| 开发者 | itay12222 |
|---|---|
| 更新时间 | 2026年8月12日 11:55 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 7.0 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
<head>.
WordPress can be given permission to write posts, pages and media over its own REST API, but not to write there. So the last step of connecting any of those three is a person being asked to paste a snippet into a theme file or into an SEO plugin's settings — and the person being asked is usually a business owner who paid somebody to build the site two years ago.
This plugin removes that step. Install it once, and Marcelo can place those tags itself.
What it does
<head> — a Search Console verification, an Analytics tag and a Tag Manager container — built from the identifier of each rather than from any markup it was handed.meta description — the sentence a search engine shows under the page in its results. WordPress core keeps no such field, and every SEO plugin uses its own hidden one, so a description written into any of those keys is invisible on a site running a different plugin.pre_get_document_title — the filter core publishes for exactly this, and the one every common SEO plugin uses. This is not the post's own title: post_title is the name of the page in the admin and usually the heading a visitor reads, and changing it does not change the title a search engine shows on a site running any SEO plugin.LocalBusiness schema block describing the business, as JSON-LD in the head of every page.post_content; Elementor keeps its own copy in a protected postmeta field and prints that instead, so a write to post_content on an Elementor page succeeds and changes nothing a visitor reads.tel: link, printed at wp_footer on every page. It is Marcelo's own element and touches nothing the site already had, so clearing it removes it completely.robots.txt file sitting in the site's root is refused rather than touched: the webserver serves that file directly and WordPress is never asked for one, so nothing a plugin does could change what a crawler reads.canonical link back at the page itself, where the one on it names another website. This is the only thing here that displaces markup the site was already printing rather than adding markup of its own — see below for exactly how far that reaches, and where it stops.hreflang alternates where it is missing one — the one entry that says "this page is itself". Nothing else in the head is touched: whatever else prints the page's other alternates is left exactly as it is, and only the language code is stored — the address is always built from the page's current request, never stored, so it stays correct if the domain ever changes.manage_options.G- measurement id, a GTM- container id — and nothing else. Google's scripts are then loaded through wp_enqueue_script, from a URL this plugin builds, so no text a caller sends can reach a visitor's browser: there is no path by which any is stored.<script type="application/ld+json"> whose body parses as JSON, re-encoded from the parsed value rather than stored as received. A field named for structured data that accepted arbitrary script would be a larger plugin than this one.<title> element, where a surviving < would close the element early and put whatever followed onto the page. It is never written to the post itself — nothing here calls wp_update_post, and no page is renamed.title-tag support, because on every other theme WordPress prints one itself and a second would give the page two. Where a theme with no such support echoes its own <title> into header.php, nothing here can reach it and the page ends up with two; Marcelo reads the page afterwards, sees the two, and takes its own title off again.wp_safe_redirect.robots.txt in the site's own root, worked out from ABSPATH and never taken from a request, and it is named in order to be refused rather than written.noindex on every page, and it is a decision somebody made on purpose — on a staging site or a site not ready to launch, the right one.wp_footer, with no JavaScript at all and with every style rule namespaced under .marcelo-call-bar, so it cannot restyle a single element the site already had. It reserves its own height as padding on the body rather than sitting permanently on top of the page's last line, and it hides itself when the page is printed. The phone number is checked against a strict pattern before it is stored and escaped again on the way out.No. The plugin makes no outbound connections at all — not to Google, and not to Marcelo. Everything travels the other way: your site's own administrator sends it what to place, over your site's own login, and it places it.
The tags stop being printed, and the stored snippets are kept — so reactivating restores them without reconnecting. Deleting the plugin removes them.
No. Nothing in your theme is read, edited or replaced — the plugin adds one element of its own at the wp_footer hook, which is the same mechanism it uses for the Google tags. Turning it off removes that element and the page is exactly what it was before.
It cannot, and it will not try. If your site has a real robots.txt file in its root, your webserver serves that file and WordPress is never asked for one — so this plugin has no way in, and it says so, with the file's full path, rather than reporting a change that would never have happened. Where there is no such file, WordPress generates robots.txt on every request and this plugin changes what it generates.
They go with it, and every address that was a 404 before is a 404 again. Deactivating keeps them, like the snippets.
No, and the reason is structural rather than a promise. The plugin does not store what it is sent. It looks for the three things it knows — a Google site-verification token, a G- Analytics measurement id, a GTM- container id — and writes the tag itself from a fixed template with that id in it. Text that is not one of those three is not stored, so there is nothing for it to print.
A caller must also already be able to manage_options, which is an account that could install a plugin doing far more. Both are true; the first is the one that would still hold if the second failed.
wp-content, nothing about the server above it — and the line number, the same information WordPress's own fatal-error screen already shows to a signed-in administrator, which is the trust level a request reaching this route already has.wp and template_redirect — and a request coming in over the REST API never reaches either. A great many themes and plugins start their front-end half on those two steps, including loading the files that define the functions their own templates then call.example.com/blog sent visitors to example.com/blog/blog/the-new-page. Every path this plugin stores is measured from the domain root, and one function turned it back into an address by appending to the site root — so on a root install it was right and on a subdirectory install it doubled the folder. The self-referencing hreflang tag named an address the same way and had the same fault. Both build the address from the site's own origin now.WP_Post built in memory for the length of one request, never wp_insert_post, so there is no post, no draft, no auto-draft, no revision and no row in any table. It has no id, because it has no row.template_include filter, so what comes back is the page this site would have served rather than a generic frame with some text in it. A site whose theme cannot draw a page it has no row for is told so plainly, and the caller shows no preview at all — a half-drawn page presented as a preview is worse than none.wp_kses_post, the same rule WordPress core applies to post content from anybody without unfiltered_html, so the preview is drawn from the characters the page would really carry.SELECT, SHOW, DESCRIBE, EXPLAIN, SET and the transaction words. Anything else is turned away, rather than the other way round: the ways of writing to MySQL are not a list this plugin could finish, and the code running while a page draws belongs to somebody else.[the-shortcode] where the published page would display what it produces.exit, a memory limit, a time limit. A site left read-only by a preview that never finished would be a site where publishing silently does nothing, which is worse than a preview that failed.24 hours. That decision is made against a record a person filled in and cannot be made here — this plugin stores and prints words that arrived and refuses the ones that are the wrong shape. A business that closes at five is never sent anything by this route, because a firm advertised as always available on the strength of its opening hours is the worst thing this feature could do.openingHours in the schema block, and the difference is the whole point. That is markup in the head of the page and no visitor will ever see a word of it; this is a line somebody reads. Answering "the page never says when you answer" with a block in the head would tick the finding without changing a word anybody reads.wp_footer rather than wp_body_open, though the top of the page is where a line like this reads best. wp_body_open is a hook a theme may or may not call, and an element that silently fails to print is worse than one printed lower down: it would be recorded as published and be nowhere on the page.sameAs property in the schema block, and the difference is the whole point. That is markup in the head of the page and no visitor will ever see a word of it; this is a link somebody can click. A site can have one and not the other, and answering "your website links to none of your profiles" with a block in the head would tick the finding without putting a link anywhere anybody could see.http or https scheme and a real host and is stored as it arrived; nothing goes looking for a business's Facebook page, guesses one from a name, or turns a host into an address. One refused address refuses the whole request, because a site linking to three of somebody's four profiles with nothing saying which one was dropped is worse than a site linking to none.photo-1024x768.jpg — is resolved back to the attachment it is a size of, and the original is what gets resaved.wp_image_editor_supports(). WordPress resizes with whichever of Imagick or GD the host has and a host can have neither, or a build of GD without JPEG support — which answers yes to "is GD loaded" and no to the question that matters. Reported as a hosting fact, because that is where it is fixed.srcset points at are rebuilt from the new file. Those are separate files generated at upload time, and a compression that fixed only the original would leave every copy a visitor is actually served exactly as heavy as it was — the page no faster, and the record saying it was fixed.AW- id before it is accepted — a Search Console token or a bare customer id is refused rather than fired on every page as a tag belonging to nobody.pre_get_document_title, registered last so it is the final opinion asked for. That filter is core's own way for a plugin to own the title and is the one Yoast, Rank Math, SEOPress, All in One SEO and The SEO Framework each use, so one hook wins against all of them without this plugin knowing anything about any of them.post_title is the name of the page in the admin, in the permalink and — on most themes — the heading a visitor reads at the top of the page. Every SEO plugin overrides the rendered <title> independently of it, so writing post_title to change a search result would change what a visitor reads and change nothing in Google. Nothing here calls wp_update_post.title-tag support never calls wp_get_document_title(), so the filter never fires there; where such a theme prints no title at all — which is the finding this most often answers — a title element of its own is printed instead, and where it prints one the page ends up with two. Marcelo reads every page back after writing and removes its own title from any page that does not come back carrying exactly one. Undoing is a normal step here rather than an error path.<title> element where a surviving < closes it early.robots_txt filter runs for the first and is never called for the second, so a plugin hooking it changes the first and does nothing at all to the second.Disallow: / under two User-agent lines is one rule about both of them, and taking it out for one would let the other in as a side effect nobody asked for.noindex on every page, and it is a deliberate decision — refused with the setting named, so it can be changed in WordPress by whoever made it.canonical link names another website can be pointed back at itself. This is the first thing this plugin does that displaces markup the site was already printing, and it is deliberately only half a mechanism — it removes WordPress core's canonical for that request and asks each of the five common SEO plugins, through the filter each publishes for exactly this, not to print theirs. A canonical a theme echoes directly into header.php is reachable by nothing, so the page then carries two; Marcelo reads every page back after writing, and removes its own override from any page that does not come back carrying exactly one. Undoing is a normal step here rather than an error path.JSON_HEX_TAG. A JSON string containing an escaped closing script tag survives the check that refuses a literal one, and re-encoding without this flag turns it back into a literal — which was harmless only for as long as the block was never printed.tel: link, printed on every page at wp_footer, so somebody who lands on a page can call without scrolling or hunting for a number.wp_add_inline_style on a registered handle, and every selector is namespaced under .marcelo-call-bar so it cannot restyle anything the site already had.G- measurement id and a GTM- container id — and no markup of any kind. A full tag can still be sent, and only the identifier inside it is taken.wp_enqueue_script instead of being written into the head. That means they can be deregistered and deferred like any other script, and are not loaded a second time when another plugin enqueues the same file — a site with Analytics installed twice counts every visit twice, and nobody finds that out by looking at the page. The Analytics configuration is attached to its own handle, so it can no longer run before the file it configures.script: any JavaScript passed, and so did onclick, which simply was not on the list. A deny list is only ever as good as the imagination of whoever wrote it.script of type application/ld+json, whose contents must parse as JSON, re-encoded from the parsed value rather than stored as received. A field named for structured data that accepted arbitrary script would be a larger plugin than this needs to be.