AI-Ready WP

Changelog

4.5.2

• Fixed: The readiness check for robots.txt asks your site instead of your settings. robots.txt is the one document this plugin does not write, it is filtered into WordPress’s own output, so a static robots.txt in your site root or an SEO plugin answering first leaves the crawler groups, the content signals and the discovery pointers out of the file a crawler actually reads. Every setting still said the feature was on, and the score gave full marks for it. Found on a live site. Your site is not blocked when this happens; it simply gets none of what the feature adds, and now you are told.
• New: The diagnosis names that case and what to look for. As everywhere else here, a check that could not run at all still counts as working.

4.5.1

• Fixed: Inline JavaScript and CSS no longer read as text. A <script> or <style> block in a page ended up in llms-full.txt and in the meta description as prose, so a tracking snippet or a builder’s inline CSS was published as if it were a sentence about the page. The blocks now go with their content, before anything else looks at a tag.
• Fixed: The base64 blocks page builders store inside their shortcodes are no longer published as a wall of letters. Removing a shortcode used to leave its payload standing, so a line of text about pricing carried “JTVCc3RtLWNhbGMlMjBpZCUzRCUyMjUxMTU5JTIyJTVE” in the middle of it. The payload is now unpacked and cleaned like the rest of the page, which also means text that was hidden inside such a block becomes readable. Checksums, tokens, filenames and anything else that merely looks like base64 are left exactly as they are.

4.5.0

• New: Connect your AI. An administrator-only REST API under /wp-json/airewp/v1/admin/ lets the hosted MCP server at wp.studiomeyer.io, or any other tool that signs in with an application password, read the readiness score and its checks, the settings, the discovery URLs and their measured state, the pages with their SEO fields, robots.txt and the crawler statistics; and change settings and per-page titles and descriptions, rebuild the files and ping IndexNow. Changed settings go through the same validation as the settings page. The routes exist whether or not the public REST routes are switched on; nothing here answers an anonymous request.
• New: A “Connect your AI (MCP)” section on the settings page with the five steps to connect Claude, ChatGPT or another MCP client.
• New: A diagnosis route that measures the discovery URLs and names the problems the plugin can see, each with its fix: an unwritable directory, a URL the web server keeps from WordPress, empty settings the score needs, blocked AI crawlers, a second SEO plugin printing the same tags, plain permalinks.

4.4.4

• Fixed: The Organization, WebSite and breadcrumb schemas now stand down next to Yoast SEO, Rank Math, The SEO Framework and the other SEO plugins, like the meta tags did since 4.4.3. Every one of those plugins publishes the same three, and a page that describes the same company twice is not twice the structured data. The FAQ schema stays; none of those plugins builds it from your headings.
• Fixed: llms.txt and llms-full.txt answer without a file. Until now they were the two documents with no fallback: on a host that keeps the site root read-only, which is the rule on managed WordPress hosting, the URLs answered 404 while the plugin had the content the whole time. The documents are now built once, cached, and refreshed whenever your content changes, so the file is a shortcut and no longer a condition.
• Changed: The readiness score and the status table ask whether llms.txt answers, the same question they ask of the JSON documents. The llms.txt pointer in robots.txt follows the feature toggle instead of the file.

4.4.3

• Changed: AI crawlers are allowed by default. Up to 4.4.2 a fresh install blocked thirteen training crawlers, GPTBot, ClaudeBot and Google-Extended among them, and most site owners never saw the checkbox. On a plugin whose job is to make a site visible to AI that was the wrong default. Existing sites are switched over once and get a notice that says so; the checkbox to block them again is where it always was.
• New: robots.txt names every known AI crawler in its own group with an explicit Allow, the way a crawler actually reads the file (RFC 9309: a crawler follows the one group that names it). Every group repeats the rules of the * group, so naming a bot never opens a directory you keep closed. A crawler that another plugin already addresses is left alone.
• New: Content Signals. Every group carries a Content-Signal line (contentsignals.org) that says what a crawler may do with your content: search, AI answers, training. It follows the two policy checkboxes and is also added to the * group when nothing has put one there.
• New: Nine crawlers added, each checked against its maker’s documentation: Applebot, anthropic-ai, Google-CloudVertexBot, DuckAssistBot, Meta-ExternalFetcher, Meta-WebIndexer, MistralAI-Index, MistralAI-Training and MistralAI-User. Two removed for the same reason: cohere-ai (Cohere states it runs no crawler) and FacebookBot (no longer in Meta’s crawler list). Crawler analytics still recognise both.
• Fixed: The SEO module stands down when Yoast SEO, Rank Math, All in One SEO, SEOPress, The SEO Framework, Squirrly, SmartCrawl or Slim SEO is active. Until now it printed its own meta description, canonical, social tags and Sitemap line next to theirs, which on one user’s site meant three meta descriptions in one head and the same Sitemap URL twice in robots.txt. The settings page names the plugin it found; a checkbox brings the output back.
• Fixed: A static front page shared on social media was captioned with its post title, usually “Home”, under og:type “article”. The front page now carries the site name, the tagline, the home URL and og:type “website”. A title or description typed into the SEO box still wins.
• Fixed: mcp.json is no longer published with an empty server list. With the feature on and no server listed the URL answers 404, the status table says so, and the readiness score no longer hands out a point for an empty manifest. The MCP check only counts once the feature is on, so a site without MCP servers can reach the full score.
• Fixed: robots.txt advertised Sitemap: /sitemap.xml even with the SEO module switched off, when nothing answered that URL. The line now appears only when this plugin serves the sitemap and nobody has advertised the URL already.
• Fixed: The # agents.json: pointer in robots.txt depended on a written file. Since 4.4.0 the URL answers without one, so the pointer now follows the feature toggle.

4.4.2

• Fixed: Pages built with a page builder no longer publish their raw shortcodes. wp_strip_all_tags() removes HTML tags and nothing else, so on a site using WPBakery, Divi or anything else that stores its layout as shortcodes, [vc_row us_bg_overlay_color="..."] ended up in the meta description, in og:description, in llms-full.txt, in the FAQ schema and in the keyword analysis. The description is the expensive one: that string is what Google and every social preview show. Reported by a user running WPBakery, thank you.
• Fixed: The same applies to the excerpt. WordPress builds an automatic excerpt with strip_shortcodes(), which does nothing at all when the page builder is not loaded, and for a post the excerpt is the only text that reaches llms-full.txt.
• Changed: Headings no longer weld themselves onto the next paragraph in the generated text. Tags now become a space instead of being dropped, so “HeadingText” reads as “Heading Text”.
• Note on footnotes: markers like [1] are kept. A shortcode name has to start with a letter, which is what tells the two apart.

4.4.1

• Fixed: German and Spanish translations for the messages added in 4.4.0. The new warnings and the status table were still English on a translated site, which is the wrong moment to switch languages: they turn up exactly when something needs explaining.

4.4.0

• Fixed: agents.json, agent-card.json, agent.json and mcp.json are now served even when the plugin cannot write them to disk. They are built from your settings on the fly instead, so the URLs answer with the same JSON as before. Previously such a site answered 404 while the plugin held the content the whole time. The usual cause is a .well-known directory owned by root, which is what certbot leaves behind on a great many servers, and it left people with a site root the plugin could write and one subdirectory in it that it could not.
• Fixed: The readiness score and the status table now ask whether the URL answers, instead of whether a file sits on disk. That was the wrong question in both directions: it failed sites that serve the documents perfectly well without a file, and it passed sites whose web server never hands /.well-known/ to WordPress, where the file existed and the URL still answered 404.
• New: When a write fails, the plugin says so. The settings page names the directory, tells you who owns it and which user PHP runs as, and gives you the chown command to pass on to your host. The plugin knew all of this before and told nobody.
• New: A separate warning for URLs that do not answer, with the nginx location block that usually causes it. A failed write and an unreachable URL look identical from the outside and have nothing to do with each other.
• New: A link on the settings page to measure the URLs again after you have changed something.
• Fixed: A switched-off feature now answers its URL with a JSON 404. It used to hand the request back to WordPress, which redirected the .json URL and replied with an HTML page.
• Fixed: mcp.json is removed on uninstall. It was the one generated file the cleanup missed, which also kept the empty .well-known directory from being tidied up.

4.3.4

• Compatibility: Tested up to WordPress 7.1.
• Changed: The four AI abilities now also declare the unified public exposure flag introduced in WordPress 7.1. The channel-specific flags (show_in_rest, mcp.public) stay in place and keep working on WordPress 6.9 and 7.0. Newer MCP Adapter releases read the unified flag, so the abilities remain discoverable as tools there.

4.3.3

• Security: Password-protected posts and pages no longer leak their content. The automatically generated meta description ran over the raw post content, so the protected text was readable in the page source — in description, og:description and twitter:description — without ever entering the password. The same content also reached llms-full.txt, the FAQ schema in JSON-LD, the plugin sitemap, the AI search ability and the IndexNow ping. Everything a password protects now stays behind that password. Please update.
• Changed: On a password-protected post the plugin outputs only the canonical URL and, if you set them, the robots directives. No description, no OpenGraph or Twitter card, no featured image, no FAQ schema — not even a description you typed yourself, because it may have been written while the post was still public. Once the password is entered, everything works as before.
• Changed: Password-protected entries are left out of llms.txt, llms-full.txt and the plugin sitemap. A URL that only ever answers with a password form has nothing to offer a search engine or an AI crawler.
• Security: The discovery files are rebuilt immediately after the update. Updating a plugin runs neither the activation hook nor a post save, so without this the llms-full.txt written by the old version would have stayed on your server — fix installed, leak still served — until you saved a post or the daily rebuild happened to run.
• Security: Turning the llms.txt feature off now deletes llms.txt and llms-full.txt, the way the agent card and mcp.json were already handled. Previously the old files stayed on the server and kept being served.
• New: When you put a password on a post that used to be public, IndexNow is pinged once. That old text is already in Bing’s index; the ping is what brings the crawler back to find the password form and drop the snippet. Posts that were protected from the start are never announced.
• Fix: On sites where WordPress cannot reach the filesystem directly, the plugin could crash with a fatal error instead of carrying on without the generated files. This affected the settings page, the dashboard checks, robots.txt, the files served at /llms.txt and /.well-known/, uninstall, and the first WP-CLI command after an update. All of those now simply report the files as missing.
• Fix: The plugin only considers the rebuild done once the llms.txt files were actually written. Previously a failed write could go unnoticed.
• Fix: Saving a post now really does rebuild the discovery files. The old code asked whether a rebuild was already scheduled using the same name as the daily job, so the answer was always yes and the rebuild never happened — llms.txt and llms-full.txt only changed once a day. This is what made the leak outlive the moment you put a password on a post.
• Fix: Taking a post offline (moving it to draft) removes it from llms.txt and llms-full.txt. Previously only published posts triggered a rebuild, so the text of an unpublished post stayed in those files.
• Fix: Putting a password on a post rebuilds the files before the save finishes, instead of a moment later.
• Note: If you run a full-page cache, make sure it treats the WordPress password cookie (wp-postpass_*) as a reason not to serve a cached page. Otherwise the cache can hand a visitor who knows the password a page that was built for someone who does not — this applies to WordPress itself just as much as to this plugin, and every common cache plugin already handles it.

4.3.2

• New: Full German (de_DE) translation of the plugin interface — the admin UI now speaks English, German and Spanish.

4.3.1

• New: Full Spanish (es_ES) translation of the plugin interface — the admin UI is now available in English and Spanish.

4.3.0

• New: A guided setup wizard opens after activation and walks you through your business details and industry, then generates all your discovery files and schema. Two steps to AI-ready.
• New: A friendly, one-time review request appears a week after setup. Dismiss it once and it never comes back.

4.2.0

• Compatibility: Tested up to WordPress 7.0 (released May 2026).
• New: Each AI-Ready ability now declares meta.show_in_rest and a readonly annotation. WordPress 7.0 ships the Abilities API and AI Client in core, and these annotations let the MCP Adapter and AI Client know the abilities only read site data and never mutate it.
• Changed: Minimum required WordPress version is now 6.9 (previously 6.0). The Abilities API that powers the MCP Adapter integration ships with WordPress 6.9, and 6.9/7.0 are the versions this plugin is tested against. Sites on older WordPress simply keep version 4.1.1.
• Housekeeping: Uninstall cleanup now uses WordPress core APIs (delete_post_meta_by_key()) instead of direct SQL for post meta removal.
• New: Optional mcp.json endpoint (/.well-known/mcp.json) — publish an MCP server discovery manifest for the MCP servers you list in the settings. Off by default.
• New: Suggested privacy policy text under Settings → Privacy (the plugin stores no personal data — this documents exactly that).
• Fix: llms.txt no longer contains an empty description blockquote when no business description is set; company name and description now fall back to the site title and tagline.
• Fix: llms.txt only advertises discovery endpoints that are actually enabled (no more links to disabled endpoints).
• Fix: The “REST API” settings toggle now actually disables the /wp-json/airewp/v1/ endpoints when unchecked.
• Removed: The builtBy tool credit from the agent-card.json extensions block — your agent card is your document, not our ad.
• No breaking changes. The classic SEO meta box, REST API behavior, and the agents.json format are unchanged.

4.1.1

• Fix: Register WP Abilities on the wp_abilities_api_init action instead of init. Resolves a _doing_it_wrong notice on WordPress 6.9 (“Abilities must be registered on the wp_abilities_api_init action”) and ensures the four airewp/* abilities are picked up by the WordPress MCP Adapter.
• Fix: Each ability now declares the required category property and uses the new execute_callback key (renamed from callback in WP 6.9). Without these the abilities were registered but discarded with a _doing_it_wrong notice.
• New: Plugin registers its own ability category airewp (label “AI-Ready WP”) on wp_abilities_api_categories_init so all four abilities are grouped under one heading in the MCP Adapter and Abilities admin views.
• Tested with WordPress 6.9.4. No changes to features or settings — pure compatibility update.

4.1.0

• Focus: AI Discovery + SEO as a complete free package.
• All features are free — no license key required.
• Full SEO module: meta title/description, OpenGraph, Twitter Cards, canonical URL, robots meta, XML Sitemap, focus keyword analysis.
• Full AI Discovery: agents.json, agent-card.json, llms.txt, JSON-LD, REST API, AI Bot Management, Crawler Analytics, IndexNow, WP Abilities.
• AI-Readiness Score dashboard widget with 11 checks.
• 16 industry presets.
• Improved output escaping and security hardening.

3.0.0

• AI Bot Management — granular robots.txt control for 20+ AI bots.
• AI Crawler Analytics — track AI bot visits.
• WP Abilities API — registers abilities for WordPress MCP Adapter (WP 6.9+).
• A2A v0.3 agent.json — canonical A2A path with backward-compatible agent-card.json.

2.0.0

• REST API endpoints, BreadcrumbList/FAQPage schemas.
• IndexNow integration for instant search engine indexing.

1.0.0

• Initial release with agents.json, agent-card.json, llms.txt, JSON-LD, Dashboard widget, 16 presets.