Access control tools for sites blocking AI agents

What to build

A WordPress plugin (plus a Shopify app version) that detects AI crawler and agent traffic via user-agent and IP heuristics, gives the site owner a simple dashboard to allow, block, or rate-limit specific bots (GPTBot, ClaudeBot, PerplexityBot, etc.), and auto-generates/updates robots.txt and llms.txt files with one click.

Large publishers already get AI-bot detection and blocking through enterprise tools like Cloudflare, but independent bloggers, publishers, and small e-commerce stores on WordPress, Shopify, and Webflow have no affordable equivalent — a focused plugin that detects, controls, and documents AI agent access fills that gap.

Demand

Independent publishers and small store owners who suspect their content is being scraped by AI agents without consent or compensation want the same visibility and control big sites already have, and the topic is actively trending as more sites adopt llms.txt and bot-blocking conventions.

• Hacker News / The VergeEngagement

  "Websites are closing their doors to AI agents" reached 134 points and 131 comments on Hacker News, indicating high engagement and active discussion around AI crawler blocking.

• Signal cluster synthesisNews

  Aggregated signal indicates a broad trend of site owners restricting AI crawler/agent access, reflecting a shift in site-owner sentiment toward wanting control over AI access.

• Market opportunity framingAnalysis

  Notes that big sites already get AI-bot control via enterprise plans like Cloudflare, while small/mid-sized site owners on WordPress, Shopify, and Webflow lack equivalent accessible tooling — implying unmet demand in that segment.

Stack

• WordPress Plugin API (PHP)
• Shopify App (Remix + Admin API)
• Cloudflare Workers (edge-level bot detection)
• ai.robots.txt open-source bot signature list (GitHub)
• Supabase/Postgres (dashboard + traffic logs)
• Next.js (dashboard UI)

Solo + AI difficulty

Easy to ship fast: user-agent based detection, robots.txt/llms.txt generation, and a basic allow/block dashboard are all straightforward with AI-assisted coding. Hard part: keeping the bot-signature database current as crawlers rotate user-agents and IP ranges, and getting through WordPress.org plugin review and Shopify app review. A WordPress-only MVP is realistic in 3-4 weeks solo.

Entry threshold

Low capital barrier, but requires maintaining an up to date bot and user-agent fingerprint list and CMS-specific integrations; a solo builder can ship a working MVP in one to two weeks using existing bot-detection signals and a basic allow or block rules engine.

Window

6-12 months

Where to find first users

• r/WordPress
• r/shopify
• WordPress.org plugin directory
• Show HN launch
• Product Hunt launch
• IndieHackers community

Competitors

• Cloudflare
• Dark Visitors

Counter-signals & risks

• Major platforms (Cloudflare, WordPress.com, Shopify) could extend their existing bot-management features downmarket for free or low cost, undercutting a standalone plugin business.

• AI companies may negotiate direct licensing or crawling agreements with publishers, reducing the need for blanket blocking tools at the site-owner level.

• Rapid evolution of AI crawler identification standards (user-agent strings, IP ranges, llms.txt conventions) could make a maintained detection database a continuous cost center with thin margins.