# IOTA Web Guardian - Pitch Deck **Updated:** April 28, 2026 **Version:** 2.1 --- ## 1. Problem: The Great Content Robbery **AI bots are draining content creators' revenue—and there is still no creator-native control layer.** ### The Numbers - **1 in 31** website visits is now an AI bot (up from 1 in 200 in Q1 2025) [web:10] - **40%** of AI bots ignore robots.txt completely [web:14] - Publishers lose **20-60% of traffic** to AI-powered search summaries [web:11] - Estimated **$2 billion** in annual advertising revenue losses across the publishing sector [web:11] ### The Asymmetry For every human visitor AI companies send back to publishers: - OpenAI scrapes **179 times** [web:11] - Perplexity scrapes **369 times** [web:11] - Anthropic scrapes **8,692 times** [web:11] **Creators earn $0 from AI training and AI search. robots.txt is ignored. Enterprise tools are expensive and not built for WordPress-native creator workflows.** --- ## 2. Solution: Start Simple, Then Scale **IOTA Web Guardian starts as a free WordPress plugin that detects AI agents and gives creators control, then evolves into an optional monetization layer for paid AI access.** ### Horizon 0: Medium Goal (June-August 2026) **Agent Detector Plugin** 1. Install plugin from WordPress.org 2. Confirm email 3. See AI agents and suspicious scrapers in the dashboard 4. Block, allow, or log them—your choice ### Horizon 0: Maximum Goal (August-December 2026) **Non-Custodial IOTA Web Guardian** - Add x402 payment flow on IOTA for protected access - Keep Web2 onboarding simple for publishers - Make blockchain details optional and mostly invisible **No code. No DNS changes. No blockchain jargon on the first experience. Just a plugin that solves a real problem first.** --- ## 3. Technical Differentiation: Detection First, Monetization Second ### Medium Goal: Detection Engine - **JA4 TLS fingerprinting** – Headless Chromium vs. real Chrome have distinct signatures [file:78] - **User-Agent heuristics with fallback rules** – Known crawler patterns checked first, then cross-validated with behavior and fingerprint data [file:78] - **Behavioral signals** – Missing CSS/JS fetches, abnormal request rates, missing referrer chains [file:78][file:2] - **Honeypot link mechanism** – Invisible trap links that only bots should follow [file:78][file:2] ### Anti-Bypass Posture - **Default-permissive** on first hit to reduce false positives [file:2] - **Always-available “I am human” path** for accessibility and trust [file:78][file:2] - **Verified allowlist** for legitimate crawlers via reverse DNS [file:78][file:2] - **Structured telemetry** for every allow/block decision [file:78][file:2] ### Maximum Goal: Security Layer for Paid Access - **VP replay prevention** – VP bound to nonce + timestamp + URL hash [file:78][file:2] - **Context-bound JWTs** – JWT bound to IP / UA / DID, forcing re-auth on suspicious change [file:78][file:2] - **Sybil resistance** – Per-DID and per-origin rate limiting plus DID reputation scoring [file:78][file:2] ### Honest Framing We do not claim perfect bot detection. We claim a better economic outcome: **make bypass non-profitable, not impossible** [file:2]. --- ## 4. Market Size: TAM / SAM / SOM ### Total Addressable Market (TAM) - **590 million active WordPress sites globally** [web:5][web:12] - WordPress powers **43.5% of all websites** [web:12] - WordPress Plugin Market growing at **14.7% CAGR** (2026-2033) [web:13] ### Serviceable Available Market (SAM) - **30-38 million actively visited WordPress sites** as a practical baseline [web:4] - Best-fit segment: blogs, media sites, documentation sites, and niche publishers producing original written content [file:79] - Investor framing: the first wedge is WordPress publishers with recurring AI scraping pain and enough traffic to care about control and monetization [file:79] ### Serviceable Obtainable Market (SOM) - **100+ active installs by end of July 2026** for the initial plugin launch [file:78] - **1,000 active installs by end of December 2026** as the 12-month investor-facing target carried into the deck [file:79] - **10 real pilot publishers** and **3 case studies** by year-end validate expansion beyond installs [file:78][file:2] ### Market Dynamics - AI bot traffic increased **33% in Q4 2025** [web:10] - ChatGPT-User bot activity rose **6,768%** year-over-year [web:14] - **80% of AI bot traffic** is web crawling, not training [web:18] - Peak AI bot traffic reached **39,000 requests per minute** per site in reported cases [web:18] **Bottom line:** giant WordPress footprint, rapidly growing AI crawler pressure, and a clear creator-side gap in lightweight protection tooling. --- ## 5. Business Model: Free Detection, Then Monetization ### Free Tier: Agent Detector Plugin **Always free. Drives installs, trust, and data.** - AI bot detection and blocking [file:78] - Activity dashboard [file:78] - Per-bot granular control [file:78] - Verified crawler allowlist [file:78] **Launch KPI:** 100 active installs by end of July 2026 [file:78] ### Pro Tier: Operational Upsell **$9/month** – Positioned in the range of established WordPress plugin pricing benchmarks already identified in the prior deck [file:79] - Advanced analytics and reporting [file:79] - AI company allowlist management [file:79] - Priority fingerprinting updates [file:79] - Alerts when new AI crawlers appear [file:79] ### Monetization Layer: Maximum Goal **Let creators charge AI companies for access.** - x402 payment flow on IOTA L1 [file:78][file:2] - Revenue share on processed payments [file:78] - Human-readable pricing such as **€0.50 per 1,000 scraper visits** [file:78][file:2] - Fiat-denominated balances and off-ramp paths for publishers [file:78][file:2] ### Revenue Logic - Detection layer builds distribution - Pro layer builds recurring SaaS revenue - Payment layer builds transaction revenue and moat ### Early Revenue Illustration - 1,000 installs × 8% Pro conversion = 80 Pro users × $9/mo = **$720 MRR** / **$8,640 ARR** [file:79] - Payment volume upside should be presented as optional upside, not as the base-case thesis for 2026 [file:78][file:2] --- ## 6. Product Roadmap: Updated to Match Horizon 0 ### Medium Goal — Agent Detector Plugin (June-August 2026) **What ships:** - Production-ready WordPress plugin [file:78] - Detection only, no blockchain and no payments in the initial release [file:78] - WordPress.org listing, 60-second onboarding, shared hosting compatibility [file:78] **Success metrics:** - 100+ active installs [file:78] - >90% detection accuracy on known AI crawlers [file:78] - <2% false positive rate [file:78] - <60 second average setup time [file:78] ### Maximum Goal — Non-Custodial IOTA Web Guardian (August-December 2026) **What expands:** - x402-protected access flow [file:78][file:2] - DID / VC / VP-based request flow [file:78] - Hosted non-custodial orchestration with KMS-backed key management and partner wallet infrastructure such as Magic Labs [file:78] - Fiat off-ramp and simplified publisher UX [file:78][file:2] **Trade-offs to present clearly:** - Custodial UX is simpler, but the 2026 maximum goal explores a non-custodial architecture for stronger user control while acknowledging more complexity and latency trade-offs [file:78] - Publishers should still experience a Web2-first interface even if the backend architecture is more advanced [file:2][file:78] ### End-of-Year Validation - 10 real pilot publishers [file:78][file:2] - 3 written case studies with real numbers [file:78][file:2] - Public bug bounty and light external security audit [file:78][file:2] - Public whitepaper on human vs AI-agent detection [file:78][file:2] --- ## 7. Competitive Landscape: Why This Wedge Matters | | **WordPress-Native** | **Infrastructure-Level** | |---|---|---| | **Free** | **IOTA Web Guardian** – AI-agent focused, creator control, plugin-native [file:79][file:78] | robots.txt – universal but frequently ignored by AI bots [web:14] | | **Paid** | WordFence / Sucuri – broad security, not AI-native [file:79] | Cloudflare Bot Management – powerful but costly and infra-heavy [file:79] | ### Why We Win the Wedge - **WordPress-native** – no DNS migration, works on shared hosting [file:78][file:79] - **Free first** – lower-friction distribution [file:79] - **AI-specific** – built around agent detection and control rather than generic website security [file:78][file:79] - **Expandable** – starts as protection, evolves into a payments market [file:78][file:2] **The strategic advantage is not just better blocking. It is owning the path from detection to monetization.** --- ## 8. Traction, Proof, and Metrics Investors Care About ### What Must Be True by June - Replace placeholders with real benchmark numbers including **p50 / p95 / p99** latency [file:2] - Publish methodology and threat model documentation [file:2] - Refresh the demo and Berlin materials with measured, reproducible claims [file:2] ### What Must Be True by August - Plugin live and production-ready [file:78] - 100+ active installs [file:78] - First telemetry on scrapers blocked, false positives, and onboarding completion [file:2][file:78] ### What Must Be True by December - 10 pilot publishers [file:78][file:2] - 3 case studies [file:78][file:2] - Benchmark page live [file:2] - External audit complete [file:78][file:2] - End-of-year report with installs, blocks, latency, and publisher value captured [file:2] ### Investor Metrics to Keep in Narrative - TAM / SAM / SOM [file:79][web:5][web:12] - Active installs [file:78][file:79] - False positive rate and detection accuracy [file:78] - p50 / p95 / p99 latency [file:2] - Pilot publishers and case studies [file:78][file:2] - Pro conversion and MRR potential [file:79] --- ## 9. Go-to-Market: Preserve the Simple Story ### Distribution Channels 1. **WordPress Plugin Directory** – organic discovery [file:78][file:79] 2. **ProductHunt** – launch spike and social proof [file:78][file:79] 3. **HackerNews** – technical credibility [file:78][file:79] 4. **IndieWeb / IndieHackers** – creator and indie publisher communities [file:78][file:79] 5. **Direct outreach** – creator newsletters, podcasts, beta testers [file:78][file:79] 6. **Twitter/X** – meet creators where they already complain about AI scraping [file:78][file:79] ### Messaging Hierarchy - **Problem:** AI bots are taking value from creator content [file:79] - **Immediate solution:** install a free plugin and regain visibility + control [file:78][file:79] - **Longer-term upside:** monetize compliant AI access without making publishers become crypto experts [file:2][file:78] ### Critical Narrative Constraint The deck should still sell the **simple first product**. The IOTA payment layer is the expansion path, not the onboarding burden [file:78][file:2]. --- ## 10. Team ### Paolo Alberti – Co-Founder, Product & Distribution - Full-stack developer and product designer [file:79] - WordPress ecosystem expertise and UX / onboarding focus aligned with the roadmap ownership split [file:2][file:79] - Responsible for documentation, distribution, pilot recruitment, and marketplace readiness [file:2] ### Niccolò Normani – Co-Founder, Technical Architecture - Systems architecture, security, and IOTA integration [file:79] - Responsible for hardening, detection robustness, performance, audits, and threat model work [file:2] ### Team Split - **Niccolò:** performance, security, infrastructure, anti-bypass, audits [file:2] - **Paolo:** WordPress UX, onboarding, docs, listing, distribution [file:2] - **Shared:** pitch, Berlin event, IOTA Foundation relationship, end-of-year report [file:2] --- ## 11. The Ask ### Funding Request: €150,000 Seed or Equivalent Grant Support **Use of funds for a 6-month runway to December 2026:** - **Development:** plugin hardening, anti-bypass work, IOTA integration [file:79][file:78] - **Distribution:** launches, tutorials, creator outreach, pilot onboarding [file:79][file:78] - **Security:** external audit, bug bounty, compliance roadmap [file:78][file:2] - **Infrastructure & partnerships:** wallet partner, off-ramp integrations, stable benchmark environment [file:78][file:2] ### Milestones That De-Risk the Ask - **July 2026:** 100 installs, production plugin momentum [file:78] - **December 2026:** 1,000 installs target, 10 pilots, 3 case studies, public benchmark, audit [file:79][file:78][file:2] - **2027 bridge:** full end-to-end IOTA Web Guardian sits in Horizon 1 after Horizon 0 validation [file:78] ### Best Framing The raise funds a credible wedge product first, then validates whether the payment layer becomes a market—not just a protocol demo [file:78][file:2]. --- ## 12. Why Now? ### Market Timing - AI bot traffic surged **33% in Q4 2025** [web:10] - ChatGPT-User activity rose **6,768%** year-over-year [web:14] - Publisher pain is measurable and immediate [web:11] ### Product Timing - WordPress is large enough for a focused wedge and simple distribution path [web:5][web:12] - No obvious WordPress-native AI detection leader has occupied the category in the current deck framing [file:79] - The plugin can ship before the full market model is proven [file:78] ### Technology Timing - IOTA payment flow becomes interesting only after detection is credible and distribution exists, which is exactly why the updated roadmap sequences it second [file:78][file:2] - Partner infrastructure such as Magic.link shows that wallet UX expectations are now Web2-grade: email, fast signing, and no seed-phrase burden [file:2] **The timing works because the first product is simple enough to ship now, and the larger protocol vision becomes believable only after that first product earns trust.** --- ## Appendix: Metrics and Validation Notes ### Core Investor Metrics - **TAM:** 590M WordPress sites [web:5][web:12] - **SAM:** 30-38M actively visited WordPress sites baseline [web:4] - **Initial SOM milestone:** 100 installs by July 2026 [file:78] - **12-month SOM narrative:** 1,000 installs by end of 2026 [file:79] - **Pilot proof:** 10 real publishers, 3 case studies [file:78][file:2] ### Technical Metrics - p50 / p95 / p99 benchmark publication [file:2] - Detection accuracy >90% on known AI crawlers [file:78] - False positive rate <2% [file:78] - Setup time <60 seconds [file:78][file:2] ### Key Strategic Message **Detection is the wedge. Distribution is the proof. Monetization is the expansion.** [file:78][file:2]