● Documentation · WordPress plugin

CryptoMeter
AI traffic control for WordPress.

Everything you need to install, set up and run CryptoMeter: see which AI bots read your site, prove whether they are real, apply one policy per intent and count the readers AI sends back. Read it top to bottom the first time. After that, press / and search.

v1.0.0WordPress 6.6+PHP 7.4+GPL-2.0-or-laterMonetize optional

01What you bought

CryptoMeter runs inside your WordPress site. It watches every request from a bot or AI crawler (human visitors are never logged), checks whether the bot is genuine, applies the policy you choose, and shows the result in its own admin area under CryptoMeter in the WordPress sidebar.

What it does

Verified bot identity. Each bot request is checked against the vendor's official published IP list (OpenAI, Perplexity, Anthropic, Google, Microsoft), forward-confirmed reverse DNS (search engines and Google's AI crawlers), or a Web Bot Auth signature (RFC 9421, Ed25519, currently used by ChatGPT). Every request gets a verdict: Verified, Spoofed, Unverified or Unknown.
Activity log and live feed. Every bot request with bot, intent, verdict, decision, status code, bytes served, page and the network prefix of the IP (never the full address).
AI referral tracking. Visitors who click through from ChatGPT, Perplexity, Claude, Gemini, Copilot and five more assistants are counted per page and compared with how much each company's bots crawl (the crawl-to-visit ratio).
robots.txt violation detector. Flags requests for paths that the bot's own robots.txt group disallows.
One policy, every signal. From one screen: robots.txt Content-Signal, IETF Content-Usage (draft), RSL /license.xml, TDMRep /.well-known/tdmrep.json and optional noai tags, with a preview before you publish.
Policies per intent (Search engines, AI search & answers, AI agents, AI training) with per-bot exceptions and per-bot rate limits. Block is enforced by WordPress with HTTP 403 and written to robots.txt.
Server and cache rule snippets for Nginx, Apache, LiteSpeed, Cloudflare and WP Rocket, generated from your block list.
Weekly report and spike alert by e-mail, plus an HTTPS webhook.
Monetize (optional, off by default). Bots you set to Charge receive an HTTP 402 x402 payment request; x402-capable agents pay in USDC straight to your own wallet.

02How a bot request flows

RecogniseThe user agent (or a Web Bot Auth signature) names a known bot.
VerifyOfficial IP list, reverse DNS or signature gives a verdict.
DecideYour policy: Allow, Block (403), rate limit (429) or, with Monetize, Charge (402).
LogOne row in the activity log. Humans are never logged.
CompareThe referral beacon counts visitors sent back by AI assistants.

03Honest expectations

Honest expectations: please read this before you buy or go live

Signals are declarations, not protection. robots.txt, Content Signals, Content-Usage, RSL, TDMRep and noai tell bots what you allow. Bots that respect them follow them; others ignore them. What CryptoMeter enforces is the Block policy (HTTP 403) for requests that reach WordPress, plus any server rules you choose to install.
Referral counts are a lower bound. Many AI apps (and most mobile apps) hide where a visitor came from, so part of your AI traffic arrives as "direct" and cannot be counted.
Unverified does not mean spoofed. A bot whose company publishes no IP list, DNS or signature method can only be "Unverified". An IP that cannot be judged (private or proxy address, list not fetched yet, DNS failure) is "Unknown". Only a definite failed check is "Spoofed".
User agents can be faked, and bots that pose as normal browsers are not recognised as bots. CryptoMeter classifies by user agent (or signature) and then verifies; it is not a general bot-management firewall.
Page caches that answer before WordPress runs hide those requests from CryptoMeter. See Page caches.
Monetize is revenue-ready, not an income product. x402 is young and few AI agents pay today. No earnings are promised.

04Pick your path

01 · about 10 min

Quick start

Installed, a preset applied, checked with curl.

02 · 5 min

Installation

Upload or FTP, what activation does, presets.

03 · 15 min

Set your policy

Intents, per-bot exceptions, rate limits.

04 · 10 min

Check your cache

The most common setup problem.

05 · 5 min

Publish signals

robots.txt, Content-Usage, RSL, TDMRep.

06 · optional

Monetize

x402 pay-per-read in USDC, test mode first.

05What is included, and what is not

Included	Not included
The `cryptometer` WordPress plugin, with the compiled, unminified admin app (`assets/app/`) and its source (`admin-app/src/`) Translation template `languages/cryptometer.pot` Self-test script `tests/run-tests.php` Optional Node.js demo payment client `tools/pay-demo.mjs` (Monetize only) This documentation	A CDN, firewall or hosted bot-management service Detection of bots that pretend to be normal browsers Installing server or page-cache configuration on your hosting (snippets are provided) Custody of funds, private keys or seed phrases (Monetize) A facilitator service, blockchain fees or facilitator fees (Monetize) Any promise of earnings, legal or tax advice

06Words used in these docs

Term	Meaning
Bot / crawler / agent	Automated software that requests web pages: to train AI models, to build a search or AI-answer index, or to fetch a page because a person asked an assistant.
Intent	What a bot is reading for: Search engines, AI search & answers, AI agents (user-triggered) or AI training. Generic HTTP clients appear as Other clients.
Policy	Allow, Block or (only with Monetize) Charge. Set per intent, with per-bot exceptions.
Verdict	Result of the identity check: Verified, Spoofed, Unverified or Unknown (see Verification explained).
Referral	A human visit that arrived from an AI assistant (by referrer host or `utm_source`).
Crawl-to-visit	A company's bot requests divided by the visitors its assistant sent you. `14 : 1` means 14 bot requests per referred visitor.
x402	An open protocol that uses HTTP status 402 ("Payment Required") so software can pay for a web resource (x402.org). Only relevant to Monetize.

07How to read these docs

Dark boxes are commands or code. Press Copy in the corner and paste them into a terminal or file.
Bold names such as Bots & rules are screens, tabs, buttons and fields exactly as the plugin shows them.
your-site.example and {prefix} are placeholders: replace them with your domain and your WordPress table prefix (usually wp_).
Grey key names next to a field (for example log_retention_days) are the internal names used in the settings export file.
"Verified on a test install" means MIKODES ran it on WordPress Playground; anything not run is marked as such.

Offline copy

The same documentation is in the documentation folder of your download. This online version is the most recent.

CryptoMeterAI traffic control for WordPress.