CryptoMeter
Get it  – $49
WordPress plugin · self-hosted · no account

AI traffic control for WordPress.

See which AI bots read your site, prove they are who they claim to be, decide who may read — and see how many visitors come back. All inside WordPress: no account, no monthly fee, no visitor data leaves your site.

Coming to CodeCanyon $49 See the admin
WordPress 6.6+ PHP 7.4+ Humans never logged Pay-per-read optional, off by default
How one request is decided
Illustration
1
Request
GET /hello-world/ user agent claims GPTBot
2
Identity
IP found in openai.com/gptbot.json Verified
3
Intent & policy
AI training → preset “Get cited, block training” Block
4
Response & log
403 logged with verdict, method, page and IP prefix

Illustration of the decision path with example paths. Your own traffic appears in the Activity log.

  1. 01SeeEvery AI bot request, live
  2. 02VerifyReal, spoofed or unverified
  3. 03DecideOne policy per intent
  4. 04MeasureWhat AI sends back
wp-admin/admin.php?page=cryptometer#/overview
Test install
CryptoMeter Overview screen: protection active with the policy Get cited, block training, 8 of 8 verification lists fresh, AI requests, verification breakdown, blocked requests, visitors from AI, a 30-day traffic chart, requests per AI company with crawl-to-visit ratio, and requests by intent.

Real screenshot from a local test install with test traffic (numbers are not from a live site). The admin is responsive down to phone width.

What it solves

AI bots read your site. You deserve to know who, and to decide.

A robots.txt file alone does not tell you which bots came, whether they were real, whether they listened, or whether anything came back.

Crawlers cost bandwidth

Wikimedia reported bandwidth used for downloading multimedia content grew 50% since January 2024, driven mostly by automated scrapers.

Source: Wikimedia, 2025

User agents can be faked

Anyone can send “Googlebot” or “GPTBot” in a header. Without checking the IP, reverse DNS or a signature, a scraper looks like a trusted crawler.

robots.txt is a request

Well-behaved bots follow it; others do not. You need enforcement on the server and a record of who ignored the rules.

Little traffic comes back

AI assistants read a lot and link back rarely. The useful number is your own: requests per vendor versus visitors that vendor sends.

Five pillars

One plugin. Identity, policy, proof, signals — and an optional paywall.

01 · Verified identity

Is that really GPTBot?

8 official IP lists from OpenAI, Perplexity, Anthropic, Google and Microsoft, reverse DNS for search engines, and Web Bot Auth signatures.

Verified Spoofed Unverified Unknown
02 · Policy by intent

Get cited, block training.

Search, AI search, AI agents and AI training each get Allow or Block, with per-bot exceptions and rate limits.

Search engines Allow
AI search & answers Allow
AI agents (user-triggered) Allow
AI training Block
 03 · Proof

Take vs. give back

Activity log, live feed, AI referrals with a crawl-to-visit ratio per vendor, robots.txt violations, weekly report.

 04 · One policy → every signal

Write it once

robots.txt, Content-Signal, IETF Content-Usage, RSL, TDMRep, noai — plus server and cache rules.

 05 · Monetize (optional)

Pay-per-read via x402

Off by default. Agents that can pay send USDC straight to your wallet. Non-custodial.
01 · Verified identity

Know which bots are real, and stop the ones pretending.

Every bot request is checked against the vendor’s own published data. Scrapers that borrow a well-known name are flagged and, by default, blocked.

  • 8 official IP lists from OpenAI (GPTBot, OAI-SearchBot, ChatGPT-User), Perplexity (2 lists), Anthropic, Google and Microsoft — refreshed daily by WP-Cron; the last good copy is kept if a download fails.
  • Forward-confirmed reverse DNS for search engines such as Googlebot, Bingbot, Applebot, YandexBot and Baiduspider.
  • Web Bot Auth signatures (RFC 9421, Ed25519) — used by ChatGPT agent; checks fall back to IP and DNS.
  • Block spoofed bots is on by default. Real Googlebot keeps reading free.
Verified Spoofed Unverified — vendor offers no method Unknown — could not decide

Verification is only as good as each vendor’s published data. A bot without an IP list, DNS or signature method is shown as unverified, never as spoofed.

Verification sources screen listing eight official IP lists from OpenAI, Perplexity, Anthropic, Google and Microsoft with IP range counts and update times, a signed-request agent chatgpt.com, and search engines verified by reverse DNS.
Bots & rules → Verification sourcesTest install
02 · Policy by intent

Decide by what a bot is reading for — not by guessing names.

Four intents that match how AI companies describe their bots. Pick a preset, then make exceptions where you need them.

  • Presets: “Get cited, block training” (default), “Block all AI”, “Monitor only”, and “Charge training and agents” when Monetize is on.
  • Block is enforced site-wide with HTTP 403; robots.txt and licence files stay readable.
  • Per-bot exceptions and per-bot rate limits (requests per minute across all of a bot’s IPs, HTTP 429).
  • 28 known AI crawlers and agents, 6 search engines, your own custom user agents, and a separate rule for generic HTTP clients (curl, python-requests, headless browsers).
Preset buttons and four intent cards: Search engines, AI search and answers, and AI agents set to Allow; AI training set to Block.
Presets and intentsTest install
AI training group table with GPTBot, ClaudeBot, Bytespider and a custom bot, showing verification method, last seen, requests, spoofed count, policy and a rate-limit field.
Per-bot exceptions and rate limitsTest install
03 · Proof

See what AI takes, and what it sends back.

Your own numbers, collected on your own server — with a clear “collecting since” date and no demo data.

  • Activity log and live feed: bot, intent, verdict and method, decision, status code, bytes, page and IP prefix. Kept 90 days by default; filter by bot, company, intent, verdict or decision.
  • AI referrals from ChatGPT, Perplexity, Claude, Gemini, Copilot, You.com, DeepSeek, Meta AI, Mistral and Grok, with a crawl-to-visit ratio per vendor and per post.
  • robots.txt violation detector flags requests for paths that the bot’s own robots.txt group disallows.
  • Weekly report, spike alert, daily digest and an HTTPS webhook signed with HMAC-SHA256.

Referral counts are a lower bound: many AI apps and mobile apps hide where a visitor came from, so part of that traffic arrives as “direct”.

Activity feed: Bytespider requests marked Unverified, Blocked with status 403 and Ignored robots.txt; ClaudeBot requests marked Unknown with decisions Allowed, Free by rule and Asked to pay (402).
Activity → Feed (robots.txt violations flagged)Test install
Referrals screen with a note that numbers are a minimum, a chart of visitors from AI per day, and a take versus give back table listing AI assistants with visitors, bot requests and crawl-to-visit ratio.
Referrals → Take vs. give backTest install
04 · One policy → every signal

Tell every AI company, in its own format — then enforce it.

Answer three questions (search, AI answers, AI training) and CryptoMeter publishes them everywhere, with a live preview before you save.

  • robots.txt per-bot rules plus a Content-Signal line (contentsignals.org).
  • IETF aipref Content-Usage header and robots.txt rule — labelled as a draft standard.
  • RSL 1.0 /license.xml with License: and Link rel="license"; TDMRep /.well-known/tdmrep.json with tdm-reservation headers; optional noai meta (experimental).
  • Server & cache rules generated from your block list: nginx, Apache (.htaccess), LiteSpeed, a Cloudflare WAF expression and a WP Rocket list — plus a loopback test that shows if a page cache is in the way.

Signals are declarations, not enforcement. Bots that respect them follow them; the Block policy and server rules are what actually stop requests.

Signals and licensing screen: yes or no for search, AI answers and AI training; format switches for Content-Signal, Content-Usage (draft standard), RSL licence, TDMRep and noai (experimental); and a robots.txt preview.
Signals & licensing with previewTest install
Server and cache rules screen with tabs for Nginx, Apache, LiteSpeed, Cloudflare and WP Rocket, an nginx snippet with a copy button, and a loopback test.
Bots & rules → Server & cache rulesTest install
05 · Monetize optional · off by default

Let agents that can pay, pay per read.

Turn it on and bots set to Charge get an HTTP 402 with a standard x402 challenge. An x402-capable agent signs a USDC payment and receives the article.

  • Non-custodial: CryptoMeter stores only your public wallet address. The agent signs, a facilitator you choose settles on-chain, your wallet receives.
  • x402 v2 with v1 compatibility; USDC on Base, Polygon, Arbitrum and Avalanche (plus testnets).
  • Facilitators: x402.org (testnet), PayAI, Coinbase CDP (your own key) or a custom URL.
  • Test mode on testnet USDC, replay protection, payments ledger with explorer links and CSV export.

Few AI agents can pay today. Treat Monetize as an extra, not a revenue plan — CryptoMeter makes no earnings promise.

Monetize screen with the pay-per-read switch, earnings cards labelled test data showing zero USDC earned, an empty payments ledger with an Export CSV button, and the wallet address and test mode settings.
Monetize (test mode, no payments yet)Test install

Workflow

Set up from one card. Useful from the first bot visit.

Install and pick a preset

A setup card on the Overview asks one question: how should AI bots be treated? The wallet is optional and can be added later.

Watch and verify

Requests appear in the Activity log with a verdict. Lists refresh daily; spoofed bots are blocked.

Tune and publish

Add exceptions and rate limits, publish signals, and copy the server or cache snippet if you use a page cache.

Review weekly

The weekly report and spike alert tell you who read, who was real, and what came back.

First-run setup card on the Overview with four presets — Get cited, block training (selected), Monitor only, Block all AI, Charge AI keep search free — an optional pay-per-read switch with a public wallet address field, and Apply and start.
First-run setup on the OverviewTest install

Admin tour

A modern React admin that feels native to WordPress.

Built with WordPress’ own components, follows your admin colour scheme, keyboard accessible, and honest when there is no data yet.

No public live demo yet. Every image below is a real screenshot from a local test install with test traffic. On localhost all requests come from 127.0.0.1, so most verdicts read “Unknown” or “Unverified”; on a public site, requests from listed vendor IPs show “Verified”.

#/overview
Test install
Overview: protection status, AI requests, verification, blocked, visitors from AI, earned, traffic chart, who is reading and requests by intent.

Who is reading, is it real, and what comes back — on one screen, for 7, 30 or 90 days.

Privacy & security

Built to keep data on your site.

No CryptoMeter account, no cloud dashboard. The only outbound requests fetch public lists and keys — and they are listed below.

Humans are never logged

Normal visitors and logged-in users are never logged, blocked or metered. Search engines read free by default.

IP prefix only

The bot log stores the network prefix (IPv4 /24, IPv6 /48), never the full address. The referral beacon uses no cookies and stores no IP.

Retention and erase

Log retention setting (90 days by default), one-click erase of the log, referrals, test payments or all statistics, and suggested privacy-policy text.

Fail-safe outbound checks

Every request has a timeout; a failure never affects your visitors, and the last good copy of each list is kept.

Works behind Cloudflare

The real visitor IP is read from CF-Connecting-IP only when the request comes from a Cloudflare address.

No keys, no custody

Monetize stores only a public wallet address. CryptoMeter never asks for a private key or seed phrase.

Every outbound request CryptoMeter makes
  • Official bot IP lists, once a day (switchable): openai.com/gptbot.json, openai.com/searchbot.json, openai.com/chatgpt-user.json, www.perplexity.ai/perplexitybot.json, www.perplexity.ai/perplexity-user.json, claude.com/crawling/bots.json, developers.google.com/static/crawling/ipranges/common-crawlers.json, www.bing.com/toolbox/bingbot.json.
  • Web Bot Auth key directory at chatgpt.com/.well-known/http-message-signatures-directory, at most once a day (switchable).
  • Reverse DNS through your server’s resolver for IPs that claim to be a search engine (cached a day, rate-limited).
  • Only with Monetize on: the x402 facilitator you choose. Only if set: your webhook URL.
  • No data about your visitors is sent.

Honest expectations

What CryptoMeter does not do.

  • It cannot stop scrapers that look like browsers.A scraper that sends a normal browser user agent looks like a human. You can block generic HTTP clients, but no WordPress plugin can catch every disguised bot.
  • Signals are not locks.robots.txt, Content-Signal, Content-Usage, RSL, TDMRep and noai are declarations. Blocking is done by the policy and the server rules.
  • It cannot opt you out of Google AI Overviews separately.AI Overviews use Googlebot’s search index. Blocking Googlebot would remove you from Google Search.
  • Page caches must be configured.Caches that answer before WordPress loads can hide bots. CryptoMeter generates the bypass rules and a loopback test shows if a cache is in the way.
  • Referral numbers are a minimum.Many AI apps hide the referrer. Ratios on low-traffic sites are noisy; raw counts and “since” dates are always shown.
  • No revenue promise.x402 is young and few agents pay today. Monetize is optional and off by default.

Stack

PluginPHP WordPress plugin, own database table for the bot log, WP-Cron jobs
AdminReact app built with @wordpress/scripts and @wordpress/components; source and build included
APIWordPress REST API (admin routes require an authorised user)
SignaturesEd25519 via PHP sodium; falls back to IP list and DNS if unavailable
ChartsLightweight SVG, no chart library
Front endOne tiny cookie-free referral beacon; nothing else added for visitors
Standards
RFC 9421Content SignalsIETF aipref (draft)RSL 1.0TDMRepx402 v2

Requirements

WordPress6.6 or newer
PHP7.4 or newer
Tested onPHP 7.4.33 and 8.4.25 with SQLite; built-in self-test passes 173 of 173 checks on both
MySQL / MariaDBNot yet tested
ServerOutbound HTTPS for the daily IP-list refresh (optional, switchable)
Page cacheMust let AI user agents reach WordPress — snippets for nginx, Apache, LiteSpeed, Cloudflare and WP Rocket are generated
Monetize onlyAn EVM wallet address (public) and an x402 facilitator

What you get

What’s included — and what isn’t.

Included

  • CryptoMeter WordPress pluginPHP source, React admin source and production build
  • All five pillarsVerification, policy, activity and referrals, signals and rules, optional Monetize
  • Built-in self-test173 checks, run with wp eval-file; no network calls
  • Translation template (.pot)
  • Developer hooks and filtersBots, IP sources, signature agents, referral vendors, signals, prices and more
  • Optional x402 demo client (Node) for test payments
  • DocumentationPublished with the release

Not included

  • Hosting, CDN or WAF setupYou paste the generated snippet yourself; CryptoMeter never edits server config silently
  • A cloud dashboard or SaaS account
  • A crypto wallet, facilitator account or Coinbase CDP key
  • Legal adviceSignals are declarations; whether they are binding depends on your jurisdiction
  • Any earnings, traffic or ranking guarantee

Documentation

Docs are coming with the release.

The full buyer documentation will be linked here when it is public. It covers installation, presets, verification sources, page caches, Cloudflare and proxies, signals, Monetize test mode, the webhook format, developer hooks and uninstall.

Read the documentation

Changelog

Version 1.0.0 first release, pending

First public release.

  • Verification engine: 8 official IP lists, reverse DNS, Web Bot Auth; spoofed bots blocked by default
  • Intent-based policy with presets, per-bot exceptions and per-bot rate limits
  • Activity log with live feed, AI referral tracking and crawl-to-visit ratios
  • robots.txt violation detector, weekly report and spike alert
  • Signals: Content-Signal, Content-Usage, RSL license.xml, TDMRep, noai
  • Server & cache rule snippets and loopback test
  • React admin with seven screens and a first-run setup card
  • Optional Monetize module: x402 pay-per-read in USDC, off by default

FAQ

Questions, answered straight.

Does this stop scraping?

It stops the scraping you can identify. Known AI bots you set to Block get HTTP 403, bots that fake a known identity are blocked as spoofed, per-bot rate limits return 429, and you can block generic HTTP clients such as curl or python-requests.

It cannot stop a scraper that fully imitates a normal browser — that traffic looks like a human visitor, and humans are never blocked.

Does blocking AI bots hurt my Google ranking?

Search engines (Googlebot, Bingbot and others) read free by default, and every preset keeps them allowed. Blocking AI training crawlers such as GPTBot or ClaudeBot does not affect Googlebot.

Note: Google’s AI Overviews use the normal search index, so they cannot be turned off separately without leaving Google Search.

Is it GDPR friendly?

It is designed to keep personal data to a minimum: humans are never logged, the bot log stores only the IP network prefix (IPv4 /24, IPv6 /48), the referral beacon uses no cookies and stores no IP, data stays on your server, and you control retention and erasure. A suggested privacy-policy text is included.

Whether your whole site is compliant depends on everything else it runs — CryptoMeter does not give legal advice.

Do I need crypto or a wallet?

No. Verification, policies, activity, referrals, signals and rules all work without any wallet. Monetize is off by default; only if you turn it on do you need a public EVM wallet address to receive USDC.

Which bots does it recognise?

28 known AI crawlers and agents (including ChatGPT agent, recognised by its signature) and 6 search engines, grouped into four intents. You can add your own user agents, and developers can extend the list with a filter.

What do “verified”, “spoofed”, “unverified” and “unknown” mean?

Verified: the IP is in the vendor’s official list, reverse DNS confirms it, or a Web Bot Auth signature is valid. Spoofed: the bot claims a name that can be checked and the check definitely failed. Unverified: the vendor publishes no way to check. Unknown: the check could not decide (for example a private or proxy IP, or a list not fetched yet).

Does it work with page caches and Cloudflare?

Yes, with configuration. Caches that answer before WordPress loads must let AI user agents through; CryptoMeter generates snippets for nginx, Apache, LiteSpeed, Cloudflare and WP Rocket and has a loopback test. Behind Cloudflare, the real IP is read automatically from Cloudflare addresses.

Are robots.txt and licence signals legally binding?

CryptoMeter makes no such claim. They are machine-readable declarations; bots that respect them follow them. Enforcement is done by the Block policy and server rules.

How are referrals counted, and why is the ratio a minimum?

A tiny script counts visits whose referrer or utm_source shows an AI assistant, so page caches cannot hide them. Many AI apps and mobile apps send no referrer, so those visits look “direct” — the real number of AI visitors can only be higher.

Will I earn money with Monetize?

Maybe a little, maybe nothing. Only x402-capable agents can pay, and few do today; large crawlers mostly do not. Money goes straight to your wallet when they do. Treat it as an extra.

What happens when I uninstall?

Settings, the bot log, referral and traffic statistics, cached lists and keys and scheduled tasks are removed. The payments ledger is kept as your accounting record unless you opt in to delete it too.

Take control of your AI traffic.

One purchase on CodeCanyon. No monthly fee, no event cap, no data leaving your site.

Read the docs first Read the FAQ

Not yet published on CodeCanyon — the buy link will go live with the listing. Purchases happen on Envato Market.

$49 on CodeCanyon

Price shown on the item page applies. Licence terms are Envato’s.

Support

Help through Envato

Buyers get item support through the CodeCanyon item page under Envato’s item-support terms. Please include your WordPress and PHP versions and the Tools & status report from the plugin.

Before you ask

Diagnose in a minute

Settings → Tools & status shows the system status and page-cache detection; the loopback test shows whether a cache is in the way; the self-test checks the core logic without network calls.