Verify AI Agents & Block Fake AI Bots | AxioRank

How it works, in plain terms

1. 01You install the plugin and connect it to your AxioRank account with a site key, a long code that identifies your site.
2. 02The plugin quietly watches the sensitive parts of your site: the login page, search, and the technical doorways that apps and integrations use to talk to WordPress (the REST API, admin-ajax, and XML-RPC).
3. 03When a request looks automated, because it carries an agent signature or a bot-style user agent, the plugin asks AxioRank one question: who is this, and are they really who they claim to be?
4. 04In Monitor mode, which is the default, the answer is simply recorded. Nothing is blocked. Your AxioRank dashboard builds up a picture of which AI agents visit your site, what they touch, and which of them are verified, unknown, or impostors.
5. 05When you have watched for a while and feel confident, you flip one switch to Enforce mode. From then on, agents that fail verification or break your rules receive a standard “access denied” response instead of getting through.

What you get

• A clear picture of the AI agents using your site, based on verifiable identity instead of easily faked names.
• Monitor mode by default: watch first, decide later. Nothing is blocked until you say so.
• Enforce mode when you are ready: verified agents pass, impostors and unwanted agents are turned away.
• A dedicated AxioRank menu in your WordPress admin with four tabs: an Overview, a live Activity log, a Rules manager, and Settings.
• A per-request activity log that shows each automated visit, its verdict, its risk score, the reason it was flagged, and the endpoint it reached, all without leaving WordPress.
• Rules you can set from WordPress: allow, challenge, or block a specific agent, a whole category, a verification status, or a risk threshold. One click on the activity log turns any agent into an allow or block rule.
• Simple scope controls: tick boxes decide which parts of the site are covered, and the recommended set is preselected.
• A branded, customizable page for blocked requests, with your own message.
• A dashboard glance widget, a Site Health check, and WP-CLI commands (wp axiorank status, test, activity, posture) for people who like the command line.
• A safety-first design: if AxioRank is ever slow or unreachable, your site keeps serving visitors as if the plugin were not there.

Manage agents right from WordPress

Version 0.3.0 turns the plugin from a quiet monitor into a control room. The new Activity tab lists the most recent automated visits with the details you need to make a decision: who the agent claims to be, whether that claim checks out, a risk score, the specific signal that raised a flag, and the exact endpoint that was hit. Next to each one, a single click creates an allow or block rule.

The new Rules tab manages the real rules on your AxioRank surface, so you do not need to open the dashboard for everyday decisions. Set the surface to monitor or enforce, then add rules that allow, challenge, or block by agent, by category (such as scrapers or training crawlers), by verification status, or by risk. Rule management uses a site key with the management permission, which the keys AxioRank issues already include.

What this plugin does not do

Honesty helps here, so two things up front.

First, this is not a general firewall, malware scanner, or comment spam filter. It does one job well: verifying the identity of automated visitors on the parts of your site that do real work.

Second, pages served straight from a full-page cache or a CDN never reach WordPress, so the plugin cannot see or block those. It stops fake AI bots and scrapers that reach the origin: a cache miss, your dynamic pages, login, search, form handlers, and app connections, which is where logins, form submissions, and data access actually happen. To police crawlers on fully cached pages too, verify at the edge, in front of the cache.

What information is sent to AxioRank?

The plugin is a small connector for the AxioRank service, so this deserves a plain answer.

For each request the plugin decides to check, it sends AxioRank the basics needed to verify identity: the address that was requested, the request type (such as GET or POST), the visitor’s stated user agent, the visitor’s IP address, and the technical headers that carry the agent’s signature.

It never sends cookies, passwords, login credentials, or the contents of forms and posts. Ordinary logged-out page reads by people are not checked at all.

Verification is provided by AxioRank . See the terms of service and the privacy policy .

Requirements

You need an AxioRank account and a site key for your website (it starts with axr_site_). The free plan is enough to get started.