Advanced analytics and AI performance insights.<\/li>\n<\/ul>\n\nPrivacy<\/h4>\n\n
This plugin can log visits from known AI crawlers. Logging is disabled by default and can be enabled in Settings > Features.<\/p>\n\n
Stored fields in bot logs:\n* Bot name (detected from user agent)\n* User agent string (truncated)\n* Visited endpoint\/path\n* Request method\n* Timestamp\n* Product ID (when applicable)<\/p>\n\n
Cookie usage:\n* ikaros_bot_ref<\/code> (30 days) may be set when AI-assisted buy links are used, to support AI-attributed checkout flows.<\/p>\n\nNo analytics JavaScript or third-party tracking pixels are injected on the frontend by this plugin.<\/p>\n\n
Site owners are responsible for configuring consent\/privacy notices as required by local law.<\/p>\n\n
External services<\/h3>\n\n
This plugin utilizes the Google Gemini API to generate product summaries and descriptions.<\/p>\n\n
\n- Service: Google Gemini API<\/li>\n
- Usage: Used only when you click \"Generate\" in the product editor.<\/li>\n
- Data sent: Product title, product description context, selected model identifier, and API request metadata needed to generate text output.<\/li>\n
- Terms of Service: https:\/\/ai.google.dev\/terms<\/li>\n
- Privacy Policy: https:\/\/policies.google.com\/privacy<\/li>\n<\/ul>\n\n\n
\n- Upload the plugin files to the
\/wp-content\/plugins\/ikaros-ai-manifest<\/code> directory, or install the plugin through the WordPress plugins screen.<\/li>\n- Activate the plugin through the Plugins screen in WordPress.<\/li>\n
- Use the Ikaros AI settings page to configure features.<\/li>\n
- Optional: Add your Google Gemini API key to generate AI product descriptions.<\/li>\n<\/ol>\n\n\n
2.3.2<\/h4>\n\n\n- Fixed: Activity Log now shows shopping query parameters for add-to-cart and buy-link traffic instead of hiding that signal behind the intent label.<\/li>\n
- Fixed: Activity Log now prefers canonical product URLs when a product ID can be recovered from the log row or shopping query parameters.<\/li>\n
- Improved: Category and tag endpoint display now uses canonical term paths when terms can be resolved.<\/li>\n<\/ul>\n\n
2.3.1<\/h4>\n\n\n- Fixed: Dashboard analytics query blocks hardened for WordPress.org PHPCS compatibility across supported WordPress versions.<\/li>\n
- Fixed: i18n translator comments and SQL lint compliance improvements in admin analytics rendering.<\/li>\n
- Fixed: Admin dashboard stability update for analytics query parsing.<\/li>\n<\/ul>\n\n
2.3.0<\/h4>\n\n\n- Security: Added signed write request verification for ACP\/AJAX write surfaces, including timestamp freshness checks, replay protection, and stronger write authorization flow.<\/li>\n
- Security: Added optional agent-key write path (
X-Ikaros-Agent-Key<\/code>) for ACP and AJAX commerce actions.<\/li>\n- Security: Added one-time automatic generation of missing security secrets\/keys during activation and early runtime initialization.<\/li>\n
- Added: Public ACP Mode guardrails with honeypot protection, optional captcha enforcement, and strict per-minute\/per-day per-IP throttling.<\/li>\n
- Added: Built-in captcha verification support for Cloudflare Turnstile and Google reCAPTCHA v3.<\/li>\n
- Added: Settings controls for Public ACP mode, captcha provider\/secrets, and quota\/rate-limit configuration.<\/li>\n
- Changed: Manifest auth metadata extended for agent-key and hardened write-auth expectations.<\/li>\n<\/ul>\n\n
2.2.9<\/h4>\n\n\n- Security: Removed public checkout nonce exposure from manifest and REST manifest discovery payloads.<\/li>\n
- Security: Mutating REST routes (
\/mcp\/call<\/code>, ACP write actions, and checkout session write actions) now require authenticated access via logged-in session or shared API key.<\/li>\n- Security: Added transient-based rate limiting to mutating REST and AJAX commerce endpoints to reduce abuse and request flooding.<\/li>\n
- Changed: Checkout API metadata now advertises shared-key authentication (
X-Ikaros-Key<\/code>) instead of public nonce fields.<\/li>\n<\/ul>\n\n2.2.8<\/h4>\n\n\n- Fixed: Bot tracking allowlist now matches encoded REST route requests (
rest_route=%2F...<\/code>) for Ikaros namespaces and MCP\/UCP\/ACP paths.<\/li>\n- Fixed: \u201cAPI Endpoints Visited by Bot\u201d query now matches both plain and encoded
rest_route<\/code> forms, ensuring REST API rows appear reliably across hosting\/cache setups.<\/li>\n<\/ul>\n\n2.2.7<\/h4>\n\n\n- Fixed: \u201cAPI Endpoints Visited by Bot\u201d now includes
\/wp-json\/ikaros\/<\/code> and encoded rest_route<\/code> endpoint patterns, so capabilities and protocol API hits are visible in the API table.<\/li>\n- Improved: Bot logging now uses both
parse_request<\/code> and template_redirect<\/code> (single-write guard) for broader request coverage, including REST requests.<\/li>\n- Improved: API analytics cache is invalidated immediately after bot log inserts so new endpoint rows appear without delay.<\/li>\n<\/ul>\n\n
2.2.6<\/h4>\n\n\n- Fixed: Bot visit tracking now runs on
parse_request<\/code>, ensuring REST API endpoint hits are logged reliably (not only template-driven frontend requests).<\/li>\n- Fixed: Free tracking allowlist now includes
\/wp-json\/ikaros\/<\/code> and equivalent rest_route<\/code> patterns so capability and protocol endpoints appear in API endpoint analytics.<\/li>\n<\/ul>\n\n2.2.5<\/h4>\n\n\n- Fixed: Free bot tracking now logs technical AI endpoints (
\/wp-json\/ikaros-ai-manifest\/<\/code>, \/wp-json\/aigentic\/<\/code>, MCP\/UCP\/ACP paths, llms.txt<\/code>, and manifest\/feed endpoints) when tracking scope is products-only.<\/li>\n- Improved: \"API Endpoints Visited by Bot\" dashboard section now captures and displays API activity more reliably.<\/li>\n<\/ul>\n\n
2.2.4<\/h4>\n\n\n- Added: New AI store capabilities endpoint at
\/wp-json\/ikaros\/v1\/ai-capabilities<\/code> exposing active protocols and AI capability flags.<\/li>\n- Changed: Manifest
plugin_type<\/code> value updated to Ikaros Ai commerce layer<\/code> across manifest outputs.<\/li>\n- Fixed: Fallback manifest endpoint handling now returns explicit HTTP 200 for
\/ai-commerce.json<\/code>.<\/li>\n<\/ul>\n\n2.2.3<\/h4>\n\n\n- Added: Agentic Checkout session endpoints under REST API for
create<\/code>, update<\/code>, get<\/code>, complete<\/code>, and cancel<\/code> checkout session flows.<\/li>\n- Added: Idempotency handling (
Idempotency-Key<\/code>) and standardized checkout error responses for session endpoints.<\/li>\n- Added: Session-shaped checkout payloads with
line_items<\/code>, totals<\/code>, fulfillment_options<\/code>, messages<\/code>, and links<\/code>.<\/li>\n- Added: Manifest discovery metadata for the new checkout session endpoints.<\/li>\n
- Added: WooCommerce order creation on checkout session completion with returned order permalink payload.<\/li>\n<\/ul>\n\n
2.2.2<\/h4>\n\n\n- Fixed: ACP WooCommerce session bootstrap no longer invokes non-prefixed external hook names, improving WordPress.org PHPCS compliance.<\/li>\n<\/ul>\n\n
2.2.1<\/h4>\n\n\n- Fixed: ACP cart-dependent endpoints now initialize WooCommerce session, customer, and cart during REST requests.<\/li>\n
- Fixed: ACP
add-to-cart<\/code>, status<\/code>, and checkout<\/code> endpoints no longer fail with cart unavailable on stores where REST cart bootstrap was missing.<\/li>\n- Improved: ACP production reliability for end-to-end agent checkout flow.<\/li>\n<\/ul>\n\n
2.2.0<\/h4>\n\n\n- Added: ACP endpoints for products search, add-to-cart, checkout, and status under the REST API.<\/li>\n
- Added: ACP discovery metadata to the REST manifest (
acp_supported<\/code> and ACP endpoint URLs).<\/li>\n- Changed: Product
purchase_url<\/code> now uses native WooCommerce add-to-cart<\/code> flow.<\/li>\n- Changed: Added
ai_summary<\/code>, product_category<\/code>, and categories<\/code> fields to manifest catalog items.<\/li>\n- Changed: Deprecated custom direct-buy handler hook in favor of WooCommerce-native purchase flow.<\/li>\n<\/ul>\n\n
2.0.0<\/h4>\n\n\n- Added: Dashboard page for AI visibility, bot category analysis, and top endpoint\/product insights.<\/li>\n
- Added: Analytics page enhancements (date range filtering, bot intent classification, activity table, charts, CSV export).<\/li>\n
- Added: AI Readiness Score in product list (sortable\/filterable column and bulk recalculate action).<\/li>\n
- Changed: Renamed \"Intelligence\" section to \"Dashboard\".<\/li>\n
- Changed: Consolidated free settings and policy controls into one unified Settings page.<\/li>\n
- Security: Strengthened nonce validation and request hardening for admin and AJAX flows.<\/li>\n<\/ul>\n\n
1.1.1<\/h4>\n\n\n- Security: Removed API key exposure from JavaScript; keys now only transmitted via AJAX POST.<\/li>\n
- Security: Added null check for product object in schema injection function.<\/li>\n
- Security: Fixed database query preparation for bot log retrieval.<\/li>\n
- Compliance: Removed feature gating on bot statistics charts (now always visible to all users).<\/li>\n
- UX: Added menu icons in admin pages.<\/li>\n<\/ul>\n\n
1.1.0<\/h4>\n\n\n- Feature: Added support for Model Context Protocol (MCP) for AI agents.<\/li>\n
- Feature: Added Universal Commerce Protocol (UCP) discovery endpoint.<\/li>\n
- Fix: Improved security by replacing strip_tags with wp_strip_all_tags.<\/li>\n<\/ul>\n\n
1.0.0<\/h4>\n\n\n- Initial release.<\/li>\n<\/ul>","raw_excerpt":"Prepare your WooCommerce store for the AI internet.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/cs.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/279613","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cs.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/cs.wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/cs.wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=279613"}],"author":[{"embeddable":true,"href":"https:\/\/cs.wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/rasimakis"}],"wp:attachment":[{"href":"https:\/\/cs.wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=279613"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/cs.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=279613"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/cs.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=279613"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/cs.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=279613"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/cs.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=279613"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/cs.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=279613"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}