Goppa – AI Visibility: llms.txt, IndexNow and AI Crawlers

Goppa is an AI visibility plugin for WordPress. It shows you which AI crawlers are reading your site, gets your changed pages into the index those assistants answer from, and states — in your own robots.txt — that your pages may be used to build a generated answer. What Goppa does

• Counts AI crawler visits on your site — GPTBot, ClaudeBot, PerplexityBot, OAI-SearchBot, Google-Extended, Amazonbot, Applebot and others — and shows the count on its own screen. The count is kept on your server and nothing about it is sent anywhere.
• Submits every changed URL through IndexNow, so Bing and Yandex learn about your pages, posts and products in hours instead of weeks. The verification key is generated and served automatically.
• Declares Content-Signal: search=yes, ai-input=yes in robots.txt, the line that says an AI system may use your page in a generated answer. It never touches ai-train.
• Serves four agent endpoints from a WooCommerce catalogue when one is present: a UCP manifest, llms.txt, a live MCP server and your catalogue as schema.org JSON.
• Publishes a product summary and an FAQ as visible text, built only from fields you already filled in. Both are off until you turn them on.
• Applies fixes for you when a Goppa account is connected: llms.txt, robots.txt rules for named AI crawlers, the sitemap reference and missing product schema fields.
• Sends nothing about you anywhere until you enter a token. The crawler count stays on your server. IndexNow submits your own public URLs, and nothing else, and can be switched off.

WooCommerce is optional. The crawler count, IndexNow and the Content Signal work on any WordPress site. The catalogue endpoints and the product feed check appear when WooCommerce is running. The line nobody is declaring Cloudflare switched the Content Signals format on across more than 3.8 million domains with ai-train=no and ai-input deliberately left blank — they said they did not want to guess your preference. ai-input is the one that means "you may use this page to build a generated answer". Millions of sites now say "do not train" and say nothing at all about appearing in the answer, and a crawler that reads blank as "no" quietly drops them from the answers they want to be in. Goppa writes Content-Signal: search=yes, ai-input=yes. It leaves ai-train alone — training a model on your content is a separate decision, and yours. If your server or CDN already sets a Content Signal, that one is left alone. First, the page has to be findable ChatGPT and Copilot answer shopping and research questions from Bing's index. A page outside that index cannot be recommended, however good its structured data is. This is the part most tools skip, because it is not a file you can generate. A meta-analysis of 54 studies published in May 2026 puts URL accessibility as the strongest single factor in whether an AI cites a page — ahead of everything else on this list. That is why IndexNow is on by default. Turn it off under Settings if another plugin already submits your URLs. Then it has to be readable With WooCommerce running, four endpoints on your own domain, with no configuration:

• /.well-known/ucp — a UCP discovery manifest conforming to the published specification, so an agent can find out what your store offers.
• /llms.txt — a plain-text description of your store, categories and products for AI models.
• /mcp — a live MCP server (JSON-RPC 2.0, protocol 2025-06-18) with three tools: search_products, get_product and get_store_info.
• /goppa/catalog — your catalogue as schema.org/Product JSON.

Products, prices, stock status, categories and attributes are read directly from WooCommerce and cached for ten minutes. Search ignores accents, so "tenis" finds "Tênis" and "fussball" finds "Fußball". It applies the fixes, not just the files With a Goppa account connected, the plugin checks hourly for fixes found by the diagnosis and applies them to your site itself — the llms.txt, the robots.txt rules that let named AI crawlers through, the sitemap reference, and product schema fields that are missing. Then it reports back what it applied, so the diagnosis you see is the state of your site and not a to-do list. Two rules it never breaks:

• It never changes what you wrote. Titles, descriptions, prices and policies are on a refuse list inside the plugin. Even if the service asked, this code would discard the instruction — the list lives here, on your server, precisely so it holds regardless of what happens upstream.
• The plugin pulls; the service never pushes. Every connection is outbound from your site, like the telemetry. No authenticated route is opened on your WordPress.

Readable is not the same as recommended Everything above makes your site readable. None of it can tell you whether an assistant actually names you when someone asks what to buy or who to use: that has to be measured by asking, from the outside. In our own published research we measured 64 shops twice: a technical readiness score, and whether AI assistants name them when asked real buying questions in their category. 25 of the 32 shops scoring a perfect 100 appeared in 0% of the answers, and only 16 of 64 were named at all. The median readiness score of the shops that are never named is 100. For the shops that are named, it is 97. The invisible ones score higher. It also varies enormously by category: 1 of 12 natural beauty shops appeared; 4 of 12 electronics shops did. The data and method are public at https://trygoppa.com/study Anyone promising a specific outcome here is guessing. Serving these protocols is a precondition, not a guarantee. You can check where you stand without installing anything Run the free check on your domain at https://trygoppa.com — it reads your site from the outside and gives you a readiness score plus the pages an AI assistant read when answering questions in your category. No account, and the plugin is not required. Install the plugin when you want the work done on your site instead. What this does not do It does not process carts, checkout or payments, and the UCP manifest does not claim otherwise — it declares catalogue search and lookup, nothing else. An agent that reads it will send the shopper to your site to buy. Announcing a checkout that does not exist would make agents try to transact and fail. Optional: see what the agents actually do Paste a token from a Goppa account and the plugin reports agent activity — which endpoint was called, what was searched, which product was returned. Never visitor data. This is off until you configure it; see "External services" below. External services With no token configured, and unless you click Connect to Goppa, this plugin makes no external connection carrying your data. The crawler count stays on your server. IndexNow, when on, submits your own public URLs to https://api.indexnow.org — the URL and your site's verification key, nothing else. If you enter a Goppa store token on the Goppa screen (it has its own item in the admin menu), the plugin sends agent activity to the Goppa service at https://trygoppa.com (endpoint /api/ingest). This is what is sent, and only when an AI agent requests one of the four endpoints above:

• which endpoint was requested (for example mcp);
• the User-Agent string sent by the agent, which the service classifies into a known agent name;
• which MCP tool was called (for example search_products);
• the search term or product identifier the agent asked for;
• the name of the product returned first.

Records are queued and sent after the response to the agent has already been delivered, so the service being slow or unreachable never delays your site. Nothing is sent about your human visitors: no IP addresses, no customer or order data, no personal information. Clearing the token stops it immediately. The Connect to Goppa button. When you click it, your browser opens https://trygoppa.com/connect with this site's address, a one-time request code and the address of this admin screen. Nothing is connected until you sign in there and confirm. The plugin then sends that one-time code, the request code and this site's address to https://trygoppa.com/api/connect/exchange, receives the store token and saves it exactly like a pasted token. The token never appears in a browser address. Service provided by Goppa — Terms of Service, Privacy Policy.

1. Upload the plugin ZIP via Plugins → Add New → Upload, or unzip into /wp-content/plugins/.
2. Activate it. The crawler count, IndexNow and the Content Signal start working immediately.
3. Optional: open Goppa in the admin menu for the site description, policy URLs and the Goppa token.

WooCommerce is optional. With it running, the four catalogue endpoints go live too. If your permalinks are set to "Plain", switch to any other setting so the endpoints resolve.

0.8.0

• Connect to Goppa in one click. Connecting used to mean finding the Store token field, creating an account in another tab, adding the site, copying a token and pasting it back. Now the Goppa screen opens with a Connect to Goppa button: sign in or create a free account, confirm, and you land back here connected, with no token to copy.

The token never travels in a browser address. The page sends back a one-time code that expires in 10 minutes and only works for this site and this request; the plugin exchanges it for the token directly with Goppa. Pasting a token still works exactly as before. 0.7.5

• Security: protected product fields can no longer be bypassed by letter case. Goppa never changes what you wrote: product name, description, price, URL and policies are on a protected list the plugin refuses to touch, even if an instruction from the platform asks for it. That check compared the field name exactly as it arrived, while saving used the normalised name, so URL or Description could slip past the list and be saved as url or description. The plugin now normalises the name before it checks, so every spelling is refused.
• The browser identifier of human visitors is no longer sent.

When a person arrives from an AI assistant, the plugin counts the visit and keeps only the assistant's host name. It was also sending that person's browser identifier (user agent), which Goppa never used. It is now dropped on your server. For AI crawlers the identifier is still sent, because it is what says which crawler it was.

• Uninstalling on a multisite network now cleans every site.

Each site in a network keeps its own Goppa token, but uninstalling only removed the settings of the current site. It now removes them from every site in the network (up to 2,000 per run, with a log note if any remain).

• Lighter on your database. The local AI crawler counter is no longer loaded on every page request.

0.7.4

• The plugin now knows whether the platform received its report. Until now it sent the list of corrections it had applied and moved on without waiting. If the reply was lost, nobody could tell whether the report had been stored or not, and the next cycle sent everything again.

It now keeps one pending delivery with a stable identifier, resends the same identifier until the platform confirms that exact delivery, and only then clears it. A delivery made under a previous connection is never resent to a new one. This is one pending delivery, not a full queue: while it waits, changes in between are not queued, and after confirmation the next report describes the current state. 0.7.3

• Goppa has its own place in the sidebar. It used to live under Settings, between Privacy and Plugin Check, which meant activating the plugin put nothing visible on your screen. It is now a top-level menu with its own icon, so the screen that shows what Goppa did on your site is one click away, every day and not only on the first.

0.7.2

• Goppa now shows you what it did, instead of waiting to be found. Activating used to be a non-event: no redirect, no notice, and the screen tucked under Settings. The plugin served llms.txt, wrote the Content Signal and counted AI crawlers in silence, and most people never saw any of it. It now opens its screen the first time you activate, and says so on the dashboard until you have looked once.

0.7.1

• Apple Intelligence added to the robots.txt access list. Goppa already counted Applebot-Extended when it visited and already checked whether your site blocked it. It just never asked it in. The allow-list had drifted from the two lists beside it; this closes the gap.

0.7.0

• WooCommerce is no longer required. Goppa now runs on any WordPress site. Three things that never needed a catalogue now work without one: the AI crawler count, IndexNow, and the Content Signal in robots.txt. The catalogue endpoints, the feed check, the product summary and the FAQ still need WooCommerce and appear when it is running.
• New: AI crawler visits are counted on your own site, with no account. GPTBot, ClaudeBot, PerplexityBot and the others are counted by name and shown on the settings screen. The count never leaves your server.
• IndexNow now covers pages and posts, not only products. The hook was save_post_product, which left every site without a shop out of the plugin's strongest single feature.
• The Content Signal no longer needs a Goppa account. It is a permission you grant, not a change of access, so it is on by default with a switch on the settings screen. The crawler access rules in robots.txt still come from a connected diagnosis, because those do change access.
• The settings screen says what is working on a site without WooCommerce instead of explaining what is missing.

0.6.8

• robots.txt now carries a Content Signal saying this store may be used in AI answers. Cloudflare turned the Content Signals format on across more than 3.8 million domains with ai-train=no and ai-input deliberately left blank — they did not want to guess. ai-input is the one that says "you may use this page to build a generative answer", which is the only thing this plugin exists to achieve. A crawler that reads blank as "no" quietly drops the store from the answers it wants to be in.

Goppa now writes Content-Signal: search=yes, ai-input=yes. It does not touch ai-train — training a model on your catalogue is your call, and some shops want it off on purpose. If you or your CDN already set a Content Signal, yours is left alone. 0.6.7

• Reordered, not rewritten. IndexNow is now the first thing this page explains, before the endpoints. A meta-analysis of 54 studies published in May 2026 puts URL accessibility as the strongest single factor in whether an AI cites a page — 9.5 out of 10, ahead of everything else the plugin does. It was described here as a footnote, starting with "It also submits".
• The settings screen now says why the IndexNow number matters, not just what it is. The llms.txt line already explained itself; the line for the stronger factor did not.
• Nothing was removed. llms.txt is still served and still useful — it is simply not the thing that decides whether you get recommended.

0.6.6

• The plugin now declares that it needs WooCommerce. From WordPress 6.5 that means WordPress itself will not let you activate Goppa without WooCommerce, and shows the dependency on the plugin card.
• On WordPress 6.0 to 6.4 that header is ignored, so the settings screen now says it in words. Before this, a store without WooCommerce saw "0 products", "0 in the feed" and an empty catalogue on every endpoint, with nothing explaining why — which reads as a broken plugin rather than a missing dependency. Nothing was ever broken: every WooCommerce call was already guarded. What was missing was the sentence.

0.6.5

• New, and off until you turn it on: when a shopper arrives from ChatGPT, Perplexity or Claude and buys in that same visit, the order is tagged with where they came from, and the totals reach your Goppa dashboard split into what an assistant can be shown to have brought and what it merely took part in. The two are never added together.
• Nothing about the shopper leaves your site. Only the name of the site they arrived from, the currency, the order total and a one-way code so the same sale is not counted twice — never a name, email, IP address or the order number itself. It uses the session WooCommerce already keeps for the cart, not a cookie of ours, and only covers a purchase made in the same visit.

0.6.4

• New on the settings page: how many of your products would be accepted into the ChatGPT product feed, and exactly what is missing from the ones that would not. A product with no image or no brand is dropped silently by the channel, with no error anywhere — this tells you before that happens, and the same fields feed Google and Perplexity.
• Fixed a real defect in the feed we generate: products without a GTIN or MPN were sent without declaring that, which OpenAI reads as a claim to an identifier that is not there. Small catalogues rarely have GTINs, so this affected most stores.

0.6.3

• The settings page now uses WordPress's own admin components, so it reads as part of your dashboard instead of a wall of text: what the plugin has already done comes first, in a card with a status icon per line, and the endpoints it serves sit below it in a table you can open one by one.
• No stylesheet of ours is loaded for any of it. The page inherits your admin theme, dark mode and accessibility settings as they are.

0.6.2

• Renamed from "Goppa Agentic Commerce" to "Goppa - AI Visibility for WooCommerce", so the name says what the plugin is for. Nothing else changes: same plugin, same settings, same address. Your site keeps updating normally.
• The settings page now shows what Goppa has actually done on your store — how many products are being served as structured data, how many URLs went to Bing and Yandex — instead of only listing what it could do. Until now that summary appeared only for connected accounts, so anyone using the plugin on its own saw a form and no evidence that anything had happened.
• Asks for a review, once, after a week of real use, inside this plugin's own settings page. Dismissable, and the dismissal sticks.

0.6.1

• The settings page now says what this plugin can and cannot tell you. It makes your catalogue readable; whether an assistant actually names your store has to be measured by asking, from the outside. The note disappears once you connect an account.
• The connection field used to ask for a token without saying where one comes from. It now links to the page that issues it, with this site's address already filled in.

0.6.0

• New: a short summary on product pages. Two factual lines and a spec list, built only from fields you already filled in — name, category, brand, price, stock and attributes. Your own description is never read, changed or rewritten. Off by default.
• New: your category guide, as a draft. The comparison guide written on the platform can now land here as a draft post instead of being copied and pasted. It is created once, it is always a draft, and once you touch it the text is yours — we never write over it. Off by default.
• New: your official profiles in the schema (sameAs). The store identity block already told an assistant your name and address. It now also links the profiles you confirm on the platform, which is what tells a model that this shop, that review page and that social profile are the same business. Nothing is published until you confirm each one.
• New: the FAQ can also be text on the page. Google no longer uses FAQ Page markup and AI reads the page itself, so the same questions and answers can now appear as visible text. Off by default: hidden markup does not change what your customers see, and this does.
• New: FAQ on category pages. Built from the products in that category — how many there are, what they cost, which brands you carry. Counted from your own catalogue, never written for you. Also off by default.
• New: see when an AI actually used your shop. Until now the plugin only reported the agent files it serves, so an assistant reading a normal product page went unseen. It now reports two things that are real counts, not estimates: pages fetched by AI crawlers, and visits from people who clicked a link inside an AI answer.
• The dashboard separates the two that matter. ChatGPT-User, Claude-User and Perplexity-User fetch a page because someone asked a question right then — those are counted as real use. GPTBot and the other sweeping crawlers are shown separately, because a crawler passing through says nothing about being recommended.
• Privacy: only the referring host is recorded (for example chatgpt.com), never the full address, which can contain the visitor's conversation id. No IPs, no raw headers, and ordinary visitors are still not recorded at all.

0.5.1

• Fixed a privacy bug: hidden products were being served to AI agents. If you had set a product's catalogue visibility to Hidden, or protected it with a password, it was still included in the catalogue the plugin publishes for AI assistants. Nothing changed on your storefront, so there was no way to notice. Those products are now excluded. If you use hidden products for B2B pricing, discontinued items or testing, update.

0.5.0

• New: the plugin now applies the fixes by itself. Once an hour it asks Goppa whether your latest diagnosis found anything it can repair, and repairs it: serving llms.txt, allowing AI crawlers and declaring the sitemap in robots.txt, and filling in structured-data fields your products were missing. Before this you had to copy and paste them.
• It will never touch what you wrote. Titles, descriptions, prices and policies are refused by the plugin itself, not only by the server — so even a bug or a breach on our side cannot change how your store looks to a shopper. Only data that AI agents read is ever modified.
• Settings now show exactly what was applied and when, and the plugin does nothing at all until your store is connected.

0.4.0

• New: IndexNow. Your product URLs are submitted to Bing and Yandex whenever a product is added, updated or removed. This matters more than it sounds: ChatGPT and Copilot answer shopping questions from Bing's index, so a product that is not in that index cannot be recommended, however good its structured data is. IndexNow cuts the wait from weeks to hours. The verification key is generated and served automatically — nothing to configure. Turn it off under Settings if another plugin already submits your URLs.
• Fixed: uninstalling did not remove the goppa_schema option, so a setting from 0.3.0 survived the plugin being deleted.

0.2.1

• Fixed: on stores running the stable WooCommerce release, every endpoint served an empty catalogue. The plugin routed on init at priority 0, the same priority WooCommerce uses, and loaded first — so wc_get_products() ran before WooCommerce had registered the product post type. Routing now runs at priority 20.
• Fixed: an empty catalogue was cached for ten minutes. If the first request happened before products existed, products added afterwards stayed invisible to agents. Only a non-empty catalogue is cached now.
• Fixed: search ignored accents. "tenis de corrida" ranked a t-shirt above a running shoe, because "tenis" did not match "Tênis". Accents are folded on both sides now, covering the Latin alphabet (including ß, ø, æ, ł, ğ).
• Fixed: a match in the product name now outranks a match in the description.
• Fixed: get_product also matches without accents, so a lookup cannot fail where the search succeeded.
• Fixed: deactivating left the hourly reporting task scheduled forever.
• Fixed: uninstalling did not remove the store token or the telemetry options, leaving a secret in the site database.
• Changed: text domain is now goppa-agentic-commerce, matching the plugin slug, so translations resolve.

0.2.0

• Rewrote the UCP manifest to conform to the published specification, checked against a live Shopify manifest. The previous version used fields that do not exist in the spec.
• The manifest now declares only what the plugin does — catalogue search and lookup. No checkout, cart or payment handlers.
• Corrected llms.txt and the plugin description, which claimed the store was transactable by agents. It is not; purchase happens on the store.
• Hardened the MCP server against malformed input. Batches, null, bare numbers, parameters sent as strings and arguments of the wrong type used to raise errors — which would surface as HTTP 500 on the merchant's site. All of them now return proper JSON-RPC errors, and batch size is capped.
• Added optional reporting of agent activity.

0.1.0

• First release: UCP manifest, llms.txt, MCP server, schema.org catalogue endpoint, settings page, catalogue cache.