Your WordPress site is being read by AI companies you never gave permission. They pull your posts to train models, feed AI search engines, and generate summaries that answer questions about your content — without linking back. Here’s what’s actually happening, why publishers should care, and how to take back control at the WordPress layer.

The Economic Shift Nobody Warned WordPress Publishers About

The web deal used to be simple. You wrote something good. Google indexed it. People searched, clicked through, and landed on your site. Ads, subscriptions, affiliate links — however you monetized — depended on those clicks.

That deal is quietly breaking. AI-generated answers now sit above search results, summarize the same content you wrote, and rarely link back. The training data that made those summaries possible? Scraped from sites like yours, without notice, permission, or payment.

The New York Times sued OpenAI over exactly this — content taken to train models that now compete with the Times for reader attention. Reddit signed a $60M+ licensing deal with Google for the same content it used to give away for free indexing. Publishers as large as The Atlantic and as small as niche independent blogs are seeing traffic drop while their words show up verbatim in ChatGPT and Perplexity answers.

If you publish on WordPress, this is happening to you right now. Most site owners simply have no way to see it.

What “AI Scraping” Actually Means

Not all AI bots are the same. Broadly there are three categories, and each is a different trade-off:

  • Training crawlers grab your content to add to model training datasets. Once your text is trained into a model, it can be recalled, paraphrased, or quoted in AI answers permanently. Examples: GPTBot (OpenAI), ClaudeBot (Anthropic), Google-Extended, Bytespider (ByteDance), CCBot (Common Crawl, which feeds most of the AI industry).
  • Retrieval bots hit your site in real time when a user asks a question. They quote or summarize your content on the fly, sometimes with a link and sometimes without. Examples: ChatGPT-User, Perplexity-User, Claude-Web.
  • AI search engines index your site the way Googlebot does, but the results are AI-generated summaries instead of the classic ten blue links. Examples: PerplexityBot, OAI-SearchBot, Claude-SearchBot.

Blocking a training crawler prevents future models from learning your voice — but doesn’t affect visitors today. Blocking a retrieval bot means AI answers about your topic won’t cite you. Blocking an AI search engine removes you from that surface entirely.

The problem: without seeing which bots are actually hitting your site, you can’t make any of these decisions on evidence. You’re guessing.

Why WordPress Publishers Are the Softest Target

WordPress powers more than 40% of the web. It’s the default platform for personal blogs, small news sites, niche publishers, course creators, and one-person shops. Almost none of those sites have:

  • A legal team to write a scraping policy or enforce it
  • The traffic scale to make an AI company negotiate a licensing deal
  • The infrastructure budget for enterprise CDN products that gate bot traffic at the edge
  • The visibility tooling that shows what’s happening at the HTTP layer

AI companies know this. The default posture is to scrape first and address concerns later, if ever. Enforcement lives on the site owner’s shoulders — and a WordPress-only site owner has, until recently, had almost nothing between them and the scraper.

That’s the gap this piece is about. It’s also the gap that’s driving the second wave of publisher tooling — llms.txt, per-bot policies, content-owner analytics — that’s now emerging as a category of its own.

The Three Questions Every WordPress Publisher Should Be Able to Answer

If you write on WordPress, you should be able to answer these three questions about your own site by end of day today:

  1. Which AI companies are already taking my content? Not “in general” — specifically. Which bots, how often, which URLs. Most owners can’t answer this because most WordPress installs don’t log it. Analytics filters bots out by design. Server logs are noisy and hard to read. Cloudflare dashboards focus on threats, not attribution.
  2. What am I willing to allow, block, or license? This is a values question, not a technical one. You might want AI search engines to keep indexing (they still drive some traffic) but block training crawlers (your content trains models that later compete with you). You might want to allow one AI company you have a relationship with and block others. You might want to log everything for a month before deciding anything. All valid — but you can’t decide without visibility (question 1).
  3. How do I enforce my decision? robots.txt is a suggestion — good actors respect it, bad actors ignore it. A firewall rule at the WordPress layer is enforcement — it returns a 403 before your content reaches the requester, regardless of whether they read your robots.txt. This is where the WordPress plugin layer matters.

What Agency Looks Like at the WordPress Layer

You don’t need enterprise infrastructure to answer those three questions. A free WordPress plugin is enough.

Royal AI Firewall is a wp.org plugin that gives you a live dashboard of every AI bot hitting your site — 60+ recognized bots grouped by category (training crawlers, retrieval bots, AI search engines, dataset scrapers) — with a one-click policy per bot: allow, log-only, or block. It’s free forever, no upgrade prompt. Every feature ships in the wp.org release.

The point isn’t the plugin. The point is that this class of tool now exists at the WordPress layer, priced at zero, and takes about four minutes to install. Nothing about the current state of AI scraping is inevitable for you — the “publishers have no leverage” story ends the moment you can see and decide.

See Every AI Agent on Your Site →

What Comes Next (2026–2027)

Three trends worth naming, because they change what “publishing on WordPress” means over the next twelve to twenty-four months:

  • llms.txt is becoming its own standard. A machine-readable file at the root of your site that tells AI companies what content they can use and how it should be cited. It’s not enforced by law yet, but it’s on the same trajectory as robots.txt was in the mid-1990s — informal at first, near-universal within a few years. Setup guide: LLMs.txt: Control How AI Crawlers Use Your Content.
  • AI-fatigue is going mainstream. “AI slop” is now a term. People are actively curating away from AI-generated content. Publishers who visibly control what AI takes from them are building a differentiator, not just protecting themselves.
  • Publisher-side tooling is maturing fast. Content licensing platforms, per-bot analytics, verification standards (like “no-AI-training” labels for content) — the ecosystem is filling in every quarter.

You don’t need to be a newspaper to decide who gets your work. You just need visibility and a way to say no. That’s the whole story.