Index Harmony

Install → run the setup wizard → done. No key, no account, no paid tier: every module and every measurement screen in this plugin is free and fully usable. Index Harmony prepares your WordPress site for AI assistants, answer engines and their crawlers (ChatGPT, Claude, Perplexity, Gemini and others) without touching your files or content — and then shows you what actually happened. Every fix is virtual and reversible: turn a module off and it disappears without a trace. What makes it different: most plugins in this space stop at generating llms.txt. Index Harmony pairs the output side with a first-party measurement side that no search-console integration can see: its own AI-bot traffic log with real bot verification (official vendor IP lists plus RFC 9421 Web Bot Auth Ed25519 signature checks), daily per-page counters, a per-page evidence panel showing which engine fetched which page on demand, a crawl-freshness funnel, an attention-decay radar, recovery for 404 URLs that assistants invent, a change log that marks every GEO-affecting setting change on your traffic chart, plus an agent-facing Site MCP endpoint and WordPress Abilities/WebMCP surfaces. llms.txt is one of its 19 modules, not the product. All 19 fix modules (free, no key needed):

• llms.txt + llms-full.txt (virtual endpoints, refreshed daily; hand-pick the highlighted pages or edit the file body yourself)
• AI bot manager for robots.txt (explicit allow rules for 25 AI bots; your existing rules are kept intact)
• JSON-LD schema injector (Organization / WebSite / Article / FAQ / Breadcrumb / Product) — defers to Yoast, Rank Math, AIOSEO and SEOPress to avoid duplicates
• Meta completer (description / Open Graph / Twitter — only when no SEO plugin handles it)
• WordPress core sitemap enablement + robots.txt declaration
• /.well-known/security.txt
• WooCommerce product feed + Product schema completeness
• hreflang auditor (reports only — it never writes a file and never emits an hreflang tag)
• /AGENTS.md — a site usage guide for agents (virtual)
• Markdown negotiation (Accept: text/markdown or ?format=md) — responses carry an X-Markdown-Tokens estimate, the Markdown for Agents convention
• .well-known discovery endpoints (api-catalog RFC 9727; mcp.json and agent-skills only when configured — no fake manifests)
• Agent-discovery Link headers + robots.txt Content-Signal declaration (search / ai-input / ai-train, plus the optional use= field introduced in 2026)
• AI bot traffic log (which bot visited when — visits carrying a Web Bot Auth Signature-Agent header are flagged with the signer's key-directory host, and while bot verification is enabled their Ed25519 request signatures are cryptographically verified against the signer's published keys)
• AI policy publishing (ai.txt + TDMRep + Content-Signal header + IETF Content-Usage directive in robots.txt and as an HTTP header)
• RSL content licensing — a virtual RSL 1.0 license.xml derived from your policy axes, plus the robots.txt License pointer (opt-in)
• Security headers — six optional response headers (X-Content-Type-Options, Referrer-Policy, Permissions-Policy, HSTS, CSP-Report-Only, X-Frame-Options); all off by default and picked one by one under Settings → Advanced
• IndexNow instant indexing (Bing/Yandex/Seznam/Naver — opt-in)
• WebMCP (in-browser agent surface for your site's public information)
• AI traffic share (opt-in daily channel counters)

Measurement & insights:

• Bot traffic dashboard — a 30-day chart and per-bot breakdown of AI crawler visits
• Bot verification (opt-in) — once enabled, downloads public bot IP lists and Web Bot Auth signature key directories once a day to flag spoofed bots and cryptographically verify signed agents (works even behind a proxy/CDN, where IP checks must abstain); no visitor data leaves your site
• Bot blocking & spike alerts (opt-in) — pick the bots to watch, then turn blocking on whenever you decide to, behind an explicit confirmation; the panel recommends a 7-day monitoring window first and warns you if you enable it earlier, but nothing is time-locked and you can stop blocking with one click; optional email when traffic spikes
• Page analysis — daily per-page counters (GDPR-neutral: no IPs, no user agents) feed a per-page evidence panel showing which engine fetched which page on demand, a crawl-freshness funnel (which pages changed after the last crawl), and a 28-day attention-decay radar for pages AI is losing interest in
• AI-404 phantom URL recovery — a report of URLs assistants think exist (404 hits with an AI user-agent or AI-platform referrer), the closest real page suggested by edit distance, and an optional per-row 301 applied ONLY to AI-originated requests
• GEO change log — every visibility-affecting setting change is marked on the traffic chart with an honest before/after delta (correlation, not causation)
• Bot health alarms — a silence sentinel for regular crawlers that go quiet and a spoof-surge guard with an explicitly confirmed, one-click "403 spoofed-only" switch
• Page readiness score + Triage — a per-page content-readiness sub-score with an in-editor meta box and a site-wide triage view
• Weekly (or daily) digest email (opt-in) — a summary of bot traffic, fading pages and your weakest pages

Honesty principles

• No files are written — everything is served virtually and switches off without a trace.
• No cloaking — humans and bots see the same content; only the format may differ when a client asks for it.
• No fake manifests — discovery files are published only when they describe something real.
• No upsell surfaces — this plugin never asks you for a key and never stores one.

Languages The admin panel ships fully translated in 17 languages: English, Türkçe, Deutsch, Español, Français, Italiano, Nederlands, Polski, Português, Русский, 日本語, 한국어, العربية, فارسی, हिन्दी, Bahasa Indonesia, Tiếng Việt. RTL layouts are supported for Arabic and Persian. Translations are bundled with the plugin itself (not delivered as WordPress.org language packs).

0.9.43

• Fixed: after deactivating and re-activating the plugin, its virtual endpoints (llms.txt, ai.txt, AGENTS.md, the .well-known files, license.xml, security.txt, the product feed) answered 404 until any module was toggled — the hook that runs when the plugin is switched on flushed the rewrite rules before the modules had registered theirs. The flush is now deferred to the next page load, where the rules are present (the path plugin updates already used).
• Audit round: static analysis (PHPStan level 8 with WordPress stubs) over every shipped file, an AJAX/REST authorization sweep, cron teardown parity, i18n key and placeholder coverage, and a live end-to-end run on WordPress 7.1 (setup wizard, the Content-Signal use= field, Markdown negotiation, every admin screen) found no further defects; two stale docblocks and one null-safe cast were tidied.

0.9.42

• New: Content Signals use= field — the Content-Signal declaration (Settings → General) gains the optional fourth field Cloudflare added to the Content Signals format in 2026: use=immediate (interact only, store nothing), use=reference (index, excerpt and link back) or use=full (summarise and reproduce). When set it is appended to the robots.txt Content-Signal line, the Content-Signal response header and the ai.txt mirror; left undeclared, nothing changes. RSL, TDMRep and IETF Content-Usage have no equivalent term and are deliberately not touched, and the setup wizard's policy presets keep the field intact.
• New: Markdown negotiation responses now send an X-Markdown-Tokens header with the estimated token count of the Markdown body — the convention established by Markdown for Agents (February 2026) — so agents can plan context windows and chunking before reading.
• Compatibility: reviewed against WordPress 7.1 (iframed editors, list-table markup, Abilities API lifecycle filters); no changes were needed.

0.9.41

• Hardening (audit round): the expires timestamp of a Web Bot Auth signature is now a hard cutoff — an expired signature can no longer earn the verified badge through the clock-skew allowance (the skew tolerance now applies only to created, so signers with a slightly fast clock still verify).
• Fixed: signer hosts whose key directory could never be fetched used to stay in the cache indefinitely and were re-tried every day forever; failed directories are now dropped after 7 consecutive failed fetches (a signer that comes back simply re-enters through its next signed request), and the cache-size cap now evicts never-successful entries first.
• Docs: the privacy descriptions now also disclose the stored 0/1 signature-verification flag and the signer key-directory downloads, and two stale internal counts (24→25 known bots, 11→12 verifiable bots) were corrected.

0.9.40

• New: Web Bot Auth cryptographic verification — while bot verification is enabled, bot visits that carry an RFC 9421 Signature-Agent header are now actually verified: the plugin fetches the signer's public Ed25519 keys from its standardised /.well-known/http-message-signatures-directory (daily, cached, capped) and checks each signed request's signature locally (tag web-bot-auth, JWK-thumbprint key ids, created/expires freshness). Verified visits get a distinct "Signed ✓" badge and a sig_verified CSV column; unverified ones keep the neutral presence badge — a failed or unavailable check never accuses anyone. Follows draft-meunier-webbotauth-httpsig-protocol-02 (August 2026), including the current dictionary Signature-Agent form with the legacy string form still accepted. Unlike IP-list checks, signature verification also works when your site sits behind a proxy or CDN.
• Improved: the bot-verification toggle description and the External services documentation now spell out the signer key-directory downloads, and the traffic-log signature badge distinguishes "carried a signature" from "signature verified".
• Fixed: the FAQ still said "all 18 modules" — the module count has been 19 since RSL licensing shipped.

0.9.39

• New: RSL content licensing (opt-in module) — publishes a machine-readable RSL 1.0 licensing document at /license.xml, derived from your existing Content-Signal policy axes, and adds the matching License pointer line to robots.txt (rslstandard.org — the open standard backed by Reddit, Yahoo and Medium).
• New: IETF Content-Usage — the AI policy module now emits the draft-ietf-aipref-attach preference expression (train-ai / search) alongside Content-Signal, both as a robots.txt directive and as an HTTP response header, and mirrors it in ai.txt.
• New: Web Bot Auth signature flagging — bot visits that carry an RFC 9421 Signature-Agent header (OpenAI and Google's agent.bot.goog identity already sign) are flagged in the traffic log and CSV export with the signer's key-directory host. Presence detection only; this version does not claim cryptographic verification.
• New bot: Google-Agent — Google's user-triggered AI agent fetcher (Gemini agent features and Project Mariner; added to Google's official crawler list in March 2026) joins the robots.txt manager (25 bots total), the traffic log with Gemini engine attribution, and opt-in IP-list verification via Google's published ranges.
• Docs: the External services list now includes Google's IP-range list, and the privacy description documents the new signature-host column in the visit log.

0.9.38

• First release on WordPress.org: 18 fix modules, setup wizard, tabbed settings, 17-language admin panel, virtual & traceless fix architecture — no key, no account, no paid tier anywhere in the plugin.
• Measurement & insights: bot traffic dashboard, opt-in bot verification, bot blocking & spike alerts, page readiness score + Triage, and an opt-in weekly/daily digest.
• Page-analysis suite: GDPR-neutral daily per-page counters powering a per-page AI evidence panel, a crawl-freshness funnel, a 28-day attention-decay radar, AI-404 phantom URL recovery with optional AI-only 301s, a GEO change log with before/after impact, and bot health alarms (silence sentinel + spoof-surge guard with an explicitly confirmed spoofed-only 403).
• Content scope & curation: opt other plugins' public content types into your llms.txt, AGENTS.md and page scoring, hand-pick which pages your llms.txt highlights with a live search picker, or edit the published llms.txt body directly.
• Security headers now have a selection screen (Settings → Advanced): six optional response headers, each off by default and switched on one at a time.
• Guideline & hardening pass: this build contains no licensing, unlock or update-check code at all, and nothing in it is limited by time, by usage or by anything you could pay for — bot blocking in particular is never time-locked, it only recommends a monitoring window and warns you if you switch it on early. It also defers sitemaps and Product schema to your SEO plugin and WooCommerce correctly, adds cache invalidation for llms.txt and the product feed, moves audits off visitor requests, and registers a personal-data exporter/eraser for author profile fields.
• Polish pass: working Amazonbot IP verification, panel-language number/date formatting on measurement screens, an honest warning (plus withheld advertising) for .well-known endpoints on subdirectory installs (RFC 8615), and Index Harmony-branded public identifiers (REST index-harmony/v1, block index-harmony/nap, index_harmony_* shortcodes).