AI assistants are shopping your store.
See the ones your platform can’t, and keep the receipts.

In two layers. Agents that name themselves in their user agent (GPTBot, ChatGPT-User, PerplexityBot, ClaudeBot and the rest of our registry) are matched by name, and a server-side install checks the request came from the operator’s published IP range where one exists. Agent browsers that don’t name themselves are scored on how the session behaves (page-timing regularity, interaction signals, the browser environment), and the score firms up as the session goes on. New agents are added to the registry without waiting for a release. How detection works.

A named crawler (GPTBot, PerplexityBot) says who it is in the User-Agent, so a user-agent list catches it. An agent browser (Meta’s Muse, OpenAI’s Operator) drives a real browser on a person’s behalf, and it visits your store whether or not you’re one of its commerce partners. There is no published request-layer fingerprint for Muse today, which means a user-agent list (and GA4) cannot see it at all. Tactical’s behavioral layer scores the session itself: page-timing regularity, interaction signals, the browser environment. In our September 2026 test, an AI-driven browser scored as an agent and a person in Chrome on the same laptop scored as human. We have not yet confirmed a real Muse session: no Muse user ran our open experiment, and the write-up says what that does and doesn’t show. Our agent registry tracks Muse as fingerprint research, and a confirmed signature goes live without waiting for a release.

Any storefront with a <head> works today: custom sites, headless commerce, BigCommerce, Squarespace, Webflow, Wix, plain HTML. The Shopify app and the WooCommerce plugin install the same snippet in one click. AI crawlers don’t run JavaScript, so seeing them needs a server-side install: the WooCommerce plugin, a one-paste Cloudflare connection (including Shopify stores behind Cloudflare), or our server middleware on a custom site. Order data (AI-referred and agent orders) comes from WooCommerce today; Shopify and direct stores don’t send us orders yet.

An agent order was placed by an AI agent: the platform marked it (a Stripe agentic checkout on WooCommerce), or the storefront session that placed it was an agent browser. An AI-referred order was placed by a person who arrived from ChatGPT, Perplexity or another assistant. The first is an agent buying; the second is a person buying after AI discovery. Tactical shows them as separate numbers and never adds them together, a match that rests on a loose signal is labeled estimated, and every agent order gets an evidence pack. How attribution works.

Two reasons. An order placed inside an AI platform’s own checkout never loads your storefront, so browser tags never fire: Shopify says Google Analytics and custom pixels don’t fire in Meta’s direct checkout, and the same holds for Stripe’s agentic checkout on WooCommerce, which creates the order server-side. And an agent browser that checks out on your storefront does run GA4, which counts it as a person. Tactical reads the order itself and says which kind it was. On Shopify, the Agentic report in your admin shows orders per AI channel; Tactical’s order data covers WooCommerce today.

They do different jobs, and they work together. A CDN’s AI settings act on bots that declare themselves. On Cloudflare, for example, every Cloudflare plan, the free one included, can block or allow Search, Agent and Training crawlers, and Cloudflare verifies a bot that declares itself through a cryptographic signature, a published IP list or reverse DNS (verified bots). If you want training crawlers out, use that. For bots that don’t declare themselves, Cloudflare scores traffic from heuristics, machine learning and JavaScript detections, but granular bot scores are an Enterprise product. And a CDN sees requests, not carts or orders. Tactical shows what happens on your store: which crawlers fetched which products, agent browsers scored on behaviour whether or not they name themselves, and the buyers AI assistants send you, down to the agent orders your pixels never see. The Cloudflare connection adds a Worker that reports crawlers and leaves your AI crawler settings and firewall rules as they are.

Your platform’s settings cover its own AI channels, and they’re the place to manage those. On Shopify, the Agentic home reports sales, orders, online store sessions and conversion per AI channel, and with “Allow Shopify to manage for me” turned off you choose catalog access and direct checkout per AI channel. Tactical adds what isn’t one of those channels: agent browsers that shop your storefront the way a person does, AI crawlers (on Shopify, when the store is behind Cloudflare) and the buyers AI assistants send you, the same way on WooCommerce and custom sites. Order data comes from WooCommerce today; on Shopify it needs order access the app doesn’t have yet, so for orders per AI channel, use Shopify’s report. Tactical doesn’t change your channel settings.

Session metadata: the user agent, the page path, the referrer’s domain, the product shown on the page (read from its structured data), and interaction counters such as whether the mouse moved, how the page was scrolled and how quickly pages followed each other. No names, email addresses, form input, cart contents or cookies from your store. Sessions and product views are deleted after 90 days.

When your store sends us order webhooks (the WooCommerce plugin sets them up): the order ID, total, currency, the line items (product ID, SKU, name, quantity and price), and how the order was attributed. The buyer’s user agent is used to match the order to a storefront session; neither it nor their IP address is stored, and we never store the buyer’s name, email, address or payment details. Order records are kept while your store is connected and deleted with the rest of its data. An agent order’s evidence pack adds the matched session (pages, products, cart and behaviour signals) and the agent’s declared identity, and holds none of those buyer details either. Details are in the privacy policy.

Within about 15 minutes. Sessions are classified as events arrive and written to your dashboard in batches, so a new session appears at the next batch.

Your storefront is never affected, and the data you already have stays visible. Once you pass your plan’s agent-session limit, new sessions stop being recorded until the limit resets: every 7 days on Scout, at the start of each month on Radar and Command. The dashboard shows a banner when you reach it, and upgrading resumes recording within about 15 minutes.

Yes: month-to-month, no commitment. Annual plans are pro-rated on cancellation. Your data stays accessible for 30 days after cancellation in case you change your mind.