Posterna

Many requests to a WordPress site now come from AI agents and crawlers: training crawlers, search crawlers, assistants fetching a page for a user, and agents acting on someone’s behalf. Some say who they are. Some of those are telling the truth.

Posterna labels every visitor request with one verdict:

• Verified by signature: the request carries a valid Web Bot Auth signature (HTTP Message Signatures, RFC 9421) from a key the operator publishes.

• Verified by IP or DNS: it comes from an address the operator publishes, or passes the forward-confirmed reverse DNS check the operator documents.

• Claimed, failed the check: it names a known agent, such as Googlebot or GPTBot, but comes from somewhere that agent does not use.

• Claimed, cannot be checked: it names an agent whose operator publishes nothing to check against, or a check is still running.

• Unknown automation: it looks automated and names no known agent.

• Browsers: it looks like an ordinary browser.

It then counts requests by hour, verdict, operator, agent, purpose and path, and shows them in wp-admin. Nothing is blocked, slowed or challenged. 0 only monitors.

What you get, with no account:

• A Posterna page with totals for the last 24 hours and 7 days, a table of agents by operator and purpose, a table of paths, and the operators seen for the first time this week.

• A dashboard widget with the last 24 hours.

• A “Check my setup” panel that shows how your own request was seen (client address and where it came from, the verdict, directory version, scheduled jobs) and warns about the two common problems: a proxy that makes every visitor look the same, and a full-page cache that serves pages without running PHP.

• Suggested robots.txt lines and Content Signals for two templates (monitor, and an allow-list that asks AI training crawlers to stay out), for you to copy. Posterna never changes robots.txt.

• Sign-ups by verdict: the verdict of each new WordPress registration and, when WooCommerce is active, each new WooCommerce customer. Sign-ups are never blocked.

• Developer hooks: posterna_get_verdict() and the posterna_verdict action.

How it works:

• The check runs early on each request, before the theme loads, inside your own site. Requests never go anywhere else.

• The operator directory (which agents exist, their user-agent tokens, published IP ranges, reverse DNS rules and signing keys) ships with the plugin. You can turn on signed updates from posterna.com; they are off by default.

• Reverse DNS lookups never run during a page load. A new address is queued, looked up by WP-Cron, and cached (24 hours when confirmed, 1 hour when not). Until then the request is labeled “claimed, cannot be checked”.

• Every error path fails open: if anything goes wrong, the request goes ahead and is labeled as a browser or unknown automation.

• The plugin does not log or store IP addresses, full URLs, headers or request bodies. Its table holds hourly counts only, and rows older than 90 days are removed.

Posterna is open source. com/posternahq/posterna

External services

Posterna works without contacting any outside server. com, run by the Posterna project, through two optional features. Both are off by default and do nothing until an administrator turns them on in Posterna > Settings.

1. com”)

• What it is for: keeping the list of AI operators, their published IP ranges and signing keys current between plugin updates.

• What is sent: a plain HTTPS download request for https://posterna.com/v1/directory.json, https://posterna.com/v1/keys.json and their.sig signature files, with the User-Agent Posterna-WordPress/1.0.0. No site address, visitor data or counts are sent. Like any web request, it shows posterna.com your server’s IP address.

• When: once a day for directory.json, once an hour for keys.json, right after the setting is turned on, when an administrator clicks “Check for updates now”, and at most once every 10 minutes when a signed request uses a key the site does not have yet.

• The downloaded files are used only if their Ed25519 signature checks out against keys built into the plugin.

2. com (setting: “Site key”)

• What it is for: showing this site’s counts on the posterna.com dashboard.

• What is sent: the site key you pasted (to identify the site), and the counts shown on the Posterna page: per hour, the number of requests with each verdict and reason code, by operator, agent, purpose and path group (such as /blog/* ), plus the plugin and PHP version, a random ID for this installation, the directory version, whether a proxy problem was detected and a count of errors. Path groups never contain more than the first part of a path, and parts that look like numbers, IDs or e-mail addresses are replaced with /:id/*. It never sends IP addresses, full URLs, headers, request bodies, user names or e-mail addresses. Sign-up counts are not sent.

• When: every five minutes while a site key is set, and when an administrator clicks “Send counts now”. Clear the site key to stop.

• Where: https://posterna.com/v1/ingest

com/terms

com/privacy

Privacy

Posterna does not store IP addresses, full URLs, headers, request bodies or anything else about a single request. Its database table holds hourly counts by verdict, reason, operator, agent, purpose and path group, kept for 90 days. Reverse DNS results are cached in transients keyed by a hash of the address, for up to 24 hours.

Sign-ups are counted by verdict only; nothing about the person is recorded. Nothing leaves the site unless you turn on one of the two optional features described under “External services”.

Data and credits

0. txt), used under the MIT License. md.

The plugin code is licensed under the GPL, version 2 or later. It bundles no third-party code. Signatures are checked with the libsodium functions built into PHP, or the sodium_compat copy that ships with WordPress.