About this plugin
AI assistants are shopping WooCommerce stores. Some send crawlers that never run JavaScript, some drive a browser that behaves like a person, and some send people who then buy. Standard analytics sees little of it: Google Analytics excludes known bots, and you can’t turn that off ( Google Analytics Help ); crawlers never fire an analytics tag; and an agent browser is counted as a person.
work, which shows you the rest. The plugin installs the storefront script, adds server-side crawler detection and registers the WooCommerce webhooks; the dashboard lives in your Tactical account.
What you get:
- AI crawlers, server-side — when a known AI crawler requests a page, the plugin records it, no JavaScript needed. A hit is marked verified only when its IP matches the operator’s published range. Nothing is sent for human visitors.
- Agent browsers, by behaviour — sessions driven by an agent, including ones that never name themselves, are scored on how the session behaves. A score is a probability, not a verdict.
- AI-referred buyers — people who arrive from ChatGPT, Perplexity, Gemini, Copilot and other assistants.
- Agent revenue — every order is labelled: Agent order, Agent order (session match) or AI-referred order, each saying how sure it is, and the two kinds are never added together. Agent orders include ones placed in an agent checkout, such as Stripe’s agentic checkout, which no browser pixel sees.
- Evidence for every agent order — a record of the order, how it was attributed, the matched session and any Tactical Gate decisions, downloadable as PDF and JSON for disputes and returns. It holds no buyer name, email, address or IP address.
- Drop Watch — tell Tactical when a release goes live and get a report afterwards: every add-to-cart and checkout attempt in the window, who made it (people, AI agents, requests with no browser) and when. Free, and nothing on your store is blocked or changed. A sample is at https://tactical-app.work/drop-watch.
- Tactical Gate (beta) — rules for AI agents by product, cart and checkout, starting in Observe mode. It is in a private beta; join the list at https://tactical-app.work/waitlist.
work:
The plugin works on every plan, including the free one. Agent revenue and evidence are on every plan, with the plan’s history.
- Scout — free — 7-day monitor, top 3 agent types, AI Search report, 100 agent sessions/week. No credit card.
- Radar — $39/mo — 90-day history, all agent types, intent signals, product interest map (top 50), 10,000 agent sessions/mo.
- Command — $129/mo — everything in Radar, plus marketplace-referral and price-check signals, unlimited products, 50,000 agent sessions/mo.
Annual plans save about 25%.
Multi-platform:
This plugin is for WooCommerce. The same Tactical account also works on Shopify (via the Shopify App Store) and on any custom storefront (via a script tag).
External services
work — a third-party AI agent analytics service operated by the plugin author. The plugin requires an active Tactical account (free Scout tier is sufficient) to function. Without an API key configured on the settings page, no requests are made.
Endpoints used:
- Snippet ingest — https://tactical-app.work/api/ingest. The detection script ( https://tactical-app.work/snippet.js ) loads on every storefront page view and posts an event payload containing: a random session ID, the page path and query string, the referrer, the user-agent string, scroll/mouse/timing heuristics, product context read from the page, and your store’s domain (never your API key, which stays on the server). No names, emails, payment data or form contents are sent. From 1.5.0 the script also sets one first-party cookie on your store, _tac_sid, holding that random session ID for up to 30 minutes, so the plugin can tell which browser session a cart or checkout request belongs to.
- Server-side crawler detection — https://tactical-app.work/api/ingest/server. Only when a request’s user-agent matches a known AI crawler or agent in Tactical’s registry: the user-agent, the page URL and the request’s IP address (used to check it against the operator’s published IP ranges, then discarded). Human visitors trigger nothing.
- Connection verification — https://tactical-app.work/api/verify-connection. Triggered only when an admin clicks “Verify connection” on the settings page. Sends only your API key (in a request header) so Tactical can confirm the key belongs to this store. No event data.
-
work/api/wc-webhook/<topic>. updated ). WooCommerce delivers these payloads directly to Tactical with WC’s standard HMAC signature when matching events occur on your store.
Payload contents are WooCommerce’s standard webhook bodies (order or product objects).
-
work/api/gate/policy. Fetched at most once every five minutes with your API key in a header, and only re-downloaded when it changed. Sends nothing about your visitors.
- Tactical Gate decisions (1.2.0) — https://tactical-app.work/api/gate/decisions. Sent in batches by WP-Cron: for each recorded decision, the time, the page path (no query string), the agent’s name and category if it declared one, the rule and the outcome, and a one-way hash of the visitor’s IP address and user-agent (never the IP itself). Every request a rule acted on is recorded; other requests about 1 in 100 sessions, except during a Drop Watch window you set, when every add-to-cart and checkout attempt is recorded. From 1.5.0 a decision also carries the _tac_sid session ID when the visitor has that cookie; Tactical keeps it only for Drop Watch decisions.
-
work/api/gate/reputation. At add-to-cart and checkout only, for a visitor that names no agent: the same one-way hash, to ask whether Tactical classified that session as an agent browser. Half-second timeout, cached for 30 seconds.
-
well-known/http-message-signatures-directory (Google, Google-Agent). It is a plain GET with no cookies and nothing about your store or its visitors, made at most once per five minutes to an hour per signer (the answer is cached in a transient), and only while the Gate has a policy. Unsigned requests, the usual case, fetch nothing.
com/policies/privacy-policy. com/privacy.
Conditions: events are only sent after you paste a valid API key on the settings page. Without a key, the snippet does not load, no requests are made, and no webhooks are registered.
Service terms:
- Tactical Privacy Policy: https://tactical-app.work/privacy
- Tactical Terms of Service: https://tactical-app.work/terms