Alesta

Go to Alesta AI → Optimisation Gzip, Cache, HTTPS, open the Gzip tab, and click Apply. A backup of the .htaccess is created automatically.

No. The HTTPS redirection only works if your host already has a valid SSL certificate on your domain. The module simply adds the .htaccess rewrite rule that forces http:// to https://.

Once generated, the sitemap is available at /sitemap.xml. Alesta does not ping search engines: submit the sitemap once in Google Search Console and Bing Webmaster Tools (the XML Sitemap page links to both), or add a Sitemap: line with the Robots.txt editor. With automatic regeneration on, the file is kept up to date when your content changes.

Yes. If you already use another plugin's XML sitemap, disable one of the two sitemaps to avoid duplicates. For the head tags:

• With Yoast SEO, Rank Math or All in One SEO, the Title & Meta module writes the generated titles and descriptions into their fields and lets them output the tags.
• With SEOPress, The SEO Framework, Slim SEO, Squirrly SEO or SmartCrawl, Alesta outputs no meta description, Open Graph or Twitter tags of its own.
• With Jetpack's Open Graph tags on, Alesta outputs only the meta description.

A lockout is based on the visitor's IP address. If your site sits behind a CDN or reverse proxy that is not declared, every visitor may appear with the same IP, and locking it would lock everyone out, you included. The protection therefore starts off: open Alesta AI → Protection Brute Force, check the IP it detects, tick "Activer la protection" and save.

Alesta trusts only the connection IP (REMOTE_ADDR). When it detects forwarding headers from an undeclared proxy, it suspends IP lockouts and shows a red warning on the Brute Force page instead of blocking everyone, and it refuses to whitelist private addresses or the proxy's IP. To restore the protection, declare the proxy in wp-config.php, above the "That's all, stop editing!" line. Example for Cloudflare: define( 'ALESTA_TRUSTED_PROXIES', '173.245.48.0/20,103.21.244.0/22' ); define( 'ALESTA_TRUSTED_PROXY_HEADER', 'HTTP_CF_CONNECTING_IP' ); ALESTA_TRUSTED_PROXIES is a comma-separated list of proxy IPs or CIDR ranges (IPv4 and IPv6). With Cloudflare, list every range published at https://www.cloudflare.com/ips/ (when it detects a proxy, the Brute Force page shows a ready-to-copy snippet). ALESTA_TRUSTED_PROXY_HEADER is the server variable that holds the real visitor IP: HTTP_CF_CONNECTING_IP for Cloudflare, HTTP_X_FORWARDED_FOR (the default) for most other proxies. For a proxy running on the same server (Varnish, nginx), declare 127.0.0.1 with HTTP_X_FORWARDED_FOR. The header is only trusted for requests that really come from a declared proxy, so it cannot be spoofed by visitors. If the warning appears although your site uses no CDN (for example because you browse through a company proxy), declaring your server's own proxy address, such as 127.0.0.1, is enough: once ALESTA_TRUSTED_PROXIES is defined, Alesta stops guessing.

No. When you turn debug mode on, the Debug Manager adds a rule that blocks web access to wp-content/debug.log, but only servers that read .htaccess files (Apache, LiteSpeed) apply it. On nginx, turn debug mode off and clear the log when you are done, or deny access to that file in your nginx configuration.

Only for the AI features (Title & Meta AI, SEO Audit suggestions, FAQ Schema, debug.log analysis). Create an API key at console.anthropic.com or at platform.openai.com, select the matching provider in Alesta AI → Configuration, paste the key there, and you are billed by that provider according to your usage. All other modules work without any account or external service.

Yes. Pick "OpenAI (ChatGPT)" as the AI provider in Alesta AI → Configuration, paste your OpenAI key and choose a model (the model list is fetched from your account and cached for 24 hours). Both keys are kept side by side, so you can switch back to Anthropic at any time without retyping anything. The Budget page knows the prices of the current Claude models; a model it has no price for (OpenAI models, newer Claude models) is counted at the highest rate in its table, a deliberately high estimate so that your monthly limit keeps working. The alesta_ai_model_pricing filter lets you supply the exact rates.

Editors and administrators (capability edit_others_posts), on the posts they are allowed to edit, with a limit of 30 generations per user per hour. Use the alesta_meta_ai_capability filter to change the required capability, and the alesta_meta_ai_rate_limit filter to change the hourly limit (0 removes it). The Title & Meta and FAQ Schema screens remain reserved to administrators.

No. The "Powered by Alesta" credit of the Talk to Me widget is off by default; you can enable it in Talk to Me → Affichage → Crédit if you wish.

The key is encrypted (AES-256-GCM) with a key derived from your site's AUTH_KEY salt before being stored in the database, and it is never displayed again in full in the admin. If your server lacks OpenSSL, the plugin warns you and stores the key as a regular option.