An operations guide for understanding, configuring, and maintaining the digital identity that proves your site's AI manifest is authentic.
Every Rootz AI Discovery plugin install generates a unique cryptographic identity — an Ethereum-compatible address derived from a secp256k1 keypair. This identity is used to sign every ai.json manifest and llms.txt your site serves.
When an AI agent reads your /.well-known/ai endpoint, it receives both your structured data and a cryptographic signature proving:
The Plugin Wallet is your site's persistent cryptographic identity. You'll find it in Settings → AI Discovery → Account & Wallet.
0xSigning requires the PHP GMP extension. Most hosting providers include it. If GMP is not available, the plugin runs in hash-only mode — content hashes are still generated for integrity verification, but no cryptographic signature is produced.
To check: look for "Signing Capability: Active" in the Account tab. If it says "GMP not available," contact your hosting provider to enable the GMP PHP extension.
wp_options table (the rootz_signing_key row).
The plugin does not auto-sign content changes. This is a deliberate security decision.
ai.json manifest (SHA-256 of the JSON body)llms.txt content (SHA-256 of the plaintext)/verify endpoint)"_signature": {
"signer": "0xD089...DAfF",
"contentHash": "sha256:a1b2c3...",
"signedAt": "2026-03-20T15:30:00Z",
"method": "ecdsa-secp256k1",
"signature": "0x3f4a5b...",
"authorization": "self-signed"
}The Owner Identity is separate from the Plugin Wallet. It represents the person or organization that owns one or more sites.
The authorization field in your signature block tells AI agents how much trust to assign. Authorization is a chain — each level builds on the one below it:
| Level | What it proves | How to get it |
|---|---|---|
none |
Content hash only. No signature (GMP not available). | Default without GMP |
self-signed |
Same key signs every response. Proves consistency and origin over time. | Automatic with GMP (free tier) |
delegated |
An authorizer wallet has delegated trust to this plugin wallet on-chain. Proves organizational authority. | On-chain transaction from owner wallet |
The owner wallet is your wallet — it can be anything that signs Ethereum transactions:
There are multiple ways to establish the chain of authority. Use whichever fits your organization:
self-signed and that's perfectly fine. Self-signed proves the same key controls the same site over time — this is what builds reputation. Delegated authorization adds organizational proof when you need it.
For enterprises managing many sites, the chain extends one level higher. A corporate wallet (controlled by the organization, often a multisig) authorizes individual owner wallets, which in turn authorize plugin wallets. This creates a verifiable hierarchy:
Each link in the chain is an on-chain record that anyone can verify independently — no trusted third party required.
Each WordPress installation generates its own Plugin Wallet. To manage multiple sites under one identity:
rootz.global/api/license/status?identity=0xYOUR_ADDRESSTo remove a site (free up a slot), use the Deactivate option in the Account tab or call the deactivation API.
wp-config.php salts (SECURE_AUTH_KEY + SECURE_AUTH_SALT)wp_options as rootz_signing_keymanage_options can trigger signingIf you move your site to a new server with the same database and wp-config.php salts, the key migrates automatically. If you change your salts (which WordPress itself warns against), you'll need to generate a new key — your site will get a new Plugin Wallet address.
Any Ethereum-compatible library can verify a Rootz AI Discovery signature:
// Using ethers.js
const { ethers } = require('ethers');
// Get the manifest
const response = await fetch('https://example.com/.well-known/ai');
const manifest = await response.json();
// Extract signature data
const { signer, contentHash, signature } = manifest._signature;
// Verify
const recoveredAddress = ethers.verifyMessage(contentHash, signature);
console.log(recoveredAddress === signer); // true = validYou can also use the plugin's built-in verification endpoint:
GET /wp-json/rootz/v1/verify?page=/about
→ { "verified": true, "hash": "sha256:...", "signer": "0x..." }Your hosting provider doesn't have the PHP GMP extension enabled. Contact them to enable it. The plugin still works without it — you just won't get cryptographic signatures.
This means content has changed since the last time you approved the manifest. Go to the What AI Sees tab, review the output, and click Approve & Sign.
This happens if: (1) you changed your wp-config.php salts, (2) the rootz_signing_key option was deleted, or (3) you reinstalled the plugin. The old address is no longer valid. If you had a subscription, register the new wallet under your Owner Identity.
Make sure the Owner Identity address in your plugin matches the one shown on your activation page. Click Refresh License in the Account tab to force a re-check.
Part of the AI Discovery Standard — the open standard for the AI-readable web.
Questions? Contact us or email support@rootz.global