How do I know if ChatGPT, Claude, or a person placed this WooCommerce order?
Open the order. It says Human, a named agent, Likely agent, Unattended, API, or Unknown. Claude, Perplexity, ChatGPT, Google Agent, Meta, and the other published agents each get their own name. A failed signature does not get a name.
The question is not “is the internet full of bots.” The order is $48, and the owner wants to know who bought it. Shopify’s admin already attributes some AI channels. WooCommerce does not. The referrer report misses the visit when the header is stripped, and an agent that never runs JavaScript never hits a theme pixel.
Where you look
Open WooCommerce, then Orders. The Buyer column is on that list. Open the order and the same line is in a box on the order. There is no second dashboard.
Four checkouts
What four kinds of checkout get.
| Order | What arrived | Buyer |
|---|---|---|
| #13 | Phone browser | Human |
| #14 | ChatGPT-User, no signature | ChatGPT (declared) |
| #15 | curl | Unknown |
| #20 | Claude-User, valid Web Bot Auth signature | Claude (signed) |
What each stamp means
- Human is an ordinary browser, a person at the checkout, and no agent signature.
- Declared is a published agent name, and nothing was signed. Order #14 arrived as ChatGPT-User.
- Signed means the signature matched the key that operator published. Order #20 carried a valid Web Bot Auth signature.
- Likely agent is a real click with at least two signs that a program drove the browser. Not proof, and no name.
- Unattended is a browser where no person used the checkout, or one that reported itself as automated.
- API is an order created through the REST API or a commerce protocol channel, not the checkout page.
- Unknown is curl, a headless browser, a crawler that is not a shopping agent, or a signature that failed. Order #15 was curl.
Copilot and Grok often arrive as a normal Chrome window. Those stay Human. Guessing would accuse a customer. The plugin does not cancel or refund the order, and blocks nothing unless you turn a rule on. A name in the user-agent is not proof.