See every bot that reaches WordPress — search crawlers, AI agents, scrapers, impostors — classified and identity-verified, in one dashboard.
AI agents, search crawlers, SEO tools, scrapers, and impostors pretending to be all of the above now make up a large share of most sites’ traffic — and standard analytics are built to ignore them. Frenemy watches that traffic instead.
For every request that reaches WordPress, the plugin:
- classifies the visitor against a maintained registry of known agents (GPTBot, ClaudeBot, Googlebot, PerplexityBot, and many more),
- verifies identity claims where the operator publishes IP ranges — an out-of-range “Googlebot” is reported as an impostor, a real one as verified,
- reports the result to your Frenemy dashboard at frenemy.dev, where you see who visits, how often, and what they claim to be.
Observe-only, by design. The plugin never blocks, slows, challenges, or alters a request — there is no blocking code in it at all. It is also fail-open at every joint: classification runs after your page has already been sent, and any Frenemy failure means “no data,” never a broken or slower site.
Honest about what it sees. Frenemy observes every request that reaches WordPress itself. Cached pages and static files are served before WordPress runs and are not observed — that trade-off is stated in the plugin, on your dashboard, and here, rather than papered over. The requests page caches never serve (cache misses, searches, POSTs, login, REST, and XML-RPC traffic) are exactly where bot and impostor signal concentrates.
Account required. The plugin needs a site key from a Frenemy account (free trial — no card required to start). All plugin code is fully functional and GPL; the key connects it to your dashboard, which is where the analytics live. There are no charts inside wp-admin and no duplicate analytics UI — one settings screen, one key, one link to your dashboard.
External services
This plugin talks to exactly two endpoints, both operated by Frenemy (frenemy.dev). It sends nothing anywhere until you save a site key.
1. Registry download (GET). The plugin periodically downloads Frenemy’s public bot registry (user-agent patterns and published IP ranges for known agents) so classification can run locally on your server with no per-request network calls. No visitor data, cookies, or credentials are sent with this request.
2. Event reporting (POST). After a response has been sent, the plugin reports one small event to Frenemy’s ingest service, authenticated by your site key. It contains: the classification result, the request method and path (query strings stripped except utm_*/ref/source), the response status code and duration, the visitor’s IP address (transmitted securely, processed transiently — hashed with a per-site rotating salt and never stored in raw form), and, only for unrecognized bot-like requests, the user-agent string. Human visitors’ user-agents are never transmitted, and presumed-human traffic is sampled, not tracked.
By installing the plugin and entering your site key you consent to this reporting. Details: Terms of Service · Privacy Policy.
