=== SEOmatic AI: SEO Agent and AI Search ===
Contributors: seomatic42
Tags: redirects, 404, ai crawlers, indexnow, search console
Requires at least: 5.7
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.0.4
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Redirects, a 404 log, an AI crawler log, instant indexing and an SEO audit, free with no account. Connect to let SEOmatic agents fix what matters.

== Description ==

**Useful on day one, with no account.** SEOmatic AI works next to the SEO plugin you already use (Yoast SEO, Rank Math, All in One SEO or SEOPress). It never asks you to switch.

Free, no account, nothing sent anywhere:

* **Redirects and a 404 log.** Add 301, 302, 307 and 410 rules, see which missing pages visitors and crawlers actually hit, and fix them in one click. Steps aside automatically if Redirection or another redirect plugin is already in charge.
* **AI crawlers.** See which AI crawlers (GPTBot, ClaudeBot, PerplexityBot and others) read your site and which pages they take, and whether your robots.txt is quietly blocking AI search.
* **llms.txt.** An optional /llms.txt built from your own content, linked from your pages so AI tools can find it.
* **Instant indexing.** Tell Bing, Yandex, Naver and Seznam the moment you publish or update a post, through IndexNow. Off until you switch it on.
* **SEO audit.** Check every post and page for missing titles, descriptions, headings and more, on your own server.
* **Internal links.** Find internal-link opportunities across the posts you already have, and add a link in one click.
* **Business facts.** Publish the key facts about your business as structured data, so AI answers quote you instead of guessing. With Yoast SEO or Rank Math, the facts fill the gaps in the organization those plugins already describe (never overwriting them), so your home page keeps one entity.
* **Page templates.** Install ready-made comparison and integration page templates for Elementor with ACF fields, then create pages from them.
* **AI shopping (WooCommerce).** See which AI assistants read your products and whether each product has what an assistant needs before it can recommend it.
* **AI shopping feed (WooCommerce).** Publish your catalogue as a product feed in the format ChatGPT shopping reads (JSONL, plus CSV for other AI shopping programs): every product and variation with price, availability, brand, GTIN, images and category, rebuilt daily on your server in batches, so large stores are fine. You give the private link to the program; the plugin sends nothing. Off until you switch it on.

Every module can be switched off on the SEOmatic Home screen. A module that is off adds no code to your pages.

**With a free SEOmatic account:** your Search Console findings inside WordPress (posts losing traffic and queries one push from page one), the pages AI engines fetch and send visits from, suggested redirects for broken inbound links, and an AI answers card showing whether ChatGPT, Claude and Google's AI answers mention your site, what changed since the last check and which competitors they name instead. The Home screen walks you through setup with a short checklist: Search Console linked, publishing allowed, agents on.

**On a paid SEOmatic plan:** SEOmatic agents fix what your data says matters. They write SEO titles, descriptions, social previews, canonicals, schema and page builder text into the fields your SEO plugin already owns, so every fix stays on your site even if you stop using SEOmatic. Each change waits for your approval, listed on the SEOmatic > Approvals screen in WordPress, and can be undone. The work runs on SEOmatic's servers; nothing in this plugin is locked.

== External services ==

**Nothing is sent anywhere until you act.** The free modules run entirely on your own server. The plugin talks to two services, each only after a choice you make.

The AI shopping feed makes no outbound request at all: it writes files to your uploads folder, and an AI shopping program you applied to fetches them from the private link you gave it.

= SEOmatic (app.seomatic.ai), operated by SEOmatic, only after you press Connect =

Nothing is sent before the site is connected: either you press Connect, or this plugin takes over the key of a standalone SEOmatic plugin you had already connected on this site.

* **Connecting.** Your site's address is sent to create a one-time pairing, and you are taken to SEOmatic to sign in. SEOmatic then checks a public address on your own site (/wp-json/seomatic/v1/pair-check/...) to confirm the pairing started here, and the plugin receives a key, so you never copy one.
* **AI crawler and visit signals (on once you connect, one checkbox turns them off).** A visit from an AI crawler sends the crawler's user agent and the page path. A visitor arriving from an AI assistant sends the assistant's hostname and the landing path, never the rest of the referrer. Only if you switch it on (SEOmatic > Home), a search typed into your site's search box sends the query text and whether it found anything; searches that look like an email address, a phone number or an order number are never sent. On WooCommerce, an order from a shopper who first arrived from an AI assistant sends the assistant's name, the order total and the currency, never the customer or the items; a daily count of products missing an identifier, brand, image, price or description is sent as counts only. No IP address is ever sent, ordinary visitors are never logged, and query strings are stripped first.
* **Reporting a blocked crawler (once).** If robots.txt blocks AI crawlers, the blocked crawler names and the single responsible line are sent once, so SEOmatic can tell you.
* **Scoring a page.** When you press "Score this page", the page's public URL is sent; SEOmatic fetches that public page itself.
* **Search Console findings.** The plugin asks SEOmatic for your own workspace's findings (posts losing traffic, the queries a page is losing, AI-cited pages, link health) and caches them for six hours. They come from the Search Console property you connected in SEOmatic; the plugin never handles your Google credentials.
* **Account status, approvals and AI answers.** On SEOmatic screens, the plugin asks SEOmatic whether your Search Console and publishing are set up, which fixes wait for your approval, and the latest AI answers summary for your site. These are reads, cached for minutes, and send nothing about your site or visitors. Approving happens on SEOmatic's own page, signed in.
* **Asking a question.** The question text is sent only when you press send.
* **Business facts.** When you save, the facts you typed are sent to your workspace so SEOmatic can hold them as ground truth.
* **Redirects.** The redirect rules SEOmatic suggested for your site are requested, applied rules are confirmed, and once a day, if 404 logging is on, a map of missing paths with their source class (linked, search or direct) and hit counts is sent. Never a referring URL or a visitor.
* **Search Console key exchange.** If you connected Search Console from the SEO audit screen, the plugin trades that one-time grant, your domain and your site address for a key, retrying every 10 minutes for up to 8 days until SEOmatic is ready.
* **Freshness pings (only if you paste a webhook URL).** On the SEO audit screen you can paste your SEOmatic content webhook; each time a public post is saved, its post ID and the event name are sent to it, so SEOmatic rechecks that page.
* **Internal link health.** After a scan on the Internal links screen, the number of pages scanned and their internal-link counts are sent, so your dashboard can track link health over time.
* **Instant indexing key.** Once the site is connected, your IndexNow key and key-file address are shared, so SEOmatic can notify the engines about pages it fixes.
* **Connecting from SEOmatic (1.0.4).** If you already connected this site in SEOmatic (it holds an Application Password you approved), SEOmatic can finish connecting this plugin for you: it hands the plugin a key over that connection, and the plugin checks the key once with app.seomatic.ai (sending the key and your site's address) before keeping it. Only SEOmatic's own Application Password can do this, never a visitor or another application; it never replaces a connection you made, and after you press Disconnect it does not happen again until you connect.
* **Disconnecting.** The key is revoked on SEOmatic. Uninstalling with "Delete all SEOmatic data when uninstalling" ticked revokes it too; otherwise the key is kept so reinstalling reconnects.

SEOmatic also calls this site's REST API (/wp-json/seomatic/v1/ and /wp-json/seomatic-redirects/v1/), signed in with an Application Password, to read status and to write changes you approved there. When you connect your site in SEOmatic, this plugin asks an administrator to approve, then issues that password for a dedicated "SEOmatic Agent" user it creates, never for the administrator. That user can only edit posts, pages, products, media and terms and use this plugin's SEO routes; it cannot install or update plugins or themes, manage users, change settings, add raw HTML or sign in to wp-admin. Every SEOmatic Application Password is also fenced by this plugin to those routes, even if it were leaked. Removing the plugin revokes the agent user's passwords. This plugin sends nothing for that.

With Agent changes on, SEOmatic can also send a short list of exact corrections for structured data (JSON-LD) your theme or a header-code box prints, for example a logo address that no longer opens or a phone number your site does not show. The plugin applies only those exact values inside JSON-LD blocks it did not print, as each page is served; each new value must be an address on this site or a phone number. Your theme settings are never changed, and switching Agent changes off (or deactivating the plugin) shows the original markup again at once.

No page content and no visitor personal data is ever sent. SEOmatic's [Terms](https://seomatic.ai/terms) and [Privacy Policy](https://seomatic.ai/privacy) apply to the connected service.

= IndexNow (api.indexnow.org), operated by Microsoft for the participating engines, only after you switch submissions on =

When you publish, update or unpublish a post, your site's hostname, your IndexNow key, the key-file URL and the changed URLs are sent to api.indexnow.org, which forwards them to Bing, Yandex, Naver and Seznam. No page content and nothing about your visitors. See the [IndexNow documentation](https://www.indexnow.org/documentation) and Microsoft's [privacy statement](https://privacy.microsoft.com/privacystatement).

== Installation ==

1. Install and activate SEOmatic AI.
2. Open **SEOmatic** in the admin menu. The free modules already work.
3. Optional: press **Connect SEOmatic** for Search Console findings and, on a paid plan, agents.

If you used one of the standalone SEOmatic plugins (SEOmatic Redirects, SEO Writer, AI Visibility and others), deactivate it after activating SEOmatic AI. Its settings and data carry over.

== Frequently Asked Questions ==

= Do I need an account? =

No. Redirects, the 404 log, the AI crawler log, llms.txt, instant indexing, the SEO audit, internal links, business facts, the WooCommerce checks and the AI shopping feed all work without one.

= How do I get my products into ChatGPT shopping? =

On AI Shopping, switch on "Publish my product feed", then apply at chatgpt.com/merchants and give OpenAI the feed link (or upload the file where they ask). Acceptance is up to OpenAI, and the same goes for any other program you give the link to. ChatGPT stopped in-chat checkout in 2026, so products appear in answers through feeds and shoppers buy on your store. The page counts the products missing a brand, GTIN or MPN, image, price or description, the fields the OpenAI feed spec asks for.

= Will it conflict with Yoast SEO, Rank Math, All in One SEO or SEOPress? =

No. It works alongside them, and agent changes are written into their own fields.

= Will it conflict with Redirection or another redirect plugin? =

No. If another redirect plugin is active, SEOmatic AI stops routing and only shows its rules and suggestions.

= Can SEOmatic change my site without asking? =

No. Agents propose changes, and each one waits for your approval. You see them under SEOmatic > Approvals, and approving opens the exact change in SEOmatic before it goes live. Every change can be undone.

= My agency manages my SEO. Will I see SEOmatic? =

If your agency resells SEOmatic under its own name, the plugin shows the agency's name and links to its client portal instead.

= What happens to my fixes if I stop using SEOmatic? =

They stay. Fixes are written into your posts and your SEO plugin's fields, not injected by a script, so they keep working after you cancel. The free modules keep working too.

= What happens when I uninstall? =

By default your data stays (redirect rules, logs, facts and settings), so reinstalling loses nothing. Fixes written into your posts and your SEO plugin's fields always stay. What the plugin serves itself (redirects, llms.txt, structured data corrections, and the SEO tags it prints on a site with no SEO plugin) stops while it is not installed. Tick "Delete all SEOmatic data when uninstalling" on the Home screen to remove everything it stored, including the AI shopping feed files. On a multisite network, each site follows its own setting.

= Will it slow my site down? =

No. Front-end work is limited to redirects, the optional llms.txt, a lightweight check for AI crawler visits and, only when SEOmatic sent structured data corrections, one pass over the page's JSON-LD blocks. Admin pages load only on SEOmatic screens.

= Does it work with page caching? =

Yes. Redirects and llms.txt work behind any page cache. AI crawler counts, 404 logging and AI referral counts only see requests that reach WordPress, so a full-page cache (a caching plugin, your host's cache or a CDN) serves many visits without WordPress knowing, and those numbers come out lower than the real traffic. If you want fuller counts, exclude AI bot user agents (GPTBot, ClaudeBot, PerplexityBot and similar) from your page cache; most caching plugins and hosts have a "never cache user agents" setting.

== Changelog ==

= 1.0.4 =
* New: structured data repair. SEOmatic can send exact corrections for JSON-LD your theme or a header-code box prints (a logo or image address that no longer opens, your site address without the www your site uses, a phone number your site does not show, a page address that moved). The plugin applies only those values inside JSON-LD blocks it did not print, as each page is served, and never changes your theme settings. Corrections must point at this site or be a phone number. Part of Agent changes: switching it off shows the original markup again.
* New: if this site is already connected in SEOmatic, SEOmatic can finish connecting the plugin itself over that connection. The plugin checks the key with SEOmatic first, accepts it only from SEOmatic's own Application Password, never replaces a connection you made, and stops after you press Disconnect.
* The SEOmatic Agent role can edit public custom post types that use their own capabilities (for example a "location" type), never a type mapped to an administrator capability.
* The REST fence now lets SEOmatic's password reach exactly the requests its agents send to WordPress abilities (Yoast SEO, Rank Math and Elementor), to the Redirection plugin (only redirects SEOmatic added) and to SiteGround Optimizer's cache purge, and nothing around them.
* "Delete all SEOmatic data when uninstalling" also removes the structured data corrections and the automatic connection setting.

= 1.0.3 =
* Security: SEOmatic now connects as its own limited "SEOmatic Agent" user, never as the administrator who approves. The connect screen explains what it can and cannot do; the password is issued for that user only, and every approval resets it to the SEOmatic Agent role.
* Security: SEOmatic's Application Password can no longer install, activate, update or remove any plugin, including this one.
* Uninstalling revokes the SEOmatic Agent user's Application Passwords and removes its role.
* Hosts that remove the Authorization header before PHP (common on shared hosting) no longer block the Application Password: on REST API requests only, and only when no credentials reached PHP, the plugin reads the same Basic credentials from the X-SEOmatic-Authorization header. WordPress core still checks the password as usual.

= 1.0.2 =
* Hardening from the WordPress.org review: request values are sanitised where they are read, admin output is escaped, two on/off settings now store a real boolean (an unticked box no longer reads as on), the Search Console grant route checks its single-use nonce in its permission callback, and the Plugin URI points at a live page.

= 1.0.1 =
* Security: the Application Password SEOmatic connects with is fenced to SEO content routes (posts, pages, media, terms, SEOmatic's own routes, keeping this plugin installed); it can no longer create users, install other plugins, change settings or create Application Passwords. Lift with the SEOMATIC_DISABLE_REST_FENCE constant; extend with the seomatic_rest_allowlist filter. The last refused request is shown on the Home screen.
* Security: new "SEOmatic Agent" role with the capabilities the agents need and nothing more; SEOmatic's site-level routes accept it instead of an administrator.
* Security: redirects applied from SEOmatic must point at this site (or a host you allow in Redirects and 404s > Settings) and are capped at 200 a day; a redirect to another site added by hand needs a tick on the form.
* Security: the Search Console connect handoff uses a fresh single-use nonce per click, bound to the administrator who clicked, valid 10 minutes; the delivery must name this site and cannot replace an existing grant unless you clicked Reconnect.
* Security: Elementor layouts written by a connection without unfiltered_html, or by the fenced SEOmatic connection, have their HTML widgets filtered through wp_kses_post; canonical URLs must be absolute http(s) URLs.
* Fixed: the IndexNow key file rule now matches only the key's file name instead of every root .txt file.
* Removed: the unused /seomatic/v1/acf-field-key route.

= 1.0.0 =
* First release: the SEOmatic redirect manager, SEO Writer, AI Visibility, Instant Indexing, SEO audit, internal link finder, business facts, content decay, AI-cited pages and AI shopping plugins, together in one plugin with one connection and module switches. Adds the Home setup checklist, the Approvals screen, the AI answers card, the WooCommerce AI shopping feed, llms.txt discovery and business facts merged into Yoast SEO and Rank Math.
