Hack The SEO – AI Bot Tracker, GEO Score, JSON-LD Schema & Cannibalization

Only if something is missing. If Yoast or Rank Math is doing the job and you have no idea whether ChatGPT reads your pages, install this one for that answer alone: the AI crawler log, the GEO score and the cannibalization report are things the big four do not give you. And you do not have to choose, see the next question.

Yes, and that is the default behaviour. You do not have to choose. On activation the plugin detects the SEO plugin already in place and stops emitting whatever that plugin handles: meta tags, canonical, schema, sitemap, breadcrumbs, robots, and hreflang when a multilingual plugin owns it. So there are no duplicate title tags, no duplicate canonicals and no duplicate schema. It never deactivates your plugin and never touches its settings. Meanwhile the three things the big four do not give you keep working, because they produce no front-end output and therefore cannot conflict: the AI crawler log, the GEO score per page, and the keyword cannibalization report. A dedicated screen lists every overlap and lets you take back any module, one by one. Your choice always wins over the automatic default. If you would rather replace your current plugin than run both, the migration wizard imports its data first, as a dry run you can review. See "How do I switch from Yoast SEO, Rank Math, All in One SEO or SEOPress?" below.

Activate the plugin and open the AI visibility screen. Every request from GPTBot, ChatGPT-User, OAI-SearchBot, ClaudeBot, Claude-User, Claude-SearchBot, PerplexityBot, Perplexity-User, Applebot, CCBot and eight more is recorded server-side, with the URL and the timestamp, in your own database. Nothing is sent anywhere. To prove it to yourself in ten seconds: curl -A GPTBot https://your-site.tld/any-page/, then refresh the screen. The row is there. A JavaScript analytics tool cannot do this. AI crawlers do not run JavaScript, so whatever your analytics says about GPTBot, it is guessing.

Your own site sends it, through WordPress, to the administrator email. Once a week: how many times AI crawlers read the site and on how many pages, how many visitors arrived from an AI chat, which new broken links appeared, and how the site score moved. Nothing is sent on a week with nothing to report. It is off by default, switched on from the AI visibility settings, and every email carries a one-click unsubscribe link that works without logging in. No third party is involved and no outbound call was added: it is wp_mail(), the same function WordPress uses for password resets.

Open the AI connection screen. One button creates a WordPress application password and prints the line to paste into your client. Paste it, and the client talks to https://your-site.tld/wp-json/htsfree/v1/mcp. No account, no OAuth relay, no companion plugin, nothing installed outside WordPress. Two things are required, and the screen tells you if either is missing: WordPress 6.9 or newer, because that is where the Abilities API entered core, and HTTPS, because WordPress only issues application passwords over a secure connection.

It can read twelve things and change nothing. There is no write among the twelve abilities, and no setting that turns one on. It reads: AI crawler activity three ways (totals per bot, the detail page by page including the pages no crawler has touched, and the day-by-day timeline), a page's GEO, on-page and meta scores, the site-wide score distribution, the competing-pages report, your redirect rules, your 404 log, your llms.txt, the Markdown of any page, and the health check. Every call is made by a signed-in WordPress user and checks a capability: administrator for the site-wide readings, and a user who can edit posts for the four that concern a single page. Unpublished and password-protected content stays out, and no visitor's IP, referrer or user agent is ever returned. Delete the application password from your user profile and that client is locked out immediately.

The plugin sends nothing and contacts no third party. Your AI client calls your site, not the other way round. What you then read inside your client goes wherever that client goes, which is between you and the client you chose, exactly as if you had typed the same figures in by hand. On the plugin's side nothing changed: still exactly nine wp_remote_ call sites, the same nine as before the MCP server existed, and the bundled library adds none of its own. If another plugin has already loaded the same MCP library in an older version, this server stays off rather than fight over it, and the AI connection screen says so plainly.

That depends on what you need, and anyone giving you a single answer is selling something. Yoast SEO and Rank Math are the two largest and have the biggest ecosystems. All in One SEO is the oldest. SEOPress is the leanest of the big four. Slim SEO is the right answer if you want zero configuration. Hack The SEO is built for a specific case: you want the whole technical layer (schema, sitemap, redirects, canonical, robots, breadcrumbs) plus keyword cannibalization detection and real AI-crawler measurement, computed locally, with no account and nothing sent to a third party. If cannibalization or GEO measurement is what you are missing, this is the free plugin that has it, and it runs next to whichever of the others you already use. If you mostly want AI-generated content, it is not.

Install Hack The SEO and it generates JSON-LD structured data automatically from what is already on each page: Article, BreadcrumbList, Organization, Person, Product, FAQPage, HowTo, QAPage, VideoObject and 60+ types in total, so your pages qualify for rich snippets. Types that cannot be detected reliably, such as LocalBusiness opening hours, are yours to enable per page in the Schema settings, so nothing is invented. Confirm the result in Google's Rich Results Test or the Schema Markup Validator.

Open the Redirects screen, enter the old URL and the destination, and choose 301 (permanent). You can also use 302, 307 and 410, add regex rules for bulk migrations, and import or export everything as CSV. When you rename a post, a 301 from the old slug is created for you. Incoming 404s are logged, and any 404 can be turned into a redirect in one click. Redirects are served in PHP, so your .htaccess is never touched and it works identically on Apache, Nginx and LiteSpeed.

It is served automatically at /sitemap.xml: a sitemap index plus one sitemap per content type, with image, video and news extensions and an XSL stylesheet so it is readable by a human. It respects noindex and is cached on disk so it does not rebuild in PHP on every request. Submit /sitemap.xml to Google Search Console. The "First steps" checklist reminds you to.

llms.txt is a plain-text file listing your key content for AI crawlers, in the same spirit as robots.txt for search crawlers. Hack The SEO serves it virtually at /llms.txt, generated from your real content, with no file written to disk. It also serves a Markdown version of every page at /your-page.md, which is the format an LLM parses most reliably and most cheaply. Both are on your own server, both are free, and neither requires an account.

GEO, sometimes called AEO (answer engine optimization), means making your content easy for generative engines (ChatGPT, Claude, Perplexity, Gemini, Google AI Overviews) to read, understand and cite. Classic SEO optimises for a ranked list of links; GEO optimises for being the source quoted inside an answer. In practice it comes down to: answer the question explicitly and early, keep facts stable and attributable, structure the page so a machine can parse it, expose clean formats (schema, Markdown, llms.txt), and then measure whether the AI crawlers actually come. Hack The SEO does all five, locally, in the free version.

Keyword cannibalization is when two or more of your own pages target the same query, so search engines have to pick between them and both underperform. It is one of the most common causes of a site that has plenty of content and no rankings. Hack The SEO detects it for free: it compares focus keywords and title similarity to find competing pairs, measures how much their content actually diverges, and recommends what to do with each pair: merge them, differentiate them, redirect one into the other, or leave them alone because they genuinely serve different intents. All computed in PHP on your server, with no embeddings and no external API.

Nobody controls that, and any tool claiming otherwise is guessing. What you can control is whether your content is citable, and whether the engines are even reading it. Being citable means: answering the question explicitly and early on the page rather than after four paragraphs of preamble; stating facts that can be quoted and attributed; keeping a clean, parseable structure; and exposing formats a model reads cheaply: valid JSON-LD schema, a Markdown version of the page, an llms.txt index. Hack The SEO's GEO score checks the first three and generates the last two. Then you measure. The AI visibility screen tells you whether GPTBot, ClaudeBot, PerplexityBot and the rest actually came, on which URLs, and how often. Very few free plugins give you that, and without it you have no way of knowing whether any of the rest is working.

Every 404 hit on your site is logged automatically, with the requested URL, the referrer and a hit count, so you can tell a real broken link from a bot probing for /wp-admin/setup.php. Sort by hits, and the URLs actually costing you traffic come straight to the top. Each row has a one-click "redirect this" action that turns the 404 into a 301 to wherever you choose. The log is capped and self-cleaning, so it cannot grow until it hurts your database.

The XML sitemap at /sitemap.xml is what you submit to Google Search Console, and the "First steps" checklist walks you through it. IndexNow is built in and optional: turn it on, and Bing, Yandex, Naver, Seznam and Yep are notified the moment you publish or update a URL, rather than waiting for a crawl. It is off by default and sends nothing but the URL, your host name and your IndexNow key. See "External services".

You do not have to: the plugin runs next to them. But if you want to, install Hack The SEO while the other plugin is still active, open the Migration screen, and run the import. It reads meta titles and descriptions, meta robots, canonical URLs, focus keywords, cornerstone/pillar flags, redirects and Open Graph fields. If the previous plugin emitted its schema through the theme or a page builder rather than storing it, the wizard parses your rendered homepage to recover Organization and LocalBusiness data. Then verify a few pages, then deactivate the other plugin. Import first, deactivate second, in that order. The wizard never deletes the source data, so the move is reversible.

No. Front-end output is meta tags, JSON-LD and, if you enable them, breadcrumbs, all built during the normal page render. The XML sitemap is cached on disk rather than rebuilt in PHP. Scores, cannibalization and health checks run in the admin or on cron, never on a visitor's request. AI crawler detection is a User-Agent read on a hook that already runs. There is no external HTTP call in the front-end path, which is worth stating explicitly: a plugin that calls a remote API while rendering your page is at the mercy of that API's latency. This one has nothing to call.

No. Out of the box it makes zero outbound requests. There is exactly one feature that can ever contact a third party, and you have to switch it on yourself: IndexNow. When enabled, it sends the URL you just published, your host name and your IndexNow key to api.indexnow.org. Nothing else, ever. While it is off, which is how it ships, no hook is even registered. The weekly report is an email your own WordPress sends to you, through the mail setup your site already has. It is not a call to us. Some features do load pages of your own site over HTTP, to verify that your sitemap answers and your schema is really in the rendered HTML. Those requests go to your domain, not to us. That is the whole story, and you can verify it: grep the plugin for wp_remote_ and read the nine call sites yourself: two are IndexNow, the seven others load a page of your own site.

The plugin sets no cookie, loads no third-party script and sends no personal data anywhere. The on-site content performance module counts views, reading time and scroll depth in your own database; visitor IP addresses are never stored, only hashed as a short-lived rate-limit key, and the module can be switched off. As always, GDPR compliance is a property of your whole site, not of one plugin, but this one gives you nothing to declare.

No. Every feature described on this page runs locally. There is no sign-up, no key to paste, and no feature that stops working because a server somewhere is down.

No, and be suspicious of any plugin that says otherwise. Ranking depends on your content, your market and factors nobody controls. What this plugin does is make sure the technical layer is correct and give you honest measurements. That is a prerequisite, not a promise.

Yes. Product pages get Product, Offer and AggregateRating schema where the data genuinely exists, product categories are handled by the sitemap and the permalink options, and product rows in the posts list show an exempt state rather than an editorial score that would mean nothing for a product.

Yes. The plugin detects the builder and reads the rendered content rather than the raw post_content, so the scoring, the schema and the Markdown output all see the same text your visitors see.

Yes. Everything on the front end is standard WordPress output, so it caches like the rest of your page. Redirects are evaluated early, on template_redirect. A full-page cache drop-in can still answer before WordPress loads any plugin, so clear your cache after adding a rule. The sitemap has its own disk cache. Nothing depends on a request reaching PHP uncached.

Yes. Each site keeps its own settings, redirects, sitemap and data.

Alt text is the sentence a screen reader announces and a search engine reads in place of the image. Hack The SEO fills in the missing ones automatically when you save a post, deriving the text from the file name, the post title or the focus keyword, and never overwriting alt text you wrote yourself. The audit screen lists every image still without one, so you can fix the ones that matter by hand. Images with no alt text are also one of the criteria of the on-page score.

Open the Hack The SEO panel on any post, page or custom post type and switch on "noindex", and "nofollow" if you need it. The plugin outputs a single, correct robots meta tag and keeps that URL out of your XML sitemap. Whole archives (author, date, internal search) can be set to noindex from the settings.

Switch the Breadcrumbs module on first, then use the [htsfree_breadcrumbs] shortcode, the "Breadcrumbs" Gutenberg block, or the htsfree_breadcrumbs() PHP function in your theme. Hack The SEO builds the trail from your category hierarchy and outputs matching BreadcrumbList schema, so your breadcrumbs can appear directly in Google's results.

Every post and page has a canonical field in the SEO panel. Leave it blank for the automatic self-referencing canonical, or enter a custom URL to consolidate duplicate content. The plugin detects conflicts and never outputs two canonical tags on the same page.

Almost nothing. There is exactly one thing written to disk: the generated XML sitemap, cached under wp-content/uploads/hts-cache/sitemaps/ so a cold request does not have to rebuild it in PHP. That is the complete list. In particular:

• No redirect is ever written to your .htaccess. Redirects are served in PHP, on Apache, Nginx and LiteSpeed alike. The only time the file changes at all is when WordPress refreshes its own # BEGIN WordPress block: the plugin asks core for a rewrite refresh on activation, on update, and when you change a permalink option, exactly as Settings > Permalinks does. Nothing of ours is added to the file, and it is left alone entirely when it is not writable.
• robots.txt is not written to disk. It is served virtually, through WordPress core's own robots_txt filter.
• llms.txt is not written to disk either.
• Nothing is ever written outside wp-content.

By default, nothing is deleted. Your redirects, your 404 log, your metadata and your settings stay in the database; only transients and scheduled tasks are cleaned. This is deliberate: someone who uninstalls and reinstalls should not lose the 301s holding their site together. If you genuinely want everything gone, enable the "delete my data on uninstall" option first.

It should not be any more. The plugin is developed in France and is fully internationalised; the interface follows your site language automatically. English, French, Spanish, German, Italian and Brazilian Portuguese ship with the plugin. Further translations are handled through translate.wordpress.org. If you still see French on an English site, tell us on the forum with the screen name: that is a string we missed.

Yes, and it is a separate product. Everything on this page works in the free version, permanently, without an account. See the section below.