropdown is disabled for these bots, and the API rejects block requests for them unless you explicitly enable the "Search engine override" toggle in Settings — with a clear warning that blocking Googlebot removes your site from Google Search. Cloudflare Compatibility If your site is behind Cloudflare, the setup wizard's Cloudflare screen tells you exactly which CF settings to turn off so this plugin can take over the AI-bot layer:

• AI Audit → set to "Allow"
• AI Labyrinth → OFF
• Custom WAF rules blocking AI bots → DELETE (the per-bot controls in this plugin replace them)
• Security Level → Medium or Low

And which CF settings to leave on (they don't conflict):

• DDoS protection
• Managed WAF rules
• SSL/TLS
• Bot Fight Mode (basic tier)
• Browser Integrity Check
• Caching

The dashboard also detects Cloudflare on every admin page load (looking for cf-ray, cf-connecting-ip, or CDN-Loop: cloudflare headers) and shows a status card with the detection state. A persistent 24-hour state ensures the UI stays stable even when an occasional admin request doesn't pass through CF. Other CDN Compatibility The setup wizard also recognizes 6 additional CDNs by their vendor-forwarded request headers: Bunny CDN, Fastly, KeyCDN, Sucuri, StackPath, and Akamai. Detection is header-sniff only — no outbound HTTP, no DNS lookups. When any of these are detected, the wizard shows a compatibility note rather than a network-specific dial-down (Cloudflare remains the only CDN with a full walkthrough because its AI controls are the most common source of operator confusion). Royal AI Firewall sees AI bot traffic that reaches WordPress regardless of which CDN sits in front — if you have edge-side AI-bot rules configured on your CDN, consult its documentation, as the two layers can coexist. Other Security Plugin Compatibility The plugin auto-detects these plugins when they're active and shows compatibility notes on the dashboard and Settings page:

• Edge-firewall security plugins — their firewalls run before WordPress loads. AI bots they block at their layer won't appear in this plugin's dashboard, but the two layers don't conflict.
• WordPress-layer security plugins — coexist cleanly at the WordPress layer.
• GuardPress (Royal Plugins) — first-party Royal Plugins integration.
• Royal MCP (Royal Plugins) — when Royal MCP is detected, MCP tool invocations from connected AI agents appear in the MCP Activity widget on the dashboard.

WordPress Abilities API & MCP Server Integration This plugin listens for the WordPress Abilities API hooks wp_before_execute_ability and wp_after_execute_ability (WP 6.9+) and logs every ability invocation regardless of which MCP server triggers it. If you have any MCP server plugin installed and an AI agent calls an ability, you'll see it in the MCP Activity widget on the dashboard. If Royal MCP 1.4.33 or later is installed, an additional first-party bridge captures every MCP tool call from that server with full tool name and result status. Search Engine Guard Major search engines are protected from accidental blocking by default. The dashboard dropdown is disabled for Googlebot, Bingbot, Applebot, and DuckDuckBot. The REST API endpoints reject block attempts on these bots with a 409 Conflict response unless the customer has explicitly enabled the "Search engine override" toggle in Settings. The override toggle includes a clear warning that blocking Googlebot removes the site from Google Search. Telemetry and Data Anonymous usage data is OFF by default. The plugin makes no outbound HTTP call for telemetry unless you explicitly opt in — via the setup wizard's final step or the "Anonymous usage data" toggle in Settings. If you opt in, once per week the plugin POSTs a small JSON payload to telemetry.royalplugins.com. The payload contains:

• Plugin version
• WordPress version
• PHP version
• An opaque one-way hash of your site URL — used only to count unique installs. The URL itself cannot be recovered from the hash (SHA-256 with a per-install random salt that never leaves your site).
• Whether you have completed the setup wizard
• How many per-bot policy overrides you have configured
• A bucketed range for AI bot hits in the last 24 hours (e.g. "11–50")

The following are NEVER sent, regardless of toggle state:

• Your site URL or domain (only its salted hash)
• Customer email addresses
• Invocation log contents
• Specific IP addresses
• Specific bot identities
• User-Agent strings of visitors

Data retention: raw payloads are retained for 90 days. Aggregated statistics are retained indefinitely. Per-site fingerprints are purged after 12 months of no reports. You can revoke consent at any time in Settings — the plugin unschedules the weekly cron immediately. The other outbound HTTP call the plugin can make (also opt-in) is a single daily GET request to fingerprints.royalplugins.com for a fresher bot catalog when you enable "Keep catalog updated between releases." That request body is empty and includes only the plugin version in the User-Agent header. See the "External Services" section below. Log retention defaults to 7 days. The retention window is filterable via raif_log_retention_days for developers who need a different value. How Activation Works On activation the plugin:

• Creates three custom database tables: raif_invocation_log, raif_daily_rollup, raif_bot_policy
• Seeds safe default options (Log only mode; telemetry off; uninstall data-delete off; live catalog updates off)
• Schedules two WP-Cron events (hourly rollup, daily log prune) — both run entirely inside your WordPress install with no network calls
• Loads the bundled bot fingerprint catalog from the plugin zip
• Redirects the activating admin to the 4-step setup wizard
• The wizard is skippable from any step

No outbound HTTP calls are made until the customer explicitly opts in to live catalog updates on the wizard's final screen or via Settings → Bot fingerprint database. The plugin is fully functional without ever making a network call — the bundled catalog refreshes from the plugin zip on every plugin update. On deactivation the plugin unschedules all WP-Cron events. Data is preserved by default so a re-activation continues where you left off. To remove all data on uninstall, check the "Delete all logs, tables, and options when the plugin is uninstalled" toggle in Settings → Data before deactivating.

1. In your WordPress dashboard, go to Plugins → Add New and search for Royal AI Firewall.
2. Click Install Now, then Activate.
3. The 4-step setup wizard runs automatically on first activation. Walk through it to detect Cloudflare and pick a default policy. The wizard is skippable.
4. Open AI Firewall in the admin menu to see the dashboard.
5. Wait 2–6 hours for the first AI bot hits to appear, or run a manual test with curl:

curl -A "GPTBot/1.2" https://your-site.com/

1.0.5

• Feature: Bot Access page shows verified Googlebot, Bingbot, Applebot, and DuckDuckBot hits against a rolling 30-day baseline and alerts if verified hits collapse.
• Feature: Reverse-DNS bot verification distinguishes real search-engine bots from spoofed User-Agents on every log row.
• Feature: Dual-request active probe fires every 12 hours to catch upstream WAF or CDN rules that block bots before rankings drop.
• Feature: Royal Tools submenu lists free companion plugins with one-click install links.
• Enhancement: Custom top header bar on every Royal AI Firewall admin page with View Docs and Support buttons.
• Enhancement: Lightweight admin footer showing family links and current plugin version.
• Enhancement: Dashboard now records real response body size in bytes for every AI bot hit.
• Fix: Dashboard stat cards no longer render doubled percent signs.

1.0.4

• Feature: Setup wizard now detects Bunny CDN, Fastly, KeyCDN, Sucuri, StackPath, and Akamai in addition to Cloudflare.
• Feature: Dashboard hero now shows total hits, blocked, allowed, and distinct bots side by side instead of a single hits number.
• Enhancement: Wizard step 3 rewritten to name whichever CDN is detected in front of your site.
• Enhancement: Cloudflare-detected callout on the dashboard now sits above the stat row for clearer visual precedence.
• Enhancement: Redundant Settings button removed from the dashboard toolbar.
• Enhancement: Admin footer on plugin pages now credits Royal Plugins.
• Enhancement: Plugin listing banner refreshed with evergreen copy.

1.0.3

• Feature: Bot policy import/export as JSON from a new Backup and portability section on the Settings page.
• Feature: Anonymous usage data toggle (opt-in, off by default) with full disclosure and privacy-policy integration.
• Enhancement: Setup wizard compatibility catalog expanded to 23 recognized plugins.
• Enhancement: Setup Wizard entry removed from the sidebar submenu (re-run it from Settings).

1.0.2

• Enhancement: Bot fingerprint catalog refreshed to 68 recognized bots.
• Enhancement: Setup wizard reads the catalog size dynamically instead of hardcoding a count.
• Enhancement: User-Agent example in readme and support docs is now version-agnostic.
• Fix: Anthropic legacy user agents softened to log-only to match vendor guidance.
• Fix: Mistral entry now points at the vendor's canonical robots documentation.

1.0.1

• Enhancement: Setup wizard compatibility step now recognizes 19 popular security and caching plugins.
• Enhancement: Compatibility step renders only plugins detected as active on your site.
• Enhancement: Persistent note invites suggestions when a customer's active plugin is not yet recognized.

1.0.0

• Initial release.