=== TrafficPaywall – Get Paid for AI Crawler Access ===
Contributors: mbskydis
Tags: ai, ai crawlers, gptbot, monetization, bots
Requires at least: 6.2
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.0.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

AI companies crawl your content. TrafficPaywall lets them pay for access instead of taking it for free.

== Description ==

**Get paid when AI crawlers access your WordPress site.**

AI companies send crawlers such as GPTBot, ClaudeBot, CCBot and Bytespider to read your articles and train their models. They take your content for free. TrafficPaywall makes them pay for it.

* **AI crawlers pay per request.** You set the price per 1,000 requests in your TrafficPaywall dashboard (for example $5). Crawlers that pay get your pages. Crawlers that don't pay get a "402 Payment Required" response instead of your content.
* **You keep 75%.** Every payment goes to your balance and is paid out to your bank through Stripe. The plugin is free; there is no subscription.
* **People and search engines are never charged.** Visitors read exactly as before. Google, Bing and other search engines, ad crawlers (AdSense, Google Ads) and AI answer engines that send you visitors (ChatGPT search, Perplexity) pass for free, so your SEO and ads keep working.
* **One click to connect.** Click "Connect and start earning", sign in, confirm your site. No DNS change, no Cloudflare account, no hosting change.
* **See what AI takes.** The TrafficPaywall screen in WordPress shows your AI revenue, paid requests, AI requests detected, unpaid requests stopped and the estimated amount of content that was not handed over, plus your top crawlers.

= How it works =

1. Each request is classified on your own server, using crawler rules the plugin downloads every hour. Nothing is sent to TrafficPaywall for normal page views.
2. Known AI training crawlers and scripted scrapers without payment get HTTP 402 with instructions on how to pay. Crawlers that pretend to be Googlebot from the wrong network are caught as well.
3. A crawler that pays sends its TrafficPaywall key with the request. The plugin confirms the payment with TrafficPaywall and serves the page.
4. If a real person is ever caught by mistake, they click "I'm human — continue", pass a quick check and keep reading for 24 hours.

AI companies hold one prepaid balance that works on every TrafficPaywall site, so paying you takes them one line of code.

= Built to never break your site =

* If TrafficPaywall is unreachable, your site keeps working: decisions are made locally, and paid requests are let through when a payment cannot be confirmed.
* Logged-in users, wp-admin, logins, cron, AJAX, form posts, webhooks, robots.txt, sitemaps, ads.txt, llms.txt and /.well-known/ are never touched.
* 402 responses are never stored in page caches. A built-in site check tells you if a page cache answers before WordPress, and can fix WP Super Cache, W3 Total Cache and WP Rocket for you.

= What is protected =

All public pages, posts, archives and feeds for anonymous visitors, and the REST API (for example `/wp-json/wp/v2/posts`) for anonymous clients, because scrapers use it to pull full articles.

The plugin also publishes your license terms where AI companies look for them: a `License:` line in robots.txt, a `<link rel="license">` tag in your pages and a `Link` header on responses to crawlers.

== External services ==

This plugin connects to the TrafficPaywall service (trafficpaywall.com), operated by TrafficPaywall, to process crawler payments. **Nothing is sent before you click "Connect and start earning"** (or enter a site key under Advanced). Disconnecting stops all requests.

Terms of service: https://trafficpaywall.com/terms
Privacy policy: https://trafficpaywall.com/privacy

What is sent, when, and to which address (all under https://trafficpaywall.com):

* **Connect** – `https://trafficpaywall.com/connect/wordpress` opens in your browser with your site address, a random one-time state value and the address of the WordPress admin screen to return to. After you confirm, your server sends the one-time code it received and your site address to `POST /api/v1/connect/wordpress/exchange` and receives the site key and signing secret.
* **Site settings** – every 5 minutes, `GET /api/v1/config/{site key}` downloads your mode, price and license links. Only the site key is sent.
* **Crawler rules** – every hour and when you connect, `GET /api/v1/rules` downloads the public list of crawler user agents and network ranges. Nothing about your site or visitors is sent.
* **Reporting** – every 10 minutes, `POST /api/v1/ingest` sends aggregate counts per day of AI and bot requests (outcome, crawler category and crawler name, number of requests and estimated bytes not delivered), signed with your site key. No IP addresses, user agents, URLs, cookies or other visitor data are sent. Human visits are only included as one sampled daily total.
* **Paid requests** – only when a request carries TrafficPaywall payment credentials (an API key, license token or TrafficPaywall session cookie), `POST /api/v1/spend` sends the credential and the full URL of the page requested, signed with your site key, to charge the crawler. This call is made from your server while the request is handled.
* **Dashboard** – when you open the TrafficPaywall screen in wp-admin, `GET /api/v1/site/summary` loads this month's revenue, paid requests and payout status (cached for 5 minutes). Only the site key and a signature are sent.

Visitors who click "I'm human — continue" on the 402 page go to `https://trafficpaywall.com/access` in their browser, pass a check, and are sent back to your site with a signed pass that is stored in a `tp_access` cookie for up to 24 hours and verified on your server.

For the site check and for estimating page size, your server also requests your own home page and up to three recent posts (loopback requests to your own site; nothing is sent to TrafficPaywall).

== Installation ==

1. Install and activate the plugin from Plugins → Add New (search "TrafficPaywall"), or upload the zip.
2. Open **TrafficPaywall** in the admin menu and click **Connect and start earning**.
3. Sign in to TrafficPaywall (a magic link is emailed to you) and confirm your site. You are sent back to WordPress, connected, and the site check runs.
4. In your TrafficPaywall dashboard, set up payouts to your bank and adjust your price if you like.

If your site is behind Cloudflare, the plugin detects it and uses the real visitor IP. For another reverse proxy or load balancer, set Advanced → "Behind Cloudflare / reverse proxy" to **Yes**.

== Frequently Asked Questions ==

= Will this hurt my Google rankings or my ads? =

No. Search engine crawlers (Googlebot, Bingbot, Applebot, DuckDuckBot and others) and ad crawlers (AdSense, Google Ads landing-page checks) always pass for free. Googlebot is verified by Google's published network ranges, so fake "Googlebots" are charged instead. robots.txt and sitemaps are never blocked.

= Will my visitors see anything? =

No. People read exactly as before. Traffic from cloud and datacenter networks with a normal browser is only counted as a "possible bot", not stopped, unless you choose to charge it in your dashboard.

= How much will I earn? =

It depends on how much AI crawler traffic your site gets and your price. The TrafficPaywall screen shows how many AI requests your site gets and how many were stopped because the crawler did not pay. You can also switch to Monitor mode in your dashboard to count without stopping anything.

= How and when am I paid? =

Your share (75% of what crawlers pay) accumulates in your TrafficPaywall balance and is paid out to your bank through Stripe. Set up payouts in your dashboard.

= How do crawlers pay? =

A crawler sends `Authorization: Bearer <TrafficPaywall key>` with its request. The plugin confirms the charge with TrafficPaywall and serves the page with an `x-tp-charged` header. A crawler is charged at most once per page per day. Crawlers without credits get a 402 response that explains how to buy them.

= Does it slow my site down? =

No. Requests are classified on your server in well under a millisecond, with no call to TrafficPaywall. Counters are written after the page is sent. Only paid crawler requests wait for TrafficPaywall to confirm the payment.

= What if TrafficPaywall is down? =

Your site keeps working. Unpaid AI crawlers are still stopped from the rules stored on your site, and paid requests are let through when payment cannot be confirmed.

= Does it work with page caches? =

Yes, with one step. A page cache that serves stored pages before WordPress loads also serves them to crawlers. The site check detects this and shows how to exclude AI crawlers from the cache; for WP Super Cache, W3 Total Cache and WP Rocket it can do it for you with one click. For host and CDN caches it links to Edge Protection, which stops unpaid crawlers before they reach your server.

= Can I keep something free for bots? =

Yes, with the `trafficpaywall_skip_request` filter, for example to keep RSS feeds free:

`add_filter( 'trafficpaywall_skip_request', function ( $skip, $req ) { return $skip || false !== strpos( $req->path, '/feed' ); }, 10, 2 );`

= Where is robots.txt handled? =

The `License:` line is added to the robots.txt that WordPress generates. If you have a physical robots.txt file, add the line yourself; the address is in your TrafficPaywall dashboard.

= What does uninstalling remove? =

Deleting the plugin removes its database table, settings and scheduled jobs. Your TrafficPaywall account and earnings are not affected.

== Screenshots ==

1. Connect screen: one button to start earning.
2. Dashboard: AI revenue, paid requests, AI requests detected and top crawlers this month.
3. Site check: confirms AI crawlers get "402 Payment Required" and fixes page caches.

== Changelog ==

= 1.0.0 =
* First release: one-click connect, local crawler classification with verified crawler networks, per-request payments, in-WordPress dashboard, site check with page-cache fixes, license discovery (robots.txt, link tag, Link header).

== Upgrade Notice ==

= 1.0.0 =
First release.
