A log audit can only catch the nine AI agents that send an HTTP request

Drop the file in wp-content/mu-plugins/ and it hooks template_redirect at priority 1, then runs a case-insensitive substring match of the request's user agent against nine names ^[12]. A hit writes to a single option, ai_crawler_log, saved with autoload switched off so ordinary page loads never load it, capped by array_slice at the last 500 visits, with the loop stopping at the first matching name ^[13]. Reading it back is one command, wp option get ai_crawler_log --format=json ^[15]. On a local WordPress 7.1 install a request sent with the GPTBot string appeared in the option within the same second, while a Chrome agent left no trace ^[14].

The nine come from three vendor pages. OpenAI documents four: GPTBot for training material, OAI-SearchBot for the ChatGPT search index, ChatGPT-User for fetches a person asks for, and OAI-AdsBot for pages submitted as ads ^[4]. Anthropic documents three, split the same way, with ClaudeBot on training data and Claude-User and Claude-SearchBot on live questions and search ^[6]. Perplexity runs two ^[7]. Four plus three plus two is the nine strings in the array ^[21].

That split matters more than the count. Anthropic's help page says its bots "respect 'do not crawl' signals by honoring industry standard directives in robots.txt" ^[9]. OpenAI writes that ChatGPT-User "is not used for crawling the web in an automatic fashion" and that "robots.txt rules may not apply", because a user starts the action ^[10]. Perplexity's guide is plainer about Perplexity-User: "Since a user requested the fetch, this fetcher generally ignores robots.txt rules" ^[11]. Two of the nine names are documented by their own vendors as not necessarily bound by robots.txt ^[22]. A Disallow line can keep a page out of a training set, and the same page can be fetched for a ChatGPT user five minutes later ^[19].

Then the two names in every guide. Google's crawler documentation says Google-Extended "doesn't have a separate HTTP request user agent string" ^[2]. Apple's Applebot page says "Applebot-Extended does not crawl webpages" ^[3]. Both are opt-out tokens that cannot be checked from the server side, because there is no request to log ^[1]. The write-up says these are among the names robots.txt guides list most often; it does not measure how many published blocklists or log audits rest on them.

Two more names circulate in templates that Anthropic's own page does not list, anthropic-ai and Claude-Web ^[8].

The PHP approach has a blind spot worth knowing before you ship it. When a full-page cache answers the request, WP Rocket or a CDN edge, WordPress never starts and the visit is not recorded, so a PHP log on a cached site shows cache misses only ^[17]. The server access log catches those hits, and a grep pipeline counts the same nine names in one pass ^[16]. In my view, if you have shell access, build that counter first. Either way the name in the string is self-reported: any script can call itself GPTBot. The vendors publish their IP ranges as JSON, openai.com/gptbot.json among them ^[18]. The author of the write-up develops Prime SEO, a WordPress plugin that includes a log like this, and says every user agent was checked against vendor documentation on September 21, 2026, and that the code runs without any plugin ^[20].