Every bot knocking on your WordPress site, named.

Every request to your server carries a user-agent string, and the legitimate crawler operators - OpenAI, Anthropic, Google, Perplexity, Meta - publish the names their bots announce. Those names matter because they are the handles you control crawlers with: a robots.txt rule addresses a bot by its token, and a server-level block refuses it by name. Know the name, and you can meter, allow, or refuse each visitor individually instead of guessing at “bot traffic” in aggregate.

Identity is layered, and the layers are where most blocking mistakes happen. One company often runs several bots with different jobs and different deals for you: OpenAI's training crawler, its search indexer, and its user-triggered fetcher are three different names with three different value exchanges attached. Blocking “OpenAI” is not one decision, it is three - and the operators split their tokens precisely so you could make them separately. The most common own-goal in AI-era bot policy is the blanket rule that blocks a company's search indexer or user-fetcher to stop its training crawler.

The same logic cuts the other way: a decision about one category tells you nothing about another. Training crawlers take content and send nothing back; AI search bots index you so answer engines can cite and link you; user agents fetch a page because one human asked about it right now; SEO tool crawlers harvest your link graph into commercial databases your own team may subscribe to. Four value exchanges, four different rational answers - which is why this directory is organized by category before anything else.

One honest caveat applies to everything below: user agents are self-reported. A polite bot tells the truth; an impolite one wears someone else's name or none at all, and the best-documented operators publish IP ranges precisely so their names can be verified. That is why serious bot control pairs name-based rules with server-side measurement - which is exactly what Viz does inside WordPress.