ChatGPT, Claude, Perplexity and Meta AI now browse stores and place orders for real customers. Google Analytics can’t show you most of that traffic, and anything can call itself “ChatGPT”.

ShopBouncer adds an AI Shoppers dashboard to WooCommerce (or to Tools on any WordPress site):

Which AI agents visit, split into agents shopping for a person and crawlers that index or train.
Verified or not, and by whom. Agents that sign their requests with Web Bot Auth (RFC 9421 HTTP Message Signatures), such as ChatGPT’s agent and Google’s agent, are checked cryptographically against their operator’s published keys, and the dashboard names the operator that signed.
Impostors spotted. OpenAI, Anthropic and Perplexity publish the IP ranges their agents use. A visitor calling itself ChatGPT, Claude or Perplexity from outside those ranges is flagged as an impostor; one from inside them is marked verified by IP. Agents whose operator publishes neither keys nor ranges are marked “unverified (name only)”.
Sales sent by AI assistants. How much shoppers who clicked through from ChatGPT, Perplexity, Gemini, Claude, Copilot and other assistants spent, read from WooCommerce’s own Order Attribution. ShopBouncer adds no tracking of its own.
Where they go: product pages, cart, checkout, customer accounts, APIs.
Orders placed by AI agents and the revenue they bring, with the agent’s identity check and signature headers saved on each order as evidence, shown in an “AI agent evidence” box on the order screen.
Alerts when impostors visit and when unverified agents reach your checkout.
A setup check that proves everything works on your own server: the official IP lists download, a real and a fake “ChatGPT” visit get the right verdicts, and your proxy settings are right.
An optional weekly AI Shopper Report by email, sent by your own site.

Privacy by design

No IP addresses or visitor identifiers are stored. An agent’s IP is compared with its operator’s published ranges in memory; only the outcome is kept.
Human visitors are never recorded.
Visit history is deleted automatically after 90 days (configurable).
No data is sent to ShopBouncer. See “External services” below.
The weekly report (off until you enter an address) is sent by your own site with WordPress’s mail function.

Built to stay out of the way

Human requests cost one string check. Agent visits are written after the page has been sent. The plugin is compatible with WooCommerce High-Performance Order Storage and the Cart and Checkout blocks.

External services

ShopBouncer connects to the services below, and only to them. None of these requests contains any data about your store’s visitors, customers or orders. Like any web request, each one reveals your server’s IP address and the user agent “ShopBouncer/1.1.0 (+https://shopbouncer.com)”. Everything downloaded is public data, cached on your site, and used only to check whether a visiting AI agent is who it claims to be.

OpenAI

What: the IP address lists OpenAI publishes for its agents (ChatGPT-User, OAI-SearchBot, GPTBot), and the public signing keys of ChatGPT’s agent.
Why: to check whether a visitor calling itself ChatGPT really came from OpenAI.
What is sent, and when: a plain download request, with no data from your site, to https://openai.com/chatgpt-user.json, https://openai.com/searchbot.json or https://openai.com/gptbot.json when a visitor claiming to be that agent arrives and the cached copy is more than 6 hours old (also when you open the AI Shoppers setup check); and to https://chatgpt.com/.well-known/http-message-signatures-directory when a signed request names chatgpt.com and the cached keys are more than an hour old.
Terms of use: https://openai.com/policies/row-terms-of-use/
Privacy policy: https://openai.com/policies/row-privacy-policy/

Anthropic (claude.com)

What: the IP address list Anthropic publishes for its agents (Claude-User, Claude-SearchBot, ClaudeBot). claude.com is Anthropic’s website.
Why: to check whether a visitor calling itself Claude really came from Anthropic.
What is sent, and when: a plain download request, with no data from your site, to https://claude.com/crawling/bots.json when a visitor claiming to be one of those agents arrives and the cached copy is more than 6 hours old (also when you open the setup check).
Terms of service: https://www.anthropic.com/legal/consumer-terms
Privacy policy: https://www.anthropic.com/legal/privacy

Perplexity

What: the IP address lists Perplexity publishes for Perplexity-User and PerplexityBot.
Why: to check whether a visitor calling itself Perplexity really came from Perplexity.
What is sent, and when: a plain download request, with no data from your site, to https://www.perplexity.ai/perplexity-user.json or https://www.perplexity.ai/perplexitybot.json when a visitor claiming to be that agent arrives and the cached copy is more than 6 hours old (also when you open the setup check).
Terms of service: https://www.perplexity.ai/hub/legal/terms-of-service
Privacy policy: https://www.perplexity.ai/hub/legal/privacy-notice

Google

What: the public signing keys of Google’s AI agent (Google-Agent).
Why: to verify requests that Google’s agent signs with Web Bot Auth.
What is sent, and when: a plain download request, with no data from your site, to https://agent.bot.goog/.well-known/http-message-signatures-directory when a signed request names agent.bot.goog and the cached keys are more than an hour old.
Terms of service: https://policies.google.com/terms
Privacy policy: https://policies.google.com/privacy

Links only (no data is sent)

The dashboard links to shopbouncer.com: the free store scanner, the IP checker and the design-partner program. Nothing is sent unless you click a link. Privacy notice: https://shopbouncer.com/privacy

The optional weekly report is sent by your own site with WordPress’s mail function, to the address you enter. It does not go through ShopBouncer or any other service.