AxioRank Agent Verification

A new kind of visitor is showing up on WordPress sites. Alongside people and the familiar search engine crawlers, there are now AI agents: automated tools like ChatGPT and other assistants that use the web on someone’s behalf. They do not just read your public pages. They log in, run searches, submit forms, and talk to the behind-the-scenes connections that power your plugins, themes, and mobile apps.

Here is the problem: WordPress has no built-in way to tell who these automated visitors really are. The traditional method is to look at the “user agent”, the name a visitor gives for itself. That name is easy to fake. Anyone can write a script that claims to be ChatGPT, and anyone can write a bot that claims to be an ordinary Chrome browser.

AxioRank Agent Verification gives you a trustworthy answer. It uses a new open web standard called Web Bot Auth, in which reputable AI companies cryptographically sign the requests their agents make. Think of a signature as a passport rather than a name tag: it can be checked, and it cannot be forged. The plugin checks those signatures through the AxioRank service, so for every automated visit to the sensitive parts of your site you can see whether the visitor is genuine, unknown, or pretending to be something it is not.

How it works, in plain terms

1. You install the plugin and connect it to your AxioRank account with a site key, a long code that identifies your site.
2. The plugin quietly watches the sensitive parts of your site: the login page, search, and the technical doorways that apps and integrations use to talk to WordPress (the REST API, admin-ajax, and XML-RPC).
3. When a request looks automated, because it carries an agent signature or a bot-style user agent, the plugin asks AxioRank one question: who is this, and are they really who they claim to be?
4. In Monitor mode, which is the default, the answer is simply recorded. Nothing is blocked. Your AxioRank dashboard builds up a picture of which AI agents visit your site, what they touch, and which of them are verified, unknown, or impostors.
5. When you have watched for a while and feel confident, you flip one switch to Enforce mode. From then on, agents that fail verification or break your rules receive a standard “access denied” response instead of getting through.

What you get

• A clear picture of the AI agents using your site, based on verifiable identity instead of easily faked names.
• Monitor mode by default: watch first, decide later. Nothing is blocked until you say so.
• Enforce mode when you are ready: verified agents pass, impostors and unwanted agents are turned away.
• A dedicated AxioRank menu in your WordPress admin with four tabs: an Overview, a live Activity log, a Rules manager, and Settings.
• A per-request activity log that shows each automated visit, its verdict, its risk score, the reason it was flagged, and the endpoint it reached, all without leaving WordPress.
• Rules you can set from WordPress: allow, challenge, or block a specific agent, a whole category, a verification status, or a risk threshold. One click on the activity log turns any agent into an allow or block rule.
• Simple scope controls: tick boxes decide which parts of the site are covered, and the recommended set is preselected.
• A branded, customizable page for blocked requests, with your own message.
• A dashboard glance widget, a Site Health check, and WP-CLI commands (wp axiorank status, test, activity, posture) for people who like the command line.
• A safety-first design: if AxioRank is ever slow or unreachable, your site keeps serving visitors as if the plugin were not there.

Manage agents right from WordPress

Version 0.3.0 turns the plugin from a quiet monitor into a control room. The new Activity tab lists the most recent automated visits with the details you need to make a decision: who the agent claims to be, whether that claim checks out, a risk score, the specific signal that raised a flag, and the exact endpoint that was hit. Next to each one, a single click creates an allow or block rule.

The new Rules tab manages the real rules on your AxioRank surface, so you do not need to open the dashboard for everyday decisions. Set the surface to monitor or enforce, then add rules that allow, challenge, or block by agent, by category (such as scrapers or training crawlers), by verification status, or by risk. Rule management uses a site key with the management permission, which the keys AxioRank issues already include.

What this plugin does not do

Honesty helps here, so two things up front.

First, this is not a general firewall, malware scanner, or comment spam filter. It does one job well: verifying the identity of automated visitors on the parts of your site that do real work.

Second, if you use a caching plugin or your host caches pages (most do), your ordinary public pages are served straight from that cache, before WordPress even wakes up. The plugin never sees those visits, and that is by design. It is not a tool for stopping crawlers from reading your public pages. It protects the parts of your site that accept input and hand out data: logins, searches, form handlers, and app connections.

What information is sent to AxioRank?

The plugin is a small connector for the AxioRank service, so this deserves a plain answer.

For each request the plugin decides to check, it sends AxioRank the basics needed to verify identity: the address that was requested, the request type (such as GET or POST), the visitor’s stated user agent, the visitor’s IP address, and the technical headers that carry the agent’s signature.

It never sends cookies, passwords, login credentials, or the contents of forms and posts. Ordinary logged-out page reads by people are not checked at all.

Verification is provided by AxioRank. See the terms of service and the privacy policy.

Requirements

You need an AxioRank account and a site key for your website (it starts with axr_site_). The free plan is enough to get started.