Tactical — AI Agent Detection for WooCommerce

Changelog

1.1.0

  • New: server-side AI crawler detection. Detects AI crawlers that don’t run JavaScript (most retrieval crawlers) by matching the request user-agent against a maintained registry of AI operators (OpenAI, Anthropic, Perplexity, Google, Meta, Apple, Amazon, ByteDance, Mistral, DuckDuckGo, and more). Fires only on a matched AI user-agent — zero extra work, and zero measurable impact, for human visitors.
  • Non-blocking delivery (wp_remote_post with blocking => false, 1s timeout) and a 60-second per-(agent, URL) dedup guard against crawler bursts.
  • New settings toggle “Server-side AI crawler detection” (on by default) with a “last event sent” status line.
  • Optional tactical_trust_proxy_headers filter to read the crawler’s real IP from CDN/proxy headers when the store is behind Cloudflare or similar.

1.0.2

  • Security: removed the data-key attribute from the storefront <script> tag. The Tactical API key is a server-side secret used to sign WooCommerce webhook deliveries and authenticate plugin-to-server API calls — it must not appear in browser-rendered HTML. The snippet identifies the tenant by data-shop plus the request Origin, so no key is required client-side. Recommended upgrade for all installs.

1.0.1

  • Compliance: storefront snippet now loads via wp_enqueue_script with the defer strategy, decorated via the script_loader_tag filter. No more inline <script> injection.
  • Compliance: settings-page admin JS extracted to assets/admin-settings.js, enqueued via wp_enqueue_script + wp_localize_script. No more inline <script> in the admin page.
  • Compliance: declared Requires Plugins: woocommerce so WP correctly blocks activation without WooCommerce.
  • Readme: added the “External services” disclosure, clarified Scout/Tactical naming in the pricing section, updated Contributors.
  • Bumped Requires at least to WP 6.3 (needed for wp_enqueue_script defer/async strategy).

1.0.0

  • Initial release.
  • Snippet injection on the storefront when an API key is configured.
  • Settings page with API key, store domain, and “Verify connection” button.
  • Auto-registration of WooCommerce webhooks for order and product topics.
  • Uninstall removes options + Tactical-managed webhooks.

Plugin Website
Visit website

Author
sourabhnk
Version:
1.1.0
Last Updated
July 6, 2026
Requires
WordPress 6.3
Tested Up To
WordPress 6.9.4
Requires PHP
7.4

Share Post

Join our newsletter.

Get insights into what’s happening at ChangelogWP right in your inbox. We don’t believe in spam.