Agent Stamp

ChatGPT can find your products. Can it check out?

ChatGPT, Claude, Perplexity, Grok and Google’s agents now shop for people. Many get stuck at a captcha, a required account or a firewall, and WooCommerce never tells you. Agent Stamp does.

What you get, free

• The agent funnel. How many AI agents visited, opened a product, built a cart, reached checkout and paid, for the last 7, 30 or 90 days.
• Why they did not buy, in money. Captcha, account required, 403 from a security plugin, out of stock, no shipping, a rejected field, a failed payment. Each reason shows the cart value your store stopped and what to change.
• A 0-100 readiness score with one-click fixes for guest checkout and letting signed agents skip the captcha.
• A stamp on every order: Human, ChatGPT, Claude, Likely agent, Unattended, API or Unknown, plus a Buyer column on the orders list.
• Evidence for disputes. Download the JSON evidence record for any order.
• A weekly email with agent revenue and the top reasons agents failed. Quiet weeks stay quiet.

How it works

1. Install and activate. WooCommerce must be active.
2. Open WooCommerce > Agent Stamp > Readiness and apply the one-click fixes.
3. Watch the Agents tab fill in as agents visit. Every new order gets its stamp.

Nothing is blocked unless you turn a rule on. Signatures are checked on your own server, and checkout traffic is not sent to another company. A person’s visit is not recorded.

Agent readiness

The Readiness tab scores the store from 0 to 100: whether the store is live or still in coming soon mode, guest checkout, captcha at checkout, robots.txt for shopping crawlers and agents, product data and barcodes, product markup, shipping and returns pages, the Store API, signature support, and agents refused in the last 30 days. Guest checkout, and letting signed agents skip the captcha, are one click. The same outside checks run free at https://getagentstamp.com/check.

Rules

Nothing is blocked or held unless you turn a rule on. An agent with a verified signature is never refused or held by a rule.

• Signed agent: always accepted. Optionally skips hCaptcha or Simple Cloudflare Turnstile. People still see the captcha.
• Likely agent: allow, or hold for review. Never refused, since a person may have placed it.
• Unattended: allow, hold the paid order, or refuse and ask the agent to identify itself. No person used the place-order control, and no agent named itself.
• Every other checkout has no rule: a declared name, an agent named by the payment, this store’s REST API, an agent protocol, a person, and Unknown.
• Agent Stamp Pro, a separate plugin, adds its own rules: a card-testing guard, a buyer confirmation email for agent orders, holding agent orders until the buyer confirms, and a dispute reply built from the order.

The stamp on each order

Agent Stamp writes one line on the WooCommerce order you already open.

• Human, when the checkout came from an ordinary browser and carried no agent signature.
• A named agent, when the request has a valid Web Bot Auth signature, or when the user-agent is a published agent such as ChatGPT-User, Claude-User, Perplexity-User, Google-Agent, or GrokAgent.
• Likely agent, when a trusted click placed the order but the page saw at least two signs that a program drove the browser. It is labeled likely, not proof.
• A named agent from the payment, such as ChatGPT (payment), when the order came from Stripe’s or PayPal’s own agent checkout, or Stripe named the agent on the payment. Many agents look like an ordinary browser, so the payment is a second place to catch them.
• Unattended, when the checkout page saw no person use the place-order control, or the browser reported itself as automated.
• API, when the order was created through the REST API or a commerce protocol channel, not the checkout page.
• Unknown, when the request is anything else, including a signature that does not check out, or a crawler such as GPTBot claiming to check out.

The orders list gets a Buyer column. The Orders tab shows the last 30, 90 or 365 days: how many orders were not a person, the revenue from them, and the orders, revenue and share for each buyer. Each order box has a JSON download of the evidence record and its fingerprint, for a dispute or a chargeback reply.

A claimed name is not treated as proof. If a request says it is ChatGPT and the signature fails, the order stays Unknown. The signature is checked on your server. Checkout traffic is not sent to another company.

Once a week, if AI agents visited or any order was not a person, the site admin gets one email: how many orders were not a person and the revenue from them, how far agents got, the top reasons they failed, and the orders. Weeks with neither stay quiet.

What it cannot see

Requests a CDN or firewall refused before WordPress ran, pages a full-page cache served, and agent browsers that look like a person until checkout. The cart value counts only carts the store itself stopped with an error.

External services

Agent Stamp does not send your customers, orders, or agent visits to its author or to Freemius. Agent visits are kept in a table on your store for 90 days, then deleted. A person’s visit is not recorded. Error text is kept without email addresses or long numbers.

When a checkout request carries a Web Bot Auth signature, the plugin reads the Signature-Agent header, which names the agent operator’s site, for example https://chatgpt.com. Your store then makes one HTTPS GET request to that operator’s public key directory at /.well-known/http-message-signatures-directory to check the signature. The request sends no order, customer, or cookie data. Only public hosts on port 443 are fetched, and the answer is cached for an hour. Each operator’s own terms and privacy policy cover that request, for example OpenAI (https://openai.com/policies/) or Google (https://policies.google.com/).

Checkouts without a signature make no outside request.

Payment check (Stripe): if your store takes payments with the WooCommerce Stripe Gateway plugin, and that plugin supports Stripe’s agentic commerce API, then after an order is paid with Stripe, Agent Stamp asks Stripe once, in the background, whether an AI agent made that payment. The request goes through the Stripe Gateway with your own Stripe account and sends only that payment’s ID. Stores without the Stripe Gateway make no such request. Stripe’s terms: https://stripe.com/legal. Privacy policy: https://stripe.com/privacy.

Freemius: the plugin includes the Freemius SDK (https://freemius.com), which runs the Agent Stamp Pro upgrade, free trial and license. On activation it asks whether you want to opt in. If you opt in, Freemius receives your WordPress user’s name and email, the site address and title, the WordPress, PHP and plugin versions, the site language, and the list of plugins and themes, and is told when Agent Stamp is activated, deactivated or uninstalled. If you skip, nothing is sent, unless you choose to send a reason when you deactivate the plugin. Starting a trial or buying Pro also goes through Freemius. Freemius terms: https://freemius.com/terms/. Privacy policy: https://freemius.com/privacy/.