ThreatPoint Intent Detection v1.0.0

AI Agent Governance, Bot Defense & Behavioral Verification for WordPress

Official Customer Guide
Website: threatpoint.co.uk
API Support: api@threatpoint.co.uk
1. Executive & Technical Overview

Purpose of ThreatPoint Intent Detection

ThreatPoint Intent Detection is an enterprise-grade AI agent governance, bot defense, and behavioral verification plugin for WordPress and WooCommerce. As the modern web shifts toward autonomous AI agents, LLM crawlers, and sophisticated headless automation frameworks, traditional IP-only or CAPTCHA-only defenses either block legitimate user-delegated AI assistants or fail against stealthy browser automation.

ThreatPoint Intent Detection solves this challenge by combining lightweight, obfuscated client-side hardware and kinetic telemetry with real-time server-side protocol, TLS/TPHash, physical device recognition, and IP intelligence. Every request is scored in real time across six independent verification engines, allowing WordPress administrators to define granular reactions (Allow, Log Only, Challenge, Deny 403, or Redirect) for each distinct class of human, AI agent, and automated traffic.

Primary API Endpoint: https://verifyb.threatpoint.co.uk/api/v1/intent/evaluate

DOM & Runtime Evasion Analysis (20% Weight)

Validates OS, navigator.platform, and Client Hints consistency; inspects desktop vs. mobile font distributions; executes an offscreen WebGL fragment shader floating-point canary to unmask virtual GPUs (SwiftShader/llvmpipe); and runs an OfflineAudioContext DSP entropy canary alongside JavaScript prototype and iframe context-leak probes.

Behavioral Kinetics & Touch Dynamics (20% Weight)

Analyzes desktop mouse trajectory curvature, velocity variance, and click dwell times alongside mobile capacitive touch contact geometry (radiusX, radiusY, force), swipe curvature, scroll direction reversals, and keystroke flight rhythm—plus synthetic untrusted event (isTrusted === false) detection.

TLS / JA3 / TPHash & GREASE Inspection (20% Weight)

Inspects TLS handshake signatures (JA3 & TPHash), verifies RFC 8701 TLS GREASE behavior across Chromium vs. Firefox stacks, flags HTTP/1.1 ALPN downgrades, and identifies known programmatic bot TLS stacks.

Physical Device Recognition & Velocity (15% Weight)

Bridges sessions across browser resets using hardware display, audio, and GPU signatures while tracking 10-second, 60-second, and 10-minute request burst velocity and IP/User-Agent rotation.

ThreatPoint IP Reputation Intelligence (15% Weight)

Evaluates real-time IP risk tiers (High, Medium, Low), Non-Human Traffic consortium flags, ASN/ISP/Hosting/VPN infrastructure, country and RIR registrar mismatches, forward-confirmed reverse DNS (rDNS), and verified residential Home IP status.

AI Agent & User-Agent Provenance (10% Weight)

Distinguishes verified Known AI Agents (ClaudeBot, GPTBot, ChatGPT-User, PerplexityBot, Google-Extended, etc.), Consumer User-Delegated Agents (OpenClaude, OpenCode, AutoGPT, LangChain, CrewAI), Spoofed AI Agents (impersonating AI crawlers from unauthorized networks), Automation Drivers (Playwright, Puppeteer, Selenium), and HTTP Libraries.

2. Installation & Activation Guide

Installing via the WordPress Plugin Store

Follow the steps below to install ThreatPoint Intent Detection directly from the WordPress Plugin Store (or via the threatpoint-intent.zip distribution archive) and connect your ThreatPoint API key.

1

Step 1: Open the WordPress Plugin Store

Log in to your WordPress Administrator Dashboard (wp-admin). In the left-hand navigation sidebar, go to Plugins -> Add New Plugin.

2

Step 2: Search for ThreatPoint Intent Detection

In the Search Plugins box in the top-right corner, type "ThreatPoint Intent Detection". Locate the official plugin by ThreatPoint in the search results and click Install Now. (Alternatively, if installing from a release package, click Upload Plugin at the top of the screen, select threatpoint-intent.zip, and click Install Now.)

3

Step 3: Activate the Plugin

Once installation completes, click the blue Activate button. A new top-level menu item titled ThreatPoint Intent Detection (with the ThreatPoint shield icon) will appear in your WordPress admin sidebar.

4

Step 4: Obtain & Enter Your ThreatPoint API Key

Navigate to ThreatPoint Intent Detection -> 1. API Key, Paywall & Protected Surfaces. Enter your X-API-Key issued by the ThreatPoint API team (request a key at api@threatpoint.co.uk or https://threatpoint.co.uk) and click Save Configuration.

5

Step 5: Verify Connectivity & Sync Quota

Click the "Test API Key & Sync Quota" button in the top-right header banner. Confirm that the status badge turns green ("Active — Included 200-Query Tier" or "Active — Commercial Paid Tier") and that a DIAGNOSTIC_TEST entry appears in Tab 4 (Live Traffic & Audit Log).

API-Key Requirement & 200-Query Paywall Overview

API-Key Requirement: An active ThreatPoint X-API-Key is required for the plugin to evaluate traffic. Without an API key, the plugin remains in a safe standby state and displays an administrative notice.
200 Included Queries (Pre-Paywall Tier): Every new installation includes 200 live API evaluation queries out of the box so you can validate policies and inspect live traffic in your environment.
Commercial Paid Tier Upgrade: Once 200 queries are consumed, the plugin automatically enters the Paywall Locked state and fails open on the frontend so legitimate visitors are never disrupted. To unlock unlimited commercial quota, contact the ThreatPoint API team (api@threatpoint.co.uk), enter your upgraded API key in Tab 1, and check "Commercial Paid Tier Unlocked".
3. Administration & Policy Reference

Configuring ThreatPoint Intent Detection

Access the configuration dashboard in WordPress by clicking ThreatPoint Intent Detection in the left-hand admin navigation sidebar. All settings are organized into logical tabs below the live API Key & 200-Query Paywall status card.

Tab 1: API Key, Paywall & Protected Surfaces

Controls API authentication, commercial paywall status, fallback behavior, and which WordPress endpoints are protected.

Setting / Control Type / Options Purpose & Recommended Configuration
Enable ThreatPoint Protection Toggle (Default: Enabled) Master switch for frontend telemetry collection and server-side policy enforcement.
ThreatPoint API Key (X-API-Key) Password / String Your secret ThreatPoint API key used to authenticate browser and server evaluations.
Commercial Paid Tier Unlocked Checkbox Removes the 200-query paywall cap once your API key has been upgraded by the ThreatPoint API team.
Intent API Endpoint URL URL Defaults to https://verifyb.threatpoint.co.uk/api/v1/intent/evaluate.
API Request Timeout & Fail Mode 2-15s / Allow | Challenge | Deny Defines the server HTTP timeout (default 4s) and fallback reaction if the API is unreachable (default: Fail-Open / Allow).
Protected WordPress Surfaces Checkboxes Individually toggle protection for All Front-End Pages, wp-login.php, User Registration, Lost Password, Comments, WooCommerce Checkout (/checkout), and WP REST API (/wp-json/*).
Custom Interactive Routes Multi-line paths Additional URL prefixes treated as high-sensitivity transactional routes (mapped to /api/v1/transact) where User-Delegated AI Agents receive stricter gating.

Tab 2: Traffic Categories & AI Agent Policies

Defines the exact reaction (Allow, Log Only, Challenge, Deny 403, or Redirect) for each traffic class and AI agent provider.

Setting / Control Type / Options Purpose & Recommended Configuration
Delegated Agents — Standard Browsing ALLOW | LOG_ONLY | CHALLENGE | DENY | REDIRECT Reaction for consumer-delegated AI tools (OpenClaude, OpenCode, AutoGPT, LangChain, CrewAI) on read-only pages. Recommended: Allow or Log Only.
Delegated Agents — Interactive Routes ALLOW | LOG_ONLY | CHALLENGE | DENY | REDIRECT Reaction when a delegated agent attempts login, checkout, or transactional routes. Recommended: Challenge (Human Step-Up).
Known / Declared AI Agents (Global & Per-Provider) Use Default | ALLOW | LOG_ONLY | CHALLENGE | DENY | REDIRECT Reaction for ASN/rDNS-verified AI crawlers, with individual overrides for all 13 providers: ClaudeBot, Claude-Web, Anthropic-AI, GPTBot, ChatGPT-User, OAI-SearchBot, PerplexityBot, Cohere-AI, Bytespider, Amazonbot, Diffbot, Meta-ExternalAgent, and Google-Extended.
Automation Considered OK Allowlists (UA, IP/CIDR, rDNS) + Reaction Exempts trusted internal monitors, webhooks, and verified search engine rDNS suffixes (e.g., .googlebot.com, .search.msn.com).
Non-Human Traffic (IP Intelligence) ALLOW | LOG_ONLY | CHALLENGE | DENY | REDIRECT Reaction when ThreatPoint IP Reputation flags NON_HUMAN_TRAFFIC or VETO_BY_IP_NON_HUMAN_INTELLIGENCE. Recommended: Deny (403).
Bots & Malicious Automation ALLOW | LOG_ONLY | CHALLENGE | DENY | REDIRECT Separate policies for Spoofed AI Agents (impersonation), Headless Automation Drivers (Selenium/Puppeteer/Playwright), Unallowlisted HTTP Libraries (curl/python-requests), and Device Velocity Bursts.
Unusual / Suspicious Agents ALLOW | LOG_ONLY | CHALLENGE | DENY | REDIRECT Separate policies for Empty User-Agent headers, Non-Standard UA syntax, and Suspicious verdicts (score 40-69).

Tab 3: Granular API Data Points & Score Thresholds

Fine-tunes numeric score thresholds (0-100) and individual hardware, audio, WebGL, DOM, and IP data point reactions.

Setting / Control Type / Options Purpose & Recommended Configuration
Composite Intent Score Thresholds Deny >= 70 / Challenge >= 40 Triggers an automatic Deny or Challenge whenever composite intent_score meets or exceeds your configured threshold.
Sub-Score Override Thresholds 0-100 (Default: 80-90) Independent thresholds for DOM & Runtime Evasion, Behavioral Kinetics, TLS / TPHash Consistency, Physical Device Velocity Risk, IP Reputation Risk, and User-Agent Risk Penalty.
Hardware, Audio & DOM Evasion Triggers Use API Default | LOG_ONLY | CHALLENGE | DENY | REDIRECT Granular overrides for Virtual GPU (SwiftShader/llvmpipe), Headless Audio DSP Canary, Audio Fingerprint Noise Injection, JS Prototype Tampering, and Cross-Context Iframe Leaks.
Kinetic & Device Identity Triggers Use API Default | LOG_ONLY | CHALLENGE | DENY | REDIRECT Granular overrides for Synthetic Untrusted Events (dispatchEvent), Zero Human Interaction, Unrecognized New Devices, and Multiple Contradictions.
IP Intelligence Data Points Use API Default | LOG_ONLY | CHALLENGE | DENY | REDIRECT Granular overrides for High/Medium IP Risk Tier, Datacenter/Hosting/VPN ASN, Country Mismatch, Registrar Mismatch, and Verified Residential Home IP Trust Boost (-15 score reduction).

Tab 4: Live Traffic & Audit Log

Provides real-time visibility into every evaluated request stored in your local WordPress database.

Setting / Control Type / Options Purpose & Recommended Configuration
24-Hour Summary KPIs Dashboard Cards Displays Total Evaluated, Verified Human, Known & Delegated AI Agents, Challenged, and Denied (403) counts over the last 24 hours.
Detailed Transaction Table Filterable Log (Latest 100) Shows Timestamp, Transaction ID, Client IP, ISP & Risk Tier, Target Route, Verdict, Actor Type, Resolved OS, Composite & Sub-Scores (DOM/KIN/TLS/DEV/IP), Action Taken, Matched Policy Rule, and Threat Flags / Contradictions.