Four Signal Layers for Detecting AI Agents on WooCommerce

What are the four signal layers for detecting AI agents?

Effective AI agent detection requires four layers: user-agent header inspection, IP/ASN reputation analysis, browser fingerprinting, and behavioural signal analysis. Each layer catches a different subset of agent traffic, and no single layer catches all of it. 71% of agentic activity is browser-based (CSide, 2026) — meaning the majority of agent traffic looks like normal browser sessions to any detection method that relies on headers alone.

The layers work in sequence. User-agent headers catch training crawlers and self-identifying bots — the easy ones. IP/ASN reputation catches traffic originating from known cloud infrastructure. Browser fingerprinting catches headless browsers with incomplete rendering environments. Behavioural analysis catches everything else — the 71% that uses real browsers, real IPs, and passes every fingerprint check but navigates in patterns no human would.

71% of agentic activity is browser-based — only behavioural analysis catches the traffic that user-agent matching, IP reputation, and browser fingerprinting all miss (CSide, 2026).

Why does user-agent matching fail for AI shopping agents?

Browser-based shopping agents run real Chromium engines and send standard Chrome user-agent strings that are indistinguishable from human traffic. Only training crawlers and search bots use identifiable UA strings; agents that browse and buy send the same headers as any human shopper (AgentLux, 2026).

The failure is architectural, not technical. User-agent matching was designed for a web where bots identified themselves — Googlebot, Bingbot, GPTBot. That convention held when bots wanted to be recognised (for crawl budgets, for robots.txt compliance). Shopping agents don’t want to be recognised — they want to evaluate products and complete purchases. They use real browsers because they need to render JavaScript, evaluate prices, and interact with checkout flows. The user-agent string is the last thing they’d change, because changing it would break the very sites they’re trying to use.

Related: A 45-Second Session Is Success When the Visitor Is an AI Agent

What behavioral signals identify AI agents?

Key behavioural signals include deterministic mouse paths, DOM burst reads, CDP (Chrome DevTools Protocol) artifacts, no viewport scrolling, and unnaturally fast page evaluation. Agents evaluate product pages in 2–5 seconds with direct navigation — humans browse 30–120 seconds with meandering paths (CSide, 2026). The timing alone is a strong signal, but it’s the combination of timing, navigation pattern, and interaction style that makes behavioural detection reliable.

DOM burst reads are particularly telling. A human reads a page sequentially — text flows from top to bottom, with pauses for images and navigation. An agent reads the entire DOM in a single burst, extracting structured data from every element simultaneously. The page renders once, the agent captures everything, and the session ends. No scroll events, no hover events, no mouse movement — just a complete page read in under three seconds followed by either a purchase or an exit.

How does IP/ASN reputation help detect AI traffic?

AI agent traffic often originates from cloud infrastructure ASNs rather than residential ISPs — checking the ASN of incoming requests filters out traffic from known data centres. OpenAI publishes its IP ranges; most other AI vendors do not (CSide, 2026). IP reputation is useful but incomplete — it catches the agents running on cloud servers and misses the ones running on the user’s own device.

The limitation is growing. As agents move from cloud-hosted services to local execution (running on the user’s laptop or phone), they’ll originate from residential IPs that no reputation database flags. A shopping agent running as a browser extension uses the user’s own IP, the user’s own browser, and the user’s own cookies. IP/ASN reputation catches zero of that traffic. The layer remains valuable for cloud-hosted agents — particularly bulk operations and automated comparison shopping — but it’s a declining share of total agentic activity.

Detection Layer	What It Catches	What It Misses	Reliability
User-Agent Headers	Training crawlers, self-identifying bots	Browser-based shopping agents (71%)	Low for commerce
IP/ASN Reputation	Cloud-hosted agents, data centre traffic	Agents on residential IPs, browser extensions	Declining
Browser Fingerprinting	Headless browsers, incomplete rendering	Real Chromium engines with full rendering	Moderate
Behavioural Analysis	DOM bursts, fast evaluation, no scrolling	Sophisticated agents mimicking human timing	Highest

Agents evaluate product pages in 2–5 seconds with direct navigation — humans browse 30–120 seconds with meandering paths. The timing gap is the strongest single behavioural signal (CSide, 2026).

Related: How to Report AI Agent Revenue Without Inflating Client ROAS

What is browser fingerprinting and does it catch AI agents?

Browser fingerprinting checks canvas rendering, WebGL capabilities, installed fonts, and screen properties — AI agents using headless browsers or incomplete rendering environments fail these checks. But agents running full Chromium instances pass every fingerprint test because they have a complete rendering environment. iOS 26 Advanced Fingerprinting Protection now adds noise to canvas and WebGL results for all browsers (CSide, 2026), which means legitimate human traffic is becoming harder to fingerprint too.

The fingerprinting layer is caught in a squeeze. On one side, privacy features are degrading fingerprint reliability for human visitors. On the other, AI agents are upgrading to full browsers that pass every check. The window where fingerprinting reliably distinguishes agents from humans is narrowing. It still catches the cheapest agents — headless Chrome instances with no GPU, no fonts, no canvas support — but those aren’t the agents making purchases on your WooCommerce store.

Which detection layer should WooCommerce stores implement first?

Start with server-side request analysis at the PHP level — it catches MCP requests (which have no browser session at all), identifies agent purchase patterns at the order hook, and doesn’t depend on JavaScript execution. Server-side detection at the PHP hook catches agent purchases that all four client-side signal layers miss (Seresa, 2026).

The reasoning is pragmatic. Client-side detection requires JavaScript to run in the visitor’s browser — which means it only works for browser-based agents. MCP agent purchases arrive as server-to-server API calls with no browser session at all. Client-side detection literally cannot see them. Server-side detection at the PHP level sees every request that hits your WooCommerce store, regardless of whether it arrived through a browser, an API, or an MCP endpoint.

Transmute Engine implements this as the first step in its event pipeline. Before any tracking event is sent to GA4 or BigQuery, the engine classifies the session at the server level — checking request headers, MCP identification, and behavioural timing against known agent patterns. The classification tag travels with every subsequent event, so your analytics platform receives pre-labelled data without running any client-side detection code.

Can WAFs and CDNs detect AI agents at the edge?

Cloudflare’s July 2026 three-category controls (Search, Agent, Training) detect and manage self-identifying bots at the edge, but browser-based shopping agents that don’t self-identify pass through like any other visitor. Cloudflare processes approximately 20% of all web traffic — its edge detection is the first line, but browser-based agents require deeper analysis (HelpNet Security, 2026).

The Cloudflare controls are valuable for managing known crawlers — blocking training bots, rate-limiting search crawlers, allowing legitimate agents. But the controls rely on bot identification signals (IP reputation, known UA strings, TLS fingerprints) that browser-based shopping agents don’t trigger. A WAF is a gate, not a detective. It decides what to do with traffic it recognises; it doesn’t recognise traffic that looks human. The detection layers below the WAF — server-side behavioural analysis — handle the traffic that passes through the gate undetected.

Is there a single solution that covers all four detection layers?

No single tool covers all four layers — the practical approach is layered: Cloudflare or a WAF at the edge for identified crawlers, server-side PHP analysis for MCP and API purchases, and behavioural scoring for browser-based agents. 6+ WordPress plugins now handle parts of the detection stack, but none covers all four layers (WordPress.org, 2026).

The gap is the integration point. Each plugin or service handles one or two layers well. CiteLayer focuses on AI citation tracking. Cloudflare handles edge detection. Individual analytics plugins add agent dimensions to GA4. But nobody is combining edge detection, server-side classification, behavioural analysis, and cohort tagging into a single pipeline — which is exactly what a WooCommerce store needs to detect agent traffic, classify it, and report on it as a distinct channel.

The stores that assemble this stack now — edge detection plus server-side classification plus behavioural scoring — will have the cleanest analytics data as agent traffic grows. The stores that wait for a single all-in-one solution will wait through the period when their analytics data is most contaminated and their optimisation decisions are least informed.

Key Takeaways

• Four detection layers are required: user-agent headers, IP/ASN reputation, browser fingerprinting, and behavioural analysis — no single layer is sufficient.
• 71% of agentic activity is browser-based: user-agent matching catches crawlers but misses the agents that actually buy.
• Behavioural signals are the strongest indicator: agents evaluate pages in 2–5 seconds with direct navigation versus 30–120 seconds for humans.
• Server-side PHP detection catches what client-side cannot: MCP purchases arrive as API calls with no browser session at all.
• Cloudflare edge controls are the first line, not the last: they manage identified bots but pass browser-based agents through undetected.
• No single tool covers all four layers: the practical approach is a layered stack, assembled now before agent traffic grows further.

References

1. CSide — Guide to Detect AI Agent Traffic on Your Website
2. AgentLux — Agentic Traffic Is Here: How Websites Should Prepare
3. Seresa — WooCommerce 10.3 Lets AI Agents Buy, Your Tracking Pixels Don’t Know
4. HelpNet Security — Cloudflare AI Crawler Controls (July 2026)
5. CiteLayer — WordPress.org Plugin Directory