CONNECT YOUR TRAFFIC
Connect your CDN, hosting, server, or proxy traffic so AIWebSignals can show which AI systems visit your site and what they request. Providers send logs with a dedicated ingestion key; raw deliveries are processed and discarded.
Creating a connection generates one-time scoped capabilities. Review the prerequisite and expected validation for your source first; collector readiness does not mean a customer/provider delivery has already been certified.
Before you create: Workers Paid with account-level Workers Trace Events Logpush, or an Enterprise zone using HTTP Requests Logpush.
Expected validation: A reserved validation request is delivered through the configured Logpush path to the scoped collector; customer configuration is not inferred until that evidence is observed.
If it does not validate: Check dataset selection, HTTPS destination, the X-AIWebSignals-Key header, and that the logging job is enabled.
Before you create: A Vercel project where you can create a Custom Log Drain and add a custom request header.
Expected validation: A request record reaches the scoped collector in JSON/NDJSON form; live connector maturity changes only after reserved validation evidence exists.
If it does not validate: Check drain scope, endpoint URL, X-AIWebSignals-Key, and that production request logs are included.
Before you create: A Fastly service where you can configure Real-Time Log Streaming to an HTTPS endpoint.
Expected validation: Fastly completes its endpoint/domain validation and the reserved AIWebSignals validation evidence reaches the collector.
If it does not validate: Check the logging endpoint, Fastly domain-control challenge, custom header, and JSON/NDJSON log format.
Before you create: Akamai DataStream 2 access with permission to configure a Custom HTTPS destination and request fields.
Expected validation: Bounded DataStream request telemetry reaches the scoped collector; Bot Manager/security evidence remains a separate stream unless explicitly integrated.
If it does not validate: Check stream activation, Custom HTTPS delivery, X-AIWebSignals-Key, JSON field selection, and delivery errors in Akamai.
Before you create: CloudFront standard logging v2 plus Amazon Data Firehose delivery to a custom HTTP endpoint.
Expected validation: Firehose delivers the CloudFront record envelope and receives the required acknowledgement from the scoped collector.
If it does not validate: Check the Firehose endpoint URL, X-Amz-Firehose-Access-Key, logging destination, delivery errors, and record format.
Before you create: Access to the NGINX access log and a trusted server-side runtime that can run the AIWebSignals shipper.
Expected validation: The shipper classifies automation locally, removes query/private request detail, and posts bounded events to the scoped collector.
If it does not validate: Check log format, hostname configuration, collector reachability, X-AIWebSignals-Key, and shipper process output.
Before you create: Access to the Apache access log and a trusted server-side runtime that can run the AIWebSignals shipper.
Expected validation: The shipper classifies automation locally, removes query/private request detail, and posts bounded events to the scoped collector.
If it does not validate: Check combined/common log format, hostname configuration, collector reachability, X-AIWebSignals-Key, and shipper process output.
Before you create: Permission to install the AIWebSignals Agent Observer plugin and save its one-time pairing code in WordPress.
Expected validation: Pairing stores the scoped collector credential encrypted at rest in WordPress and performs reserved validation automatically before normal evidence delivery.
If it does not validate: Check plugin activation, pairing-code hostname, outbound HTTPS access to ingest.aiwebsignals.com, and the plugin validation state.
Before you create: A trusted observer or shipper that can POST bounded JSON, NDJSON, CSV, or combined-style request records over HTTPS.
Expected validation: The scoped collector accepts normalized automated-request evidence without requiring provider/admin credential custody.
If it does not validate: Check HTTPS reachability, X-AIWebSignals-Key, supported record shape, hostname match, and delivery-size limits.
Choose the site and infrastructure that already sees the requests. AIWebSignals will normalize only the evidence needed for machine-traffic analysis.
Create a connection and AIWebSignals will issue two random capabilities: an ingestion key for the provider and a separate management key for reading AI Impact or pausing the connection.
Public readiness tells you what a machine can retrieve from outside your site. Connected evidence answers the next question: what automated systems actually requested from infrastructure you control.
Your infrastructure sends scoped request evidence to a site-specific collector. AIWebSignals does not require custody of your provider account credentials.
Query strings, client IPs, cookies, authorization data, request bodies and raw user agents are stripped, discarded or reduced before persistence.
Keep the fields needed to support a claim: time, source, method, host, path, status and classified machine identity with evidence and confidence.
Use Agent Journeys and AI Impact to interpret normalized first-party evidence without pretending to know private prompts, hidden reasoning or internal objectives.
Fields recorded by the connected source: timestamp, request path, method, status, source and the classification evidence available for that request.
Likely identity, purpose, session grouping or journey patterns only when the available signals support them. Confidence remains explicit.
Private prompts, chain of thought, hidden objectives and traffic that never reached connected infrastructure remain unknown.
A source can be collector-ready without having a live customer delivery certification. The live connector catalog is authoritative and only promotes maturity when reserved validation evidence exists.
The configured baseline is Cloudflare. A later connector may be promoted only after real reserved validation evidence is recorded.
NGINX, Apache and WordPress have end-to-end validation without claiming a live customer/provider certification.
Vercel, Fastly, Akamai, CloudFront and generic HTTPS remain contract-validated until real delivery is certified.
Collector ready means the ingestion path is available; it is not the same as live validated. View the live connector maturity catalog →
Native HTTPS streaming is preferred where the platform supports it. CloudFront uses Amazon Data Firehose as its HTTPS bridge. Self-hosted NGINX and Apache can use the AIWebSignals shipper. WordPress uses the paired Agent Observer to send privacy-minimized evidence directly to the scoped collector.
Source status: “collector ready” describes availability of the ingestion path. It does not assert a live customer/provider validation. See connector maturity below for the evidence level.
Workers Paid uses account-level Workers Trace Events Logpush. Enterprise zones may alternatively use HTTP Requests Logpush.
Vercel Custom Drains can send JSON or NDJSON request evidence to the scoped collector.
Fastly Real-Time Log Streaming can send JSON/NDJSON after domain-control validation.
Akamai DataStream 2 Custom HTTPS can push bounded JSON request evidence over TLS.
CloudFront standard logs can flow through Amazon Data Firehose to the scoped HTTPS collector.
Use the AIWebSignals self-hosted shipper or another trusted server-side shipper to POST bounded access-log evidence.
Use the AIWebSignals self-hosted shipper or another trusted server-side shipper to POST bounded access-log evidence.
Install the AIWebSignals Agent Observer, paste the one-time pairing code, and send privacy-minimized automated-request evidence directly to the scoped collector.
Any trusted observer or shipper can POST bounded JSON, NDJSON, CSV, or combined-style records.
AIWebSignals keeps only the fields needed to understand machine activity: time, traffic source, method, hostname, query-free path, response status, agent identity evidence, and one-way linkage values when available. IP addresses, cookies, query strings, request bodies, and raw user-agent strings are excluded from connected storage.
WHY THIS LAYER EXISTS
The difference runs from data and protocols through identity, permission, intent, and value. The foundational explainer shows where AIWebSignals fits in that stack.