Description
EONSR AEO Agent is a powerful content generation tool designed to help website owners automate the creation of SEO and AEO (Answer Engine Optimization) friendly articles.
Unlike generic AI writers, this plugin utilizes a specialized 2-pane UI workflow and structured prompt engineering to produce in-depth, formatted, and media-rich content directly within your WordPress dashboard.
How it works (SaaS Service)
This plugin operates as a connector (client) to the EONSR Cloud Platform. It sends your input (keywords, topics, settings) to our external Node.js processing servers to generate content using advanced AI models (Google Gemini API). This architecture ensures your WordPress site remains fast and is not burdened by heavy AI processing tasks.
All plugin features are fully functional. The plugin itself contains no locked or restricted functionality. API usage limits are managed entirely server-side by the EONSR Cloud service.
Key Features
- AI Article Generation: Create comprehensive articles from a single keyword using advanced prompting.
- Dual-Pane Interface: Edit content and prompts side-by-side before publishing.
- Image Generation: Automatically create Featured Images and In-Content images with text overlays.
- Bulk Generation: Upload an Excel (.xlsx) file to schedule and generate hundreds of posts automatically in the background.
- Smart Auto-Translation: Generate content in one language and automatically translate/localize it into multiple languages.
- SEO Optimization: Automatically fills Rank Math / Yoast SEO meta descriptions and focus keywords.
- YouTube Embedding: Automatically finds and embeds relevant videos to increase time-on-site.
External Services
This plugin connects to the following external services. By using this plugin, you agree to the terms of each service listed below.
1. EONSR Cloud API
This plugin requires the EONSR Cloud API to function. All content generation, image creation, and translation features are processed on EONSR’s external servers — no AI processing is done locally on your WordPress site.
- What it is: A managed Node.js API platform that processes AI content generation requests using Google Gemini models.
- API Endpoint:
https://commercial-api.congtyeon.com - What data is sent: When an authorized WordPress user triggers a generation action, the plugin sends the requested keywords, language, country, writing style, generation settings, site URL, license information, and any selected source content required to complete the request. The plugin does not send WordPress user passwords.
- When data is sent: Data is sent when an authorized user starts article generation, image generation, translation, bulk processing, license activation or synchronization, or a supported payment flow.
- How the connection is secured: Outbound requests use HTTPS. Inbound callbacks from EONSR Cloud use signed HMAC authentication with a per-site secret, timestamp, nonce, request-body hash, and replay protection.
- Outbound endpoints used: Every feature of this plugin is a thin client for the EONSR Cloud service. No article text, image, or translation is produced on the WordPress server itself.
POST /api/v1/article/generate— Generates article text.POST /api/v1/article/generate-images— Generates illustration images.POST /api/v1/article/bulk/upload-scheduled— Uploads an XLSX job list for bulk generation. The spreadsheet is parsed and every article in it is written on EONSR’s servers.GET /api/v1/article/bulk/status-scheduled— Polls the progress of a bulk job.GET /api/v1/apiConfig/config/get— Retrieves the generation configuration for the active plan.POST /api/v1/license/create,/activate,/validate,/trial,GET /api/v1/license/details/,POST /api/v1/license/cancel/— License lifecycle.GET /api/v1/product,POST /api/v1/paypal/capture-order/— Plan catalogue and payment confirmation.
- Service Provider: Cong Ty EON (EONSR)
- Terms of Service: https://aeo.eonsr.com/terms/
- Privacy Policy: https://aeo.eonsr.com/privacy-policy/
2. YouTube Data API v3 (Google)
This plugin optionally uses the YouTube Data API v3 to search for and embed relevant videos inside generated articles.
- What it is: Google’s public API for searching YouTube video content.
- API Endpoint:
https://www.googleapis.com/youtube/v3/search - What data is sent: The article keyword/topic is sent to YouTube’s API to find a relevant video. No personal user data is transmitted.
- When data is sent: Only when the YouTube embedding feature is enabled and a generation action is triggered.
- Service Provider: Google LLC
- Terms of Service: https://developers.google.com/youtube/terms/api-services-terms-of-service
- Privacy Policy: https://policies.google.com/privacy
REST API Endpoints (Inbound Webhooks)
This plugin registers REST API endpoints on the connected WordPress site so that the EONSR Cloud service can return generated content and retrieve the limited site information required for article generation.
The protected endpoints require an HMAC-signed request generated with a unique per-site secret. Every signed request includes a timestamp, a random nonce, and a SHA-256 hash of the raw request body. Expired, modified, incorrectly signed, or replayed requests are rejected.
POST /wp-json/eonsr-aeo-agent/v1/scheduled-post/create— Receives completed article data from EONSR Cloud and creates or schedules a WordPress post. Requires HMAC authentication. Incoming HTML is sanitized before it is stored.POST /wp-json/eonsr-aeo-agent/v1/sync-license— Receives a license synchronization request. Requires HMAC authentication and verifies that the supplied domain matches the current WordPress site.GET /wp-json/eonsr-aeo-agent/v1/languages— Returns the active language configuration needed for translation routing. Requires HMAC authentication.GET /wp-json/eonsr-aeo-agent/v1/posts— Returns a limited list of published post information used for internal-link suggestions and duplicate-content prevention. Requires HMAC authentication and enforces a maximum result limit.GET /wp-json/eonsr-aeo-agent/v1/keyphrases— Returns a limited list of existing SEO focus keyphrases used to reduce keyword cannibalization. Requires HMAC authentication, validates the search query, excludes deleted and auto-draft posts, and limits the response size.
The inbound endpoints do not return WordPress passwords, authentication cookies, private user credentials, payment credentials, or unrestricted post metadata.
Third-Party Libraries
This plugin bundles the following third-party library. It is served locally so that no request is made to an external CDN.
- SweetAlert2 v11.26.17 — used for the plugin’s dialog boxes.
- File:
assets/js/sweetalert2.all.min.js - License: MIT
- Source: https://github.com/sweetalert2/sweetalert2
- Unminified source for this exact version: https://github.com/sweetalert2/sweetalert2/releases/tag/v11.26.17
- File:
Installation
- Log in to your WordPress Administration Panels.
- Go to Plugins -> Add New.
- Search for EONSR AEO Agent.
- Click Install Now, then click Activate.
- Go to the AEO Agent menu in your dashboard.
- Optionally, enter your License Key to connect your own third-party API quota (YouTube, Google Search). You can also proceed without a key using EONSR’s shared default quota.
- Start generating content!
Alternatively, you can upload the plugin zip file via the Plugins -> Add New -> Upload Plugin screen.
FAQ
-
Do I need to pay to use this plugin?
-
The plugin itself is free to download and all features are fully accessible without a license key. The plugin connects to the EONSR Cloud service for AI processing, which is available to all users using EONSR’s default shared quota. A License Key is available for purchase at https://aeo.eonsr.com and grants you a dedicated, higher-volume quota for third-party integrations such as the YouTube Data API and Google Search API — resources that EONSR provisions and manages on your behalf.
-
Where is my data sent?
-
Depending on the feature you use, the plugin may send keywords, article settings, selected source content, image prompts, language and country settings, site URL, license information, and payment product identifiers to
https://commercial-api.congtyeon.com. WordPress account passwords and authentication cookies are not sent to the service. Please review the Terms of Service and Privacy Policy listed in the External Services section for retention and processing details. -
Why does it use an external server?
-
AI content generation, especially image creation and long-form text processing, requires significant computational power. Running this directly on your WordPress hosting would likely cause timeout errors. Our Node.js cloud infrastructure handles the heavy lifting to ensure stability.
-
Can I use my own Google Gemini API Key?
-
No. To ensure quality consistency, structured prompt engineering security, and advanced features (like text-on-image generation), the system uses our managed API infrastructure.
-
What are the REST API endpoints registered by this plugin?
-
The plugin registers protected inbound endpoints used to receive generated articles and retrieve the limited site information required for translation, internal linking, license synchronization, and duplicate-content prevention. All listed inbound endpoints require signed HMAC authentication. See the “External Services” section for the endpoint list and data-flow details.
Reviews
Contributors & Developers
“EONSR AEO Agent” is open source software. The following people have contributed to this plugin.
Contributors
Translate “EONSR AEO Agent” into your language.
Interested in development?
Browse the code, check out the SVN repository, or subscribe to the development log by RSS.
Changelog
3.9.3
- The Article Studio now defaults its target language and country to the site’s Polylang languages instead of a fixed locale. English is always offered as an option.
3.9.2
- Security: removed from the article HTML allowlist. Generated posts can no longer carry inline JavaScript. YouTube embeds are unaffected (they use
<
iframe> plus a separately enqueued script).
* Security:
<
iframe> embeds are now restricted to YouTube hosts; any other iframe src is stripped when a post is saved.
* Hardens the scheduled-post, languages and sync-license REST routes, which already require HMAC authentication, against stored cross-site scripting in the article body.
3.9.0
- Rebuilt the plugin on an object-oriented architecture: 91 global functions and 31 anonymous hook callbacks are now 37 autoloaded classes under the EONSR\AEO_Agent namespace.
- Page markup moved out of PHP into dedicated view files under views/.
- Replaced the bundled Tahoma font with the SIL Open Font License Noto fonts. Chinese, Japanese and Korean image watermarks now render correctly instead of showing empty boxes.
- Fixed bulk XLSX upload, which rejected every file.
- Fixed saved language, country and writing-style selections not appearing in the editor.
- The keyphrase REST route now requires the same HMAC authentication as every other webhook, and no longer reports keyphrases from trashed posts.
- Diagnostic logging is silent unless WP_DEBUG is enabled.
3.8.0
- Fixed an unauthenticated stored cross-site scripting vulnerability in inbound article creation.
- Added HMAC authentication to all inbound REST API endpoints used for article creation, license synchronization, language retrieval, post retrieval, and keyphrase lookup.
- Added timestamp validation, nonce validation, SHA-256 request-body hashing, constant-time signature comparison, and replay protection.
- Restored WordPress KSES filtering for generated article HTML and removed unsafe KSES bypasses.
- Added validation and sanitization for generated HTML, CSS, metadata, tags, summaries, image prompts, license data, payment data, uploads, and remote API responses.
- Removed the fallback that attributed webhook-created posts to WordPress user ID 1.
- Added per-post capability checks for article editing, image generation, translation, scheduling, and category updates.
- Added ownership checks and capability validation for job and bulk cancellation actions.
- Strengthened XLSX and PNG upload validation, including MIME type, file size, and image dimension checks.
- Added authorization and nonce protection to license synchronization actions.
- Hardened PayPal and ZaloPay flows with trusted redirect-domain checks, PayPal order ownership validation, duplicate-capture protection, and safer license activation handling.
- Added query validation, result limits, and deleted-post filtering to the protected keyphrase lookup endpoint.
- Updated compatibility information for WordPress 7.0.
3.7.7
- Refactored codebase for better performance and security (Prefix Standardization).
- Implemented WordPress Nonce verification for all AJAX actions.
- Enhanced Bulk Processor with background processing logic.
- Added DOMDocument handling for better image injection in translated posts.
- Updated API endpoints to v1 structure.
- Extracted all inline CSS and JavaScript into separate enqueued files per WordPress guidelines.
1.0.0
- Initial release.