HUMAN IS THE KEY
Your content. Your rules. Your revenue.
See exactly which AI crawlers visit your website — GPTBot, ClaudeBot, Perplexity and 60+ more. Help the right AI models discover your content, block harmful bots, and prove your human traffic to advertisers. GDPR-native, EU-hosted analytics.
Enterprise-grade privacy and security, included in every plan.
Primary data stored exclusively within the EU. Encryption at rest and in transit.
IP addresses cryptographically hashed with rotating salts. No cookies placed on visitors.
Our Data Protection Impact Assessment is publicly available. Full transparency on data processing.
Read more →Download our Data Processing Agreement. Enterprise customers receive countersigned DPA.
Read more →Data automatically deleted per your retention schedule. No manual intervention. Right to erasure built-in.
Public registry of every third-party service processing data on your behalf, with EU status.
Read more →Independent multi-role AI audit grades the platform across 33 criteria covering security, GDPR Art. 28, EU AI Act Art. 50 transparency, ML calibration honesty, hallucination risk, and ecosystem drift. Last audited 4d ago.
Every place HumanKey uses an LLM is registered and publicly listed. 9 of 10 surfaces are currently covered by the Assistant Audit Hub; each surface's audience, risk level and audit status is on the transparency page.
Read more →AI companies are signing content-licensing deals with publishers. HumanKey gives you the data to negotiate — and certifies your human traffic for advertisers.
AI companies are signing content-licensing deals with publishers — and the ones with crawler data come to the table first. Know exactly which systems train on your content, which pages they target most, and how often. Use that data to negotiate licensing terms, join pay-per-crawl programs, or simply understand what your content is worth to AI.
Separate real human visitors from AI crawlers and show only verified human traffic in your media kit. The Certified Human Traffic badge signals quality to ad networks and direct buyers.
HumanKey never stores raw IPs — only hashed identifiers with cryptographically rotating salts. Built for EU publishers subject to DPA audits, with full DPIA documentation and a ready-to-sign DPA.
Want to know what your AI traffic is worth?
Publishers with crawler data negotiate content licensing first.
Paste 1 line of JavaScript on any site, including WordPress. A dedicated WordPress plugin is coming soon. Sites with CSP headers may need a quick config update.
View documentation →HumanKey classifies every bot by name and company in real-time — GPTBot, ClaudeBot, Perplexity and more.
See all features →Attract AI licensing traffic. Block bad bots. Certify your human audience.
Sign in for live demo →Know who crawls your site. Configure smart rules. Audit your robots.txt. Prove human traffic to advertisers.Click any card to learn more.
See exactly which AI systems crawl your site — GPTBot, ClaudeBot, PerplexityBot and 60+ more, identified by name, company, and purpose.
Choose which AI crawlers to allow, monitor, or block — 60+ bots classified across 6 tiers with smart recommendations based on your traffic.
See where AI crawlers come from by country and network, and audit your robots.txt against our recommendations (Business+). Generate llms.txt on Pro — all from one dashboard.
Block scrapers, credential stuffers, and fake traffic with behavioral analytics, ML-based scoring, datacenter detection, and heuristic analysis.
No raw IPs stored. No fingerprinting. EU data residency. Built for GDPR compliance from day one — not bolted on.
Paste 1 line of JS to add HumanKey to any site, including WordPress — live in under a minute. A dedicated WordPress plugin is coming soon to WordPress.org. No developer required.
Built-in AI assistant answers your questions about traffic, GDPR, integration, and billing — instantly, in any language.
Forensic exports of every bot visit for Business+ sites — classification reasoning, confidence scores, country + ASN attribution. Downloadable as CSV or NDJSON.
Privacy-first click and scroll heatmaps for Business+ sites. See where real humans (and bots) interact with your pages — no cookies, no fingerprinting.
Everything you need to know about HumanKey — AI analytics, bot protection, GDPR compliance, and setup.
AI Crawler Analytics identifies every AI bot visiting your website — GPTBot (OpenAI), ClaudeBot (Anthropic), PerplexityBot, Googlebot-Extended, and 60+ others. You see who crawls, which pages they target, and how often. Use Smart Bot Config (Pro and up) to manage crawlers with AI-powered recommendations, and audit your robots.txt against recommended rules (Business and up).
We track 60+ AI crawlers including GPTBot (OpenAI), ClaudeBot (Anthropic), PerplexityBot (Perplexity AI), Googlebot-Extended (Google AI), Meta-External-Agent (Meta), YouBot (You.com), Common Crawl, and more. Our bot taxonomy grows as new AI systems appear — AI-powered Bot Research surfaces new crawlers, which we review and add.
Yes — GDPR compliance is core to our architecture, not an afterthought. We never store raw IP addresses (only cryptographically hashed with a rotating salt), use no fingerprinting, keep all data in EU data centers (Frankfurt + Amsterdam), and support all GDPR rights: access (Art. 15), deletion (Art. 17), and portability (Art. 20). We publish our DPIA, Transfer Impact Assessment (TIA), and DORA Compliance Mapping publicly at /legal. DPA documentation is available for Business and Enterprise plans.
A dedicated HumanKey WordPress plugin is coming soon to the WordPress.org directory. Until then, you can add HumanKey to any WordPress site in about a minute with our 1-line JS snippet — no plugin required: paste it into your site header via your theme settings or a headers and footers helper plugin. When the plugin ships, it will let you enter your site key and auto-add tracking, with a traffic panel inside WP Admin.
Add one line of JavaScript to your site's <head> section. It works with any platform — Shopify, Webflow, Squarespace, custom HTML, React, Next.js, or any framework that allows custom HTML injection. Advanced users can also use our REST API directly for server-side integration.
Free: 1,000 verifications/month, 1 site, AI crawler report + Certified Human Traffic badge — forever free. Pro ($49/month): 100,000 verifications/month, 3 sites, full AI analytics dashboard, bot detection API, and the WordPress plugin (coming soon). Business ($149/month): 1,000,000 verifications/month, 10 sites, data export, webhooks, team accounts, and priority support.
On Business and Enterprise plans, owners can invite collaborators by email through the Team page in the dashboard. The invitee receives a link, opens a preview showing who invited them and which role they're being offered (Admin, Analyst, or Read-only), and explicitly clicks Accept to join. Invitations expire after 7 days. The inviter is notified if the invitation is declined. Once accepted, the new member appears on the Team page with their role and can switch into the team's context to access the workspace.
No to both. IP addresses are immediately cryptographically hashed with a rotating salt before any storage — the original IP never touches our database. We use no browser fingerprinting for tracking purposes. Bot detection uses a proprietary multi-layered methodology — fully privacy-respecting by design.
The badge is a publicly verifiable certificate displaying the percentage of human traffic on your site, updated regularly. Display it to advertisers and ad networks to prove your traffic quality and justify premium CPM rates. The badge is cryptographically signed by HumanKey (HMAC-SHA256) and cannot be forged or replicated.
Yes. On Pro and up, Smart Bot Config lets you classify, allow, or block any AI crawler with one click, with AI-powered auto-recommendations based on your traffic patterns, and generate optimized robots.txt rules automatically. The robots.txt Audit — a full diff against recommended rules — is available on Business and up.
The robots.txt Audit compares your current robots.txt file against HumanKey's recommended rules for all detected AI crawlers and shows a full diff view of exactly what to add, remove, or change — with one-click copy for quick updates. The Audit is a Business and Enterprise feature. On Pro, you instead get AI-generated robots.txt and llms.txt rules from your Smart Bot Config settings — rule generation, not the diff audit.
All data is stored exclusively in the European Union: database servers in Frankfurt, Germany (EU) and application servers in Amsterdam, Netherlands (EU). Data never leaves the EU. No Schrems II transfer concerns.
Yes — HumanKey generates timestamped, verifiable crawl logs for every AI system visit: which bot, which URL, when, and how often. This data is exactly what you need to negotiate licensing fees with AI companies, join pay-per-crawl programs (like those offered by Perplexity and Cloudflare), or document your content's AI traffic value. Business and Enterprise plans include JSON/CSV export and 90–365 day retention suitable for licensing negotiations, ad fraud disputes, and compliance reporting.
Those tools measure human visitor behavior — sessions, clicks, and conversions. HumanKey measures the other half of your traffic: AI crawlers training on your content, scrapers harvesting your prices, and bots inflating your session counts. Google Analytics can't tell you that GPTBot visited 2,400 pages last week or that your traffic is 94% human-verified. Together, they give you the complete picture.
Common causes: (1) If your site uses Content-Security-Policy (CSP) headers, add api.humankey.io to both script-src and connect-src. (2) Your CDN may be serving cached HTML without the snippet — purge your cache. (3) Ad blockers on your browser may block the snippet during testing — try an incognito window. (4) If you use Cloudflare, check that "Block AI bots" and "Bot Fight Mode" are disabled — see the next question. See /docs#troubleshooting for full diagnostics.
Cloudflare's "Block AI bots" and "Bot Fight Mode" features can prevent AI crawlers from reaching your site entirely. If enabled, HumanKey will show zero AI bot traffic — not because it's broken, but because the bots are blocked before they arrive. To get full AI traffic visibility, disable these two settings in Cloudflare Dashboard → Security → Settings. Also disable "AI Labyrinth" if enabled, as it can generate misleading traffic data. Important: Cloudflare Rocket Loader may also interfere — add data-cfasync="false" to the HumanKey script tag. These changes do not reduce your site's security — HumanKey monitors and reports AI traffic without blocking it, giving you data to make informed decisions.
Yes. Add https://api.humankey.io to both script-src and connect-src in your CSP header. Without this, the browser will silently block the tracking snippet. This is the most common cause of "snippet installed but no data" issues.
Ad blockers like uBlock Origin or Brave Shields may block the HumanKey snippet for visitors using those extensions. This typically affects 15–30% of human traffic. However, AI crawlers and bots — HumanKey's primary detection target — do not use ad blockers, so your bot detection data remains fully accurate.
No. The snippet loads asynchronously (async attribute), weighs under 2 KB gzipped, and has zero impact on Core Web Vitals. It runs after your page has loaded and does not block rendering.
Open DevTools (F12), go to the Network tab, and reload your page. Search for "detect.js" — it should show status 200. Then look for "/api/v1/challenge" (also status 200). If both appear, your installation is correct. Data should appear in your dashboard within 5 minutes.
Traffic Trends shows how your human, bot, and unknown traffic evolves over time using automated daily aggregations. Compare periods to spot changes, see which bots dominate your traffic, and track trend shifts. Available on Pro (30-day), Business (90-day), and Enterprise (365-day) plans. Find it at Dashboard → Traffic → Benchmarks.
Expert insights on AI traffic, content monetization, and GDPR compliance for website owners.
A crawler-control recommendation that only lists the bots already in your logs is incomplete by design. Here is why we recommend an explicit rule for every AI crawler we track — including the ones that have not visited yet.
Before any control of ours starts rejecting requests, we prove in a log-only mode that it is complete, that it actually fires, and that it never trips legitimate traffic.
Two changes make your traffic intelligence more trustworthy: traffic over your plan limit is still measured instead of going dark, and geography is read from the real visitor rather than the delivery edge.
14-day free trial. No credit card required. GDPR-native. Setup in under 5 minutes.