Index Harmony
| 开发者 | indexharmony |
|---|---|
| 更新时间 | 2026年11月6日 20:51 |
| PHP版本: | 8.1 及以上 |
| WordPress版本: | 7.1 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
Install → run the setup wizard → done. No key, no account, no paid tier: every module and every measurement screen in this plugin is free and fully usable.
Index Harmony prepares your WordPress site for AI assistants, answer engines and their crawlers (ChatGPT, Claude, Perplexity, Gemini and others) without touching your files or content — and then shows you what actually happened. Every fix is virtual and reversible: turn a module off and it disappears without a trace.
What makes it different: most plugins in this space stop at generating llms.txt. Index Harmony pairs the output side with a first-party measurement side that no search-console integration can see: its own AI-bot traffic log with real bot verification (official vendor IP lists plus RFC 9421 Web Bot Auth Ed25519 signature checks), daily per-page counters, a per-page evidence panel showing which engine fetched which page on demand, a crawl-freshness funnel, an attention-decay radar, recovery for 404 URLs that assistants invent, a change log that marks every GEO-affecting setting change on your traffic chart, plus an agent-facing Site MCP endpoint and WordPress Abilities/WebMCP surfaces. llms.txt is one of its 19 modules, not the product.
All 19 fix modules (free, no key needed):
- llms.txt + llms-full.txt (virtual endpoints, refreshed daily; hand-pick the highlighted pages or edit the file body yourself)
- AI bot manager for robots.txt (explicit allow rules for 31 AI bots; your existing rules are kept intact)
- JSON-LD schema injector (Organization / WebSite / Article / FAQ / Breadcrumb / Product) — defers to Yoast, Rank Math, AIOSEO and SEOPress to avoid duplicates
- Meta completer (description / Open Graph / Twitter — only when no SEO plugin handles it)
- WordPress core sitemap enablement + robots.txt declaration
- /.well-known/security.txt
- WooCommerce product feed + Product schema completeness
- hreflang auditor (reports only — it never writes a file and never emits an hreflang tag)
- /AGENTS.md — a site usage guide for agents (virtual)
- Markdown negotiation (Accept: text/markdown with q-values, ?format=md or ?output_format=md) — responses carry an X-Markdown-Tokens estimate, the Markdown for Agents convention
- .well-known discovery endpoints (api-catalog RFC 9727; mcp.json and agent-skills only when configured — no fake manifests)
- Agent-discovery Link headers + robots.txt Content-Signal declaration (search / ai-input / ai-train, plus the optional
use=field introduced in 2026) - AI bot traffic log (which bot visited when — visits carrying a Web Bot Auth Signature-Agent header are flagged with the signer's key-directory host, and while bot verification is enabled their Ed25519 request signatures are cryptographically verified against the signer's published keys)
- AI policy publishing (ai.txt + TDMRep + Content-Signal header + IETF Content-Usage directive in robots.txt and as an HTTP header)
- RSL content licensing — a virtual RSL 1.0 license.xml derived from your policy axes, plus the robots.txt License pointer (opt-in)
- Security headers — six optional response headers (X-Content-Type-Options, Referrer-Policy, Permissions-Policy, HSTS, CSP-Report-Only, X-Frame-Options); all off by default and picked one by one under Settings → Advanced
- IndexNow instant indexing (Bing/Yandex/Seznam/Naver — opt-in)
- WebMCP (in-browser agent surface for your site's public information)
- AI traffic share (opt-in daily channel counters)
- Bot traffic dashboard — a 30-day chart and per-bot breakdown of AI crawler visits
- Bot verification (opt-in) — once enabled, downloads public bot IP lists and Web Bot Auth signature key directories once a day to flag spoofed bots and cryptographically verify signed agents (works even behind a proxy/CDN, where IP checks must abstain); no visitor data leaves your site
- Bot blocking & spike alerts (opt-in) — pick the bots to watch, then turn blocking on whenever you decide to, behind an explicit confirmation; the panel recommends a 7-day monitoring window first and warns you if you enable it earlier, but nothing is time-locked and you can stop blocking with one click; optional email when traffic spikes
- Page analysis — daily per-page counters (GDPR-neutral: no IPs, no user agents) feed a per-page evidence panel showing which engine fetched which page on demand, a crawl-freshness funnel (which pages changed after the last crawl), and a 28-day attention-decay radar for pages AI is losing interest in
- AI-404 phantom URL recovery — a report of URLs assistants think exist (404 hits with an AI user-agent or AI-platform referrer), the closest real page suggested by edit distance, and an optional per-row 301 applied ONLY to AI-originated requests
- GEO change log — every visibility-affecting setting change is marked on the traffic chart with an honest before/after delta (correlation, not causation)
- Bot health alarms — a silence sentinel for regular crawlers that go quiet and a spoof-surge guard with an explicitly confirmed, one-click "403 spoofed-only" switch
- Page readiness score + Triage — a per-page content-readiness sub-score with an in-editor meta box and a site-wide triage view
- Weekly (or daily) digest email (opt-in) — a summary of bot traffic, fading pages and your weakest pages
- No files are written — everything is served virtually and switches off without a trace.
- No cloaking — humans and bots see the same content; only the format may differ when a client asks for it.
- No fake manifests — discovery files are published only when they describe something real.
- No upsell surfaces — this plugin never asks you for a key and never stores one.
屏幕截图:
常见问题:
Does it modify my files or content?
No. Nothing is written to your files and your post content is never changed. All endpoints (llms.txt, AGENTS.md, the product feed…) are served virtually. Disable a module and it is gone without a trace.
Do I need a key or an account?
No. There is no key field anywhere in this plugin, nothing to activate and nothing to buy. All 19 modules and every measurement screen work as soon as you switch them on.
Where does the scan result appear?
On the service's own page, in the browser tab that opens when you press "Scan". The plugin does not fetch the report back into wp-admin and does not store it.
Does the plugin send data anywhere on its own?
With everything at its defaults, no: there is no telemetry and no outbound call happens on its own. If you enable an opt-in module, it makes only the calls described in the "External services" section — IndexNow submits a URL when you publish, update or remove a post, and bot verification downloads public crawler IP lists and signer key directories about once a day. The plugin never phones home.
Will it conflict with my SEO plugin?
No. When Yoast SEO, Rank Math, AIOSEO or SEOPress is detected, Index Harmony defers the overlapping schema/meta output to them and tells you so in the panel. When Yoast SEO's Schema Aggregator serves /schemamap.xml, that address is left to Yoast. If another plugin also publishes llms.txt (Yoast SEO, Rank Math, All in One SEO, Hostinger Tools, Website LLMs.txt), the llms.txt module names it and tells you how to keep a single producer — it never deletes another plugin's files or switches its features off.
Is this cloaking?
No. Visitors and bots always receive the same content. Markdown negotiation only changes the format when a client explicitly asks for it.
更新日志:
0.9.47
- New: Link headers also announce the registered link relations
describedby(llms.txt, on every page, as llms.txt v2 recommends),service-desc(openapi.json, RFC 8631) andlicense(license.xml, RSL 1.0); the existing rel values stay exactly as they were. On sites kept private with Members or Force Login, endpoints that return 404 to logged-out visitors are no longer announced, mcp.json is announced whenever it is served (also when only the Site MCP is on), and Verify now checks every announced link rather than the first one it finds. - New: RSL — /license.xml is served as
application/rsl+xml, and every page links to it with<link rel="license">(plus its own Link header when the Link-headers module is off). - Updated: /.well-known/api-catalog sends its own
rel="api-catalog"Link header (RFC 9727 §2 — also on HEAD requests and sub-directory installs), uses the RFC 9727 profile parameter, and adds a REST API context withservice-desc(openapi.json) andservice-doc. security.txt's default expiry is now 364 days ahead (RFC 9116 recommends less than a year). - New: coexistence with other plugins that publish the same files. When Yoast SEO's Schema Aggregator (Yoast SEO 28.3+) serves /schemamap.xml, Index Harmony leaves that address to it and says so in the panel. The llms.txt module now recognises another producer — a physical llms.txt or llms-full.txt (Yoast SEO, All in One SEO, Hostinger Tools or an unknown file), another plugin's earlier address rule (Website LLMs.txt) or Rank Math's llms.txt module — names it and explains how to keep one producer (or, for a file left behind by a plugin that is no longer active, that the file can simply be deleted), instead of always advising to delete the file. Its own responses carry an
X-Index-Harmonyheader, so Verify reports a conflict rather than a false "verified" when visitors actually get another plugin's file. Nothing is deleted or switched off for you. - New: 6 more AI bots — OAI-AdsBot, Google-GeminiNotebook, Meta-WebIndexer, MistralAI-Index, MistralAI-Training and Claude-Agent (31 in total) — in robots.txt, the visit log and the engine breakdown; OAI-AdsBot and MistralAI-Index are verified against their operators' published IP lists, and MistralAI-Training joins the optional training-preference alignment. Google-GeminiNotebook is a user-triggered fetcher and the operators of OAI-AdsBot and Claude-Agent do not say they read robots.txt, so those three groups are documentary. On the bot-blocking screen OAI-AdsBot sits in its own "ad and link-preview checkers" group.
- New: with the AI policy module on, when Content Signals say
ai-input=no, pages also carry Bing's page-level grounding preference —<meta name="bingbot" content="ai-grounding:disallow">andX-Robots-Tag: bingbot: ai-grounding:disallow— which Bing applies from February 1, 2027. Training is still covered by the robots.txt training-preference group. - New: with the Site MCP turned on, its abilities are also offered to the WordPress MCP Adapter (0.7.1+ lists only abilities marked for MCP); the same administrator permission applies. The
agrc_abilities_mcp_publicfilter turns this off. - Fixed: Markdown responses no longer replace other X-Robots-Tag headers with their own.
- Fixed: on the bot-blocking screen the per-group counters and "select all" labels now update as you tick boxes; the digest email shows translated bot purposes; bot verification refreshes the oldest IP list first, so the same lists are not skipped every day when the time budget runs out.
- Docs: the privacy-policy text now names the Common Crawl and DuckDuckGo IP lists and describes the Web Bot Auth key-directory download as the -01 draft defines it.
- Security: on sites kept private with Members or Force Login, the content-carrying virtual endpoints (Markdown copies including
/slug.md, llms.txt, llms-full.txt, AGENTS.md, the schema map, the product feed and the .well-known API files) answered logged-out visitors before the privacy plugin's gate ran. They now return 404 to logged-out visitors — and, on a multisite network, to logged-in users who are not members of that site, matching both plugins' own rules; Force Login'sv_forcelogin_bypassallow-list (and its older whitelist filter) is honoured and the newagrc_public_content_allowedfilter covers other gate plugins. robots.txt, ai.txt, license.xml and security.txt are unchanged. - Security: password-protected posts, and posts limited to certain roles with Members' content permissions (other membership plugins can use the new
agrc_post_restrictedfilter), no longer appear in llms.txt, llms-full.txt, AGENTS.md, the schema map, the Markdown index and discovery links or the product feed (their opening words were published), are not served as Markdown to visitors who cannot read them, and their meta / Open Graph description and FAQ, HowTo, Video and Product JSON-LD no longer carry their text. Posts marked noindex in Yoast SEO or Rank Math and WooCommerce products hidden from the catalog are left out of those lists too, and Markdown responses repeat the page's noindex as an X-Robots-Tag. Lists built by earlier versions are discarded on update and are now also rebuilt when a post is unpublished, trashed, made private or given a password; on a private site llms.txt is no longer marked cacheable by shared caches. - Privacy: Person JSON-LD only publishes givenName / familyName when they match the author's public display name, so an author who chose a pen name is not unmasked.
- New: Site MCP speaks MCP 2026-07-28 — stateless requests with per-request
_meta,server/discover,resultType, cache hints, the MCP-Protocol-Version / Mcp-Method / Mcp-Name header checks and the new error codes — while clients that start withinitializekeep working (2025-11-25 is added; 2025-06-18, 2025-03-26 and 2024-11-05 stay). Tools now carry titles and read-only / idempotent hints, return structured content, and validate their arguments against their schema (a text value such as "false" can no longer switch a module on). Requests from a foreign browser Origin are refused (DNS-rebinding protection, extendable withagrc_site_mcp_allowed_origins; allowed browser origins also pass the CORS preflight for the MCP headers), the WordPress Abilities adapter converts its arguments the same way, and the server now identifies itself as Index Harmony. - New: when Content Signals say
ai-train=no, robots.txt also publishes the shared AI-training preference groupUser-agent: __usage_ai-training/Disallow: /(draft-kelley-aipref-training-preference-signal-00), which Anthropic honours now and Google and Bing have announced for 2027. Because a rule that names a crawler takes precedence, two opt-in options under Settings → General can align the named training crawlers and Google-Extended with that choice; Verify points out training crawlers that remain allowed by name. - Updated: Web Bot Auth follows draft-ietf-webbotauth-httpsig-protocol-01 (October 29, 2026) — a Signature-Agent value is now the key-directory URL itself, members with parameters are ignored, and a key's
kidis accepted alongside its JWK thumbprint; the draft's new Appendix E.2.1 test vector verifies. Values that name only a host keep using the well-known directory path, and keys cached by 0.9.45 carry over. A signature verified against a key set on some other path is logged with that path, not just the host (only the well-known directory speaks for the host). - Updated: bot verification uses Perplexity's current IP-list address and adds IP-list verification for CCBot (Common Crawl) and DuckAssistBot (DuckDuckGo); Amazon's list format is read correctly. Microsoft Copilot's copilot.com and copilot.cloud.microsoft are recognised as AI referrers.
- Updated: IndexNow also reports URLs that were unpublished, trashed, deleted or re-slugged, sends one batched request per page load (per site on a multisite network, with that site's key), and pauses while Settings → Reading discourages search engines or the site runs as a local, development or staging environment.
- Updated: Markdown negotiation honours Accept q-values (
text/markdown;q=0is a refusal; Markdown is chosen only when preferred at least as much as HTML, and wildcards such as*/*count for HTML), accepts?output_format=md, addsVary: Accept, and Markdown responses keep the Content-Signal, Content-Usage and Link headers when those modules are on. - Changed: /.well-known/agent-card.json is no longer served by default — an A2A agent card advertises an agent endpoint this plugin does not run. Sites that run one can turn it on with the
agrc_serve_agent_cardfilter. - Fixed: robots.txt — when the content outside this block ends with a group that has no Allow/Disallow rule, the block now closes it first, so the block's first group (such as the training-preference group) can no longer merge into it and block those crawlers; Verify also reports crawlers this block blocks that another group re-opens by name.
- Fixed: bot-log paths keep their percent-encoded characters, so non-ASCII URLs no longer collide in the visit log, the daily counters and the AI-404 map (the stored form is stable, so AI-404 redirects can be approved for every logged path); the AI-404 live check no longer doubles the sub-directory on sub-directory installs.
- Fixed: AI traffic share no longer counts search-engine crawlers, SEO tools and scripts (or empty user agents) as human visits, and ignores robots.txt, feeds and policy files.
- Fixed: per-language robots.txt Sitemap lines and AGENTS.md links are correct for WPML
?lang=URLs and region-coded language slugs; the OpenAPI document declares its path parameters, skips routes it cannot express and keeps one of two identical templated paths; the product feed and schema map drop XML-forbidden control characters and noncharacters, and the schema map skips noindex / hidden items and refreshes when a post changes; AGENTS.md describes theuse=Content-Signal value correctly; ai.txt's refusal comment is in English; llms.txt adds WooCommerce products only in the standard content scope; the CSV export is clean on PHP 8.4; the scheduled digest reads the self-check results regardless of the admin's language; page-score summaries include every scored public post type.
- Fixed: the robots.txt block's
User-agent: *group, which carries only the Content-Signal and Content-Usage lines, is now closed with a neutral emptyDisallow:. Records other than Allow/Disallow do not end a group (RFC 9309; Google's parser follows this), so crawlers read that group together with the first AI-bot group. ItsAllow: /then also applied to every crawler without its own group, which on a site whose robots.txt also saidUser-agent: */Disallow: /re-opened the site to all of them. - Fixed: Web Bot Auth signature verification now follows the IETF working-group draft (draft-ietf-webbotauth-httpsig-protocol-00), which requires signers to cover their Signature-Agent dictionary member as
"signature-agent";key="…". Earlier versions never attempted that parameterised component, so signers following the draft could not earn the verified-signature badge (only the legacy single-string form verified). Both forms now verify, checked against the draft's Appendix E.2.1 and E.2.2 test vectors. Every web-bot-auth signature on a request is tried (not only the first), the recorded signer host is the member the signature actually refers to, directory members must be a plain https origin,type=jwks_uri/cimdmembers are ignored, and the key-directory download no longer follows redirects (the draft forbids it). - Compatibility: WebMCP tools follow the W3C WebMCP draft (October 20, 2026) —
document.modelContext(with anavigator.modelContextfallback for early previews), a title and thereadOnlyHintannotation on every tool, plain JSON results, and a rejected duplicate registration no longer logs an uncaught error. - New: AI traffic share also recognises AI clicks that arrive without a referrer (or with one that is not a known AI, search or social site) through their utm_source (ChatGPT appends
utm_source=chatgpt.com); the card explains how its AI row lines up with the AI Assistant channel in Google Analytics 4. The same signal now applies to the AI-only redirect for AI-sourced 404s, and that redirect keeps the visit's utm_* tags. Internal navigation is never counted as AI. - New: robots.txt diagnostics — Verify now reads your live robots.txt with RFC 9309 group rules and reports AI bots that another layer (for example Cloudflare's AI crawler settings or another plugin) blocks site-wide while this block allows them, site-wide path rules that AI bots skip, and conflicting site-wide Content-Signal lines. It only runs when this block is actually being served.
- New (optional, off by default): Settings → General → Site-wide path rules copies your
User-agent: *path rules (never a site-wide rule such asDisallow: /orDisallow: /*; copied rules can then also appear as partial restrictions for those bots in scans) into each allowed AI bot group, so rules such asDisallow: /wp-admin/reach those bots too.
- New: IETF Content-Usage
ai-usecategory — draft-ietf-aipref-vocab-08 (September 14, 2026) definesai-use(using content as input to AI answers, such as grounding and retrieval, as opposed to training). Your Content Signalsai-inputpreference is now published astrain-ai=…, ai-use=…, search=…in the robots.txt Content-Usage line, the Content-Usage response header and the ai.txt mirror. Readers that do not know the new key ignore it, so the train-ai and search meanings are unchanged. - New: llms.txt v2 discovery (llmstxt.org, August 10, 2026) — with Markdown negotiation on, every content page announces its Markdown version with
rel="alternate" type="text/markdown"(Link header and HTML link tag), and when the llms.txt module is on, pages and Markdown responses point to /llms.txt withrel="describedby". Markdown URLs use the{page}.mdform v2 recommends, falling back to?format=mdfor plain permalinks, the front page and attachments. Only pages whose Markdown is actually served are announced (password-protected posts, drafts and previews are not).
- Fixed: after deactivating and re-activating the plugin, its virtual endpoints (llms.txt, ai.txt, AGENTS.md, the .well-known files, license.xml, security.txt, the product feed) answered 404 until any module was toggled — the hook that runs when the plugin is switched on flushed the rewrite rules before the modules had registered theirs. The flush is now deferred to the next page load, where the rules are present (the path plugin updates already used).
- Audit round: static analysis (PHPStan level 8 with WordPress stubs) over every shipped file, an AJAX/REST authorization sweep, cron teardown parity, i18n key and placeholder coverage, and a live end-to-end run on WordPress 7.1 (setup wizard, the Content-Signal
use=field, Markdown negotiation, every admin screen) found no further defects; two stale docblocks and one null-safe cast were tidied.
- New: Content Signals
use=field — the Content-Signal declaration (Settings → General) gains the optional fourth field Cloudflare added to the Content Signals format in 2026:use=immediate(interact only, store nothing),use=reference(index, excerpt and link back) oruse=full(summarise and reproduce). When set it is appended to the robots.txt Content-Signal line, the Content-Signal response header and the ai.txt mirror; left undeclared, nothing changes. RSL, TDMRep and IETF Content-Usage have no equivalent term and are deliberately not touched, and the setup wizard's policy presets keep the field intact. - New: Markdown negotiation responses now send an
X-Markdown-Tokensheader with the estimated token count of the Markdown body — the convention established by Markdown for Agents (February 2026) — so agents can plan context windows and chunking before reading. - Compatibility: reviewed against WordPress 7.1 (iframed editors, list-table markup, Abilities API lifecycle filters); no changes were needed.
- Hardening (audit round): the
expirestimestamp of a Web Bot Auth signature is now a hard cutoff — an expired signature can no longer earn the verified badge through the clock-skew allowance (the skew tolerance now applies only tocreated, so signers with a slightly fast clock still verify). - Fixed: signer hosts whose key directory could never be fetched used to stay in the cache indefinitely and were re-tried every day forever; failed directories are now dropped after 7 consecutive failed fetches (a signer that comes back simply re-enters through its next signed request), and the cache-size cap now evicts never-successful entries first.
- Docs: the privacy descriptions now also disclose the stored 0/1 signature-verification flag and the signer key-directory downloads, and two stale internal counts (24→25 known bots, 11→12 verifiable bots) were corrected.
- New: Web Bot Auth cryptographic verification — while bot verification is enabled, bot visits that carry an RFC 9421 Signature-Agent header are now actually verified: the plugin fetches the signer's public Ed25519 keys from its standardised
/.well-known/http-message-signatures-directory(daily, cached, capped) and checks each signed request's signature locally (tagweb-bot-auth, JWK-thumbprint key ids, created/expires freshness). Verified visits get a distinct "Signed ✓" badge and asig_verifiedCSV column; unverified ones keep the neutral presence badge — a failed or unavailable check never accuses anyone. Follows draft-meunier-webbotauth-httpsig-protocol-02 (August 2026), including the current dictionary Signature-Agent form with the legacy string form still accepted. Unlike IP-list checks, signature verification also works when your site sits behind a proxy or CDN. - Improved: the bot-verification toggle description and the External services documentation now spell out the signer key-directory downloads, and the traffic-log signature badge distinguishes "carried a signature" from "signature verified".
- Fixed: the FAQ still said "all 18 modules" — the module count has been 19 since RSL licensing shipped.
- New: RSL content licensing (opt-in module) — publishes a machine-readable RSL 1.0 licensing document at /license.xml, derived from your existing Content-Signal policy axes, and adds the matching License pointer line to robots.txt (rslstandard.org — the open standard backed by Reddit, Yahoo and Medium).
- New: IETF Content-Usage — the AI policy module now emits the draft-ietf-aipref-attach preference expression (train-ai / search) alongside Content-Signal, both as a robots.txt directive and as an HTTP response header, and mirrors it in ai.txt.
- New: Web Bot Auth signature flagging — bot visits that carry an RFC 9421 Signature-Agent header (OpenAI and Google's agent.bot.goog identity already sign) are flagged in the traffic log and CSV export with the signer's key-directory host. Presence detection only; this version does not claim cryptographic verification.
- New bot: Google-Agent — Google's user-triggered AI agent fetcher (Gemini agent features and Project Mariner; added to Google's official crawler list in March 2026) joins the robots.txt manager (25 bots total), the traffic log with Gemini engine attribution, and opt-in IP-list verification via Google's published ranges.
- Docs: the External services list now includes Google's IP-range list, and the privacy description documents the new signature-host column in the visit log.
- First release on WordPress.org: 18 fix modules, setup wizard, tabbed settings, 17-language admin panel, virtual & traceless fix architecture — no key, no account, no paid tier anywhere in the plugin.
- Measurement & insights: bot traffic dashboard, opt-in bot verification, bot blocking & spike alerts, page readiness score + Triage, and an opt-in weekly/daily digest.
- Page-analysis suite: GDPR-neutral daily per-page counters powering a per-page AI evidence panel, a crawl-freshness funnel, a 28-day attention-decay radar, AI-404 phantom URL recovery with optional AI-only 301s, a GEO change log with before/after impact, and bot health alarms (silence sentinel + spoof-surge guard with an explicitly confirmed spoofed-only 403).
- Content scope & curation: opt other plugins' public content types into your llms.txt, AGENTS.md and page scoring, hand-pick which pages your llms.txt highlights with a live search picker, or edit the published llms.txt body directly.
- Security headers now have a selection screen (Settings → Advanced): six optional response headers, each off by default and switched on one at a time.
- Guideline & hardening pass: this build contains no licensing, unlock or update-check code at all, and nothing in it is limited by time, by usage or by anything you could pay for — bot blocking in particular is never time-locked, it only recommends a monitoring window and warns you if you switch it on early. It also defers sitemaps and Product schema to your SEO plugin and WooCommerce correctly, adds cache invalidation for llms.txt and the product feed, moves audits off visitor requests, and registers a personal-data exporter/eraser for author profile fields.
- Polish pass: working Amazonbot IP verification, panel-language number/date formatting on measurement screens, an honest warning (plus withheld advertising) for .well-known endpoints on subdirectory installs (RFC 8615), and Index Harmony-branded public identifiers (REST index-harmony/v1, block index-harmony/nap, index_harmony_* shortcodes).