HUMAN IS KEY
Your content. Your rules. Your revenue.
See exactly which AI crawlers visit your site — GPTBot, ClaudeBot, Perplexity and 60+ more. Attract AI licensing deals. Block bad bots. Certify your human audience for premium ad rates.
Enterprise-grade privacy and security, included in every plan.
Primary data stored exclusively within the EU. Encryption at rest and in transit.
IP addresses cryptographically hashed with rotating salts. No cookies placed on visitors.
Our Data Protection Impact Assessment is publicly available. Full transparency on data processing.
Read more →Download our Data Processing Agreement. Enterprise customers receive countersigned DPA.
Read more →Data automatically deleted per your retention schedule. No manual intervention. Right to erasure built-in.
Public registry of every third-party service processing data on your behalf, with EU status.
Read more →Independent multi-role AI audit grades the platform across 32 criteria covering security, GDPR Art. 28, EU AI Act Art. 50 transparency, ML calibration honesty, hallucination risk, and ecosystem drift. Last audited 4d ago.
Every place HumanKey uses an LLM is registered and publicly listed. 9 of 10 surfaces are currently covered by the Assistant Audit Hub; each surface's audience, risk level and audit status is on the transparency page.
Read more →AI companies are paying publishers for content access. HumanKey gives you the data to negotiate — and certifies your human traffic for premium ad rates.
AI companies committed $2.9 billion to content licensing in 2025 — and publishers with crawler data sit at the negotiation table first. Know exactly which systems train on your content, which pages they target most, and how often. Use that data to negotiate licensing fees, join pay-per-crawl programs, or simply price your content's AI value.
Separate real human visitors from AI crawlers and show only verified human traffic in your media kit. The Certified Human Traffic badge signals quality to ad networks and direct buyers.
HumanKey never stores raw IPs — only hashed identifiers with daily-rotating salts. Built for EU publishers subject to DPA audits, with full DPIA documentation and a ready-to-sign DPA.
Ready to monetize your AI traffic?
Publishers with crawler data negotiate content licensing first.
Add our WordPress plugin or paste 1 line of JavaScript to any site. Sites with CSP headers may need a quick config update.
View documentation →HumanKey classifies every bot by name and company in real-time — GPTBot, ClaudeBot, Perplexity and more.
See all features →Attract AI licensing traffic. Block bad bots. Certify your human audience.
Try live demo →Know who crawls your site. Configure smart rules. Audit your robots.txt. Prove human traffic to advertisers.Click any card to learn more.
See exactly which AI systems crawl your site — GPTBot, ClaudeBot, PerplexityBot and 60+ more, identified by name, company, and purpose.
Choose which AI crawlers to allow, monitor, or block — 60+ bots classified across 6 tiers with smart recommendations based on your traffic.
See where AI crawlers come from by country and network. Audit your robots.txt and generate llms.txt — all from one dashboard.
Block scrapers, credential stuffers, and fake traffic with behavioral analytics, ML-based scoring, IP reputation, and heuristic analysis.
No raw IPs stored. No fingerprinting. EU data residency. Built for GDPR compliance from day one — not bolted on.
Official WordPress plugin — install in 60 seconds. Or paste 1 line of JS to any site. No developer required.
Built-in AI assistant answers your questions about traffic, GDPR, integration, and billing — instantly, in any language.
Forensic exports of every bot visit — classification reasoning, confidence scores, country + ASN attribution. Downloadable as CSV or NDJSON.
Privacy-first click and scroll heatmaps for Business+ sites. See where real humans (and bots) interact with your pages — no cookies, no fingerprinting.
Everything you need to know about HumanKey — AI analytics, bot protection, GDPR compliance, and setup.
AI Crawler Analytics identifies every AI bot visiting your website — GPTBot (OpenAI), ClaudeBot (Anthropic), PerplexityBot, Googlebot-Extended, and 60+ others. You see who crawls, which pages they target, and how often. Use Smart Bot Config to manage crawlers with AI-powered recommendations, and audit your robots.txt against best practices.
We track 60+ AI crawlers including GPTBot (OpenAI), ClaudeBot (Anthropic), PerplexityBot (Perplexity AI), Googlebot-Extended (Google AI), Meta-External-Agent (Meta), YouBot (You.com), Common Crawl, and more. Our bot taxonomy is updated continuously via our AI-powered Bot Research feed as new AI systems appear.
Yes — GDPR compliance is core to our architecture, not an afterthought. We never store raw IP addresses (only cryptographically hashed with a rotating salt), use no fingerprinting, keep all data in EU data centers (Frankfurt + Amsterdam), and support all GDPR rights: access (Art. 15), deletion (Art. 17), and portability (Art. 20). We publish our DPIA, Transfer Impact Assessment (TIA), and DORA Compliance Mapping publicly at /legal. DPA documentation is available for Business and Enterprise plans.
Install the official HumanKey plugin from the WordPress plugin directory. Enter your site key (found in your dashboard), and the plugin automatically adds the tracking snippet to every page. A lightweight panel in WP Admin shows your traffic stats without leaving WordPress. Setup takes under 60 seconds.
Add one line of JavaScript to your site's <head> section. It works with any platform — Shopify, Webflow, Squarespace, custom HTML, React, Next.js, or any framework that allows custom HTML injection. Advanced users can also use our REST API directly for server-side integration.
Free: 1,000 verifications/month, 1 site, AI crawler report + certified badge — forever free. Pro ($49/month): 100,000 verifications/month, 3 sites, full AI analytics dashboard, bot detection API, and WordPress plugin. Business ($149/month): 1,000,000 verifications/month, 10 sites, data export, webhooks, team accounts, and priority support.
No to both. IP addresses are immediately cryptographically hashed with a rotating salt before any storage — the original IP never touches our database. We use no browser fingerprinting for tracking purposes. Bot detection uses a proprietary multi-layered methodology — fully privacy-respecting by design.
The badge is a publicly verifiable certificate displaying the percentage of human traffic on your site, updated regularly. Display it to advertisers and ad networks to prove your traffic quality and justify premium CPM rates. The badge is cryptographically signed by HumanKey (HMAC-SHA256) and cannot be forged or replicated.
Yes. Smart Bot Config lets you classify, allow, or block any AI crawler with one click. AI-powered auto-recommendations suggest the optimal configuration based on your traffic patterns. You can also audit your robots.txt against recommended rules and generate optimized rules automatically.
The robots.txt Audit compares your current robots.txt file against HumanKey recommended rules for all detected AI crawlers. On Pro, you see a read-only view. On Business, you get a full diff view showing exactly what to add, remove, or change — with one-click copy for quick updates. Rules are auto-generated based on your Smart Bot Config settings.
All data is stored exclusively in the European Union: database servers in Frankfurt, Germany (EU) and application servers in Amsterdam, Netherlands (EU). Data never leaves the EU. No Schrems II transfer concerns.
Yes — HumanKey generates timestamped, verifiable crawl logs for every AI system visit: which bot, which URL, when, and how often. This data is exactly what you need to negotiate licensing fees with AI companies, join pay-per-crawl programs (like those offered by Perplexity and Cloudflare), or document your content's AI traffic value. Business and Enterprise plans include JSON/CSV export and 90–365 day retention suitable for licensing negotiations, ad fraud disputes, and compliance reporting.
Those tools measure human visitor behavior — sessions, clicks, and conversions. HumanKey measures the other half of your traffic: AI crawlers training on your content, scrapers harvesting your prices, and bots inflating your session counts. Google Analytics can't tell you that GPTBot visited 2,400 pages last week or that your traffic is 94% human-verified. Together, they give you the complete picture.
Common causes: (1) If your site uses Content-Security-Policy (CSP) headers, add api.humankey.io to both script-src and connect-src. (2) Your CDN may be serving cached HTML without the snippet — purge your cache. (3) Ad blockers on your browser may block the snippet during testing — try an incognito window. (4) If you use Cloudflare, check that "Block AI bots" and "Bot Fight Mode" are disabled — see the next question. See /docs#troubleshooting for full diagnostics.
Cloudflare's "Block AI bots" and "Bot Fight Mode" features can prevent AI crawlers from reaching your site entirely. If enabled, HumanKey will show zero AI bot traffic — not because it's broken, but because the bots are blocked before they arrive. To get full AI traffic visibility, disable these two settings in Cloudflare Dashboard → Security → Settings. Also disable "AI Labyrinth" if enabled, as it can generate misleading traffic data. Important: Cloudflare Rocket Loader may also interfere — add data-cfasync="false" to the HumanKey script tag. These changes do not reduce your site's security — HumanKey monitors and reports AI traffic without blocking it, giving you data to make informed decisions.
Yes. Add https://api.humankey.io to both script-src and connect-src in your CSP header. Without this, the browser will silently block the tracking snippet. This is the most common cause of "snippet installed but no data" issues.
Ad blockers like uBlock Origin or Brave Shields may block the HumanKey snippet for visitors using those extensions. This typically affects 15–30% of human traffic. However, AI crawlers and bots — HumanKey's primary detection target — do not use ad blockers, so your bot detection data remains fully accurate.
No. The snippet loads asynchronously (async attribute), weighs under 2 KB gzipped, and has zero impact on Core Web Vitals. It runs after your page has loaded and does not block rendering.
Open DevTools (F12), go to the Network tab, and reload your page. Search for "detect.js" — it should show status 200. Then look for "/api/v1/challenge" (also status 200). If both appear, your installation is correct. Data should appear in your dashboard within 5 minutes.
Traffic Trends shows how your human, bot, and unknown traffic evolves over time using automated daily aggregations. Compare periods to spot changes, see which bots dominate your traffic, and track trend shifts. Available on Pro (30-day), Business (90-day), and Enterprise (365-day) plans. Find it at Dashboard → Traffic → Benchmarks.
Expert insights on AI traffic, content monetization, and GDPR compliance for publishers.
Rule-based detection can't keep up with modern bots. Learn how ML-based behavioral scoring catches what static rules miss — and why it matters for your website.
Major publishers are signing multi-million dollar licensing deals with AI companies. Here's how the content licensing landscape is evolving and what it means for website owners of all sizes.
The EU AI Act becomes fully applicable in August 2026 with strict transparency obligations. Here's what website owners need to understand about AI crawler compliance and content rights.
14-day free trial. No credit card required. GDPR-native. Setup in under 5 minutes.