Agentic Commerce for WooCommerce

Description

AI Traffic & Sales Tracking for WooCommerce — ChatGPT Ads, Product Feed & AI Visibility

Something is already sending you customers, and your analytics can’t see it.

When a shopper asks ChatGPT “find me a cordless drill under $80 that ships in 2 days” and buys from the store it names, that order lands in WooCommerce looking like ordinary direct traffic. Google Analytics shows you nothing. Your reports show you nothing. You cannot tell whether AI assistants are worth your attention, because you cannot see them at all.

This plugin makes the AI channel visible, makes you the answer it gives, and lets you buy more of it. No theme changes, no replatforming, no new payment processor.

🌐 Plugin home: www.xpay.sh/merchants/woocommerce/

See the AI channel

• AI crawler analytics → — which assistants visit (GPTBot, ChatGPT-User, OAI-SearchBot, ClaudeBot, PerplexityBot, Google-Extended and more) and what they read. Opt-in, off by default, known AI bots only.
• AI-attributed orders — your real WooCommerce orders traced to the assistant that referred the buyer (ChatGPT, Claude, Perplexity, Gemini, Copilot and more), with the match rate against all your orders so you can check the number.
• Agent-readiness audit → — how well AI shopping assistants can read and recommend your catalog, with a prioritised fix list.
• Agent delivery speed → — how fast your catalog, /llms.txt and product pages answer the AI crawlers themselves.

Win the AI channel

• An agent-readable product feed — full catalog with live prices and stock on xpay’s CDN, refreshed within ~30 seconds of a change.
• AI-shopping structured data — Product, Offer, BuyAction and ItemList JSON-LD that fills only the gaps Yoast, Rank Math or WooCommerce leave.
• /llms.txt and an AI user-agent robots.txt allowlist on your own domain; an existing /llms.txt is appended to, never replaced.
• Cart deep-link — an assistant can hand a shopper a one-click link into your existing cart and checkout.
• Product FAQs and return policy — FAQPage and MerchantReturnPolicy data for products you approve; optionally shown to shoppers (off on new installs).
• AI storefront assistant → (optional) — on-site shopper chat from your own catalog, only with your say-so.

Run ChatGPT Ads

• Campaigns inside WooCommerce → — create, budget, activate and pause campaigns; results sit next to the orders they produced, our reconciled count beside OpenAI’s.
• A ChatGPT product feed to OpenAI’s specification, with a per-product health score.
• Eligibility, up front — minimum catalog size and supported countries checked before you invest time.
• Conversion tracking — link your ads account and purchases from ChatGPT ads are reported back: funnel events from shoppers’ browsers plus a copy of each paid order from your server, under one id so nothing counts twice. Off until you link a pixel; marketing consent respected; your ads key is never stored on your site.
• Works with your existing pixels — Pixel Manager, PixelYourSite or GTM keep running; if another OpenAI pixel is on the store, ours records but does not forward.

Works alongside what you already run

If another plugin already does a job, this one stands down: Yoast SEO, Rank Math and SEOPress schema (fills only the gaps); AdTribes, CTX Feed and Google Listings & Ads feeds; Pixel Manager, PixelYourSite, GTM and WooCommerce Order Attribution; WP Rocket, LiteSpeed, Autoptimize and SiteGround Optimizer (excluded from JS optimization automatically). Declares HPOS and Cart/Checkout Blocks compatibility.

What it doesn’t do

• It doesn’t touch your checkout. Stripe / WooPayments / PayPal / Square / whatever you already use — payment runs through them, unchanged. Your payout schedule is unchanged.
• It doesn’t see your customers. Order summaries carry no buyer name, email, address or payment card. The one exception is ChatGPT Ads conversion tracking, which you switch on yourself: with the shopper’s marketing consent it sends their email (hashed before OpenAI sees it), IP address and user agent so the ad platform can match the purchase. See External services.
• It doesn’t require a new account or contract to start. Free to install and get going — paid plans available as you grow. See pricing.
• It doesn’t slow down your site. The JSON-LD block is tiny and cached; the catalog feed is served from xpay’s CDN, not your origin.

Getting started

Install, activate, click Connect store and grant a read-only WooCommerce REST API key on app.xpay.sh. Your catalog is live on AI surfaces within about 10 minutes. Requires WooCommerce 7.0+, WordPress 6.2+ and PHP 7.4+. Stuck? merchants@xpay.sh or the support forum. What the plugin sends and when: see Privacy and External services below, and the full disclosure.

Source code

GPLv2-or-later, readable PHP, all of it on your server once installed. Changelog: install.xpay.sh/woocommerce/CHANGELOG.md.

External services

This plugin connects to the following xpay-operated services to deliver its core function. Every endpoint and its purpose is documented; full payload disclosure is in the Privacy section.

1. agent-feed.xpay.sh — Public CDN that hosts your AI-readable catalog feed at https://agent-feed.xpay.sh/catalog/{your-slug}.json. The plugin does not contact this URL directly; the xpay backend writes it from your WooCommerce REST API after you click Connect store.

2. agent-commerce.xpay.sh — The agent-side API that AI shopping agents call to surface and buy from your products. The plugin contacts this host at the following paths: (a) POST /v1/onboard/woocommerce/wc-auth-callback is the WooCommerce OAuth callback target (WordPress itself calls this on your behalf, server-to-server, after you approve the one-click connect prompt); (b) GET /v1/onboard/woocommerce/status?nonce=… is polled by the xpay onboarding page while the handshake finishes; (c) POST /v1/merchants/{slug}/resync triggers a fresh catalog ingest after a product or stock change; (d) GET /v1/merchants/{slug} is called when xpay✦ Commerce → Settings verifies the current connection state; (e) PATCH /v1/merchants/{slug}/products/{sku} pushes a single-product delta when a WooCommerce product/stock webhook fires; (f) DELETE /v1/merchants/{slug} is sent (non-blocking) when you click Disconnect so xpay marks your account as disconnected and archives the cached catalog. The hostname is also the publicly advertised target for POST /mcp/{slug} (the JSON-RPC commerce MCP endpoint AI agents talk to) — the plugin itself does not call this URL but lists it in the /.well-known/ucp manifest.

3. app.xpay.sh/onboard/woocommerce — The merchant-side onboarding page. When you click Connect store, the plugin redirects your browser here with three query-string parameters: your site URL, your administrator email address, and a one-time random nonce generated locally. No data is sent to xpay before you click the button. You sign in or sign up on xpay and grant the WooCommerce REST API permission there.

4. agent-commerce.xpay.sh/v1/events — Optional anonymous lifecycle telemetry. Disabled by default; only contacted if you explicitly opt in via the first-activation admin notice or xpay✦ Commerce → Settings → Privacy. Full payload disclosure in the Privacy section.

5. agent-commerce.xpay.sh/v1/merchants/{slug}/orders — Agent-attributed order reporting for connected stores (non-PII order summary + attribution source; no customer, payment, or personal data). Off via the xpay_wc_order_events_enabled option. Full payload disclosure in the Privacy section.

6. agent-commerce.xpay.sh/v1/agent-analytics — Optional anonymous AI-bot crawl analytics. Disabled by default; shares the same opt-in as item 4 (and respects a separate define( 'XPAY_WC_AGENT_ANALYTICS', false ) hard-off). When enabled, the plugin counts requests from known AI bots only (e.g. GPTBot, ChatGPT-User, ClaudeBot, PerplexityBot, Google-Extended) — recording the bot name, a coarse page type (home/product/category/discovery-file/sitemap/other), the HTTP status, and whether we routed the bot to your structured catalog. It also sends an aggregate daily count of human pageviews (a number only — no user-agent, no URLs, no per-visit data) as the AI-vs-human denominator. Since 0.5.3 a bot event also carries a salted, one-way hash of the connecting IP address (a bot’s — behind a proxy or CDN this is the connecting edge address), so two hits from the same crawler can be counted as one visitor. The salt is unique to your store and is regenerated every day, so the hash cannot be linked across days or across stores, and the address itself is never stored or transmitted. This applies to AI bots only — a human visitor’s IP is never read, hashed or sent. Events are buffered locally and sent in the background by WP-Cron, never on a page load. Cart, checkout, account, admin and REST paths are never recorded. No per-visit human data, no customer, order, or personal data.

7. ai-readiness.xpay.sh — Merchant-facing audit dashboard. The plugin emits a link to ai-readiness.xpay.sh/m/{your-slug} on the Settings page so you can review the live agent-readiness score xpay computed from your catalog; the plugin itself does not fetch from this host. Opening the link from your browser sends standard browser headers to xpay.

8. auth.xpay.sh — Public OAuth-protected-resource discovery target. The plugin publishes auth.xpay.sh as the authorization_servers[0] entry in /.well-known/oauth-protected-resource (an RFC 9728 metadata document AI agents fetch to learn where to obtain a token). The plugin does not contact this host server-to-server; it is referenced for agent-side discovery only.

9. install.xpay.sh/woocommerce/{terms,privacy}.html — Legal pages linked from this readme and the Settings privacy panel; opened in your browser, never fetched by the plugin.

10. pixelproof.xpay.sh — xpay’s ChatGPT Ads conversion relay, contacted only when ChatGPT Ads conversion tracking is on (a pixel is linked on xpay✦ Commerce → ChatGPT Ads, or you chose “Always on”). Shoppers’ browsers send POST /pixel/events for page views, product views, add-to-cart, checkout start and purchase: the page URL, the ChatGPT Ads click id and campaign parameters, the products, quantities and prices involved, and — only with marketing consent — a random browser id and, on checkout and purchase, the shopper’s email. Your server sends POST /api/woo/server-events with each paid order (order id, total, currency, line items, click id, campaign parameters, referring site, how the order was created — e.g. checkout or wp-admin — and with consent the billing email, IP address and user agent). It calls POST /api/woo/connect and POST /api/woo/manual when you set tracking up, and GET /api/woo/config when you open the ChatGPT Ads or Tracking screen, when xpay links a pixel to your store at your request, and about once an hour while a pixel is linked. A store with no pixel linked does not contact this host from shopper traffic. The relay forwards conversions to OpenAI’s Conversions API for your ChatGPT Ads account; OpenAI receives the email only as a SHA-256 hash (plus, with consent, the IP address and user agent), and receives an opt-out flag instead of any identifier when consent is absent. If another OpenAI pixel is on your store, events are recorded for your own reports and not forwarded; orders created in wp-admin and subscription renewals are recorded and never forwarded. OpenAI terms: openai.com/policies.

11. widget.xpay.sh/v1/track.js → agent-commerce.xpay.sh/widget/track — The visitor tracker, loaded on your storefront for a connected store (by the shopping assistant when it is on, otherwise on its own). It records the shopping journey so you can see which visits — from ChatGPT and elsewhere — turned into orders: page type and path (no query string), page title, product id, category, price and currency, add-to-cart, checkout start, the order id on the thank-you page, the referring site, campaign parameters, device type and language, and a random first-party visitor id (cookie and local storage, 365 days) with a 30-minute session id. It never records a name, email, address or anything typed into a form. It does not run at all for a browser sending Do Not Track or Global Privacy Control. With the WP Consent API installed it waits for the shopper’s “statistics” consent; on a store based in the EU/EEA, UK or Switzerland without a consent tool it is not loaded. Turn it off with add_filter( 'xpay_wc_tracker_enabled', '__return_false' );.

12. nehl6uu58j.execute-api.us-east-1.amazonaws.com — xpay’s merchant API, called from your server by a connected store only. GET /merchant/widget-config/public/{your-slug} reads your storefront assistant settings (cached up to an hour) and GET /merchant/content-pages/public/{your-slug} reads the pages you publish from the xpay dashboard (hourly). Only your store’s slug is sent, in the path; nothing about shoppers. The connection diagnostic in wp-admin also times the first call.

13. Proxied sections — Hourly, a connected store reads its proxy settings from agent-commerce.xpay.sh (GET /v1/merchants/{slug}/blog-proxy-policy). If xpay enables a section (such as /blog), a request there that WordPress cannot serve is fetched, with the section’s sitemap, from its configured origin: xpay’s content service or a site xpay operates for your store. Sent: the path, the query string minus tracking parameters, your store’s host name and an Accept header. No cookies or visitor data.

Your own website. The Tracking screen fetches your store’s own home page (a request from your server to itself, never to a third party) to check whether an advertising pixel is present in the markup. The result is cached for several hours; no data leaves your site.

Terms of use: install.xpay.sh/woocommerce/terms.html
Privacy policy: install.xpay.sh/woocommerce/privacy.html

Privacy

We never see payment data, and never a buyer’s name or address. The plugin is non-custodial by design: payment stays with your gateway.

• Nothing leaves your site until you click Connect store. Before that, the settings page makes no outbound request of any kind.
• ChatGPT Ads conversion tracking is off until you switch it on. Once on, purchases and shopping events are sent to our relay and on to your ChatGPT Ads account — see item 10 under External services. Customer email, IP address and user agent are included only with marketing consent.
• After you connect we receive: your site URL, your admin email, a one-time nonce, a WooCommerce REST API key so we can read your catalog, your public product fields (name, description, price, stock, images, categories), and an order summary per order — order id, total, currency, SKUs, status and the channel it came from (item 9). No buyer names, addresses or payment data.
• Shopper journey (connected stores). The visitor tracker records pages, products, carts, checkouts and order ids against a random visitor id — never a name, email or address — and does not run for Do Not Track / Global Privacy Control browsers, before consent where a consent tool is installed, or at all on EU/EEA/UK/CH stores without one (item 11).
• Anonymous diagnostics are OFF by default. You’re asked once. If you turn them on, we receive plugin lifecycle events and version numbers tagged with your site URL — and, separately, counts of known AI bots only (which bot, what kind of page, the response code) plus a daily total of human pageviews as a number, so you can see your AI-vs-human split. A human visitor’s IP address is never read, hashed or sent, and cart, checkout, account and admin pages are never recorded.
• Turn it off any time at xpay✦ Commerce → Settings → Privacy, or hard-disable in wp-config.php with define( 'XPAY_WC_TELEMETRY', false ); (or XPAY_WC_AGENT_ANALYTICS for bot counts alone). The constant overrides any UI choice.
• Delete your data: email privacy@xpay.sh from your admin address with your store name. Processed within 7 business days.

Every byte, itemised: install.xpay.sh/woocommerce/privacy.html · Terms