AI Agent Shield gives every nginx website a policy for automated traffic. A built-in registry recognises the AI crawlers and agents in use today (GPTBot, ClaudeBot, PerplexityBot, Bytespider, Meta and Amazon crawlers, assistant fetchers like ChatGPT-User) and common automation tools, grouped as training, search, assistant, scraper and automation. For bots whose operators publish their IP ranges, a request that uses the bot's name from anywhere else is flagged as fake.

For each site you choose an action per category or per bot: allow, block (HTTP 403), limit (a per-IP rate limit, HTTP 429) or challenge (a short proof-of-work computation in the browser, served by a small local daemon with no third-party service). Presets cover the common choices: Balanced keeps the site in AI search and assistants but out of training sets; Strict blocks all AI; Open allows everything. The policy also writes the matching Disallow lines into the site's robots.txt (in a marked section, your own lines untouched) and serves an ai.txt.

Every site starts in learning mode: requests are classified and logged but nothing is blocked, so the dashboard shows who is crawling, how much bandwidth they take and what the policy would do before you enforce it. Website owners manage their own sites; admins see all of them and refresh the published IP ranges.

Free: registry, fake-bot detection, per-site policy with allow/block, robots.txt, ai.txt, learning mode and dashboard. Pro (any paid VinzaPanel plan): rate limiting and the proof-of-work challenge, also for login and search paths. This version supports nginx; the challenge runs on the panel server.

Min Panel Version

1.4.0

Platform

Ubuntu 20.04+ / 22.04+ / 24.04+

License

Free — no key needed

Hooks

website_deleting website_vhost_written

Permissions

websites.manage

VinzaPanel handles installation automatically via the Vinza Store. Make sure the panel agent has internet access to download dependencies.

1.1.0 — Honeypot traps with auto-ban (every shielded site of the server), a burst guard for clients that pretend to be browsers, trusted addresses per site and panel-wide, Content Signals (search / ai-input / ai-train) in robots.txt, the published bot ranges refreshed weekly, and a dashboard with bandwidth saved and the most refused addresses (Pro: traps, auto-ban, guard). Fixes: robots.txt is read and written as the site owner (a root write could follow a symlink in the document root); a bot name alone no longer skips a challenge path — only a bot verified by its address does; ACME, robots.txt and ai.txt are never challenged; Basic Auth sites keep their password prompt (no challenge there); the challenge daemon listens on a socket only nginx can use; an address in two operators' ranges is no longer flagged as fake; requests still arriving from Cloudflare are not checked for fakes; saves on one server no longer race; a lapsed plan no longer locks a site's settings; 7-day statistics read the older log rotations; the http file is removed with the last shielded site; challenged requests and solved challenges are counted; learning-mode start date shown. 1.0.1 — Policy page layout fixes. 1.0.0 — Initial release: AI bot registry with fake-bot detection from published IP ranges, per-site policy (allow / block / limit / challenge per category or bot) with presets, robots.txt and ai.txt, learning mode, dashboard (who crawls, bandwidth, latest events), rate limiting and proof-of-work challenge (Pro).

Use VinzaPanel's REST API to download and install this app programmatically.

Download app files

HTTP

POST /plugins/api/download/ai-agent-shield/
Content-Type: application/json

{
  "panel_version": "1.0.0"
}

Example response

JSON

{
  "success": true,
  "plugin_id": "ai-agent-shield",
  "version": "1.1.0",
  "download_url": "..."
}