ShopBouncer
| 开发者 | karan08 |
|---|---|
| 更新时间 | 2026年9月30日 22:18 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 7.1 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
- Which AI agents visit, split into agents shopping for a person and crawlers that index or train.
- Verified or not, and by whom. Agents that sign their requests with Web Bot Auth (RFC 9421 HTTP Message Signatures), such as ChatGPT's agent and Google's agent, are checked cryptographically against their operator's published keys, and the dashboard names the operator that signed.
- Impostors spotted. OpenAI, Anthropic and Perplexity publish the IP ranges their agents use. A visitor calling itself ChatGPT, Claude or Perplexity from outside those ranges is flagged as an impostor; one from inside them is marked verified by IP. Agents whose operator publishes neither keys nor ranges are marked "unverified (name only)".
- Sales sent by AI assistants. How much shoppers who clicked through from ChatGPT, Perplexity, Gemini, Claude, Copilot and other assistants spent, read from WooCommerce's own Order Attribution. ShopBouncer adds no tracking of its own.
- Where they go: product pages, cart, checkout, customer accounts, APIs.
- Orders placed by AI agents and the revenue they bring, with the agent's identity check and signature headers saved on each order as evidence, shown in an "AI agent evidence" box on the order screen.
- Alerts when impostors visit and when unverified agents reach your checkout.
- A setup check that proves everything works on your own server: the official IP lists download, a real and a fake "ChatGPT" visit get the right verdicts, and your proxy settings are right.
- An optional weekly AI Shopper Report by email, sent by your own site.
- No IP addresses or visitor identifiers are stored. An agent's IP is compared with its operator's published ranges in memory; only the outcome is kept.
- Human visitors are never recorded.
- Visit history is deleted automatically after 90 days (configurable).
- No data is sent to ShopBouncer. See "External services" below.
- The weekly report (off until you enter an address) is sent by your own site with WordPress's mail function.
安装:
- Install and activate the plugin.
- Open WooCommerce → AI Shoppers (or Tools → AI Shoppers without WooCommerce).
- Visits appear as soon as an AI agent loads a page.
屏幕截图:
常见问题:
Does it block anything?
No. This plugin only observes and reports. It never changes what visitors or agents see.
How do you know an agent is really ChatGPT?
An agent is verified in one of two ways. If it signs its request with Web Bot Auth, the signature is checked against the public keys its operator publishes; ShopBouncer only uses the key directories of operators that document them (OpenAI for ChatGPT's agent, Google for Google-Agent), and the dashboard names the operator that signed. If it doesn't sign, its IP address is checked against the ranges its operator publishes: inside means verified by IP, outside means impostor. A user-agent string with nothing to check it against is recorded as "unverified (name only)", because anyone can send it.
My site is behind Cloudflare or another proxy. Does the IP check still work?
Yes, once you tell ShopBouncer where the visitor's IP arrives: open the AI Shoppers page and set "Visitor IP comes from" to Cloudflare, X-Forwarded-For or X-Real-IP. The page warns you when it detects a proxy header. Until then, requests from private addresses are left unchecked rather than flagged.
Where does the "sales sent by AI assistants" figure come from?
From WooCommerce's built-in Order Attribution (WooCommerce 8.5 and later), which already records where each order came from. ShopBouncer counts the paid orders whose source is an AI assistant's website, such as chatgpt.com or perplexity.ai. If Order Attribution is switched off, the dashboard tells you where to turn it on.
Does it slow my store down?
No measurable impact for human visitors. Agent visits are recorded after the response is finished.
What happens when I uninstall?
The visit table and settings are deleted. Evidence saved on agent orders stays on those orders, because it is part of the order record.
更新日志:
- New: sales sent by AI assistants (ChatGPT, Perplexity, Gemini, Claude, Copilot and more), from WooCommerce Order Attribution.
- New: redesigned dashboard: a one-line summary, a real-vs-fake bar for every agent, and daily visits split by verdict.
- New: setup check that tests impostor detection live on your server.
- New: optional weekly AI Shopper Report email.
- Improved: IP lists are accepted only when complete, so a partly downloaded list can never create false impostors.
- Improved: signatures are checked only against documented key directories (OpenAI for ChatGPT's agent, Google for Google-Agent). Keys are matched by thumbprint or key id, and expired keys are ignored.
- Improved: all request data is sanitized with WordPress functions and then validated.
- First public release: AI Shoppers dashboard, Web Bot Auth signature verification, impostor detection against operators' published IP ranges, agent order tagging with an evidence box on each agent order.