Tool
AMDT AI Traffic Analytics: see which AI bots read your site, and whether they are who they claim to be
AMDT AI Traffic Analytics is a free WordPress plugin that logs two things your analytics does not show you: which artificial intelligence bots read your pages, checking whether each one is genuine, and how many people reach your site after clicking a citation inside an AI assistant. It ships with a catalogue of twenty-one declared agents and measures visits from twelve assistants. Everything is stored in your own site database; nothing is sent to AMDT and there is no telemetry. It is developed by AMDT, a digital marketing consultancy in Madrid.
Coming soon on WordPress.org
Open your analytics and you see people: sessions, pages, conversions.
Two things are missing from that picture. The first is who reads your site in order to feed a language model. That is not a session; it is a server request, and your analytics — which runs on JavaScript in the browser — never counts it. The second is how many people arrive because an assistant cited you. Those are real people, but they usually end up filed under direct traffic, or scattered across referrals that tell you very little.
Two different questions, two different measurements. This plugin handles both and, just as importantly, tells you when it cannot answer them.
The bots reading your pages
The plugin logs every request from a declared agent: which bot, which page, when, and from which address. The catalogue ships with twenty-one names — OpenAI, Anthropic, Perplexity, Google, Microsoft, Apple, Meta, ByteDance, xAI and DuckDuckGo — and you can add your own.
One distinction worth making, because almost nobody makes it: of those twenty-one names, nineteen can appear in a request to your server. The other two, Google-Extended and Applebot-Extended, never visit pages. They are labels used in robots.txt to signal whether your content may be used for training, and according to Google and Apple they never appear in a request. They are in the catalogue for completeness, not because you will ever see them.
You will also find Googlebot and Bingbot there, which are classic search crawlers rather than AI agents. They are included because their index feeds AI products — AI Overviews and Copilot — so their crawling counts in this conversation too.
The people arriving from an assistant
When somebody clicks a citation inside ChatGPT, Claude, Perplexity, Gemini, Copilot, Grok, Mistral Le Chat, You.com, Phind, Kagi Assistant, DuckDuckGo or Exa and lands on your site, the plugin records it and tells you which page they reached.
These visits are measured on cached pages too, because it is the browser, not your server, that reports where the visit came from. With one condition: only visits that arrive with that information (the referrer) are counted. Visits without it cannot be attributed to any assistant, and the plugin does not guess.
Alongside that: a dashboard with totals and charts, and a log you can filter and export to CSV. None of what you see there leaves your server.
How it knows whether a bot is genuine
A bot identifies itself with a name, the User-Agent, and that name is simply text. Declaring yourself GPTBot costs exactly as much as declaring yourself anything else.
So the plugin does not take the name at face value. It checks it against the IP address the request came from, by three routes.
- The address lists operators publish. OpenAI, Anthropic and Perplexity publish the ranges their bots use.
- Reverse DNS. Google, Microsoft and Apple allow you to ask who an address really belongs to.
- Known operator networks. For Anthropic and Meta, the ranges ship with the plugin itself.
Every request ends up in one of three states: verified, impostor or unverified.
It flags an impostor only when it can prove the claim: because reverse DNS contradicts it (Google, Microsoft, Apple), because the operator list does not include that address (OpenAI, if you have enabled the download), or because the address belongs to a different known operator.
And when it cannot prove anything, it says so. Unverified does not mean suspicious. It means that with the available evidence there is no way to confirm or deny the claim. Some bots will never leave that state, because there is no list, no reverse DNS and no known network to check them against: Bytespider, Grok, and any agent you add yourself. A tool that handed out verified badges to everyone would be giving you false comfort.
llms.txt
llms.txt is a site content index written for language models. The plugin generates yours, counts who reads it, and lets you leave entries out from the editor itself.
If Yoast SEO or Rank Math are already serving theirs, the plugin does not generate another and cannot count those reads — and the dashboard tells you so. If your llms.txt comes from a different plugin, or is a file someone uploaded to the server by hand, it is not detected and you get no warning. That is a real limitation and we would rather you knew in advance.
The addresses it cannot identify
Not everything crawling your site announces itself. The plugin gathers the addresses it could not identify and hands you the blocking rule, already written, for Apache, Nginx, Cloudflare and Wordfence.
You apply the rule, in your own firewall. The plugin blocks nobody. That is deliberate: deciding who gets in is a business decision, not a box a measurement tool ticks on your behalf.
Caching, where this gets complicated
A page served from cache without passing through WordPress cannot be measured. WordPress never runs, so there is nothing to record. This affects bots, not assistant referrals, which are counted on cached pages.
With WP Rocket, LiteSpeed Cache or W3 Total Cache, the plugin offers to exclude bots from the cache at the press of a button, and the problem goes away.
With WP Super Cache, or with a server-level cache — nginx, Varnish, your host own cache, or Cloudflare caching the HTML — it cannot be done. The plugin warns you when it detects one, although it does not always detect one.
Privacy: what is stored and what is not
Everything is stored in your own site database. This is what goes into it:
- From bots and from whoever reads llms.txt: IP address, User-Agent and page.
- From people arriving via an assistant: the page, the User-Agent and the address they came from. Of their IP, only the network is stored, never the full address: for IPv4, up to the third block; for IPv6, the first forty-eight bits.
- From automated browsers posing as an iPhone: the request with its full IP address.
- From an ordinary visitor: nothing.
That last line carries one exception worth stating out loud: the automated-browser detector could, in theory, mistake a person for one. It needs two matching signals to do so, which makes it unlikely, but not impossible.
Nothing is stored in your visitor browser: no cookies, no local storage.
Data is kept for thirty, sixty or ninety days, as you choose. The diagnostic log ships switched off; if you switch it on, it also writes IP addresses and User-Agents to a file in your uploads folder. On uninstall, data is not deleted unless you tick the option in settings.
The plugin also adds suggested wording to the WordPress privacy guide (Settings → Privacy), for you to review and fold into your own policy if appropriate.
What leaves your server
Nothing reaches AMDT. There is no telemetry. There are exactly three external connections:
- The IP address lists. Once a day, the public lists from OpenAI, Anthropic and Perplexity. This ships switched off until you enable it. Until you do, OpenAI and Perplexity bots will show as unverified, and an impostor using the name of an OpenAI bot will not be caught; Anthropic bots are still checked by reverse DNS and by their networks, which ship with the plugin.
- DNS. The plugin asks your server DNS about the addresses of bots and of whoever reads llms.txt. It does not do this for people arriving from an assistant.
- Your own home page. At most twice a day, to check whether there is a cache sitting in front of WordPress.
What it does not do
We would rather tell you than have you find out:
- It does not block bots. It tells you who came and hands you the written rule; applying it is yours to decide.
- It does not improve your AI visibility or make anyone cite you. It measures. What you do with the measurements is a separate conversation.
- It does not see everything. It misses pages served by a server-level cache, bots presenting themselves as ordinary browsers, and assistant referrals that arrive without a referrer.
- It carries no API, no MCP server and no WebMCP. The free version measures; it does not serve content to agents.
Requirements and installation
You need WordPress 6.9 or later and PHP 8.1 or later. The plugin is free and distributed under GPL v2 or later. The panel is in English, with a Spanish translation included.
If there is a CDN or external proxy in front of your site other than Cloudflare, you will need to declare it in settings. If you do not, every visit will show the proxy address and the measurement will be worthless. A proxy on the same server or on a private network is accepted automatically.
Coming soon on WordPress.org
AMDT AI Traffic Analytics
Frequently asked questions
How can I tell whether ChatGPT or Claude are reading my site?
Language model bots identify themselves by name on every request to your server — GPTBot, ClaudeBot, PerplexityBot and others — but your usual analytics does not record them, because it runs on JavaScript in the browser and a bot does not execute JavaScript. You have to measure at server level. AMDT AI Traffic Analytics logs those requests, checks whether each bot is genuine, and tells you which pages were read.
Does it block AI bots?
No. It tells you who came in and hands you the blocking rule, already written, for Apache, Nginx, Cloudflare and Wordfence. Whether you apply it, and applying it in your firewall, is yours to decide.
Does it work if I use a caching plugin?
It depends what is being measured. Human visits from assistants are counted on cached pages too, provided they arrive with a referrer. Bot requests are only recorded when the page passes through WordPress; with WP Rocket, LiteSpeed Cache or W3 Total Cache the plugin offers to exclude bots from the cache at the press of a button. With WP Super Cache or a server-level cache, it is not possible.
I already have the llms.txt from Yoast SEO. What happens?
Yoast keeps serving it. This plugin does not generate its own and cannot count who reads it, and the dashboard says so. If your llms.txt comes from a different plugin or from a file uploaded to the server, it is not detected.
What data does it store, and where?
In your own site database. From bots: IP, User-Agent and page. From people arriving via an assistant: the page, the User-Agent, the originating address, and only the network portion of their IP, never the full address. From an ordinary visitor, nothing. Data is kept for thirty, sixty or ninety days, as you choose.
Does it send anything to AMDT?
No, and it carries no telemetry. The only external connections are the daily download of the public IP lists — which ships switched off until you enable it — queries to your server DNS, and a request to your own home page, at most twice a day, to detect caching.
Do I need Cloudflare?
No. If you have a CDN or external proxy in front of your site other than Cloudflare, you simply declare it in settings.
Is data deleted on uninstall?
Not by default. Only if you tick the option in settings before uninstalling.
Support
If you find a bug or behaviour that does not add up, write to us through the contact form.
AMDT AI Traffic Analytics is a tool developed by AMDT, a digital marketing consultancy in Madrid.
Read this tool privacy policy.
If what you need is the next step
Measuring is where it starts. Once you know who is reading you, the question stops being how many bots came in and becomes on what terms you want them to.
AgentGate is the AMDT plugin for WordPress and WooCommerce that takes that step: alongside measurement, it serves your content to AI agents through an API and an MCP server, declares the usage permissions for your content, defends that API and analyses what you publish. On platforms that are not WordPress — PrestaShop, Shopify, Magento or bespoke builds — AMDT implements the same layer as custom work rather than as a plugin.
Both versions use the same data, so moving from one to the other loses nothing you have already measured.
