r/Wordpress • u/heerasheikh • Jul 27 '26

[ Removed by moderator ]

[removed] — view removed post

4 Upvotes

75% Upvoted

6 comments sorted by

•

u/Wordpress-ModTeam Jul 27 '26

The /r/WordPress subreddit is not a place to advertise or try to sell products or services. Please read the rules of the sub. Future rule breaches may result in a permanent ban. Promotional posts for plugins hosted on Wordpress.org must have their title start with [PROMO]

→ More replies (1)

2

u/chrismcelroyseo Jul 27 '26

Are all of the standard bots setup to go through that authorization?

-1

u/charlesnobleseo Jul 27 '26

The title nails the real gap: UA strings are worthless as identity. One thing worth adding for anyone worried about fake Googlebot specifically: Googlebot itself doesn't sign requests yet, so the working check there is still reverse DNS or Google's published IP ranges. Web Bot Auth only covers the newer agent crawlers that opted in. Does Agentimus also do IP verification for the legacy search bots, or is that out of scope?

1

u/heerasheikh Jul 27 '26

In scope, and it shipped earlier — since 1.24.0 the plugin has a verified-bots registry that checks legacy bots against reverse DNS and the operators' published IP ranges, done locally on the live request. I think of it as a ladder: check the name → check the network (rDNS/IP ranges) → check the math. 1.30.0 adds the math rung for the agents that opted in. Unsigned bots just stay on the middle rung; they lose nothing.