Tactical — AI Agent Analytics for WooCommerce

Description

AI assistants are shopping WooCommerce stores. Some send crawlers that never run JavaScript, some drive a browser that behaves like a person, and some send people who then buy. Standard analytics sees little of it: Google Analytics excludes known bots, and you can’t turn that off (Google Analytics Help); crawlers never fire an analytics tag; and an agent browser is counted as a person.

This plugin connects your store to Tactical, a third-party service at https://tactical-app.work, which shows you the rest. The plugin installs the storefront script, adds server-side crawler detection and registers the WooCommerce webhooks; the dashboard lives in your Tactical account.

What you get:

• AI crawlers, server-side — when a known AI crawler requests a page, the plugin records it, no JavaScript needed. A hit is marked verified only when its IP matches the operator’s published range. Nothing is sent for human visitors.
• Agent browsers, by behaviour — sessions driven by an agent, including ones that never name themselves, are scored on how the session behaves. A score is a probability, not a verdict.
• AI-referred buyers — people who arrive from ChatGPT, Perplexity, Gemini, Copilot and other assistants.
• Agent revenue — every order is labelled: Agent order, Agent order (session match) or AI-referred order, each saying how sure it is, and the two kinds are never added together. Agent orders include ones placed in an agent checkout, such as Stripe’s agentic checkout, which no browser pixel sees.
• Evidence for every agent order — a record of the order, how it was attributed, the matched session and any Tactical Gate decisions, downloadable as PDF and JSON for disputes and returns. It holds no buyer name, email, address or IP address.
• Tactical Gate (beta) — rules for AI agents by product, cart and checkout, starting in Observe mode. It is in a private beta; join the list at https://tactical-app.work/waitlist.

Tactical pricing — managed at tactical-app.work:

The plugin works on every plan, including the free one. Agent revenue and evidence are on every plan, with the plan’s history.

• Scout — free — 7-day monitor, top 3 agent types, AI Search report, 100 agent sessions/week. No credit card.
• Radar — $39/mo — 90-day history, all agent types, intent signals, product interest map (top 50), 10,000 agent sessions/mo.
• Command — $129/mo — everything in Radar, plus marketplace-referral and price-check signals, unlimited products, 50,000 agent sessions/mo.

Annual plans save about 25%.

Multi-platform:

This plugin is for WooCommerce. The same Tactical account also works on Shopify (via the Shopify App Store) and on any custom storefront (via a script tag).

External services

This plugin connects to Tactical at https://tactical-app.work — a third-party AI agent analytics service operated by the plugin author. The plugin requires an active Tactical account (free Scout tier is sufficient) to function. Without an API key configured on the settings page, no requests are made.

Endpoints used:

• Snippet ingest — https://tactical-app.work/api/ingest. The detection script (https://tactical-app.work/snippet.js) loads on every storefront page view and posts an event payload containing: an anonymised session ID, page URL (path + query string only), referrer domain, user-agent string, scroll/mouse/timing heuristics, and your store’s API key. No customer PII (no names, emails, IP addresses, payment data, or form contents) is sent.
• Connection verification — https://tactical-app.work/api/verify-connection. Triggered only when an admin clicks “Verify connection” on the settings page. Sends only your API key (in a request header) so Tactical can confirm the key belongs to this store. No event data.

• WooCommerce webhooks — https://tactical-app.work/api/wc-webhook/<topic>. Once an API key is saved, four webhook subscriptions are registered with WooCommerce (order.created, order.updated, product.created, product.updated). WooCommerce delivers these payloads directly to Tactical with WC’s standard HMAC signature when matching events occur on your store. Payload contents are WooCommerce’s standard webhook bodies (order or product objects).

• Agent key directories (Tactical Gate, 1.4.0) — when a request to your store carries a Web Bot Auth signature (the Signature, Signature-Input and Signature-Agent headers) naming a signer in Tactical’s agent registry, the plugin fetches that signer’s public key directory to check the signature: https://chatgpt.com/.well-known/http-message-signatures-directory (OpenAI, ChatGPT agent) or https://agent.bot.goog/.well-known/http-message-signatures-directory (Google, Google-Agent). It is a plain GET with no cookies and nothing about your store or its visitors, made at most once per five minutes to an hour per signer (the answer is cached in a transient), and only while the Gate has a policy. Unsigned requests, the usual case, fetch nothing. OpenAI: https://openai.com/policies/terms-of-use and https://openai.com/policies/privacy-policy. Google: https://policies.google.com/terms and https://policies.google.com/privacy.

Conditions: events are only sent after you paste a valid API key on the settings page. Without a key, the snippet does not load, no requests are made, and no webhooks are registered.

Service terms:

• Tactical Privacy Policy: https://tactical-app.work/privacy
• Tactical Terms of Service: https://tactical-app.work/terms