內容簡介
Tactical 外掛為 WooCommerce 商店提供 AI 代理分析，幫助商家識別來自 AI 爬蟲和代理瀏覽器的流量，並提供詳細的訂單來源和行為分析，提升商店的數據準確性。
【主要功能】
• AI 爬蟲伺服器端檢測
• 代理瀏覽器行為評分
• AI 引薦購買者識別
• 訂單標籤與收入分析
• 訂單證據記錄下載
• Drop Watch 實時報告
外掛標籤
開發者團隊
② 後台搜尋「Tactical — AI Agent Analytics for WooCommerce」→ 直接安裝（推薦）
原文外掛簡介
AI assistants are shopping WooCommerce stores. Some send crawlers that never run JavaScript, some drive a browser that behaves like a person, and some send people who then buy. Standard analytics sees little of it: Google Analytics excludes known bots, and you can’t turn that off (Google Analytics Help); crawlers never fire an analytics tag; and an agent browser is counted as a person.
This plugin connects your store to Tactical, a third-party service at https://tactical-app.work, which shows you the rest. The plugin installs the storefront script, adds server-side crawler detection and registers the WooCommerce webhooks; the dashboard lives in your Tactical account.
What you get:
AI crawlers, server-side — when a known AI crawler requests a page, the plugin records it, no JavaScript needed. A hit is marked verified only when its IP matches the operator’s published range. Nothing is sent for human visitors.
Agent browsers, by behaviour — sessions driven by an agent, including ones that never name themselves, are scored on how the session behaves. A score is a probability, not a verdict.
AI-referred buyers — people who arrive from ChatGPT, Perplexity, Gemini, Copilot and other assistants.
Agent revenue — every order is labelled: Agent order, Agent order (session match) or AI-referred order, each saying how sure it is, and the two kinds are never added together. Agent orders include ones placed in an agent checkout, such as Stripe’s agentic checkout, which no browser pixel sees.
Evidence for every agent order — a record of the order, how it was attributed, the matched session and any Tactical Gate decisions, downloadable as PDF and JSON for disputes and returns. It holds no buyer name, email, address or IP address.
Drop Watch — tell Tactical when a release goes live and get a report afterwards: every add-to-cart and checkout attempt in the window, who made it (people, AI agents, requests with no browser) and when. Free, and nothing on your store is blocked or changed. A sample is at https://tactical-app.work/drop-watch.
Tactical Gate (beta) — rules for AI agents by product, cart and checkout, starting in Observe mode. It is in a private beta; join the list at https://tactical-app.work/waitlist.
Tactical pricing — managed at tactical-app.work:
The plugin works on every plan, including the free one. Agent revenue and evidence are on every plan, with the plan’s history.
Scout — free — 7-day monitor, top 3 agent types, AI Search report, 100 agent sessions/week. No credit card.
Radar — $39/mo — 90-day history, all agent types, intent signals, product interest map (top 50), 10,000 agent sessions/mo.
Command — $129/mo — everything in Radar, plus marketplace-referral and price-check signals, unlimited products, 50,000 agent sessions/mo.
Annual plans save about 25%.
Multi-platform:
This plugin is for WooCommerce. The same Tactical account also works on Shopify (via the Shopify App Store) and on any custom storefront (via a script tag).
External services
This plugin connects to Tactical at https://tactical-app.work — a third-party AI agent analytics service operated by the plugin author. The plugin requires an active Tactical account (free Scout tier is sufficient) to function. Without an API key configured on the settings page, no requests are made.
Endpoints used:
Snippet ingest — https://tactical-app.work/api/ingest. The detection script (https://tactical-app.work/snippet.js) loads on every storefront page view and posts an event payload containing: a random session ID, the page path and query string, the referrer, the user-agent string, scroll/mouse/timing heuristics, product context read from the page, and your store’s domain (never your API key, which stays on the server). No names, emails, payment data or form contents are sent. From 1.5.0 the script also sets one first-party cookie on your store, _tac_sid, holding that random session ID for up to 30 minutes, so the plugin can tell which browser session a cart or checkout request belongs to.
Server-side crawler detection — https://tactical-app.work/api/ingest/server. Only when a request’s user-agent matches a known AI crawler or agent in Tactical’s registry: the user-agent, the page URL and the request’s IP address (used to check it against the operator’s published IP ranges, then discarded). Human visitors trigger nothing.
Connection verification — https://tactical-app.work/api/verify-connection. Triggered only when an admin clicks “Verify connection” on the settings page. Sends only your API key (in a request header) so Tactical can confirm the key belongs to this store. No event data.
WooCommerce webhooks — https://tactical-app.work/api/wc-webhook/
Tactical Gate policy (1.2.0) — https://tactical-app.work/api/gate/policy. Fetched at most once every five minutes with your API key in a header, and only re-downloaded when it changed. Sends nothing about your visitors.
Tactical Gate decisions (1.2.0) — https://tactical-app.work/api/gate/decisions. Sent in batches by WP-Cron: for each recorded decision, the time, the page path (no query string), the agent’s name and category if it declared one, the rule and the outcome, and a one-way hash of the visitor’s IP address and user-agent (never the IP itself). Every request a rule acted on is recorded; other requests about 1 in 100 sessions, except during a Drop Watch window you set, when every add-to-cart and checkout attempt is recorded. From 1.5.0 a decision also carries the _tac_sid session ID when the visitor has that cookie; Tactical keeps it only for Drop Watch decisions.
Tactical Gate session reputation (1.3.0) — https://tactical-app.work/api/gate/reputation. At add-to-cart and checkout only, for a visitor that names no agent: the same one-way hash, to ask whether Tactical classified that session as an agent browser. Half-second timeout, cached for 30 seconds.
Agent key directories (Tactical Gate, 1.4.0) — when a request to your store carries a Web Bot Auth signature (the Signature, Signature-Input and Signature-Agent headers) naming a signer in Tactical’s agent registry, the plugin fetches that signer’s public key directory to check the signature: https://chatgpt.com/.well-known/http-message-signatures-directory (OpenAI, ChatGPT agent) or https://agent.bot.goog/.well-known/http-message-signatures-directory (Google, Google-Agent). It is a plain GET with no cookies and nothing about your store or its visitors, made at most once per five minutes to an hour per signer (the answer is cached in a transient), and only while the Gate has a policy. Unsigned requests, the usual case, fetch nothing. OpenAI: https://openai.com/policies/terms-of-use and https://openai.com/policies/privacy-policy. Google: https://policies.google.com/terms and https://policies.google.com/privacy.
Conditions: events are only sent after you paste a valid API key on the settings page. Without a key, the snippet does not load, no requests are made, and no webhooks are registered.
Service terms:
Tactical Privacy Policy: https://tactical-app.work/privacy
Tactical Terms of Service: https://tactical-app.work/terms
