=== Verified AI Bot Analytics ===
Contributors: lamak25
Tags: ai bots, gptbot, crawler, bot detection, analytics
Requires at least: 6.2
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 0.3.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

See which AI bots really visit your site: GPTBot, ClaudeBot and others checked against official IP ranges, fakes filtered out.

== Description ==

Anyone can put "GPTBot" or "ClaudeBot" in a request. On real servers a large share of "AI bot" traffic is vulnerability scanners in disguise. This plugin checks every AI-bot visit against the IP ranges that OpenAI, Anthropic, Perplexity, Google, Microsoft, Apple, Common Crawl, DuckDuckGo and Mistral publish, and shows you:

* Real vs fake visits per AI bot (GPTBot, OAI-SearchBot, ChatGPT-User, ClaudeBot, Claude-SearchBot, PerplexityBot, Google-Extended, Amazonbot, Meta and more)
* Which pages verified AI crawlers read
* Visitors sent to you by AI assistants (ChatGPT, Perplexity, Claude, Gemini, Copilot…)
* Signed AI agents: verifies Web Bot Auth (IETF draft, HTTP Message Signatures) signatures from agents that sign their requests
* Optional: block fake AI bots (safe — a genuine request from the operator can't fail the IP check)

Crawlers don't run JavaScript, so script-based analytics can't see them. This plugin runs on your server and stores only daily counts in your own database.

= External services =

Nothing is downloaded until you switch it on: after activation, open Tools → AI Bot Analytics, tick "Download the bot list" and save. From then on the plugin downloads:

* Once a day, the bot list (`https://aibots.kaderagha.com/data/v1/ranges.json`): bot names, user-agent patterns and the operators' official IP ranges. No visitor data is sent; it's a plain download. Like every WordPress HTTP request, it reveals your server's IP address and WordPress's standard user-agent (your site address and WordPress version). [Privacy policy](https://aibots.kaderagha.com/privacy), [terms](https://aibots.kaderagha.com/terms).
  The same file also contains Cloudflare's published edge IP ranges, so the real visitor IP can be read safely when your site is behind Cloudflare.

* Key directories of signed AI agents: when a request carries a Web Bot Auth signature, the plugin downloads that agent's public key directory from the HTTPS address the agent names (`https://<agent host>/.well-known/http-message-signatures-directory`) to check the signature. Only that public file is requested; no visitor data is sent (the request shows your server's IP address and WordPress's standard user-agent). Requests to private/internal addresses are refused, results are cached for a day, and at most 20 new agents are looked up per hour.

== Frequently Asked Questions ==

= Does it slow my site down? =
Normal visitors only cost one string check. AI-bot requests add one small database write.

= My bots all show as "can't verify" =
Your site is behind a proxy or CDN that hides the visitor IP. Make sure it forwards the client IP (CF-Connecting-IP or X-Forwarded-For).

= Is Google-Extended a crawler? =
No. Google documents it as a robots.txt token without its own user agent, so requests claiming it are counted as fake.

== Screenshots ==

1. Dashboard: verified vs fake AI-bot visits, per-bot breakdown, pages real AI crawlers read, visitors sent by AI assistants.

== Changelog ==

= 0.3.0 =
* Renamed to Verified AI Bot Analytics.
* Remote downloads (bot list, agent key directories) only after the admin switches them on in Settings.

= 0.2.0 =
* Verify Web Bot Auth signatures (Ed25519) from signed AI agents; new dashboard section.

= 0.1.1 =
* All admin strings translatable.

= 0.1.0 =
* First release.
