Frenemy

Description

AI agents, search crawlers, SEO tools, scrapers, and impostors pretending to be all of the above now make up a large share of most sites’ traffic — and standard analytics are built to ignore them. Frenemy watches that traffic instead.

For every request that reaches WordPress, the plugin:

• classifies the visitor against a maintained registry of known agents (GPTBot, ClaudeBot, Googlebot, PerplexityBot, and many more),
• verifies identity claims where the operator publishes IP ranges — an out-of-range „Googlebot” is reported as an impostor, a real one as verified. Most bot lists take the user-agent’s word for it; Frenemy checks,
• separates bots from people, so your dashboard carries a human-only analytics baseline next to the bot ledger — no more crawler traffic inflating your visitor numbers,
• reports it all to your Frenemy dashboard at frenemy.dev: who visits, how often, what they claim to be, and what each bot costs or earns you.

See first. Then decide — on receipts, not guesses. Your dashboard is where the deciding happens: author per-bot rules and Frenemy shows exactly what each rule would have caught in your real traffic, rehearsing it for as long as you like before anything is ever switched on. Built-in guardrails mean a rule can never touch verified search crawlers your SEO depends on.

The plugin itself is observe-only, by design. It never blocks, slows, challenges, or alters a request — there is no blocking code in it at all. It is also fail-open at every joint: classification runs after your page has already been sent, and any Frenemy failure means „no data,” never a broken or slower site.

Honest about what it sees. Frenemy observes every request that reaches WordPress itself. Cached pages and static files are served before WordPress runs and are not observed — that trade-off is stated in the plugin, on your dashboard, and here, rather than papered over. The requests page caches never serve (cache misses, searches, POSTs, login, REST, and XML-RPC traffic) are exactly where bot and impostor signal concentrates.

Account required. The plugin needs a site key from a Frenemy account (free trial — no card required to start). All plugin code is fully functional and GPL; the key connects it to your dashboard, which is where the analytics, the per-bot ledger, and the rules live. There are no charts inside wp-admin and no duplicate analytics UI — one settings screen, one key, one link to your dashboard.

External services

This plugin talks to exactly two endpoints, both operated by Frenemy (frenemy.dev). It sends nothing anywhere until you save a site key.

1. Registry download (GET). The plugin periodically downloads Frenemy’s public bot registry (user-agent patterns and published IP ranges for known agents) so classification can run locally on your server with no per-request network calls. No visitor data, cookies, or credentials are sent with this request.

2. Event reporting (POST). After a response has been sent, the plugin reports one small event to Frenemy’s ingest service, authenticated by your site key. It contains: the classification result, the request method and path (query strings stripped except utm_*/ref/source), the response status code and duration, the visitor’s IP address (transmitted securely, processed transiently — hashed with a per-site rotating salt and never stored in raw form), and, only for unrecognized bot-like requests, the user-agent string. Human visitors’ user-agents are never transmitted, and presumed-human traffic is sampled, not tracked.

By installing the plugin and entering your site key you consent to this reporting. Details: Terms of Service · Privacy Policy.