#1070 Add opt-in AI-bot identity verification snippet - #1077
Merged
Merged
Conversation
Ship web/sites/ai_bot_verification.php, an opt-in, no-WAF fallback that enforces AI-bot identity via forward-confirmed reverse DNS: a request claiming to be GPTBot/ClaudeBot/PerplexityBot/Meta-ExternalAgent must reverse-resolve to the vendor domain and forward-resolve back to the same IP, otherwise it gets a 403. Ordinary traffic never triggers a DNS lookup. Not wired into settings by default; enable by requiring it next to bot_trap_protection.php. Prefer CDN/WAF verified-bot rules when available. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019P53wM3Lq5g9ZVH3uziQsR
AronNovak
reviewed
Aug 31, 2026
Replace the reverse-DNS lookups with an in-memory match against vendor- published IP ranges. Ranges are fetched out-of-band via an OOP cron hook (AiBotRangeCronHook) and cached to a file that the pre-bootstrap snippet reads with no network I/O, so a slow vendor endpoint can't stall PHP workers. Cache is written atomically and the snippet fails open. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016hxr3xBHM8RvMXbXprZrx7
AronNovak
approved these changes
Sep 10, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #1076 (robots.txt baseline), closing out #1070's CDN/WAF item.
What
robots.txtis advisory — any client can sendUser-agent: GPTBot. This addsweb/sites/ai_bot_verification.php, an opt-in snippet (modeled onbot_trap_protection.php) that enforces bot identity via forward-confirmed reverse DNS:GPTBot,ClaudeBot,PerplexityBot,Meta-ExternalAgent, …)..openai.com,.anthropic.com,.perplexity.ai,.facebook.com).403. Ordinary traffic (non-AI UA) is untouched and never triggers a DNS lookup.Deliberately not wired in
bot_trap_protection.phpisrequired from the settings files; this one is not. It's shipped as a documented, self-contained opt-in (see the file's docblock for how to enable) because per-request DNS enforcement in PHP is a fallback — a CDN/WAF verified-bot rule (e.g. Cloudflare) is the better home. Left available for projects that want it without a WAF.Kept to a single file so it doesn't conflict with #1076's README changes; a README pointer can follow once both land.
🤖 Generated with Claude Code