About this plugin
ChatGPT, Claude, Perplexity and Meta AI now browse stores and place orders for real customers. Google Analytics can’t show you most of that traffic, and anything can call itself “ChatGPT”.
ShopBouncer adds an AI Shoppers dashboard to WooCommerce (or to Tools on any WordPress site):
- Which AI agents visit, split into agents shopping for a person and crawlers that index or train.
- Verified or not, and by whom. Agents that sign their requests with Web Bot Auth (RFC 9421 HTTP Message Signatures), such as ChatGPT’s agent and Google’s agent, are checked cryptographically against their operator’s published keys, and the dashboard names the operator that signed.
- Impostors spotted. OpenAI, Anthropic and Perplexity publish the IP ranges their agents use. A visitor calling itself ChatGPT, Claude or Perplexity from outside those ranges is flagged as an impostor; one from inside them is marked verified by IP. Agents whose operator publishes neither keys nor ranges are marked “unverified (name only)”.
- Sales sent by AI assistants. How much shoppers who clicked through from ChatGPT, Perplexity, Gemini, Claude, Copilot and other assistants spent, read from WooCommerce’s own Order Attribution. ShopBouncer adds no tracking of its own.
- Where they go: product pages, cart, checkout, customer accounts, APIs.
- Orders placed by AI agents and the revenue they bring, with the agent’s identity check and signature headers saved on each order as evidence, shown in an “AI agent evidence” box on the order screen.
- Alerts when impostors visit and when unverified agents reach your checkout.
- A setup check that proves everything works on your own server: the official IP lists download, a real and a fake “ChatGPT” visit get the right verdicts, and your proxy settings are right.
- An optional weekly AI Shopper Report by email, sent by your own site.
Privacy by design
- No IP addresses or visitor identifiers are stored. An agent’s IP is compared with its operator’s published ranges in memory; only the outcome is kept.
- Human visitors are never recorded.
- Visit history is deleted automatically after 90 days (configurable).
- No data is sent to ShopBouncer. See “External services” below.
- The weekly report (off until you enter an address) is sent by your own site with WordPress’s mail function.
Built to stay out of the way
Human requests cost one string check. Agent visits are written after the page has been sent. The plugin is compatible with WooCommerce High-Performance Order Storage and the Cart and Checkout blocks.
External services
ShopBouncer connects to the services below, and only to them. None of these requests contains any data about your store’s visitors, customers or orders. com)”.
Everything downloaded is public data, cached on your site, and used only to check whether a visiting AI agent is who it claims to be.
OpenAI
What: the IP address lists OpenAI publishes for its agents (ChatGPT-User, OAI-SearchBot, GPTBot), and the public signing keys of ChatGPT’s agent.
Why: to check whether a visitor calling itself ChatGPT really came from OpenAI.
com and the cached keys are more than an hour old.
com/policies/row-terms-of-use/
com/policies/row-privacy-policy/
Anthropic (claude.com)
What: the IP address list Anthropic publishes for its agents (Claude-User, Claude-SearchBot, ClaudeBot). com is Anthropic’s website.
Why: to check whether a visitor calling itself Claude really came from Anthropic.
json when a visitor claiming to be one of those agents arrives and the cached copy is more than 6 hours old (also when you open the setup check).
com/legal/consumer-terms
com/legal/privacy
Perplexity
What: the IP address lists Perplexity publishes for Perplexity-User and PerplexityBot.
Why: to check whether a visitor calling itself Perplexity really came from Perplexity.
json when a visitor claiming to be that agent arrives and the cached copy is more than 6 hours old (also when you open the setup check).
ai/hub/legal/terms-of-service
ai/hub/legal/privacy-notice
What: the public signing keys of Google’s AI agent (Google-Agent).
Why: to verify requests that Google’s agent signs with Web Bot Auth.
goog and the cached keys are more than an hour old.
com/terms
com/privacy
Links only (no data is sent)
com: the free store scanner, the IP checker and the design-partner program. Nothing is sent unless you click a link. com/privacy
The optional weekly report is sent by your own site with WordPress’s mail function, to the address you enter. It does not go through ShopBouncer or any other service.