Posterna

How it works:

• The check runs early on each request, before the theme loads, inside your own site. Requests never go anywhere else.
• The operator directory (which agents exist, their user-agent tokens, published IP ranges, reverse DNS rules and signing keys) ships with the plugin. You can turn on signed updates from posterna.com; they are off by default.
• Reverse DNS lookups never run during a page load. A new address is queued, looked up by WP-Cron, and cached (24 hours when confirmed, 1 hour when not). Until then the request is labeled “claimed, cannot be checked”.
• Every error path fails open: if anything goes wrong, the request goes ahead and is labeled as a browser or unknown automation.
• The plugin does not log or store IP addresses, full URLs, headers or request bodies. Its table holds hourly counts only, and rows older than 90 days are removed.

Posterna is open source. The verifier follows the same specification and passes the same conformance tests as the Posterna packages for Node.js: https://github.com/posternahq/posterna

External services

Posterna works without contacting any outside server. It can connect to one service, posterna.com, run by the Posterna project, through two optional features. Both are off by default and do nothing until an administrator turns them on in Posterna > Settings.

1. Directory updates (setting: “Download updates to the operator directory from posterna.com”)

• What it is for: keeping the list of AI operators, their published IP ranges and signing keys current between plugin updates.
• What is sent: a plain HTTPS download request for https://posterna.com/v1/directory.json, https://posterna.com/v1/keys.json and their .sig signature files, with the User-Agent Posterna-WordPress/1.0.0 . No site address, visitor data or counts are sent. Like any web request, it shows posterna.com your server’s IP address.
• When: once a day for directory.json, once an hour for keys.json, right after the setting is turned on, when an administrator clicks “Check for updates now”, and at most once every 10 minutes when a signed request uses a key the site does not have yet.
• The downloaded files are used only if their Ed25519 signature checks out against keys built into the plugin.

2. Connection to posterna.com (setting: “Site key”)

• What it is for: showing this site’s counts on the posterna.com dashboard.
• What is sent: the site key you pasted (to identify the site), and the counts shown on the Posterna page: per hour, the number of requests with each verdict and reason code, by operator, agent, purpose and path group (such as /blog/* ), plus the plugin and PHP version, a random ID for this installation, the directory version, whether a proxy problem was detected and a count of errors. Path groups never contain more than the first part of a path, and parts that look like numbers, IDs or e-mail addresses are replaced with /:id/* . It never sends IP addresses, full URLs, headers, request bodies, user names or e-mail addresses. Sign-up counts are not sent.
• When: every five minutes while a site key is set, and when an administrator clicks “Send counts now”. Clear the site key to stop.
• Where: https://posterna.com/v1/ingest

posterna.com terms of service: https://posterna.com/terms posterna.com privacy policy: https://posterna.com/privacy

Privacy

Posterna does not store IP addresses, full URLs, headers, request bodies or anything else about a single request. Its database table holds hourly counts by verdict, reason, operator, agent, purpose and path group, kept for 90 days. Reverse DNS results are cached in transients keyed by a hash of the address, for up to 24 hours. Sign-ups are counted by verdict only; nothing about the person is recorded. Nothing leaves the site unless you turn on one of the two optional features described under “External services”.

Data and credits

The plugin includes a snapshot of the Posterna operator directory ( data/directory.json and data/keys.json ), licensed under CC BY 4.0: Posterna operator directory (https://github.com/posternahq/posterna), CC BY 4.0. Records marked as community records are derived from the ai.robots.txt project (https://github.com/ai-robots-txt/ai.robots.txt), used under the MIT License. Details and the license notices are in data/README.md .

The plugin code is licensed under the GPL, version 2 or later. It bundles no third-party code. Signatures are checked with the libsodium functions built into PHP, or the sodium_compat copy that ships with WordPress.