Title: Hack The SEO – AI Bot Tracker, GEO Score, JSON-LD Schema & Cannibalization Author: Hack The SEO Published: August 31, 2026 Last modified: September 9, 2026 --- Search plugins ![](https://ps.w.org/hack-the-seo/assets/banner-772x250.png?rev=3674500) ![](https://ps.w.org/hack-the-seo/assets/icon-256x256.png?rev=3686755) # Hack The SEO – AI Bot Tracker, GEO Score, JSON-LD Schema & Cannibalization By [Hack The SEO](https://profiles.wordpress.org/hacktheseo/) [Download](https://downloads.wordpress.org/plugin/hack-the-seo.1.1.2.zip) * [Details](https://wordpress.org/plugins/hack-the-seo/#description) * [Reviews](https://wordpress.org/plugins/hack-the-seo/#reviews) * [Installation](https://wordpress.org/plugins/hack-the-seo/#installation) * [Development](https://wordpress.org/plugins/hack-the-seo/#developers) [Support](https://wordpress.org/support/plugin/hack-the-seo/) ## Description **[Hack The SEO](https://hacktheseo.com/wordpress-seo-plugin/)** shows you something no analytics tool can: which AI crawlers read your pages, which pages they read, and when. Then it tells you what to fix so those pages are worth quoting. And it handles the whole technical SEO layer on top, free. **You do not have to choose.** Hack The SEO is built to run next to **Yoast SEO, Rank Math, All in One SEO and SEOPress**. It detects the one you already have and steps aside on everything that plugin already produces, so nothing is emitted twice and you configure nothing. It never deactivates it and never touches its settings. What it adds is what none of them gives you: the AI crawler log, the GEO score, and the cannibalization report. **Why your analytics cannot see this.** GPTBot, ClaudeBot and PerplexityBot do not run JavaScript, so a JavaScript analytics tool never sees them. Hack The SEO reads the request on your server, before any script runs, and writes every visit into a table in your own database. #### Safe to install today, on the site you already have * **Keep your current SEO plugin.** Hack The SEO detects Yoast, Rank Math, All in One SEO or SEOPress and steps aside, module by module. No duplicate title tags, no duplicate schema, nothing to configure. * **Nothing leaves your site.** No account, no API key, no telemetry. Out of the box the plugin makes zero outbound requests. * **Nothing breaks if you uninstall.** Your redirects, your metadata and your settings stay in the database unless you ask for them to be deleted. * **Nothing slows your visitors down.** No external call in the front-end path. Scores and audits run in the admin, never on a visitor’s request. * **Runs on the hosting your clients actually have.** PHP 7.4, WordPress 5.9, MySQL or MariaDB. No Composer, no build step, no cron daemon. #### Everything you get, and all of it is free * **AI crawler log**: 18 user agents from OpenAI, Anthropic, Perplexity, Apple, Google, Meta, Cohere and Common Crawl, recorded server-side. * **Weekly report by email**: once a week, your own site tells you how many AI crawlers came, on how many pages, how many visitors arrived from an AI chat, and which broken links appeared. Sent by WordPress, from your site, to you. Opt- in. * **[GEO score](https://hacktheseo.com/geo-score-wordpress/) per page**: scored out of 100 on six criteria, with the failing ones named. * **[Keyword cannibalization report](https://hacktheseo.com/keyword-cannibalization-wordpress/)**: which of your pages compete against each other, and what to do about each pair. * **A read-only MCP server**: connect Claude and ask your site directly. Twelve abilities, and all twelve read. * **[JSON-LD schema and structured data](https://hacktheseo.com/structured-data-wordpress/)**: 60+ types generated automatically, configurable per page, so your pages are eligible for rich results (rich snippets). * **XML sitemaps**: sitemap index, per-type sitemaps, human-readable XSL stylesheet. * **[Redirects and 404 monitor](https://hacktheseo.com/404-redirects-wordpress/)**: 301s, regex rules, CSV import and export, a 404 log with one-click 404-to-redirect. * **Meta titles and descriptions**: templates, variables, live SERP preview. * **Open Graph and Twitter Cards**: `og:title`, `og:description`, `og:image`, ` twitter:card` and the rest, on every post, page and custom post type. * **Alt text auto-fill**: images published without alt text get one, derived from the file name, the title or the focus keyword. The audit lists the ones still missing. * **Canonicals, breadcrumbs, robots, noindex**: per post, per type, per taxonomy. * **[On-page audit](https://hacktheseo.com/on-page-seo-audit-tool/)**: 21 checks in the editor, a Google score and an AI citability score side by side. * **Orphan detection**: pages with no inbound internal link are flagged in the global score, because a page nothing links to is a page nothing finds. * **IndexNow**: ping Bing, Yandex, Naver, Seznam and Yep the moment you publish. Off until you switch it on. * **llms.txt**: generated from your real content, not a static template. Plus a Markdown version of every page, at `/your-page.md`, the format an LLM reads most reliably. * **[WooCommerce](https://hacktheseo.com/woocommerce-seo/)**: product and category schema, shop-aware sitemaps. #### See which AI crawlers read your pages * Detection runs on `template_redirect`, server-side. No beacon, no tracking script, no external service. * GPTBot, ChatGPT-User, OAI-SearchBot, ClaudeBot, Claude-User, Claude-SearchBot, PerplexityBot, Perplexity-User, Applebot, CCBot, Bytespider and seven more. * Every hit is written to a table in your own database, with the URL and the timestamp. * Human visits arriving from an AI chat are counted through the referrer, so you see the crawler and the click it eventually sent. * Only agents these companies really send. `Google-Extended` is a robots.txt token, not a crawler, so counting it would count nothing. Other plugins give you a switch to block AI crawlers. This one tells you whether they came. #### Prove it to yourself in ten seconds Run this in a terminal, then refresh the AI visibility screen: ``` curl -A GPTBot https://your-site.tld/any-page/ ``` The row is there, with the page and the timestamp. That is the whole mechanism. Everything else on this page is built the same way: if we claim it, you can check it. #### Find out which of your pages are worth quoting [GEO](https://hacktheseo.com/seo-geo-glossary/), generative engine optimization ( also called AEO), is the work of making a page a generative engine can read, understand and quote. Each page is scored out of 100 on six questions: * Does the page answer its question explicitly and early? * Is that answer above the fold, or buried under four paragraphs of preamble? * Are there stable facts that can be quoted and attributed? * Is there a definition block a model can lift as it stands? * Is the structure parseable by a machine? * Is the page fresh enough to be worth citing? The rules are plain PHP in the plugin. Open the file and read them. No model decides your score, and no API key is involved. #### Ask your site directly, from Claude The plugin ships a **read-only MCP server**. Connect Claude Code or Claude Desktop, and ask instead of clicking through screens: * Which pages has ClaudeBot never touched? * Why does this article score 38 out of 100? * Which of my pages compete with each other? * What are the most-hit 404s since Monday? How it stays safe: * **Twelve abilities, and all twelve read.** There is no write among them, and no setting that turns one on. * **It answers a signed-in WordPress user and nobody else.** Every call checks a WordPress capability. Unpublished and password-protected content stays out. * **The connection is inbound.** Your client calls your site. No relay, no third party, no data sent anywhere. * **It needs WordPress 6.9**, where the Abilities API entered core. Below that it simply does not register, and nothing else changes. #### Already running Yoast, Rank Math, All in One SEO or SEOPress? **Keep it. Hack The SEO installs next to it and steps aside on its own.** The usual reason not to run two SEO plugins is duplicate output: two title tags, two canonicals, two sets of schema. This plugin is built to avoid exactly that, without you configuring anything. * **It gets out of the way, module by module.** On activation it detects the plugin already in place and stops emitting whatever that plugin handles: meta tags, canonical, schema, sitemap, breadcrumbs, robots, and hreflang when a multilingual plugin owns it. Nothing is emitted twice. * **It never deactivates your plugin, and never changes its settings.** Your existing setup keeps running exactly as it did. * **What you came for works from day one.** The AI crawler log, the GEO score and the cannibalization report have no front-end output, so there is nothing to overlap. They start measuring the moment you activate. * **You stay in charge.** A dedicated screen lists every overlap and lets you decide, one by one, which plugin owns what. Your choice always wins over the automatic default. * **And if you would rather replace than stack**, the [migration wizard](https://hacktheseo.com/documentation/wordpress-integration/) imports your meta titles and descriptions, your robots and noindex rules, your canonicals, your redirects and your schema settings. It runs as a dry run first, so you see what will be imported, counted per type, before anything is written. It never deletes the source data. #### Your data stays yours * AI crawler data, GEO scores and audit results stay in your database. No telemetry, no phone-home, no usage statistics. * The only outbound request is one you switch on yourself: IndexNow pings. The weekly report is your own WordPress writing to you. * Read the [privacy policy](https://hacktheseo.com/privacy-policy/) if you want the long version. #### Works with the tools you already use * Tested with Elementor, Divi, Bricks, Oxygen and WPBakery. The plugin reads the rendered content, so scores and schema see what your visitors see. * Works with caching plugins and CDNs. Crawler detection happens before the cache layer can swallow it. * Multisite compatible. Each site keeps its own settings, redirects, sitemap and data. #### What this plugin will not do, and will not pretend to * It does not promise you a ranking or a position. Nobody can, and anyone who does is selling something. * It does not write your content for you, suggest internal links, or track your rankings. * It does not make you “visible in ChatGPT” by dropping an llms.txt on your server. That claim has no evidence behind it. * It does not block AI crawlers. It measures them. #### Useful links * [Documentation](https://hacktheseo.com/documentation/) * [Getting started](https://hacktheseo.com/documentation/getting-started/) * [SEO and GEO glossary](https://hacktheseo.com/seo-geo-glossary/), 100+ terms defined * [Free SEO audit](https://hacktheseo.com/free-seo-audit/) * [Blog](https://hacktheseo.com/blog/) * [Support](https://wordpress.org/support/plugin/hack-the-seo/) * [Contact us](https://hacktheseo.com/contact/) ### External services This plugin connects to exactly one external service, and it is disabled by default: IndexNow. #### IndexNow **What it is.** IndexNow is an open protocol that lets a site notify participating search engines (Bing, Yandex, Naver, Seznam, Yep) that a URL has changed, instead of waiting to be crawled. The endpoint `https://api.indexnow.org/indexnow` is operated by the IndexNow sponsors: Microsoft Corporation, Yandex N.V. and Seznam.cz, a.s. **When it is used.** Only when the IndexNow module is enabled. The option `htsfree_indexnow_enabled` defaults to `0`. While it is `0`, no hook is registered and no request is ever made. The plugin never enables it for you, including on activation. Once you enable it, a request is sent when you publish or update a post or page, or when you click the manual ping button in the admin. **What is sent.** Only: * the public URL(s) of the content you just published or updated on your own site; * the host name of your site; * an IndexNow key, randomly generated locally and published by design at `https:// your-site.tld/{key}.txt`, which is how the protocol proves you own the domain. No post content, no personal data, no visitor data, no site credentials and no administrator information are transmitted. Requests are rate-limited to one ping per URL per ten minutes. **Where to read their terms.** Terms of use, which also contain the privacy statement for the service: [https://www.indexnow.org/terms](https://www.indexnow.org/terms). Protocol documentation: [https://www.indexnow.org/documentation](https://www.indexnow.org/documentation). Microsoft’s privacy statement, as one of the sponsors processing submissions: [https://privacy.microsoft.com/privacystatement](https://privacy.microsoft.com/privacystatement). #### The weekly report (your own site, to you) When enabled, once a week your WordPress sends its administrator a short email through` wp_mail()`: AI crawler passages and pages, visitors arriving from AI chats, new broken links, and the movement of the site score. It uses your site’s existing mail configuration and contacts no third party. Nothing is sent on a week with nothing to report. Every email carries a one-click unsubscribe link that works without logging in. It is off by default and controlled from the AI visibility settings. #### On-site visitor measurement (no third party) The content performance module counts views, reading time and scroll depth for your published posts. This is stored **in your own database only**. Visitor IP addresses are never stored: they are hashed and used solely as a short-lived rate-limit key so the same visitor is not counted twice within thirty minutes. Nothing is sent anywhere. The module can be turned off with the option `htsfree_visits_tracking`. #### For clarity: requests to your own site Some features (the health check, the sitemap self-test, the schema verification, the redirect probe, page-builder content extraction) load a URL of **your own site** over HTTP, because that is the only reliable way to see what a visitor or a crawler actually receives. These are loopback requests to your own domain. They are not a third-party service, and nothing leaves your server. ### A paid version exists Hack The SEO also has a commercial version, which adds automated internal linking and semantic cocoons, AI-assisted content workflows, and a hosted dashboard. It is a separate product and is not required for anything described here. The free version is not a trial and does not expire. If you ever move to the commercial version, the work you did page by page comes with you: your meta titles and descriptions, your canonical and robots choices, your redirects and your scores are stored in shared keys and are read as they are. The free plugin’s own settings, such as which modules you switched on, are stored separately and are set again in the other plugin. Details at [hacktheseo.com](https://hacktheseo.com/). ## Screenshots [⌊AI visibility: every visit from GPTBot, ClaudeBot, PerplexityBot and 15 other AI agents, measured server-side, page by page.⌉⌊AI visibility: every visit from GPTBot, ClaudeBot, PerplexityBot and 15 other AI agents, measured server-side, page by page.⌉[ AI visibility: every visit from GPTBot, ClaudeBot, PerplexityBot and 15 other AI agents, measured server-side, page by page. [⌊SEO dashboard: module status, site health, SEO score, GEO score and AI crawler activity at a glance.⌉⌊SEO dashboard: module status, site health, SEO score, GEO score and AI crawler activity at a glance.⌉[ SEO dashboard: module status, site health, SEO score, GEO score and AI crawler activity at a glance. [⌊Keyword cannibalization report: pages competing on the same keyword, with a recommended action for every pair.⌉⌊Keyword cannibalization report: pages competing on the same keyword, with a recommended action for every pair.⌉[ Keyword cannibalization report: pages competing on the same keyword, with a recommended action for every pair. [⌊On-page SEO panel in the editor: a Google score and an AI citability score, meta title and description, and 21 checks.⌉⌊On-page SEO panel in the editor: a Google score and an AI citability score, meta title and description, and 21 checks.⌉[ On-page SEO panel in the editor: a Google score and an AI citability score, meta title and description, and 21 checks. [⌊Every issue on your site, ranked: pages under 50, 404s, competing groups, images without alt, each with its fix.⌉⌊Every issue on your site, ranked: pages under 50, 404s, competing groups, images without alt, each with its fix.⌉[ Every issue on your site, ranked: pages under 50, 404s, competing groups, images without alt, each with its fix. [⌊Overlaps: the plugin detected Yoast and stepped aside. Every overlap listed, and who owns what, module by module.⌉⌊Overlaps: the plugin detected Yoast and stepped aside. Every overlap listed, and who owns what, module by module.⌉[ Overlaps: the plugin detected Yoast and stepped aside. Every overlap listed, and who owns what, module by module. [⌊Migration wizard: import meta, redirects and schema from Yoast SEO, Rank Math, All in One SEO or SEOPress.⌉⌊Migration wizard: import meta, redirects and schema from Yoast SEO, Rank Math, All in One SEO or SEOPress.⌉[ Migration wizard: import meta, redirects and schema from Yoast SEO, Rank Math, All in One SEO or SEOPress. [⌊Schema JSON-LD settings: 60+ schema types generated automatically, configurable per page.⌉⌊Schema JSON-LD settings: 60+ schema types generated automatically, configurable per page.⌉[ Schema JSON-LD settings: 60+ schema types generated automatically, configurable per page. [⌊Redirects and 404 log: 301 redirects, regex rules, CSV import and export, one- click 404-to-redirect.⌉⌊Redirects and 404 log: 301 redirects, regex rules, CSV import and export, one-click 404-to-redirect.⌉[ Redirects and 404 log: 301 redirects, regex rules, CSV import and export, one-click 404-to-redirect. [⌊XML sitemap: sitemap index, per-type sitemaps and a human-readable XSL stylesheet.⌉⌊ XML sitemap: sitemap index, per-type sitemaps and a human-readable XSL stylesheet .⌉[ XML sitemap: sitemap index, per-type sitemaps and a human-readable XSL stylesheet. [⌊Health check: sitemap, schema and canonical verified against your rendered HTML.⌉⌊ Health check: sitemap, schema and canonical verified against your rendered HTML.⌉[ Health check: sitemap, schema and canonical verified against your rendered HTML. [⌊AI connection: two steps to connect Claude to your site. One button creates the WordPress application password and prints the line to paste into your AI client.⌉⌊ AI connection: two steps to connect Claude to your site. One button creates the WordPress application password and prints the line to paste into your AI client.⌉[ AI connection: two steps to connect Claude to your site. One button creates the WordPress application password and prints the line to paste into your AI client. [⌊The twelve read-only tools, what each one returns, and the minimum WordPress role it requires. There is no write among them.⌉⌊The twelve read-only tools, what each one returns, and the minimum WordPress role it requires. There is no write among them.⌉[ The twelve read-only tools, what each one returns, and the minimum WordPress role it requires. There is no write among them. ## Blocks This plugin provides 1 block. * Breadcrumbs ## Installation #### From your WordPress admin 1. Go to **Plugins > Add New**. 2. Search for **Hack The SEO**. 3. Click **Install Now**, then **Activate**. #### Manual installation 1. Download the ZIP file. 2. Go to **Plugins > Add New > Upload Plugin** and select the ZIP. 3. Click **Install Now**, then **Activate**. 4. Or, over FTP, upload the `hack-the-seo` folder to `/wp-content/plugins/` and activate it from the **Plugins** screen. #### After activation 1. Open the **Hack The SEO** menu. The “First steps” checklist adapts to what your site still needs and disappears once you are done. 2. Already running another SEO plugin? Nothing to do: Hack The SEO detected it and stepped aside. The **Compatibility** screen shows you who handles what. 3. Want to replace it instead? Run the **Migration** screen **before** deactivating it. Import first, deactivate second. 4. Check **Health** to confirm your sitemap and schema are being served correctly. 5. Submit `/sitemap.xml` to Google Search Console. #### Requirements * WordPress 5.9 or later (6.9 or later for the MCP server) * PHP 7.4 or later * No account, no API key, no subscription. ## FAQ ### Do I really need another SEO plugin? Only if something is missing. If Yoast or Rank Math is doing the job and you have no idea whether ChatGPT reads your pages, install this one for that answer alone: the AI crawler log, the GEO score and the cannibalization report are things the big four do not give you. And you do not have to choose, see the next question. ### Can I run it alongside Yoast, Rank Math, All in One SEO or SEOPress? Yes, and that is the default behaviour. You do not have to choose. On activation the plugin detects the SEO plugin already in place and stops emitting whatever that plugin handles: meta tags, canonical, schema, sitemap, breadcrumbs, robots, and hreflang when a multilingual plugin owns it. So there are no duplicate title tags, no duplicate canonicals and no duplicate schema. It never deactivates your plugin and never touches its settings. Meanwhile the three things the big four do not give you keep working, because they produce no front-end output and therefore cannot conflict: the AI crawler log, the GEO score per page, and the keyword cannibalization report. A dedicated screen lists every overlap and lets you take back any module, one by one. Your choice always wins over the automatic default. If you would rather replace your current plugin than run both, the migration wizard imports its data first, as a dry run you can review. See “How do I switch from Yoast SEO, Rank Math, All in One SEO or SEOPress?” below. ### How do I see which AI crawlers visit my site? Activate the plugin and open the AI visibility screen. Every request from GPTBot, ChatGPT-User, OAI-SearchBot, ClaudeBot, Claude-User, Claude-SearchBot, PerplexityBot, Perplexity-User, Applebot, CCBot and eight more is recorded server-side, with the URL and the timestamp, in your own database. Nothing is sent anywhere. To prove it to yourself in ten seconds: `curl -A GPTBot https://your-site.tld/any- page/`, then refresh the screen. The row is there. A JavaScript analytics tool cannot do this. AI crawlers do not run JavaScript, so whatever your analytics says about GPTBot, it is guessing. ### What is in the weekly report, and who sends it? Your own site sends it, through WordPress, to the administrator email. Once a week: how many times AI crawlers read the site and on how many pages, how many visitors arrived from an AI chat, which new broken links appeared, and how the site score moved. Nothing is sent on a week with nothing to report. It is off by default, switched on from the AI visibility settings, and every email carries a one-click unsubscribe link that works without logging in. No third party is involved and no outbound call was added: it is `wp_mail()`, the same function WordPress uses for password resets. ### How do I connect Claude to my WordPress site? Open the **AI connection** screen. One button creates a WordPress application password and prints the line to paste into your client. Paste it, and the client talks to` https://your-site.tld/wp-json/htsfree/v1/mcp`. No account, no OAuth relay, no companion plugin, nothing installed outside WordPress. Two things are required, and the screen tells you if either is missing: WordPress 6.9 or newer, because that is where the Abilities API entered core, and HTTPS, because WordPress only issues application passwords over a secure connection. ### What can an AI agent read, and can it change anything? It can read twelve things and change nothing. There is no write among the twelve abilities, and no setting that turns one on. It reads: AI crawler activity three ways (totals per bot, the detail page by page including the pages no crawler has touched, and the day-by-day timeline), a page’s GEO, on-page and meta scores, the site-wide score distribution, the competing-pages report, your redirect rules, your 404 log, your `llms.txt`, the Markdown of any page, and the health check. Every call is made by a signed-in WordPress user and checks a capability: administrator for the site-wide readings, and a user who can edit posts for the four that concern a single page. Unpublished and password-protected content stays out, and no visitor’s IP, referrer or user agent is ever returned. Delete the application password from your user profile and that client is locked out immediately. ### Does the MCP server send my data to OpenAI or Anthropic? The plugin sends nothing and contacts no third party. Your AI client calls your site, not the other way round. What you then read inside your client goes wherever that client goes, which is between you and the client you chose, exactly as if you had typed the same figures in by hand. On the plugin’s side nothing changed: still exactly nine `wp_remote_` call sites, the same nine as before the MCP server existed, and the bundled library adds none of its own. If another plugin has already loaded the same MCP library in an older version, this server stays off rather than fight over it, and the AI connection screen says so plainly. ### What is the best free SEO plugin for WordPress? That depends on what you need, and anyone giving you a single answer is selling something. Yoast SEO and Rank Math are the two largest and have the biggest ecosystems. All in One SEO is the oldest. SEOPress is the leanest of the big four. Slim SEO is the right answer if you want zero configuration. Hack The SEO is built for a specific case: you want the whole technical layer (schema, sitemap, redirects, canonical, robots, breadcrumbs) plus keyword cannibalization detection and real AI-crawler measurement, computed locally, with no account and nothing sent to a third party. If cannibalization or GEO measurement is what you are missing, this is the free plugin that has it, and it runs next to whichever of the others you already use. If you mostly want AI-generated content, it is not. ### How do I add schema (JSON-LD) to WordPress? Install Hack The SEO and it generates JSON-LD structured data automatically from what is already on each page: Article, BreadcrumbList, Organization, Person, Product, FAQPage, HowTo, QAPage, VideoObject and 60+ types in total, so your pages qualify for rich snippets. Types that cannot be detected reliably, such as LocalBusiness opening hours, are yours to enable per page in the Schema settings, so nothing is invented. Confirm the result in Google’s Rich Results Test or the Schema Markup Validator. ### How do I create a 301 redirect in WordPress? Open the Redirects screen, enter the old URL and the destination, and choose 301( permanent). You can also use 302, 307 and 410, add regex rules for bulk migrations, and import or export everything as CSV. When you rename a post, a 301 from the old slug is created for you. Incoming 404s are logged, and any 404 can be turned into a redirect in one click. Redirects are served in PHP, so your `.htaccess` is never touched and it works identically on Apache, Nginx and LiteSpeed. ### How do I generate an XML sitemap for WordPress? It is served automatically at `/sitemap.xml`: a sitemap index plus one sitemap per content type, with image, video and news extensions and an XSL stylesheet so it is readable by a human. It respects noindex and is cached on disk so it does not rebuild in PHP on every request. Submit `/sitemap.xml` to Google Search Console. The “First steps” checklist reminds you to. ### What is llms.txt, and how do I add it to WordPress? llms.txt is a plain-text file listing your key content for AI crawlers, in the same spirit as `robots.txt` for search crawlers. Hack The SEO serves it virtually at `/ llms.txt`, generated from your real content, with no file written to disk. It also serves a Markdown version of every page at `/your-page.md`, which is the format an LLM parses most reliably and most cheaply. Both are on your own server, both are free, and neither requires an account. ### What is GEO (generative engine optimization) and AEO? GEO, sometimes called AEO (answer engine optimization), means making your content easy for generative engines (ChatGPT, Claude, Perplexity, Gemini, Google AI Overviews) to read, understand and cite. Classic SEO optimises for a ranked list of links; GEO optimises for being the source quoted inside an answer. In practice it comes down to: answer the question explicitly and early, keep facts stable and attributable, structure the page so a machine can parse it, expose clean formats (schema, Markdown, llms.txt), and then measure whether the AI crawlers actually come. Hack The SEO does all five, locally, in the free version. ### What is keyword cannibalization, and how do I fix it? Keyword cannibalization is when two or more of your own pages target the same query, so search engines have to pick between them and both underperform. It is one of the most common causes of a site that has plenty of content and no rankings. Hack The SEO detects it for free: it compares focus keywords and title similarity to find competing pairs, measures how much their content actually diverges, and recommends what to do with each pair: merge them, differentiate them, redirect one into the other, or leave them alone because they genuinely serve different intents. All computed in PHP on your server, with no embeddings and no external API. ### How do I get my content cited by ChatGPT, Perplexity or Google AI Overviews? Nobody controls that, and any tool claiming otherwise is guessing. What you can control is whether your content is _citable_, and whether the engines are even reading it. Being citable means: answering the question explicitly and early on the page rather than after four paragraphs of preamble; stating facts that can be quoted and attributed; keeping a clean, parseable structure; and exposing formats a model reads cheaply: valid JSON-LD schema, a Markdown version of the page, an `llms.txt` index. Hack The SEO’s GEO score checks the first three and generates the last two. Then you measure. The AI visibility screen tells you whether GPTBot, ClaudeBot, PerplexityBot and the rest actually came, on which URLs, and how often. Very few free plugins give you that, and without it you have no way of knowing whether any of the rest is working. ### How do I find and fix 404 errors in WordPress? Every 404 hit on your site is logged automatically, with the requested URL, the referrer and a hit count, so you can tell a real broken link from a bot probing for `/wp-admin/setup.php`. Sort by hits, and the URLs actually costing you traffic come straight to the top. Each row has a one-click “redirect this” action that turns the 404 into a 301 to wherever you choose. The log is capped and self-cleaning, so it cannot grow until it hurts your database. ### Does it work with Google Search Console and IndexNow? The XML sitemap at `/sitemap.xml` is what you submit to Google Search Console, and the “First steps” checklist walks you through it. IndexNow is built in and optional: turn it on, and Bing, Yandex, Naver, Seznam and Yep are notified the moment you publish or update a URL, rather than waiting for a crawl. It is off by default and sends nothing but the URL, your host name and your IndexNow key. See “External services”. ### How do I switch from Yoast SEO, Rank Math, All in One SEO or SEOPress? You do not have to: the plugin runs next to them. But if you want to, install Hack The SEO **while the other plugin is still active**, open the Migration screen, and run the import. It reads meta titles and descriptions, meta robots, canonical URLs, focus keywords, cornerstone/pillar flags, redirects and Open Graph fields. If the previous plugin emitted its schema through the theme or a page builder rather than storing it, the wizard parses your rendered homepage to recover Organization and LocalBusiness data. Then verify a few pages, then deactivate the other plugin. Import first, deactivate second, in that order. The wizard never deletes the source data, so the move is reversible. ### Will it slow down my site? No. Front-end output is meta tags, JSON-LD and, if you enable them, breadcrumbs, all built during the normal page render. The XML sitemap is cached on disk rather than rebuilt in PHP. Scores, cannibalization and health checks run in the admin or on cron, never on a visitor’s request. AI crawler detection is a User-Agent read on a hook that already runs. There is no external HTTP call in the front-end path, which is worth stating explicitly: a plugin that calls a remote API while rendering your page is at the mercy of that API’s latency. This one has nothing to call. ### Does this plugin send my data anywhere? No. Out of the box it makes **zero outbound requests**. There is exactly one feature that can ever contact a third party, and you have to switch it on yourself: **IndexNow**. When enabled, it sends the URL you just published, your host name and your IndexNow key to `api.indexnow.org`. Nothing else, ever. While it is off, which is how it ships, no hook is even registered. The weekly report is an email your own WordPress sends to you, through the mail setup your site already has. It is not a call to us. Some features do load pages of _your own site_ over HTTP, to verify that your sitemap answers and your schema is really in the rendered HTML. Those requests go to your domain, not to us. That is the whole story, and you can verify it: grep the plugin for `wp_remote_` and read the nine call sites yourself: two are IndexNow, the seven others load a page of your own site. ### Is it GDPR compliant? The plugin sets no cookie, loads no third-party script and sends no personal data anywhere. The on-site content performance module counts views, reading time and scroll depth in your own database; visitor IP addresses are never stored, only hashed as a short-lived rate-limit key, and the module can be switched off. As always, GDPR compliance is a property of your whole site, not of one plugin, but this one gives you nothing to declare. ### Do I need an account to use it? No. Every feature described on this page runs locally. There is no sign-up, no key to paste, and no feature that stops working because a server somewhere is down. ### Does it guarantee I will rank better on Google? No, and be suspicious of any plugin that says otherwise. Ranking depends on your content, your market and factors nobody controls. What this plugin does is make sure the technical layer is correct and give you honest measurements. That is a prerequisite, not a promise. ### Does it work with WooCommerce? Yes. Product pages get Product, Offer and AggregateRating schema where the data genuinely exists, product categories are handled by the sitemap and the permalink options, and product rows in the posts list show an exempt state rather than an editorial score that would mean nothing for a product. ### Does it work with Elementor, Divi, Bricks, Oxygen or WPBakery? Yes. The plugin detects the builder and reads the rendered content rather than the raw `post_content`, so the scoring, the schema and the Markdown output all see the same text your visitors see. ### Does it work with caching plugins and CDNs? Yes. Everything on the front end is standard WordPress output, so it caches like the rest of your page. Redirects are evaluated early, on `template_redirect`. A full-page cache drop-in can still answer before WordPress loads any plugin, so clear your cache after adding a rule. The sitemap has its own disk cache. Nothing depends on a request reaching PHP uncached. ### Does it work on multisite? Yes. Each site keeps its own settings, redirects, sitemap and data. ### How do I add alt text to images in WordPress? Alt text is the sentence a screen reader announces and a search engine reads in place of the image. Hack The SEO fills in the missing ones automatically when you save a post, deriving the text from the file name, the post title or the focus keyword, and never overwriting alt text you wrote yourself. The audit screen lists every image still without one, so you can fix the ones that matter by hand. Images with no alt text are also one of the criteria of the on-page score. ### How do I noindex a page or post in WordPress? Open the Hack The SEO panel on any post, page or custom post type and switch on “ noindex”, and “nofollow” if you need it. The plugin outputs a single, correct robots meta tag and keeps that URL out of your XML sitemap. Whole archives (author, date, internal search) can be set to noindex from the settings. ### How do I add breadcrumbs to WordPress? Switch the Breadcrumbs module on first, then use the `[htsfree_breadcrumbs]` shortcode, the “Breadcrumbs” Gutenberg block, or the `htsfree_breadcrumbs()` PHP function in your theme. Hack The SEO builds the trail from your category hierarchy and outputs matching BreadcrumbList schema, so your breadcrumbs can appear directly in Google’s results. ### How do I set a canonical URL? Every post and page has a canonical field in the SEO panel. Leave it blank for the automatic self-referencing canonical, or enter a custom URL to consolidate duplicate content. The plugin detects conflicts and never outputs two canonical tags on the same page. ### Does the plugin write files on my server? Almost nothing. There is exactly one thing written to disk: the generated XML sitemap, cached under `wp-content/uploads/hts-cache/sitemaps/` so a cold request does not have to rebuild it in PHP. That is the complete list. In particular: * **No redirect is ever written to your `.htaccess`.** Redirects are served in PHP, on Apache, Nginx and LiteSpeed alike. The only time the file changes at all is when WordPress refreshes its own `# BEGIN WordPress` block: the plugin asks core for a rewrite refresh on activation, on update, and when you change a permalink option, exactly as Settings > Permalinks does. Nothing of ours is added to the file, and it is left alone entirely when it is not writable. * `robots.txt` is **not** written to disk. It is served virtually, through WordPress core’s own `robots_txt` filter. * `llms.txt` is **not** written to disk either. * Nothing is ever written outside `wp-content`. ### What happens to my data if I uninstall? By default, nothing is deleted. Your redirects, your 404 log, your metadata and your settings stay in the database; only transients and scheduled tasks are cleaned. This is deliberate: someone who uninstalls and reinstalls should not lose the 301s holding their site together. If you genuinely want everything gone, enable the “ delete my data on uninstall” option first. ### Why is part of the interface in French? It should not be any more. The plugin is developed in France and is fully internationalised; the interface follows your site language automatically. English, French, Spanish, German, Italian and Brazilian Portuguese ship with the plugin. Further translations are handled through translate.wordpress.org. If you still see French on an English site, tell us on the forum with the screen name: that is a string we missed. ### Is there a paid version? Yes, and it is a separate product. Everything on this page works in the free version, permanently, without an account. See the section below. ## Reviews ![](https://secure.gravatar.com/avatar/bcf1ebb3024399b5ba0264ef2bc69f9b75b981199ce09eb9843fc9bdc7c083b7? s=60&d=retro&r=g) ### 󠀁[Hack The SEO](https://wordpress.org/support/topic/hack-the-seo/)󠁿 [pifos999](https://profiles.wordpress.org/pifos999/) September 11, 2026 Je viens de tester ce nouveau module, je venais de Yoast. L’import a récupéré mes titres, descriptions et redirections sans rien casser. Ce qui m’a convaincu : le suivi des passages de GPTBot, ClaudeBot et Perplexity côté serveur aucun outil analytics ne me montrait ça. Seul bémol, l’interface est dense au premier abord. ![](https://secure.gravatar.com/avatar/0e7afecada48c40ca73093d652a3322df24216d776428f488654a2a4515bfb90? s=60&d=retro&r=g) ### 󠀁[all-in-one SEO extension](https://wordpress.org/support/topic/all-in-one-seo-extension/)󠁿 [remyc73](https://profiles.wordpress.org/remyc73/) September 4, 2026 1 reply Hack the SEO is a powerful all-in-one SEO extension for website owners looking to improve their organic visibility and grow traffic more efficiently. Easy to use, great value for money, and backed by a highly responsive team! [ Read all 2 reviews ](https://wordpress.org/support/plugin/hack-the-seo/reviews/) ## Contributors & Developers “Hack The SEO – AI Bot Tracker, GEO Score, JSON-LD Schema & Cannibalization” is open source software. The following people have contributed to this plugin. Contributors * [ Hack The SEO ](https://profiles.wordpress.org/hacktheseo/) [Translate “Hack The SEO – AI Bot Tracker, GEO Score, JSON-LD Schema & Cannibalization” into your language.](https://translate.wordpress.org/projects/wp-plugins/hack-the-seo) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/hack-the-seo/), check out the [SVN repository](https://plugins.svn.wordpress.org/hack-the-seo/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/hack-the-seo/) by [RSS](https://plugins.trac.wordpress.org/log/hack-the-seo/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.1.2 * Changed: the dashboard widget now draws the week. Seven bars, one per day, with the busiest crawler names underneath and the difference with the previous week. A day with no visit keeps a thin grey line rather than disappearing, because a missing column reads as missing data and not as a zero. Same figures as before, read in a second instead of a sentence. * Changed: the two notices about your other SEO plugin no longer describe a risk that this plugin prevents. They said your indexing settings, your canonicals and your redirects “would be lost” without an import, and asked you to import“ before uninstalling it”. Neither is true since 1.1.0: Hack The SEO steps aside wherever another SEO plugin is in charge, so nothing is lost and nothing has to be uninstalled. They now say what the import actually gives you, that your other plugin keeps running and is not modified, and that the import can be undone. * Changed: the reminder that appeared after a week no longer counts the days since detection. A number of days is not information, it is pressure, and the action it pushed towards is optional. #### 1.1.1 * Added: a dashboard widget, “AI crawlers this week”. Until now the plugin only existed inside its own menu: an administrator who did not open that menu never saw the product again after installing it. The widget shows how many times AI crawlers read the site over the last seven days, how that compares with the week before, and which crawlers came. It reads the log that is already in your database, adds no query to the front end, and carries no promotion. * Fix: the “Go Pro” link on the Plugins screen pointed at a page that returns 404. It is the one link the plugin shows outside its own menu, so every click on it was lost. It now points at the pricing page. * Fix: the notice that tells you your import is done and that you may keep both plugins was never displayed. It was written and translated, but the function that renders it was not attached to anything, and the condition governing the second half read a setting that no file in this plugin ever writes. Both are corrected, and the notice is confined to the plugin’s own screens and the Plugins screen. * Changed: the review request now reaches sites it could never reach before. It asked for a review after 50 AI crawler visits, 15 redirects or 10 pages scoring 80, thresholds a small site may take months to cross, so on a new install the invitation could simply never appear. A new step opens on the first AI crawler visit, for three weeks, and only after the numbered milestones have been checked, so it never replaces a sentence carrying a real figure. The invitation also waits seven days after installation, and it now offers the support forum to anyone for whom something is not working, without ever hiding the review link. * Added: the plugin records its installation date, once, at activation. Without it no rule of the form “and at least so many days after installing” could be written at all. * Fix: the description said that moving to the commercial version picks your data up exactly as it is. That is true of the work you do page by page, which is stored in shared keys, and it is not true of this plugin’s own settings, which are stored under their own names. The sentence now says which is which. #### 1.1.0 * Added: a read-only MCP server, at `/wp-json/htsfree/v1/mcp`. Claude Code, Claude Desktop and other MCP clients can read what the plugin measures: AI-crawler passages by page and over time, GEO, on-page and meta scores, the site-wide score distribution, the competing-pages report, redirects, the 404 log, llms.txt, the Markdown of a page, and the health check. Twelve abilities, and all twelve read: there is no write among them, and no setting that turns one on. It needs WordPress 6.9, where the Abilities API entered core; below that it does not register and nothing else changes. * Added: the plugin now runs next to Yoast SEO, Rank Math, All in One SEO and SEOPress. On activation it detects the SEO plugin already in place and stops emitting whatever that plugin handles (meta tags, canonical, schema, sitemap, breadcrumbs, robots, and hreflang when a multilingual plugin owns it), so nothing is output twice. It never deactivates the other plugin and never changes its settings. A Compatibility screen lists every overlap and lets you take back any module, one by one. The AI crawler log, the GEO score and the cannibalization report have no front-end output and work regardless. * Added: a weekly report by email. Once a week your own site sends its administrator a short message: how many times AI crawlers read the site and on how many pages, how many visitors arrived from an AI chat, which new broken links appeared, and how the site score moved. Nothing is sent on a week with nothing to report, every email carries a one-click unsubscribe link that works without logging in, and the report can be switched on or off from the AI visibility settings. It is sent by your own site through WordPress, so no third party is involved and no outbound call was added. * Added: an “AI connection” screen. One button creates the WordPress application password and prints the line to paste into your client. The screen lists the twelve abilities with the capability each one needs, shows which client connected and when, and keeps the last fifty calls with their duration. It records what was called, never the arguments and never the answers. * Added: the interface ships translated into French, Spanish, German, Italian and Brazilian Portuguese. Until now nothing loaded them: WordPress reads a plugin’s own catalogues only when the plugin points at them, and otherwise waits for a package from translate.wordpress.org, of which none exists yet for this plugin. Both halves are fixed. Your site language is followed automatically, with no account and no setting to change. An official package, the day it exists, takes precedence on its own. * Changed: every link leaving the plugin now goes through a single point, so it is possible to tell which screen sends people to the site and which one converts. The dashboard previously wrote tracking parameters onto an internal admin URL, where no measurement tool can ever read them; internal links now carry the originating screen instead, and the pricing page reads it back onto its outgoing links. * Added: a way to say what is missing or broken, from the footer of every plugin screen. You write your message, optionally attach a summary of your setup (versions and active modules, never your site address and never a key), copy it, and open the support forum. Nothing is sent from the plugin and nothing is stored: the text never reaches the server, so it is never altered and there is nothing to delete later. * Security: every MCP call is made by a signed-in WordPress user and checks a capability,` manage_options` for the site-wide readings and `edit_posts` for the four that concern a single page. An anonymous request cannot even list the tools. No ability returns unpublished or password-protected content, nor a visitor’s IP address, referrer or user agent. * Fix: the crawler report no longer lists a page that has been unpublished or password- protected since a crawler read it. Its rows stayed in the log, so its title could still appear. * Fix: the “Set up the connection” button in the settings, and the Pro link on the AI connection screen, navigate again. Both were rendered as buttons carrying a link, which does nothing. * Unchanged: the plugin still makes exactly the same nine outbound calls as before, and the bundled MCP library adds none. MCP is inbound: your client calls your site, and no third party is contacted. #### 1.0.25 * Fix: `Google-Extended` and `Applebot-Extended` have been removed from the AI crawler list. Neither is a crawler: Google documents that Google-Extended has no separate user agent string, and Apple documents that Applebot-Extended does not crawl web pages. Both were robots.txt tokens, so neither could ever have been detected. Apple is now tracked through its real crawler, `Applebot`. * Added: `Claude-User` and `Claude-SearchBot`, Anthropic’s current on-demand and search agents; `Perplexity-User`, Perplexity’s on-demand fetcher; and `Google- CloudVertexBot`. Eighteen user agents are now matched, up from thirteen. * Removed: `Gemini-Bot` and `CopilotBot`, which neither company publishes. Human visits arriving from Gemini and Copilot chats are still measured, through the referrer. #### 1.0.24 * Fix: updating from 1.0.22 or earlier no longer resets your settings. The rename migration ran after the modules had already written their defaults, so a module you had switched on could come back off. * Fix: the migration now keeps each setting’s autoload state instead of turning it off. WordPress 6.6 changed the wording stored in that column, and the check missed it, which added one database query per setting on every page. * Fix: `[hts_breadcrumbs]` and `[hts_sitemap]` written in older posts render again. They were renamed in 1.0.21 without rewriting existing content, so visitors saw the raw shortcode text. * Fix: the rename migration no longer runs when the commercial version is installed alongside. It shares the same setting names, and moving them emptied its data. * Changed: the breadcrumbs block is now registered as `htsfree/breadcrumbs`, and the remaining French labels and untranslatable strings are translated: “Table of contents”, “Breadcrumb”, “Home”, “Other AI”, and the sitemap screen messages. #### 1.0.23 * Changed: every option and transient the plugin owns now carries the `htsfree_` prefix, as the directory requires. Your settings are migrated automatically on update; per-post SEO data is untouched. * Fix: the Author URI now points to the wordpress.org profile, which answers in a second. The previous address took eleven, over the review tool’s timeout. For the full version history, see changelog.txt. ## Meta * Version **1.1.2** * Last updated **1 week ago** * Active installations **Fewer than 10** * WordPress version ** 5.9 or higher ** * Tested up to **7.1** * PHP version ** 7.4 or higher ** * Tags * [ChatGPT](https://wordpress.org/plugins/tags/chatgpt/)[geo](https://wordpress.org/plugins/tags/geo/) [JSON-LD](https://wordpress.org/plugins/tags/json-ld/)[noindex](https://wordpress.org/plugins/tags/noindex/) * [Advanced View](https://wordpress.org/plugins/hack-the-seo/advanced/) ## Ratings 5 out of 5 stars. * [ 2 5-star reviews ](https://wordpress.org/support/plugin/hack-the-seo/reviews/?filter=5) * [ 0 4-star reviews ](https://wordpress.org/support/plugin/hack-the-seo/reviews/?filter=4) * [ 0 3-star reviews ](https://wordpress.org/support/plugin/hack-the-seo/reviews/?filter=3) * [ 0 2-star reviews ](https://wordpress.org/support/plugin/hack-the-seo/reviews/?filter=2) * [ 0 1-star reviews ](https://wordpress.org/support/plugin/hack-the-seo/reviews/?filter=1) [Your review](https://wordpress.org/support/plugin/hack-the-seo/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/hack-the-seo/reviews/) ## Contributors * [ Hack The SEO ](https://profiles.wordpress.org/hacktheseo/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/hack-the-seo/)