Description

YUJI AI SEO Suite generates SEO candidates for eligible public WordPress content and lets authorized users review current values, candidates, destinations, and possible effects before applying changes.

The plugin is fully functional without a paid license, trial period, quota, feature unlock, or upgrade key. Its generic singular-content workflow is available to public post types that are shown in the WordPress administration UI, are viewable on the public site under WordPress rules, and support titles. Standard posts and pages normally meet these conditions. Product entries and other custom post types may also be eligible when they meet the same conditions.

Eligibility means that the plugin can apply its generic WordPress content and metadata workflow. It does not imply complete compatibility with every custom post type, editor, storage model, or third-party plugin. In particular, the plugin does not add WooCommerce-specific product fields, commerce logic, price or availability metadata, or Product structured data.

Main features:

SEO titles, meta descriptions, focus keywords, and related keywords
Excerpts and taxonomy-term suggestions where the content type exposes a public tag-like taxonomy
Social titles and descriptions
Featured-image ALT overrides scoped to the selected content item
Related-content and contextual internal-link suggestions
Single-item and WP-Cron-based bulk optimization
Theme/plugin conflict detection and public-HTML diagnosis
Impact explanations and server-validated confirmation checks
Repair, history, rollback, and supported cache invalidation
Single-plugin direct OpenAI connection with encrypted local API-key storage and configuration-file/environment alternatives

The plugin is not tied to one theme. It inspects actual public HTML and chooses a standard WordPress output path, a narrowly scoped recognized adapter whose output is validated on the current site, or candidate-generation-only mode. If duplicate tags, an existing SEO owner, or an unreachable public-page probe is detected, the plugin does not start its public output and shows the reason. The plugin does not silently disable other plugins or guess unknown theme settings.

Normal SEO operations do not rewrite the saved body content (post_content), Gutenberg blocks, the WordPress title/H1, permalink, theme, CSS, layout, image files, or the activation state of other plugins. If selected, the standard WordPress excerpt may be updated and new tag-like taxonomy terms may be appended; existing terms are not removed. The separate advanced HTML-repair feature can change saved body content only after diagnosis, a visible diff, a backup, and explicit confirmation.

Administration language

The administration interface follows the current WordPress administration locale. English is the source language. Translations are delivered through WordPress.org language packs. If a translation is unavailable, WordPress displays the English source strings.

The plugin ZIP does not bundle PO, MO, POT, or translation JSON files and does not call load_plugin_textdomain(), in accordance with WordPress.org translation distribution.

External Service

This plugin requires WordPress 7.0 or later and intentionally provides a direct OpenAI integration so the AI-assisted SEO workflow can be configured and used within this single plugin. No separate AI-provider plugin is required. The WordPress site sends requests directly to the OpenAI API; the plugin author does not operate a proxy, licensing server, telemetry service, analytics endpoint, or API-key collection endpoint.

OpenAI is contacted only after an authorized administrator has saved the current external-service and API-key confirmation and an authorized WordPress user explicitly requests model retrieval, a production-format compatibility test, AI candidate generation, or bulk optimization. A user-started bulk job may continue through WP-Cron after that explicit request. OpenAI performs substantive remote AI processing; the service is not used for licensing, payment verification, or unlocking local plugin functionality.

Service: OpenAI API

Data sent during AI candidate generation may include:

Site name and locale
Target content title, plain text extracted from the saved body, headings, excerpt, taxonomy names, and existing SEO values
Existing site tag-like term names used as candidate context
Featured-image filename, media title, caption, description, and current ALT; the image file itself is not sent
Titles and short excerpts of candidate internal-link content
Selected model, output language, and site-specific instructions

Model-list retrieval sends the API key and ordinary HTTPS request metadata but does not send post content or a test prompt. The production-format compatibility test sends a small neutral test prompt and model/output settings, not the selected post body. Candidate generation sends the content categories listed above.

API-key storage and security

When an OpenAI API key is saved through this plugin’s Settings screen:

The key can be saved only when the WordPress administration request is detected as HTTPS. It is then encrypted and stored in the database used by that WordPress site, as part of the yaiss_settings option.
The settings option is explicitly marked not to autoload.
Encryption uses Sodium secretbox when available, otherwise AES-256-GCM through OpenSSL. The encryption key is derived from the WordPress installation’s authentication salts.
The full saved key is not displayed again. Only a masked indicator is shown to authorized administrators.
The plugin does not intentionally include the full key in public HTML, localized JavaScript configuration, telemetry, analytics, advertising, or plugin-generated logs.
The key is decrypted in server memory only when required and is sent directly from the user’s WordPress server to api.openai.com over HTTPS in the Authorization header.
The plugin author does not receive, collect, or store the key.

A server administrator may instead define YAISS_OPENAI_API_KEY in wp-config.php or provide the OPENAI_API_KEY environment variable. An externally managed key takes precedence and is not copied into the WordPress database by this plugin. If an older database-saved key already exists, it remains stored but unused until an administrator explicitly deletes it in Settings or opts into data removal during uninstall. The Settings screen warns about that stored copy.

Encryption reduces exposure if the database alone is accessed. It cannot guarantee protection if the WordPress installation, hosting account, administrator account, wp-config.php, database, backups, server process, or another installed component is compromised. The site owner is responsible for restricting administrative and hosting access, protecting configuration files and backups, keeping WordPress and installed components updated, monitoring OpenAI usage and charges, setting suitable OpenAI project limits and key permissions, and rotating or revoking a key when compromise is suspected.

The plugin does not claim that an API key can never be exposed. It documents the storage and transmission path and avoids sending the key to the plugin author’s systems, but the plugin author cannot administer or guarantee the security of each user’s WordPress site, server, accounts, database, backups, or OpenAI account. If WordPress authentication salts change, an existing encrypted database key may no longer be decryptable; the plugin reports that condition and requires deletion and re-entry rather than silently treating the key as valid.

The plugin does not send themes, CSS, the full database, WordPress passwords, or image binaries to OpenAI. Site owners are responsible for ensuring that content submitted to OpenAI may lawfully be transmitted and does not contain information they are not authorized to share.

Local data retention and removal

A database-saved API key remains until an administrator deletes it in Settings or the plugin is uninstalled with “Delete plugin data on uninstall” enabled. Deactivation alone does not remove it.
Generated candidates, current selections, histories, repair backups, compatibility data, and background-job records may be stored in WordPress options or post metadata until replaced, deleted through plugin controls, or removed during an opted-in uninstall.
The plugin does not control OpenAI-side retention. OpenAI processing and retention depend on the site owner’s OpenAI account settings and applicable OpenAI agreements.
Ordinary HTTPS requests disclose technical connection data to OpenAI, including the site server IP address, request time, and a User-Agent identifying the plugin and WordPress versions.

OpenAI terms, privacy, data, security, and pricing information:

OpenAI Services Agreement (applicable business/API terms): https://openai.com/policies/services-agreement/
OpenAI Terms of Use (general terms page): https://openai.com/policies/terms-of-use/
OpenAI Privacy Policy: https://openai.com/policies/privacy-policy/
OpenAI Service Terms: https://openai.com/policies/service-terms/
OpenAI Usage Policies: https://openai.com/policies/usage-policies/
OpenAI Enterprise Privacy: https://openai.com/enterprise-privacy/
OpenAI Data Processing Addendum: https://openai.com/policies/data-processing-addendum/
OpenAI API pricing: https://openai.com/api/pricing/
OpenAI API-key safety guidance: https://help.openai.com/en/articles/5112595-best-practices-for-api-key-safety

OpenAI states that its general Privacy Policy does not apply to content processed on behalf of API customers; that content is governed by the applicable customer agreements. The Privacy Policy is linked for OpenAI’s general personal-data practices, while the Services Agreement, Service Terms, Enterprise Privacy information, and Data Processing Addendum provide the API/business context.

OpenAI API usage may incur charges under the user’s OpenAI account. The plugin author does not collect those charges. The external-service and API-key confirmation must be saved before this plugin initiates an OpenAI request. If this disclosure is materially revised in a future release, confirmation is required again.

Source Code

All PHP, CSS, and JavaScript distributed with this plugin is GPL-compatible and human-readable.

JavaScript source-to-runtime mapping:

src/js/admin-v5.js -> assets/admin-v5.js
src/js/admin-legacy.js -> assets/admin-legacy.js

The JavaScript under src/js/ is the editable source. Each corresponding file under assets/ is an exact, byte-for-byte copy used by WordPress at runtime. The JavaScript is not transformed, minified, compressed, transpiled, bundled, obfuscated, or generated by npm, webpack, or any other build system. No package manager or build dependency is required.

POSIX reproduction and verification, run from the plugin directory:

cp src/js/admin-v5.js assets/admin-v5.js
cp src/js/admin-legacy.js assets/admin-legacy.js
cmp src/js/admin-v5.js assets/admin-v5.js
cmp src/js/admin-legacy.js assets/admin-legacy.js
sha256sum src/js/admin-v5.js assets/admin-v5.js src/js/admin-legacy.js assets/admin-legacy.js

PowerShell reproduction and verification, run from the plugin directory:

Copy-Item -LiteralPath src/js/admin-v5.js -Destination assets/admin-v5.js
Copy-Item -LiteralPath src/js/admin-legacy.js -Destination assets/admin-legacy.js
(Get-FileHash src/js/admin-v5.js -Algorithm SHA256).Hash -eq (Get-FileHash assets/admin-v5.js -Algorithm SHA256).Hash
(Get-FileHash src/js/admin-legacy.js -Algorithm SHA256).Hash -eq (Get-FileHash assets/admin-legacy.js -Algorithm SHA256).Hash
Get-FileHash src/js/admin-v5.js,assets/admin-v5.js,src/js/admin-legacy.js,assets/admin-legacy.js -Algorithm SHA256

Known SHA-256 values for this release:

admin-v5.js source and runtime: f29c13929d138a88696d02fdc051256dcea6f2ab64e51fe3111647cd0f67d06e
admin-legacy.js source and runtime: 80653bd81c0204edd95adc7bebaf43d55fd6a9291c9dfedc66e062dd73cd7e99

The CSS files in assets/, including admin-v5.css and frontend.css, are directly edited, human-readable runtime source files. They are not generated build artifacts and have no separate preprocessor source or build step.

Languages

The plugin uses English source strings and WordPress internationalization functions. Translations are distributed through translate.wordpress.org and the normal WordPress language-pack system. Translation .po and .mo files are not bundled in the plugin ZIP.

AI-generated SEO content can follow the WordPress site language or be generated in Japanese, English, Simplified Chinese, Traditional Chinese, or Korean. AI output language is independent of administration-screen translation.

Administration Flow

The main administration navigation is limited to five task-oriented screens: Dashboard, Optimize one item, Bulk optimization, Diagnostics and restore, and Settings. The Dashboard shows required, recommended, optional, and first-use actions in dependency order.

Settings follow the same order and use independent save boundaries: OpenAI connection, SEO publishing, AI generation, Related content, and Advanced/data removal. OpenAI connection has four required steps: save an API key, save the external-service confirmation, retrieve and deliberately select and save a model, and run the production-format compatibility test. Blocked actions explain the missing requirement and link directly to it.

Privacy

The plugin does not include analytics, advertising tracking, telemetry, a developer-operated API proxy, or an API-key collection endpoint. It communicates with OpenAI only after the current external-service/API-key confirmation has been saved and an authorized user requests an API operation or starts a bulk job that continues through WP-Cron. When saved through Settings, the encrypted API key remains in the database used by the user’s WordPress site; it is not sent to the plugin author. The data categories, storage path, security limits, site-owner responsibilities, and policy links are disclosed in the External Service section above. WordPress also receives suggested privacy-policy text from the plugin so a site owner can adapt it to the site’s actual use and legal requirements. The suggested text is informational, is not legal advice, and does not guarantee compliance with any law or policy.

Known Limitations

Eligibility for the generic workflow does not guarantee compatibility with every custom post type, editor, custom-field framework, or third-party storage model.
WooCommerce product posts are not provided with WooCommerce-specific fields, price or availability metadata, commerce logic, or Product structured data.
Attachments, archive URLs, and non-public post types are not managed.
Multisite is not formally supported.
Automatic public-page diagnosis can fail when loopback requests are blocked or protected by authentication.
MU plugins, server/CDN injection, JavaScript-added tags, and conditionally emitted tags may not be fully detectable.
Unsupported theme/plugin storage fields are not guessed or overwritten.
OpenAI models, pricing, permissions, rate limits, policies, and API behavior can change.
Search ranking, impressions, click-through rate, and sales are not guaranteed.

Installation

Upload the plugin ZIP from Plugins > Add New Plugin > Upload Plugin, then activate it.
Open YUJI AI SEO > Dashboard and follow the required setup link.
In Settings > OpenAI connection, review API-key handling, save the API key and external-service confirmation, retrieve and save a model, and run the production-format compatibility test.
In Settings > SEO publishing, review the detected environment, possible effects, safety checks, and publishing method.
In Optimize one item, test candidate generation, selective application, public output, and restore on one non-critical content item.
Use Bulk optimization only after the single-item workflow is confirmed. Use Diagnostics and restore for site diagnosis, limited content-display checks, repair, and rollback.

FAQ

Is a paid ChatGPT plan enough?: No. The OpenAI API is a separate service. You need an OpenAI API key and API billing configuration.
Where is my OpenAI API key stored?: When saved through the plugin Settings screen, it is encrypted and stored in the database used by your WordPress site, inside the non-autoloaded yaiss_settings option. It is not sent to or stored on a server operated by the plugin author. A wp-config.php constant or server environment variable can be used instead, in which case the plugin does not copy that external key into the database. Review the External Service section for security limits and site-owner responsibilities.
Which content types are eligible?: The generic workflow applies to post types that are public, shown in the WordPress administration UI, viewable on the public site under WordPress rules, and support titles. Standard posts and pages normally qualify. A product or custom post type may qualify under the same rules, but eligibility does not guarantee compatibility with custom fields, nonstandard editors, or plugin-specific storage.
Does it provide complete WooCommerce SEO support?: No. An eligible WooCommerce product post can use the plugin’s generic title, description, social metadata, taxonomy, internal-link, and related-content workflows where the required WordPress data is available. The plugin does not add WooCommerce-specific product fields, price or availability metadata, commerce logic, or Product structured data.
Does it guarantee complete compatibility with Cocoon or another theme?: No. The plugin may use a narrowly scoped environment-specific adapter for recognized hooks and storage fields, but only after public-HTML checks on the current site. This does not guarantee compatibility with every theme version, child theme, setting, extension, or customization. If the required output cannot be validated on the current site, the plugin falls back to candidate generation only.
Does the plugin change content or design?: Normal SEO optimization does not rewrite the saved body content or design. If selected, it can update the standard WordPress excerpt and append new tag-like taxonomy terms without removing existing terms. The separate advanced HTML-repair feature can change saved body content only after diagnosis, a visible comparison, a backup, and explicit confirmation.
Can it coexist with other SEO plugins and themes?: It can generate candidates and diagnose the environment. Public output starts only when ownership and duplicate checks pass. Unknown settings are not changed by assumption. Compatibility with every third-party storage model or injected output cannot be guaranteed.
Does choosing public SEO management modify all existing content?: No. Existing theme SEO fields are not bulk-synchronized merely by choosing a management mode. Bulk repair is a separate operation with scope, history, cache handling, checkboxes, and final confirmation.
Can changes be restored?: Supported repair and management operations create history records. Restore rechecks the current environment and values before applying the saved state.
Can I close the page during bulk processing?: The job can continue when WP-Cron works normally. Low-traffic sites, DISABLE_WP_CRON, or hosting restrictions can delay or stop background processing.

Reviews

There are no reviews for this plugin.

Contributors & Developers

“YUJI AI SEO Suite” is open source software. The following people have contributed to this plugin.

yujihosaka

Translate “YUJI AI SEO Suite” into your language.

Interested in development?

Browse the code, check out the SVN repository, or subscribe to the development log by RSS.

Changelog

7.1.7

Changed public HTML probes to use short-lived, site- and target-bound HMAC tokens sent only in a dedicated HTTP header.
Added atomic one-time probe claims, replay prevention, expiry cleanup, and normal-page fallback for every invalid probe.
Centralized AJAX nonce and capability checks before business input and standardized access-error JSON responses.
Expanded source/runtime reproduction documentation with POSIX and PowerShell commands and release hashes.

7.1.6

Reorganized the administration interface into five task-oriented top-level screens with stable URLs and a dependency-based Dashboard.
Split Settings into OpenAI connection, SEO publishing, AI generation, Related content, and Advanced/data removal forms with independent save boundaries.
Added local save actions for the required OpenAI confirmation and selected model, and require a deliberate model choice before testing.
Moved limited stored-content display diagnosis into Diagnostics and restore instead of mixing it with daily optimization.
Changed bulk optimization to a conservative SEO-only initial preset; broader fields require explicit selection.
Preserved all prior nonce, capability, eligible-content, source-code, translation, and external-service review fixes and re-ran package tests.
Kept the WordPress.org readme in English and aligned installation instructions with the current Dashboard and Settings routes.

7.1.5

Reorganized initial OpenAI setup into a visible four-step sequence: save API key, save external-service confirmation, retrieve and save a model, and run the compatibility test.
Moved the required external-service confirmation directly below the API-key field and added an immediate setup save button.
Added setup progress indicators and direct navigation from blocked model retrieval to the exact missing requirement.
Collapsed detailed API-key storage and policy references so the required setup controls remain visible without removing disclosures.
Added dynamic explanations for unsaved API keys, unsaved confirmations, and unsaved model selections.

7.1.4

Made AJAX nonce and capability enforcement explicit before all request parsing so static analysis and manual review see the same security boundary.
Replaced the recovery OR meta query with simpler meta-key queries while preserving the same eligible-content results.
Corrected eligible-content detection so WordPress built-in pages are included through the standard is_post_type_viewable() rule.
Re-ran syntax, package-integrity, source-equivalence, and security-oriented static and runtime checks.

7.1.3

Removed the Plugin URI and in-product links to an external documentation page that had not yet been updated to the current eligible-public-content scope.
Rechecked the package against the prior review categories without changing the WordPress 7-only feature set, direct OpenAI setup, security controls, privacy disclosures, or WordPress.org language-pack integration.

7.1.2

Made PHP and JavaScript administration strings parser-compatible with the WordPress.org translation system.
The administration interface now follows the WordPress user/site locale when a WordPress.org language pack is available.
Kept all translation files outside the submission ZIP, as required by the prior WordPress.org review.
Retained the complete 7.1.1 feature, security, privacy, and single-plugin OpenAI setup.

7.1.1

Requires WordPress 7.0 or later while retaining a single-plugin direct OpenAI integration; no provider add-on is required.
Requires HTTPS before a database-managed API key can be saved, while retaining wp-config.php and environment-variable alternatives.
Detects unreadable encrypted keys after security-salt changes, warns about unused database copies when an external key is active, and redacts likely API-key material from OpenAI/HTTP error messages.
Clarifies local retention, deletion, OpenAI-side retention limits, technical request metadata, model-list retrieval, test prompts, and uninstall behavior.
Added prominent API-key storage, transmission, security-limit, and site-owner responsibility disclosures in Settings, Help, readme, and suggested privacy-policy text.
Requires the current external-service/API-key confirmation before model retrieval, connection testing, candidate generation, or bulk processing contacts OpenAI.
Model retrieval no longer accepts or sends an unsaved key from the browser; the key must first be saved locally or managed through wp-config.php or OPENAI_API_KEY.
Enforced non-autoloaded storage for the plugin settings option.
Retained the eligible-content, nonce/capability, source-code, translation, diagnosis, repair, rollback, and bulk-processing improvements from 6.5.x.

6.5.1

Clarified that product and custom post types use the generic eligible-post-type workflow and are not claimed as fully supported third-party integrations.
Added explicit OpenAI Terms of Use, Privacy Policy, Services Agreement, Service Terms, Enterprise Privacy, Data Processing Addendum, usage-policy, and pricing links, with the API/customer-agreement distinction stated accurately.
Improved external-service consent and WordPress privacy-policy guidance without removing or restricting existing features.

6.5.0

Expanded the generic SEO generation and management workflow from standard posts to eligible public post types without paid feature gating.
Added centralized content-type discovery and taxonomy handling.
Added explicit nonce and capability checks before every AJAX or administrative state-changing request.
Removed bundled translation files and the manual PHP text-domain loader; translations now use WordPress.org language packs.
Included readable JavaScript source counterparts and documented the no-build reproduction process.
Updated public-output, diagnosis, bulk-processing, repair, and rollback workflows for eligible content types.

6.4.4

Resolved Plugin Check translator-comment, input-handling, output-escaping, readme, and packaging findings.

Older changes are documented in CHANGELOG.md included with the plugin.

Description

Administration language

External Service

API-key storage and security

Local data retention and removal

Source Code

Languages

Administration Flow

Privacy

Known Limitations

Installation

FAQ

Is a paid ChatGPT plan enough?

Where is my OpenAI API key stored?

Which content types are eligible?

Does it provide complete WooCommerce SEO support?

Does it guarantee complete compatibility with Cocoon or another theme?

Does the plugin change content or design?

Can it coexist with other SEO plugins and themes?

Does choosing public SEO management modify all existing content?

Can changes be restored?

Can I close the page during bulk processing?