# IOTA Web Guardian — Roadmap 2026

- **Version:** 1.0
- **Date:** 2026-04-28
- **Authors:** Niccolò, Paolo

```{=openxml}
<w:p><w:r><w:br w:type="page"/></w:r></w:p>
```

## 1. Direction

From May to December 2026 IOTA Web Guardian adds no new features. We work on three parallel fronts:

1. **Hardening** — measured performance, security, robustness of the distinction between human users and AI scrapers.
2. **Web2 onboarding** — a non-crypto publisher must be able to install and use the system without ever seeing a wallet, a DID, or a seed phrase.
3. **Distribution** — real pilot publishers, WordPress.org listing, case studies with real numbers.

The goal at year-end is to arrive with a measured, robust, and used system — not with new demos.

```{=openxml}
<w:p><w:r><w:br w:type="page"/></w:r></w:p>
```

## 2. Q2 2026 — May and June

**Goal:** turn the prototype into software a publisher can trust in production, and arrive prepared at the Berlin event.

**Deliverables by end of June:**

- Public benchmark page with measured p50/p95/p99 latency (cold fetch, JWT cached path, on-chain settlement) on IOTA Rebased testnet.
- Internal threat model document covering the four main attack vectors (scraper masquerading as browser, false positive on humans, Verifiable Presentation replay, DID Sybil attack).
- Opt-in telemetry running: number of installs, scrapers blocked, revenue captured, false positives reported.
- Internal security review of the WordPress plugin completed.
- Stress test of the certifier: sustainable req/s, behavior under latency spikes, documented failure modes.
- Pitch deck and demo updated with real measured numbers, ready for Berlin.

**Milestone:** Berlin event, June 2026.

```{=openxml}
<w:p><w:r><w:br w:type="page"/></w:r></w:p>
```

## 3. Q3 2026 — July, August, September

**Goal:** make the system usable by a WordPress blogger who has never heard of blockchain, and harden the detection layer against bypass attempts.

**Web2 Onboarding — deliverables by end of September:**

- Custodial mode by default: email/Google signup, wallet provisioned and held by a partner custodian (decision to be agreed with IOTA Foundation by July).
- Fiat off-ramp integrated: publisher dashboard in EUR/USD, withdrawal to PayPal / Stripe / SEPA. At least one on/off-ramp partner integrated.
- Measured setup wizard: install plugin → email confirmation → first scraper blocked, all in under 60 seconds on a fresh WordPress.
- Human-friendly UI: pricing in euros/dollars per 1000 visits, zero blockchain jargon on the first screen. Advanced view available on demand.
- "Export to self-custody" path available with one click for users who want to control their keys.

**Detection Hardening — deliverables by end of September:**

- TLS fingerprinting (JA4) integrated at the certifier edge, distinguishing real Chrome from headless Chromium / curl / Python requests.
- Behavioral signals active: missing CSS/JS fetch after HTML, missing internal referrer chain, abnormal request rate per session.
- Progressive proof-of-work challenge configurable per publisher (off / light / aggressive), invisible to humans, costly for mass scraping.
- Verifiable Presentations bound to nonce + timestamp + URL hash; JWT bound to IP+UA+DID with re-auth on context change. Replay made impossible.
- Verified allowlist of legitimate crawlers (Googlebot, Bingbot, Common Crawl, Wayback) via reverse-DNS, extendable by the publisher.
- "I am human" path always available for accessibility cases and false positives.

```{=openxml}
<w:p><w:r><w:br w:type="page"/></w:r></w:p>
```

## 4. Q4 2026 — October, November, December

**Goal:** close the year with field proof, external validation, and material for the next step of growth.

**Deliverables by end of December:**

- Ten real publishers onboarded (not friends-and-family): independent tech blogs, small EU/IT independent media, niche docs sites. Each running for at least 30 days with shared telemetry.
- Three written case studies with real numbers: revenue captured, scrapers blocked, uptime, user-side conversion friction.
- Plugin submitted to WordPress.org in October and listed on the official marketplace by year-end.
- Publisher-grade documentation: video tutorial in Italian and English (5–10 minutes, from install to first revenue), FAQ, troubleshooting, "exit story" explaining how to leave the system without lock-in.
- Reference SDK or integrable example for legitimate AI agents that want to pay via x402 (demand side of the market).
- Public bug bounty program open, even with a modest budget, as a signal of openness to scrutiny.
- Light external security audit (1 week) of the detection flow, conducted by a specialist freelancer.
- Public whitepaper on the methodology for distinguishing human users from AI agents, peer-reviewable.
- Year-end report with aggregate metrics: sites onboarded, scrapers blocked, revenue redistributed to publishers, measured latency. Material ready for the next step (round / IOTA Foundation grant continuation).

```{=openxml}
<w:p><w:r><w:br w:type="page"/></w:r></w:p>
```

## 5. Year-End Indicators

| Indicator | Target |
|---|---|
| Real publishers onboarded | ≥ 10 |
| Plugin listed on WordPress.org | Live |
| Public benchmark with measured p50/p95/p99 | Published |
| External light security audit | Completed |
| Whitepaper on detection methodology | Published |
| Custodian / on-ramp partner integrated | At least 1 |
| Case studies with real numbers | ≥ 3 |
| Known bypass vectors mitigated to "non-economic" | All |

```{=openxml}
<w:p><w:r><w:br w:type="page"/></w:r></w:p>
```

## 6. Working Principles

- **No new features until December.** Any external request goes to a 2027 backlog.
- **Web2 first impression, Web3 underneath.** Publishers should never have to see a DID unless they want to.
- **Every published number is measured.** No estimates, no placeholders.
- **Detection is the foundation.** If the distinction between humans and scrapers is not robust, everything else loses value. We work on it continuously, every quarter.
- **Honesty about scope.** We do not promise unbeatability: we change the economic incentive, making scraping more expensive than paying.

```{=openxml}
<w:p><w:r><w:br w:type="page"/></w:r></w:p>
```

## 7. Coordination

- **Niccolò:** lead on performance, security, infrastructure, detection robustness, audits.
- **Paolo:** lead on WordPress UX, onboarding, publisher documentation, marketplace, distribution, pilot publishers.
- **Both:** pitch deck, Berlin event, IOTA Foundation relationship, year-end report.
- **Proposed cadence with IOTA Foundation:** monthly progress check-in, extended re-sync after Berlin.