Forge AI Bot Log – Block AI Bots, Crawler Detection & Verification

Changelog

1.6.2

• Fixed: Access Control blocks are now built once at plugin load and reach the robots.txt served to bots, not just the preview shown in the admin. A build taken during development had regressed to admin-only construction, so blocked bots were never actually kept out.
• Fixed: reverse-DNS verification no longer labels a genuine bot “Spoofed” when the address checked belongs to an unrecognised proxy rather than the bot itself; it’s reported “Unverified” instead, as in earlier releases.
• Fixed: uninstalling now also clears the scheduled new-bot-alert event, so nothing is left pending after removal.
• Performance: the reverse-DNS verification cache is larger (500 to 5,000 entries) and results are trusted for longer (1 hour to 6 hours), so busy sites crawled by Google, Amazon, Apple or Meta from many different addresses don’t force repeated live DNS lookups.
• Added: a mention of the Forge AI Bot Log Pro add-on — a fuller description in a panel at the bottom of Settings, and a single quiet line at the bottom of the Dashboard, Activity Log, Bot Directory and Access Control screens, plus the monthly summary and new-bot alert emails. Hidden automatically once Pro is active, and can be turned off everywhere at once with the forge_ai_bot_log_show_pro_notice filter.

1.6.1

• Added: extension hooks (actions and filters) so add-ons such as Forge AI Bot Log Pro can attach reports and capture without duplicating the core plugin. No change to tracking behaviour.
• Added: the access-log importer now exposes each parsed line, including the referrer, to add-ons, and no longer counts a bot visit twice when it was already recorded as it happened. A line for the same bot and page within two minutes of an existing record is skipped.
• Added: a warning when a caching plugin or a managed host (WP Engine, Kinsta, Flywheel, Pantheon) is active, explaining that bot visits to cached pages are not seen by WordPress, with the bot names to paste into the cache’s exclusion setting or the alternative of importing the server log file.
• Redesigned: every screen now uses one consistent layout of headings, number cards, panels, tables and coloured tags, shared with add-ons, with a “?” icon beside every number and column that needs explaining. Hover, tab to it or tap it for a plain-language explanation.
• Added: the dashboard chart splits bot visits per day into live reads, search crawls, training crawls and agents.
• Changed: bot types are named in plain words: Live read, Search crawl, Training crawl, Agent.
• Changed: “Most-visited pages” counts address variants of the same page together, so /about, /about/ and /about/?ref=1 are one row.
• Fixed: Google-Extended and Applebot-Extended are now labelled as opt-out names rather than bots. They are names used in robots.txt to control AI training and never visit a site themselves. They can still be blocked under Access Control but are no longer offered for recording.
• Fixed: tables no longer squash neighbouring panels on narrower screens; wide tables scroll sideways instead.
• Fixed: when the older pre-release “AI Bot Log” plugin was also active, its stylesheet loaded on this plugin’s screens instead of this plugin’s own, so help text showed inline and the layout looked broken. This plugin now uses its own asset names and switches the older plugin’s styles off on its screens.

1.3.0

• Added: xAI’s Grok crawlers — GrokBot, xAI-Grok and Grok-DeepSearch — to the bot directory, with an honest note that much of Grok’s fetching uses disguised browser user agents no tracker can attribute.
• Security: forwarding headers (X-Forwarded-For, X-Real-IP, CF-Connecting-IP) are no longer trusted from arbitrary clients — previously a request could forge a vendor IP in a header and have a fake crawler labelled Verified. Cloudflare’s header is now honoured only when the request genuinely arrives from Cloudflare’s published ranges, and generic proxy headers only behind a local reverse proxy.
• Fixed: hits captured by the optional early logger (mu-plugin) now record the visitor’s IP address and are labelled “No check” instead of being mislabelled “Unverified”.
• Fixed: the early logger now honours the excluded-paths and IP-anonymisation settings, matching the main logger.
• Performance: the early logger no longer reads the signature list for ordinary human traffic.
• Removed: the cross-promotion email settings and the optional remote promo feed. Existing promo settings are cleaned up automatically.

1.2.4

• Fixed: OpenAI, Anthropic and Perplexity crawlers are now verified against the vendors’ published IP-range lists instead of reverse DNS, which those vendors don’t support — genuine ClaudeBot/GPTBot hits were previously shown as Spoofed/Unverified.

1.2.3

• Documentation: expanded and clarified the readme, with new FAQs on blocking, verification and robots.txt handling.
• Documentation: corrected the verification description — hits are labelled Verified, Spoofed or Unverified, not only the first two.
• Documentation: clarified that robots.txt directives are merged into the robots.txt WordPress serves, and that a physical robots.txt file in the site root overrides them.
• Internal version constant bumped to match the plugin header, so browsers re-fetch the plugin’s CSS and JavaScript once. No other functional changes.

1.2.2

• Fixed: genuine bots visiting over IPv6 are no longer incorrectly marked “Spoofed” by DNS verification.

1.2.1

• Removed the remote bot-list auto-updater; the bundled bot list now updates via plugin releases.

1.2.0

• Added an External services disclosure for the optional promo feed.
• Added a Settings shortcut to the Plugins screen.
• New-bot alert emails are now sent on a background schedule instead of during the visit.

Older entries (1.0.0 – 1.1.1) are in changelog.txt in the plugin folder.