Agentrue – Verified AI Agents for WooCommerce

AI assistants are starting to browse and buy on behalf of shoppers. Anyone can put an AI agent’s name in a User-Agent header, so a request that says it comes from an AI agent proves nothing.

Major agent operators now sign their requests with Web Bot Auth – HTTP Message Signatures (RFC 9421) with Ed25519 keys published in a key directory on the operator’s own domain. Agentrue checks those signatures directly on your WordPress server. No third-party service sees your traffic and no account is needed.

What it does

• Verifies every signed request against the operator’s published public keys (/.well-known/http-message-signatures-directory), with caching.
• Labels each request as Verified agent, Forged signature or Unsigned impostor (a request that uses a known AI agent name but carries no signature).
• Tags WooCommerce orders – an “Agent” column in the orders list (HPOS and legacy), an “AI agent check” box on each order and an order note.
• Monitor or enforce – start in monitor mode (log only). In enforce mode, forged signatures are blocked with HTTP 403 and unsigned impostors can be blocked at cart and checkout.
• Trusted operators list – choose which operator origins you accept, or accept any operator with a valid key directory.
• Self-test button – signs a request with a temporary key and confirms that a valid signature passes and a tampered one fails.
• Developer helper – agentrue_is_verified_agent() lets other plugins skip CAPTCHA or bot challenges for verified agents only. Filters: agentrue_should_block, agentrue_pre_directory_keys.

Also included

• Agent readiness checks for your product data, a product feed, an optional llms.txt and simple AI-referral sales reporting.

Honest limitations

• Only agents that sign with Web Bot Auth can be verified. Unsigned bots from smaller tools will show as unverified.
• A captured signed request could be replayed within its short validity window; nonce tracking is planned.
• If you use a CDN that already verifies bots at the edge, Agentrue still adds order-level labelling and checkout rules inside WooCommerce.
• AI agent orders are still a small share of e-commerce today. Monitor mode lets you see your real numbers before changing anything.

External services

Agentrue connects to the public key directories of AI agent operators. This is needed to check the cryptographic signature on requests from AI agents.

When: only when a request arrives with a Web Bot Auth signature from an operator that you trust (or from any operator, if you turn on “Accept any operator”). Results are cached, so a directory is fetched at most about once an hour.

What is sent: one plain HTTPS GET request from your server to https://<operator>/.well-known/http-message-signatures-directory. No visitor, customer or order data is sent. The operator receives only the request itself (your server’s IP address and a standard WordPress user agent).

Default operator – ChatGPT agent (OpenAI): the directory at https://chatgpt.com/.well-known/http-message-signatures-directory is provided by OpenAI. Terms of use: https://openai.com/policies/terms-of-use – Privacy policy: https://openai.com/policies/privacy-policy

Operators you add yourself: if you add other operator origins in Settings, Agentrue fetches their directories in the same way. Each of those services is provided by that operator, under its own terms and privacy policy.

No other external service is used.