Google Analytics Help<\/a>); crawlers never fire an analytics tag; and an agent browser is counted as a person.<\/p>\n\nThis plugin connects your store to Tactical<\/strong>, a third-party service at https:\/\/tactical-app.work, which shows you the rest. The plugin installs the storefront script, adds server-side crawler detection and registers the WooCommerce webhooks; the dashboard lives in your Tactical account.<\/p>\n\nWhat you get:<\/strong><\/p>\n\n\n- AI crawlers, server-side<\/strong> \u2014 when a known AI crawler requests a page, the plugin records it, no JavaScript needed. A hit is marked verified only when its IP matches the operator's published range. Nothing is sent for human visitors.<\/li>\n
- Agent browsers, by behaviour<\/strong> \u2014 sessions driven by an agent, including ones that never name themselves, are scored on how the session behaves. A score is a probability, not a verdict.<\/li>\n
- AI-referred buyers<\/strong> \u2014 people who arrive from ChatGPT, Perplexity, Gemini, Copilot and other assistants.<\/li>\n
- Agent revenue<\/strong> \u2014 every order is labelled: Agent order, Agent order (session match) or AI-referred order, each saying how sure it is, and the two kinds are never added together. Agent orders include ones placed in an agent checkout, such as Stripe's agentic checkout, which no browser pixel sees.<\/li>\n
- Evidence for every agent order<\/strong> \u2014 a record of the order, how it was attributed, the matched session and any Tactical Gate decisions, downloadable as PDF and JSON for disputes and returns. It holds no buyer name, email, address or IP address.<\/li>\n
- Tactical Gate (beta)<\/strong> \u2014 rules for AI agents by product, cart and checkout, starting in Observe mode. It is in a private beta; join the list at https:\/\/tactical-app.work\/waitlist.<\/li>\n<\/ul>\n\n
Tactical pricing \u2014 managed at tactical-app.work:<\/strong><\/p>\n\nThe plugin works on every plan, including the free one. Agent revenue and evidence are on every plan, with the plan's history.<\/p>\n\n
\n- Scout \u2014 free<\/strong> \u2014 7-day monitor, top 3 agent types, AI Search report, 100 agent sessions\/week. No credit card.<\/li>\n
- Radar \u2014 $39\/mo<\/strong> \u2014 90-day history, all agent types, intent signals, product interest map (top 50), 10,000 agent sessions\/mo.<\/li>\n
- Command \u2014 $129\/mo<\/strong> \u2014 everything in Radar, plus marketplace-referral and price-check signals, unlimited products, 50,000 agent sessions\/mo.<\/li>\n<\/ul>\n\n
Annual plans save about 25%.<\/p>\n\n
Multi-platform:<\/strong><\/p>\n\nThis plugin is for WooCommerce. The same Tactical account also works on Shopify (via the Shopify App Store) and on any custom storefront (via a script tag).<\/p>\n\n
External services<\/h3>\n\n
This plugin connects to Tactical<\/strong> at https:\/\/tactical-app.work \u2014 a third-party AI agent analytics service operated by the plugin author. The plugin requires an active Tactical account (free Scout tier is sufficient) to function. Without an API key configured on the settings page, no requests are made.<\/p>\n\nEndpoints used:<\/strong><\/p>\n\n\n- Snippet ingest<\/strong> \u2014
https:\/\/tactical-app.work\/api\/ingest<\/code>. The detection script (https:\/\/tactical-app.work\/snippet.js<\/code>) loads on every storefront page view and posts an event payload containing: an anonymised session ID, page URL (path + query string only), referrer domain, user-agent string, scroll\/mouse\/timing heuristics, and your store's API key. No customer PII (no names, emails, IP addresses, payment data, or form contents) is sent.<\/li>\n- Connection verification<\/strong> \u2014
https:\/\/tactical-app.work\/api\/verify-connection<\/code>. Triggered only when an admin clicks \"Verify connection\" on the settings page. Sends only your API key (in a request header) so Tactical can confirm the key belongs to this store. No event data.<\/li>\n- WooCommerce webhooks<\/strong> \u2014
https:\/\/tactical-app.work\/api\/wc-webhook\/<topic><\/code>. Once an API key is saved, four webhook subscriptions are registered with WooCommerce (order.created<\/code>, order.updated<\/code>, product.created<\/code>, product.updated<\/code>). WooCommerce delivers these payloads directly to Tactical with WC's standard HMAC signature when matching events occur on your store. Payload contents are WooCommerce's standard webhook bodies (order or product objects).<\/li>\n<\/ul>\n\nConditions:<\/strong> events are only sent after you paste a valid API key on the settings page. Without a key, the snippet does not load, no requests are made, and no webhooks are registered.<\/p>\n\nService terms:<\/strong><\/p>\n\n\n- Tactical Privacy Policy: https:\/\/tactical-app.work\/privacy<\/li>\n
- Tactical Terms of Service: https:\/\/tactical-app.work\/terms<\/li>\n<\/ul>\n\n\n
\n- Upload the
tactical-agent-detection<\/code> folder to \/wp-content\/plugins\/<\/code>, or install via the Plugins \u2192 Add New screen.<\/li>\n- Activate the plugin. (WooCommerce must be installed and active first; this plugin declares it as a required dependency.)<\/li>\n
- Sign up at https:\/\/tactical-app.work and copy your API key from the dashboard.<\/li>\n
- Go to Settings \u2192 Tactical and paste the API key.<\/li>\n
- Click \"Verify connection\" \u2014 you should see a green checkmark.<\/li>\n
- Open your storefront \u2014 Tactical starts classifying agent traffic immediately.<\/li>\n<\/ol>\n\n
The plugin auto-registers WooCommerce webhooks for order.created<\/code>, order.updated<\/code>, product.created<\/code>, and product.updated<\/code> so order and catalog activity is correlated with agent sessions.<\/p>\n\n\n\nDo I need a Tactical account to use this plugin?<\/h3><\/dt>\nYes \u2014 sign up free at tactical-app.work. The free Scout tier is 100 agent sessions per week with no credit card.<\/p><\/dd>\n
What data does the plugin collect?<\/h3><\/dt>\nThe storefront script sends anonymised session metadata only: user-agent, page URL, referrer, scroll\/mouse heuristics, and product context, with no names, emails, IP addresses or payment data. The order webhooks deliver WooCommerce's standard order body, which includes the customer's details; Tactical keeps only the order ID, total, currency, line items and how the order was attributed, uses the buyer's IP address and user-agent once to match the order to a session, and discards the rest.<\/p><\/dd>\n
How is agent traffic detected?<\/h3><\/dt>\nNamed crawlers and fetchers are matched against Tactical's registry of AI operators by user agent, and verified against the operator's published IP ranges where there are any. Browser sessions are scored on behaviour and environment (page-timing regularity, interaction signals, a datacenter network, automation flags); the IP itself is not stored. The dashboard updates in 15-minute batches.<\/p><\/dd>\n
What about agents that don't identify themselves, like Meta's Muse?<\/h3><\/dt>\nA named crawler (GPTBot, PerplexityBot, ClaudeBot) says who it is in its user-agent, so server-side detection catches it outright. An agent browser \u2014 Meta's Muse, OpenAI's Operator \u2014 drives a real browser on a shopper's behalf, and it visits your store whether or not you're a commerce partner of theirs. No request-layer fingerprint for Muse has been published by anyone yet, so a user-agent list can't see it. Tactical's behavioural layer scores the session itself (page-timing regularity, interaction signals, browser environment). In a September 2026 test, an AI-driven browser scored as an agent and a person in Chrome on the same laptop scored as human; a real Muse session has not yet been confirmed. Tactical's agent registry tracks Muse as fingerprint research, and a confirmed signature goes live without waiting for a plugin release.<\/p><\/dd>\n
Will this slow down my site?<\/h3><\/dt>\nThe storefront script loads with the defer<\/code> attribute (about 8 KB gzipped), and classification happens on Tactical's servers, not yours. Server-side crawler detection does nothing for human visitors: it sends a small, non-blocking request only when a request's user agent matches a known AI crawler.<\/p><\/dd>\nHow do I cancel?<\/h3><\/dt>\nCancel from the Tactical dashboard's billing page at tactical-app.work. The plugin keeps working on the free Scout tier after cancellation.<\/p><\/dd>\n
Where's my data stored?<\/h3><\/dt>\nIn Tactical's Postgres database. Sessions, product views and Gate decisions are deleted after 90 days and AI crawler visits after 180 days; order records and their evidence are kept while your store is connected. Details: https:\/\/tactical-app.work\/privacy<\/p><\/dd>\n
Is this GDPR-compliant?<\/h3><\/dt>\nTactical processes data under the legitimate-interest legal basis. It stores no names or contact details of visitors or buyers, and merchants can request deletion at any time by emailing support@tactical-app.work. A Data Processing Addendum is available on request.<\/p><\/dd>\n\n<\/dl>\n\n\n
1.2.0<\/h4>\n\n\n- New: Tactical Gate.<\/strong> Enforce the agent policy you set on tactical-app.work in the request path: throttle, require identification, challenge, redirect or block AI agents by identity, category, confidence and scope (paths, products, collections, cart, checkout, schedule). Fetches the compiled policy every five minutes with an ETag, applies it on page requests, add-to-cart and checkout, and reports decisions in batches.<\/li>\n
- Every policy starts in Observe mode, where rules only tag. People are never restricted, whatever the policy says, and a search engine only when the policy names it and confirms the SEO impact. No policy, a failed fetch or any error means the request passes untouched.<\/li>\n
- New settings toggle \"Tactical Gate\" (on by default; a no-op until a policy exists) with policy version, mode and last-fetch status.<\/li>\n
- The settings page now recreates any missing Tactical webhooks (for example after WooCommerce was activated after this plugin), instead of asking you to reactivate.<\/li>\n<\/ul>\n\n
1.1.0<\/h4>\n\n\n- New: server-side AI crawler detection.<\/strong> Detects AI crawlers that don't run JavaScript (most retrieval crawlers) by matching the request user-agent against a maintained registry of AI operators (OpenAI, Anthropic, Perplexity, Google, Meta, Apple, Amazon, ByteDance, Mistral, DuckDuckGo, and more). Fires only on a matched AI user-agent; human visitors trigger nothing.<\/li>\n
- Non-blocking delivery (
wp_remote_post<\/code> with blocking => false<\/code>, 1s timeout) and a 60-second per-(agent, URL) dedup guard against crawler bursts.<\/li>\n- New settings toggle \"Server-side AI crawler detection\" (on by default) with a \"last event sent\" status line.<\/li>\n
- Optional
tactical_trust_proxy_headers<\/code> filter to read the crawler's real IP from CDN\/proxy headers when the store is behind Cloudflare or similar.<\/li>\n<\/ul>\n\n1.0.2<\/h4>\n\n\n- Security: removed the
data-key<\/code> attribute from the storefront <script><\/code> tag. The Tactical API key is a server-side secret used to sign WooCommerce webhook deliveries and authenticate plugin-to-server API calls \u2014 it must not appear in browser-rendered HTML. The snippet identifies the tenant by data-shop<\/code> plus the request Origin, so no key is required client-side. Recommended upgrade for all installs.<\/li>\n<\/ul>\n\n1.0.1<\/h4>\n\n\n- Compliance: storefront snippet now loads via
wp_enqueue_script<\/code> with the defer<\/code> strategy, decorated via the script_loader_tag<\/code> filter. No more inline <script><\/code> injection.<\/li>\n- Compliance: settings-page admin JS extracted to
assets\/admin-settings.js<\/code>, enqueued via wp_enqueue_script<\/code> + wp_localize_script<\/code>. No more inline <script><\/code> in the admin page.<\/li>\n- Compliance: declared
Requires Plugins: woocommerce<\/code> so WP correctly blocks activation without WooCommerce.<\/li>\n- Readme: added the \"External services\" disclosure, clarified Scout\/Tactical naming in the pricing section, updated Contributors.<\/li>\n
- Bumped
Requires at least<\/code> to WP 6.3 (needed for wp_enqueue_script<\/code> defer\/async strategy).<\/li>\n<\/ul>\n\n1.0.0<\/h4>\n\n\n- Initial release.<\/li>\n
- Snippet injection on the storefront when an API key is configured.<\/li>\n
- Settings page with API key, store domain, and \"Verify connection\" button.<\/li>\n
- Auto-registration of WooCommerce webhooks for order and product topics.<\/li>\n
- Uninstall removes options + Tactical-managed webhooks.<\/li>\n<\/ul>","raw_excerpt":"See the AI crawlers, agent browsers and AI-referred buyers on your WooCommerce store, and which orders AI agents placed.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/bn-in.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/308436","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/bn-in.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/bn-in.wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/bn-in.wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=308436"}],"author":[{"embeddable":true,"href":"https:\/\/bn-in.wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/sourabhnk"}],"wp:attachment":[{"href":"https:\/\/bn-in.wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=308436"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/bn-in.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=308436"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/bn-in.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=308436"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/bn-in.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=308436"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/bn-in.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=308436"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/bn-in.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=308436"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}