Exact status codes, redirect tracking, queued delivery with retries, and correct visitor IPs behind proxies. Update to keep reporting: Citlyze now expects this version's event format.<\/p>","2.0.0":"
Encrypted signing-secret storage, enforced HTTPS endpoints, and a stricter signed request format. Re-paste your signing secret after upgrading.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3653705,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3653705,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3653705,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3653705,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["2.1.0","2.2.0","2.3.0"],"block_files":[],"assets_screenshots":{"screenshot-1.png":{"filename":"screenshot-1.png","revision":3653705,"resolution":"1","location":"assets","locale":"","width":2560,"height":1580},"screenshot-2.png":{"filename":"screenshot-2.png","revision":3653705,"resolution":"2","location":"assets","locale":"","width":2560,"height":1580},"screenshot-3.png":{"filename":"screenshot-3.png","revision":3653705,"resolution":"3","location":"assets","locale":"","width":2560,"height":1580}},"screenshots":{"1":"Connection settings, the write-only signing-secret field, and the signed connection test.","2":"Verified AI crawler visits in the Citlyze dashboard: totals, top crawler, trend, and visits over time.","3":"User-triggered agents and verification diagnostics: verified totals kept separate from unverified user-agent claims."}},"plugin_section":[],"plugin_tags":[244526,2353,232,2591,186],"plugin_category":[36,55],"plugin_contributors":[276381],"plugin_business_model":[],"class_list":["post-350870","plugin","type-plugin","status-publish","hentry","plugin_tags-aeo","plugin_tags-ai","plugin_tags-analytics","plugin_tags-geo","plugin_tags-seo","plugin_category-analytics","plugin_category-seo-and-marketing","plugin_contributors-citlyze","plugin_committers-citlyze"],"banners":{"banner":"https:\/\/ps.w.org\/citlyze-ai-crawler-tracker\/assets\/banner-772x250.png?rev=3653705","banner_2x":"https:\/\/ps.w.org\/citlyze-ai-crawler-tracker\/assets\/banner-1544x500.png?rev=3653705","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/citlyze-ai-crawler-tracker\/assets\/icon-128x128.png?rev=3653705","icon_2x":"https:\/\/ps.w.org\/citlyze-ai-crawler-tracker\/assets\/icon-256x256.png?rev=3653705","generated":false},"screenshots":[{"src":"https:\/\/ps.w.org\/citlyze-ai-crawler-tracker\/assets\/screenshot-1.png?rev=3653705","caption":"Connection settings, the write-only signing-secret field, and the signed connection test."},{"src":"https:\/\/ps.w.org\/citlyze-ai-crawler-tracker\/assets\/screenshot-2.png?rev=3653705","caption":"Verified AI crawler visits in the Citlyze dashboard: totals, top crawler, trend, and visits over time."},{"src":"https:\/\/ps.w.org\/citlyze-ai-crawler-tracker\/assets\/screenshot-3.png?rev=3653705","caption":"User-triggered agents and verification diagnostics: verified totals kept separate from unverified user-agent claims."}],"raw_content":"\n
AI Crawler Tracker by Citlyze shows you which AI crawlers visit your WordPress site and which AI answer engines send you human visitors. It is built for AI SEO: generative engine optimization (GEO), answer engine optimization (AEO), and LLM visibility measurement.<\/p>\n\n
AI search engines and LLM chatbots such as ChatGPT, Claude, Perplexity, Gemini, and Copilot discover your content by crawling it, and most AI bots never execute JavaScript, so JavaScript analytics tools cannot see them. This plugin runs server-side inside WordPress, so it observes the AI bot traffic that reaches PHP and reports it to your Citlyze workspace.<\/p>\n\n
A Citlyze account and a site key generated in Citlyze are required. Tracking stays inactive until an administrator enters valid settings. The plugin sends signed events only for matching crawler, signed-agent, or AI-referral requests. Citlyze independently verifies supported crawler sources before adding them to verified totals; other claims remain separate diagnostics.<\/p>\n\n
AI search is becoming a real discovery channel. Whether ChatGPT, Perplexity, or Gemini can cite your site starts with whether their crawlers can reach it. Tracking AI crawler visits tells you which bots read your content, how often they come back, and which pages they fetch, and tracking AI referrals tells you when that visibility turns into visitors. That measurement is the foundation of any GEO or AEO strategy.<\/p>\n\n
This plugin connects to the Citlyze endpoint entered by the site administrator. It requires a Citlyze account and cannot provide tracking without that service.<\/p>\n\n
For a request from a known AI crawler or signed agent, the plugin sends the visitor IP address, user agent, requested path, query string, HTTP status code, HTTP method, the request host, and for redirects the redirect destination (a same-site path, or only the domain for an external destination) and the name of the plugin that issued it. When Web Bot Auth is present, it also sends bounded Signature, Signature-Input, Signature-Agent, and safe original-request metadata so Citlyze can independently verify the signature. When a human visitor arrives from a supported AI answer engine, the plugin sends the referrer URL without its query string. The site key ID, a timestamp, a request signature, and a one-time nonce authenticate each batch. Once a day the plugin also downloads Citlyze's current list of known crawlers, signed with your site key, so newly launched crawlers are recognised without a plugin update.<\/p>\n\n
Data is sent only when the request carries a recognised crawler user agent, contains bounded Web Bot Auth headers, comes from a supported AI-referrer host, or when an administrator explicitly sends a connection test. Requests are never sent for ordinary human page views, and a human visitor's query string is never sent. Matching requests wait in a table in your WordPress database until delivery, at most one day. Citlyze uses the IP address and signature metadata transiently for verification and does not store them. Referrer URLs are not stored. Citlyze persists aggregate counters, and on plans that include the crawl log it also keeps a per-request record of verified crawler and signed agent visits (time, path, sanitized query string, status code, and redirect destination; never an IP address or user agent) for up to 30 days. Sanitized user-agent samples may be retained in bounded diagnostics for unrecognized bots.<\/p>\n\n
Service terms: https:\/\/citlyze.com\/terms-of-service<\/p>\n\n
Privacy policy: https:\/\/citlyze.com\/privacy-policy<\/p>\n\n\n
For security-conscious hosts, define Only when the request reaches WordPress. A full-page cache or CDN can respond without running PHP, so those crawler visits are not visible to this plugin. The settings page tells you when it detects a page cache. Use the Citlyze Cloudflare Worker, or upload your server logs in Citlyze, for sites where most traffic is served from a cache or the edge.<\/p><\/dd>\n Anything that never reaches WordPress: redirects done by your web server or CDN (for example rules in .htaccess or nginx, or a host-level redirect to https or www), requests a firewall blocks before WordPress loads, and pages served from a full-page cache. The Citlyze Cloudflare Worker or a log upload covers those.<\/p><\/dd>\n Citlyze confirms a crawler by its IP address, so the plugin needs the real visitor address. Behind Cloudflare this works automatically: the plugin trusts Cloudflare's visitor header only for requests that come from Cloudflare's own network. Behind another proxy, choose the header it sets and list its addresses under Settings > AI Crawler Tracker > Visitor IP behind a proxy.<\/p><\/dd>\n The plugin recognises crawlers that issue live page requests, including GPTBot, ChatGPT-User, OAI-SearchBot, ClaudeBot, PerplexityBot, Googlebot, Google Gemini Notebook, Google-Agent, Atlassian Rovo, Amazonbot, Applebot, Bingbot, Meta crawlers, and others. The list is updated with each release.<\/p>\n\n Citlyze independently confirms that a request genuinely came from the crawler it claims to be before counting it as verified. A user-agent string on its own is only a claim, so unconfirmed requests are reported separately as diagnostics and never inflate verified crawler totals.<\/p><\/dd>\n Tracking is the measurement side of generative engine optimization. The plugin shows whether AI crawlers actually reach your pages and whether AI answer engines send you visitors, so you can tell if your optimization work is having an effect. It does not modify your content or your robots.txt.<\/p><\/dd>\n Events go to the Citlyze endpoint configured in Settings. See the External services section for the exact fields, timing, retention summary, and policy links.<\/p><\/dd>\n The secret you paste is never stored. It is reduced to a derived signing key immediately, and that key is encrypted using your site's own WordPress salts before it is written to the database. The field is write-only: once saved, the value cannot be read back through the admin screen.<\/p>\n\n You can avoid database storage entirely by defining CITLYZE_CRAWLER_SIGNING_KEY in wp-config.php instead.<\/p>\n\n If a database backup leaks, rotate the site key in Citlyze under AI Crawlers > Install tracking. Rotation invalidates the old key immediately.<\/p><\/dd>\n\n<\/dl>\n\n\nCITLYZE_CRAWLER_SIGNING_KEY<\/code> in wp-config.php<\/code>. The plugin hashes it in memory and does not store it in the WordPress database. CITLYZE_CRAWLER_ENDPOINT<\/code> and CITLYZE_CRAWLER_KEY_ID<\/code> may be defined there as well.<\/p>\n\n\n\n
Does this work with full-page caching or a CDN?<\/h3><\/dt>\n
What can the plugin not see?<\/h3><\/dt>\n
My site is behind a proxy or load balancer. Does verification still work?<\/h3><\/dt>\n
Which crawlers are counted?<\/h3><\/dt>\n
Does this help with AI SEO, GEO, or AEO?<\/h3><\/dt>\n
Where does the data go?<\/h3><\/dt>\n
How is the signing secret stored?<\/h3><\/dt>\n
2.3.0<\/h4>\n\n
\n
2.2.0<\/h4>\n\n
\n
2.1.0<\/h4>\n\n
\n
2.0.0<\/h4>\n\n
\n