Index Harmony

Install → run the setup wizard → done. No key, no account, no paid tier: every module and every measurement screen in this plugin is free and fully usable.

Index Harmony prepares your WordPress site for AI assistants, answer engines and their crawlers (ChatGPT, Claude, Perplexity, Gemini and others) without touching your files or content — and then shows you what actually happened. Every fix is virtual and reversible: turn a module off and it disappears without a trace.

What makes it different: most plugins in this space stop at generating llms.txt. Index Harmony pairs the output side with a first-party measurement side that no search-console integration can see: its own AI-bot traffic log with cryptographic-grade bot verification (official vendor IP lists), daily per-page counters, a per-page evidence panel showing which engine fetched which page on demand, a crawl-freshness funnel, an attention-decay radar, recovery for 404 URLs that assistants invent, a change log that marks every GEO-affecting setting change on your traffic chart, plus an agent-facing Site MCP endpoint and WordPress Abilities/WebMCP surfaces. llms.txt is one of its 18 modules, not the product.

All 18 fix modules (free, no key needed):

• llms.txt + llms-full.txt (virtual endpoints, refreshed daily; hand-pick the highlighted pages or edit the file body yourself)
• AI bot manager for robots.txt (explicit allow rules for 24 AI bots; your existing rules are kept intact)
• JSON-LD schema injector (Organization / WebSite / Article / FAQ / Breadcrumb / Product) — defers to Yoast, Rank Math, AIOSEO and SEOPress to avoid duplicates
• Meta completer (description / Open Graph / Twitter — only when no SEO plugin handles it)
• WordPress core sitemap enablement + robots.txt declaration
• /.well-known/security.txt
• WooCommerce product feed + Product schema completeness
• hreflang auditor (reports only — it never writes a file and never emits an hreflang tag)
• /AGENTS.md — a site usage guide for agents (virtual)
• Markdown negotiation (Accept: text/markdown or ?format=md)
• .well-known discovery endpoints (api-catalog RFC 9727; mcp.json and agent-skills only when configured — no fake manifests)
• Agent-discovery Link headers + robots.txt Content-Signal declaration
• AI bot traffic log (which bot visited when)
• AI policy publishing (ai.txt + TDMRep + Content-Signal header)
• Security headers — six optional response headers (X-Content-Type-Options, Referrer-Policy, Permissions-Policy, HSTS, CSP-Report-Only, X-Frame-Options); all off by default and picked one by one under Settings → Advanced
• IndexNow instant indexing (Bing/Yandex/Seznam/Naver — opt-in)
• WebMCP (in-browser agent surface for your site’s public information)
• AI traffic share (opt-in daily channel counters)

Measurement & insights:

• Bot traffic dashboard — a 30-day chart and per-bot breakdown of AI crawler visits
• Bot verification (opt-in) — once enabled, downloads public bot IP lists once a day to flag spoofed bots; no visitor data leaves your site
• Bot blocking & spike alerts (opt-in) — pick the bots to watch, then turn blocking on whenever you decide to, behind an explicit confirmation; the panel recommends a 7-day monitoring window first and warns you if you enable it earlier, but nothing is time-locked and you can stop blocking with one click; optional email when traffic spikes
• Page analysis — daily per-page counters (GDPR-neutral: no IPs, no user agents) feed a per-page evidence panel showing which engine fetched which page on demand, a crawl-freshness funnel (which pages changed after the last crawl), and a 28-day attention-decay radar for pages AI is losing interest in
• AI-404 phantom URL recovery — a report of URLs assistants think exist (404 hits with an AI user-agent or AI-platform referrer), the closest real page suggested by edit distance, and an optional per-row 301 applied ONLY to AI-originated requests
• GEO change log — every visibility-affecting setting change is marked on the traffic chart with an honest before/after delta (correlation, not causation)
• Bot health alarms — a silence sentinel for regular crawlers that go quiet and a spoof-surge guard with an explicitly confirmed, one-click “403 spoofed-only” switch
• Page readiness score + Triage — a per-page content-readiness sub-score with an in-editor meta box and a site-wide triage view
• Weekly (or daily) digest email (opt-in) — a summary of bot traffic, fading pages and your weakest pages

Honesty principles

• No files are written — everything is served virtually and switches off without a trace.
• No cloaking — humans and bots see the same content; only the format may differ when a client asks for it.
• No fake manifests — discovery files are published only when they describe something real.
• No upsell surfaces — this plugin never asks you for a key and never stores one.

Languages

The admin panel ships fully translated in 17 languages: English, Türkçe, Deutsch, Español, Français, Italiano, Nederlands, Polski, Português, Русский, 日本語, 한국어, العربية, فارسی, हिन्दी, Bahasa Indonesia, Tiếng Việt. RTL layouts are supported for Arabic and Persian. Translations are bundled with the plugin itself (not delivered as WordPress.org language packs).

External services

This plugin can connect to the third-party/external services listed below. Nothing is contacted on install or silently: every connection either requires an explicit opt-in toggle (off by default) or happens only when you press a button. With all defaults untouched, the plugin makes no outbound calls and collects no telemetry.

1. Index Harmony scan service (operated by us at indexharmony.com)

• What it is / why: the optional site-readiness scan — a 133-check audit of how your site looks to AI crawlers. Scoring that requires fetching your pages from the outside, which cannot be done from inside your own WordPress, so the scan runs on the service’s servers.
• What is sent and when: when you press “Scan” in the dashboard, your browser opens the service’s scan page in a new tab with your site’s public address in the URL, and the scan runs there. The report is shown on the service’s own page — it is not returned to your dashboard, and this plugin performs no follow-up requests, keeps no job id and stores no scan result. Nothing is sent on install, on a schedule or in the background.
• This plugin contains no key entry field, no unlock step, no licence status check and no support call, and it stores no key or token for this service.
• Terms of Service · Privacy Policy

2. AI-crawler IP lists for bot verification (opt-in, off by default)

When you enable “bot verification”, about once a day the plugin downloads the public, read-only crawler IP-range lists each vendor publishes, so genuine AI crawlers can be told apart from spoofed user-agents. Only a plain HTTP GET is made to the fixed URLs below — none of your site content, settings or visitor data is sent to these vendors.

• OpenAI — openai.com/gptbot.json, /searchbot.json, /chatgpt-user.json · Terms · Privacy
• Anthropic — claude.com/crawling/bots.json · Terms · Privacy
• Perplexity — perplexity.com/perplexitybot.json, /perplexity-user.json · Terms · Privacy
• Amazon — developer.amazon.com/amazonbot/ip-addresses/ · Conditions of Use · Privacy Notice
• Mistral — mistral.ai/mistralai-user-ips.json · Terms · Privacy
• Microsoft Bing — no HTTP request; bingbot is verified with a standard reverse-DNS lookup (PTR must end in search.msn.com) through your server’s resolver · Microsoft Services Agreement · Privacy Statement

3. IndexNow (opt-in module, off by default)

• What it is / why: instant-indexing protocol operated by Microsoft Bing and used by participating engines (Bing, Yandex, Seznam, Naver) to hear about new/updated content immediately.
• What is sent and when: when you publish or update a public post, its URL, your site host and your site’s IndexNow key are POSTed to api.indexnow.org. Nothing else is transmitted.
• IndexNow Terms of Use · Microsoft Privacy Statement

Developer

agrc_bot_visit_post_id

Maps a logged bot visit to the WordPress entry that the requested path represents.

Sites that serve pages through a custom router (a rewrite or template_include handler running after template_redirect priority 0) have no queried object at the moment the visit is recorded, so the visit is stored with no entry attached. Those pages then drop out of the entry-based surfaces — readiness correlation, blind spots, content freshness and the crawl funnel — and blind spots may even report them as “not visited by any bot yet”.

The router is the only party that knows which entry a path represents, so the decision is delegated to it. The filter is opt-in: with no callback attached, behaviour is unchanged.

Parameters:

• int $post_id — entry ID resolved by WordPress; 0 when the request is not a singular entry (archives, the blog listing, 404s, and genuinely virtual pages).
• string $bot_id — registry identifier of the matched crawler, e.g. gptbot.
• string $path — request path with the query string removed and truncated to 255 characters; byte-for-byte what is stored in the visit row.

Return an integer. Non-numeric returns are ignored and negative values are clamped to 0. The filter runs once per bot visit and never on human traffic.

Genuinely virtual pages (those with no WordPress entry at all) cannot be scored, because readiness scores live in post meta. Such paths are listed in a separate section of the “Bot interest x readiness” card so the report stays honest instead of silently dropping them.