AI Rank Suite — AI Search, llms.txt, Schema & SEO

Changelog

0.2.45

• The plugin’s own capabilities no longer guard anything. Every REST route and every screen asks WordPress directly, and the capability stands in the route itself: current_user_can( 'manage_options' ). Routes that name a post also ask WordPress about that post.
• The Roles screen is gone with them. It handed out four capabilities that now decide nothing, and an installation that still carries them has them removed on update. Access follows WordPress roles: administrators manage the plugin.
• A test fails the build if a route is registered without a WordPress capability on the spot, or if one of the old capabilities is checked anywhere.

0.2.44

• Every REST route now asks WordPress for one of its own capabilities before the plugin capability is considered. A plugin capability can be handed to any role in Settings, Roles, so it can never be the only gate.
• Values read from $_SERVER and $_COOKIE are sanitized, not only unslashed.
• The audit export hands spreadsheet rows to the browser, which writes the file. Nothing is echoed from the route, and a cell that starts with an equals sign is written as text, so a spreadsheet cannot run it as a formula.
• llms.txt is stripped of markup on output.

0.2.43

• Elementor no longer overwrites a title applied elsewhere. Elementor keeps its own copy of the SEO title, description, keyword and noindex switch in its page settings and posts all of them on every save, layout edits included. Written back as they came, that copy put the old title back over one applied minutes earlier from the AI review, the block-editor sidebar or the content list. The panel now remembers what it handed the builder and writes only the fields that were changed inside Elementor. The meta box and the block-editor sidebar already behaved this way; a test now holds all three to it.

• Long keyword lists fold. A page can carry a hundred keywords, and the meta box and the sidebar drew every one of them as a chip, a wall that pushed the page down and a counter that read “100 / 10”. Both now show the first twelve (eight in the sidebar), one chip says how many more there are, and the opened list scrolls inside a box. The limit reads 100, which is what it always was.

0.2.42

• The SEO score is a formula. Four pillars with fixed points, one hundred in total: keyword 40 (in the title, the description, the URL, the first paragraph, a subheading, the density and an image alt), title and description 25, structure 20 (one H1, heading order, 300+ words, alt texts, a compact slug), links 15. Until now the keyword checks fed no score at all, so a page with the keyword nowhere scored like one with it everywhere. Without a focus keyword the keyword pillar earns nothing and the score cannot pass 60. The four numbers are shown under the rings in the editor sidebar and the meta box.
• llms.txt written in one click. “Write everything” gives every page in both files a summary (from the AI engine when a key is stored, from the page’s first sentences otherwise), writes the site’s lead paragraph and rebuilds both files, with a progress bar. Pages that already have a summary are kept unless you choose to rewrite.
• Site Audit: seven more rules, a way out of every finding, and a spreadsheet. Meta description length, missing focus keyword, keyword missing from the title, very long slug, post without a featured image, no internal links out, oversized featured image. Every finding links to the optimiser as well as to the editor, and the whole run exports as CSV.
• Measure has an overview. Search Console and Analytics for the same days side by side, each against the same days before, the two lines on one axis, the top pages with both numbers. Bing sits next to Google: the Search Console property beside the site Bing expects, with Bing’s import from Search Console one click away.
• Image SEO counts the media library. How many images have no alt text, are wider than 2500 pixels or heavier than 500 KB, the largest ones listed, and one run that writes the missing alt texts from the template, fifty at a time.
• Import shows what is there. The plugin that is installed or left data behind gets a card with the numbers and the buttons; the rest are one line each. Yoast and SEOPress have their marks.
• The AI proposal compares against the page as it is now. “Now” in the title and description review showed the snapshot the proposal had taken when it was written; after an earlier apply that was an old title, and the content list, reading the page, showed the real one. The review now reads the current values with every load and says when the metadata changed since the proposal.
• Job postings carry what Google’s report asks for. datePosted from the post date, a job ID, the applicant country for remote jobs, and whether applying happens on the page.

0.2.41

• The Pro package carries its translations again. The 0.2.40 Pro build shipped without the languages folder, so every screen fell back to English on a German site. The build now refuses to run without the translation sources, and the release check verifies that the compiled catalogues are in the package.
• The word counter is called Words again. The tab under Content had been renamed Length; the counter of every page’s words, and of the whole site, is the same tab and now says so.

0.2.40

• The dashboard takes a score reading itself. WP-Cron only runs when somebody visits the site, so on a quiet site the daily reading added in 0.2.39 could wait for days. When the dashboard opens and the last reading is older than twenty hours, it takes one on the spot. The findings card gained a button: “Run an audit now” starts one and opens Site Audit, where it runs slice by slice.
• The editor toolbar shows both scores. The pinned AI Rank Suite button carries GEO and SEO as two small pills in their verdict colours, and it sits first in the pinned row. With Rank Math active, its two pinned score buttons step back into the ⋮ menu, where its sidebar still opens, so the toolbar holds one set of numbers instead of two.
• Keywords in bulk. The keyword field in the meta box and in the sidebar accepts a pasted list (commas, semicolons or line breaks) and adds every entry at once, and the AI suggestions have an “Add all” button. Ten remains the ceiling.
• The meta box and the sidebar look like WordPress. Core blue for every button, the secondary as an outline of the same blue, 3 and 4 pixel corners, core input borders, no gradients and no tinted shadows. The score rings are honey rather than marigold, and the number sits in the centre of the ring in every browser: it is HTML laid over the ring now, not SVG text rotated back into place.
• The post list says what Rank Math says. The SEO details column adds the schema type the page will carry and three link counts as icons: internal, external and incoming. Score pills are top-aligned like every other cell, so they stay next to the title when another column makes the row tall.

0.2.39

• The AI search score is read once a day. The dashboard’s “AI search score over time” card promised one point per recalculation, by hand or on schedule, and only the first half was true: a point was stamped when somebody pressed Recalculate, and on a site where nobody did, the line’s last date stayed where it was for weeks. A daily job (airanksuite_job_score_snapshot, listed under Autopilot’s systems) now takes a reading, so the line moves on its own. Recalculate still adds a point on the spot.
• Both trend cards say when they last moved and when they move next. Under the score card: the last reading and the next automatic one. Under the findings card: the last completed audit and the next scheduled one, or, when none is scheduled, that an audit has to be run or scheduled for the line to gain a point. A last label from three weeks ago is a schedule now, not a fault.
• The “Open findings” tile updates with the chart under it. Finishing an audit cleared the chart’s cache but not the tile’s, so for up to five minutes the chart showed the new run while the tile kept the old count.

0.2.38

• Recurring events are scheduled on init, not on plugins_loaded. Scheduling an event asks every plugin for its list of cron schedules, and WooCommerce translates the label of its schedules while answering. Asked during our boot, that made WooCommerce load its translations before init, which WordPress 6.7 and later report as a notice under WP_DEBUG, against this plugin. All eight recurring events (job resumer, retention, rank snapshots, backlink checks, listing refresh, reports, audit alerts, AI visibility) now go through one helper, Cron::ensure(), that waits for init. On a site without WooCommerce nothing changes; on a site with it the notice is gone.
• Running an import needs a WordPress administrator. 0.2.37 added that check to the settings import and the backup restore, and left it off the plugin importer, which can replace settings, redirects and post data just the same. Starting, ticking and cancelling an import run, and reading an uploaded file, now require manage_options as well. Listing the sources, detecting installed plugins, exporting and reading the backup stay with the plugin’s own capability.

0.2.37

• Changing who may do what needs a WordPress administrator. The plugin has its own capabilities so that an agency can hand “manage settings” to an editor. That capability alone also opened the role editor, so somebody who had been given it could have given it, or anything else the plugin offers, to further roles. The role editor now requires WordPress’ own promote_users as well. The same second check, manage_options, was added to the other routes that reach beyond the plugin’s settings: writing and restoring .htaccess, importing a settings file, restoring a settings backup, the maintenance tasks under Developer tools, and creating, changing or testing a webhook, which sends site data to an address somebody typed in. WordPress is asked first, so a refused request does not use up the rate limit. For an administrator nothing changes.
• Values reach JavaScript as JSON. The toolbar’s script received its REST address and nonce by text substitution into the source, and the Matomo snippet had its address and site id pasted between quotes. Both now get one JSON object built by wp_json_encode(). The addresses were the site’s own, so nothing could be injected, but a value that is encoded for a URL is not encoded for a script, and only one of the two is right.
• Structured data is printed with the default JSON encoding. The JSON-LD in the page head was encoded with flags that leave slashes and non-ASCII characters as they are. With the defaults every slash is escaped, so no headline can close the script element, and the output is the same data to every consumer.
• Six importer queries pass the table name as an identifier. The readers for Redirection, Rank Math and All in One SEO appended the other plugin’s table name to the statement. It travels as %i now, like everywhere else.

0.2.36

• Everything the plugin names is named airanksuite now. Options, tables, post and term meta, capabilities, scheduled events, hooks, constants, the REST namespace (airanksuite/v1), script handles and the WP-CLI command (wp airanksuite) used a four-letter abbreviation that the directory’s review found too short to be safe from collisions with other plugins. Your data moves by itself: on the first request after the update, before any setting is read, tables are renamed, options and meta keys are carried across, capabilities and scheduled events follow. Nothing is copied row by row and nothing is left behind under the old names. Shortcodes already typed into pages, such as [airs_breadcrumbs] and [airs_business_hours], keep working under their old names as well as the new ones, and so does the [airs-private] marker. A settings export or a pre-update backup made by an earlier version restores under today’s names. If you wrote code against the old hooks, constants or REST paths, replace airs with airanksuite in it.
• A route that names a post asks WordPress about that post. A plugin capability says what somebody may do with the plugin, not which posts they may see. Reading a post’s schema or its PageSpeed result needed only “view reports”, so a role with that capability could read them for a colleague’s private draft. Those routes now require read_post on the post itself, and writing requires edit_post. The same check was added where a post id arrives in the body or in a list: applying an internal link suggestion, rejecting or undoing an Autopilot proposal, a bulk run over chosen ids, submitting a URL for indexing. The Autopilot queue and log, the content list and its CSV leave out drafts the current user could not open in WordPress.
• No SQL statement is assembled any more. The redirect list built its ORDER BY from the sort the screen asked for. The value came from an allow-list, so it was never injectable, but a statement put together from pieces cannot be told apart from one that is. Every list in the plugin now sends one constant statement: the sort column travels as an identifier placeholder, the direction selects one of two literals, and a filter that is not in use is switched off by a flag instead of being left out of the text. Same results, same order, same paging.
• The sitemap’s browser view is a file. The XSL stylesheet behind /sitemap.xsl, CSS included, was a string inside the PHP source; it is assets/sitemap/sitemap.xsl now, and PHP only serves it.
• No translation is loaded before init. A cron interval label was translated while modules scheduled their events on plugins_loaded, which WordPress 6.7 and later report as a notice under WP_DEBUG. The interval was a copy of WordPress’ own weekly and is gone.
• Four services were missing from the list of external services, and are documented with what is sent, when, and their terms and privacy policies: OpenStreetMap Nominatim (“Find coordinates from the address” in Local SEO), our own connect service behind “Sign in with Google”, the Google Ads API (Pro keyword ideas), and the webhooks you configure yourself.

0.2.35

• Every database query goes through $wpdb->prepare(). 107 reads and writes were built as strings with the table name interpolated and no placeholder at all. None carried user input, but a query that is not prepared cannot be told apart from one that should have been, and the directory’s review said so. Table names are now passed as %i identifiers, IN lists get one placeholder per value, and LIKE patterns go through esc_like(); nothing is pasted into SQL by hand any more.
• No plugin CSS is printed into the page. The upgrade menu entry’s colour, the boot skeleton behind the admin app, the upgrade screen’s stylesheet and the post-list score columns were each an echoed
• The head arbiter cannot leave its output buffer open. If another plugin opened a buffer above ours and never closed it, finish() gave up and the plugin’s own ob_start() stayed open for the rest of the request. Foreign buffers are flushed through first now, and a shutdown guard closes ours if nothing else did.
• The admin app never guesses where admin-ajax.php is. The endpoint always came from PHP, but the script kept a literal /wp-admin/admin-ajax.php as a last resort, which is wrong on every renamed or subdirectory admin. The fallback is gone.
• The compiled admin and editor bundles ship with their source. assets/admin/src and assets/editor/src, the two Vite configs and the build steps in the readme, so anyone can read or rebuild what runs.
• Every external service is documented with its terms and privacy policy, host by host: the Google APIs, the Google tag, IndexNow and its four endpoints, Bing Webmaster Tools, Microsoft Clarity, Matomo, Places, PageSpeed, the AI providers and the SEO data providers.
• One review platform that has withdrawn API access from all plugins no longer appears in the local directory suggestions.
• Two answer-simulation reads were behind the licence gate. The trend and the competitor matrix are reports on data already collected, and an inactive licence is meant to pause new work, never to hide what exists. Both read freely now, as every other report does.
• A site that moves from Pro to the free edition no longer fires empty cron events. The rank snapshot, the answer simulation, the e-mail report and the backlink re-check stayed in the cron table with nothing listening, so WordPress ran them into nothing on schedule for ever. Any scheduled event of this plugin’s with no module behind it is removed once, the first time the plugin loads after the change.
• The free edition’s admin no longer asks for routes it does not have. The dashboard card, the content screen, the analyzer and the licence tab each requested an endpoint that only exists with a Pro module installed and left a 404 in the browser console; each asks the module list first now, and the licence tab says what the free edition is instead of reading a licence that cannot exist.
• The 404 monitor explains what it records and where an entry goes, instead of showing one line when it is empty.
• The free edition never ran its uninstall cleanup. The Pro build wires it to Freemius’ own uninstall hook inside a file the free package does not carry, so the “remove my data on uninstall” setting there was a switch connected to nothing. The free edition registers WordPress’ uninstall hook itself now; data is still kept unless you opted out of keeping it.
• Nine explanatory captions added in 0.2.34 (the score ring, the four counters, the three trend notes, the directories hint in Local SEO) had no German translation and showed in English on German sites. They have one now.

0.2.34

• The dashboard says what it is connected to, and what is being done with AI. The card that reports the agent now carries the wiring underneath it: a row of every service the plugin is plugged into — the AI engines, Search Console, Matomo, Analytics, Bing, IndexNow, WooCommerce — each with what stops working while it is dark, fed by one moving artery that carries current only while an engine can actually answer. Under it, the ten kinds of work the plugin does with a model and which engine each one goes to. It is drawn with or without a key: without one, the same diagram greys out, which is the argument for connecting one.
• Every figure now says what it counts. Calls today, spend today, the run’s progress, the run’s cost, an engine’s load, the score in the ring, pages scored, open findings, broken links and each of the three trend lines carry one sentence explaining what is measured, over what window, and whether the number is metered or forecast.
• Five figures were measuring the wrong thing. “Calls today” and “Spent today” counted from UTC midnight while the site keeps its own clock, so in the Gulf every morning until 4am reported the wrong day. A finished run went on advertising the estimate it opened with instead of the metered cost of the calls it actually made, and showed a full progress bar beside the word “idle”. The search clicks sparkline selected the oldest thirty snapshots, so on any site with more history it froze on its first month for ever. The findings line plotted a run that was still crawling, drawing a cliff that reversed itself an hour later, and labelled its points in UTC while the score line beside it used the site’s timezone. The coverage line bucketed its days in UTC for the same reason.
• On a translated site the desks were invisible. The panel matched each job against the translated name of its desk, so on a German or French install nothing matched and the whole lower half of the diagram rendered empty, with no error anywhere. Jobs now carry a language-independent key. The engine load bar likewise divides by a total the server sends rather than by the length of whatever list the screen happened to be holding.

0.2.33

• The compliance work from the WordPress.org review reaches the Pro edition too. Analytics tags are enqueued rather than printed into wp_head, so they are visible to the script loader and to caching layers, and Consent Mode’s requirement that its default runs before the Google tag is a declared dependency instead of a hook priority that another plugin could land inside. The cookie banner’s stylesheet moved to the head, where it belongs, and no longer arrives after the banner it styles. Five reads of $_SERVER that carried a phpcs:ignore are sanitized through one helper that unslashes before it sanitizes.
• The licence gate cannot be filtered into refusing. airanksuite/licensing/allows still lets a host or an agency widen access; it can no longer narrow it, so a third-party snippet cannot lock a customer out of something they have paid for.

0.2.32

• The WordPress.org edition carries no licensing code at all. Directory guideline 5 forbids a hosted plugin from locking any feature behind a licence, and says the locked code must not even be present. The build already left the Pro modules out; it now also leaves out the licensing module, the Freemius SDK and the licence bootstrap, so no code path remains in the free package that could answer “no” to a feature. The licence gate additionally refuses to enforce anything, and refuses to be filtered into enforcing anything, without the Pro build’s own marker.
• Analytics tags are enqueued instead of printed. The Google tag, its configuration, Microsoft Clarity, Matomo and the consent banner used to print <script> and <style> straight into wp_head, which makes them invisible to the script loader and to every caching or optimisation layer. They register handles and attach inline code now. Consent Mode’s requirement that its default runs before the Google tag is expressed as a dependency rather than a hook priority, so nothing can land between them, and the cookie banner’s stylesheet moved to the head instead of arriving after the banner it styles.
• Request input is sanitized rather than excused. Five reads of $_SERVER were annotated with phpcs:ignore instead of being cleaned. Headers and the request URI are attacker-influenced like any other input, and they now go through one helper that unslashes before it sanitizes, in that order.
• Translations come from the directory. WordPress.org generates and serves language packs for a hosted plugin, and a bundled catalogue silently shadows whatever the community contributes. The free package ships the .pot for translators and nothing compiled.
• A plugin role could edit posts WordPress would not open for it. The SEO editor preset grants “edits titles, descriptions and keywords”; it never said which posts, and the content route did not ask. A user holding that capability could rewrite the SEO title, description, slug, robots and canonical of any post over the REST API, including somebody else’s private draft, and read that draft’s text and previews from the same screen. The route now makes the object check WordPress makes: edit_post before any write, read_post before an unpublished post is shown at all, and an unreadable id answers “not found” rather than confirming it exists. Two tests hold it from both sides.
• A clean audit no longer shows the last one’s findings. The dashboard tile derived the run from the newest row in the findings table. A run that finds nothing writes no rows, so the newest row still belonged to the run before it and the number stayed up after everything was fixed; a run in progress, conversely, was counted half-finished. The tile now reads the run the auditor publishes when it completes, which is the same run the audit report shows. No finished run, no number.
• A large redirect import cannot time out half-applied. Fifty thousand rows, each a lookup and a write, do not fit in one PHP time limit, and what a timeout left behind was some redirects live, the rest missing, and nothing on screen saying which. The import now applies two thousand rows per request and answers with where to continue; the screen walks through the slices and reports the totals as before.

0.2.31

• The page drawer no longer runs off the right edge. On a window around 1100px wide the drawer’s own column was sized by its content rather than by the drawer, so the header chips, the tab strip and the whole right-hand rail were drawn 40px past the edge and cut off; the search preview looked clipped and the view switch broke into two rows. The drawer’s column is now an explicit track that cannot exceed the drawer, every grid inside the rail is the same, the preview frames fill the rail, and the view switch reads Google, AI answer, Social, X on one line.
• Titles show their dash, not –. WordPress hands the admin a texturised title with the dash as an HTML entity, and the drawer header, the list row and the SEO title fallback printed it literally. Decoded once on the server, so every screen gets the same plain text.

0.2.30

• The admin looks like WordPress again. An earlier pass gave the plugin its own typeface, its own violet and softer, rounder surfaces so it would stop looking like every other SEO plugin. It worked, and it was the wrong goal: the people who use this are WordPress administrators, and what reads to a designer as identity reads to them as a SaaS dashboard dropped into their admin. The typeface is now the admin’s own, the working colour is core’s blue, the radii and card shadows are core’s, and the violet survives only as the accent on the score ring. The upgrade page keeps the website’s look on purpose; that page is the shop window.
• The dashboard verdict now sees the audit. It read site checks, broken links and missing descriptions and then declared “no failing check, no broken link and every page described” on a site whose audit, one click away, held 43 warnings. Critical findings now outrank everything but a disconnected engine; warnings sit just below a broken link.
• Every calculation was read end to end. The AI-search score, the audit score, the page GEO and SEO scores, the library averages, the numeric sort and the null handling all check out; the arithmetic is consistent (pass 1, warn ½, fail 0, weighted) and unanalysed pages are excluded from averages rather than counted as zero. One accessibility slip: the score ring told screen readers “0 / 100” for a page it drew as “not yet scored”. Fixed.
• Every route the screens call exists (176 of 176) and every field they read is one the server sends. Six more strings were built as English fragments and are translated now, including the dry-run summary on the autopilot.

0.2.29

• Build housekeeping only, no change to the plugin itself. The release script wrote the finished build into one folder and the second copy was made by hand afterwards, so that folder held the version before the one just shipped, every time. Both are written by the script now, and both keep the newest three builds.

0.2.28

• The dashboard said “0 open findings” while the audit it linked to reported 335. The tile counted the site checks, a handful of foundation tests, but wore the audit’s label. The first number anyone looks at gave an all-clear that was wrong by 43 warnings and 292 notices. It reads the audit now, from the same query as the chart below it, so the two cannot disagree. A test holds the arithmetic.
• “Pages scored over time” stopped at 20,000 pages and started its total at zero. Three faults in one chart: a hard stop after 20,000 analyses with nothing on screen saying so, pagination by OFFSET with no ORDER BY (so two loads of the same site could draw different curves), and a cumulative line that ignored everything scored before the last sixty days — drawing a site with 40,000 scored pages as a line rising from nothing. Stable keyset pagination, no silent ceiling, and the curve starts where the site already was.
• More English on a German install: the audit’s “156 pages · 30 rules · 21 passing” line, “nothing outstanding”, the severity counts, and “Page 1 of 7” on two screens. All were built as template literals, which is why they were invisible to the translation test as well.

Found by an independent audit of the 0.2.27 release. Every finding above was reproduced before it was fixed.

0.2.27

• The AI can no longer write a meta description longer than the limit. It was asked for 120-155 characters and returned 196, and the editor drew its own red bar under it: the product told you the text was too long and had written it itself. A prompt is a request, and the JSON schema …