Site-First SEO

Site-First SEO is a practical on-site SEO toolkit for WordPress sites that need clear diagnostics, clean metadata, local/entity schema, crawl controls, redirect recovery, lightweight visit tracking, and protection from suspicious automated traffic. The plugin is built around your own WordPress content and server-side signals. It does not require Google API keys, external SEO subscriptions, or off-site crawlers to be useful. Each module focuses on an action a site owner, consultant, or agency can take inside WordPress. Current module scope

• Dashboard: shows responsive site-health charts, visits, SEO quick wins, content health signals, recent 404s, recent bot activity, and traffic quality snapshots.
• Titles and Meta: edit SEO titles, meta descriptions, noindex, canonical URLs, and page-level schema mode from one table.
• SERP Preview: preview title and meta description length while editing snippets.
• Content Health: scores important pages using title, description, headings, images, internal links, indexation, and structured data signals.
• Headings and Images: audits heading structure, treats the WordPress page or post title as the expected H1, flags extra content H1s, and reports missing image alt text.
• Links Overview: maps internal link counts and helps identify orphaned or under-supported pages.
• AI Readiness: scores pages and site-level signals for crawlability, extractability, schema/entity clarity, answer-friendly structure, freshness, sitemaps, robots, and llms.txt support without external APIs.
• Indexation Monitor: reviews noindex, canonical, sitemap inclusion, and other page-level indexability signals.
• Content Decay: surfaces older or lower-supported content that may need refreshing.
• Internal Link Manager: suggests internal link opportunities, supports anchor selection, inserts approved links, and lets you hide pages from future suggestions.
• Local SEO Schema: manages organization and LocalBusiness details, NAP, service areas, opening hours, Google Business Profile URL, principal/founder entity, services, software/tools, entity pages, ProfilePage schema, Article schema, FAQ schema, and breadcrumbs.
• Native schema controls: adds schema selection to the WordPress posts list and the Titles and Meta screen.
• Author Box: adds editable, per-post author attribution with site-wide defaults.
• Redirects and 404s: logs missing URLs, creates redirects, suggests likely targets, and supports IP blocking from repeated 404 activity.
• Visits Tracker: records lightweight local visits and detects common AI crawlers such as GPTBot, PerplexityBot, ClaudeBot, and other search or AI bots.
• Bot Block: monitors exploit probes and suspicious automation with behavioral scoring, verified crawler handling, request logs, retention controls, cache-aware browser beacons, filters, CSV exports, and a rule simulator.
• XML Sitemaps: generates clean post type and taxonomy sitemaps.
• Robots.txt: manages robots.txt directives from WordPress.
• llms.txt: serves a root-level Markdown overview for AI assistants and retrieval tools.
• UTM Builder: creates consistent campaign URLs.
• Exports: exports useful SEO, link, image, redirect, and bot data for reporting.
• Module Controls: enables or disables major modules from a central settings screen.

Bot Block protection and traffic monitoring Bot Block offers Monitor, Soft block (429), and Hard block (403) modes. Monitor records suspicious behavior without enforcing score-based blocks. Enable Block Common Exploits to immediately reject recognized sensitive-file and exploit probes in every mode, before crawler and user allowlists are evaluated. Exploit protection covers source-control metadata, .env files, cloud credentials, configuration backups, ALFA shell paths, PHP-CGI executable probes, and CGI argument-injection queries. Detection handles encoded paths, backslash separators, and Windows ::$DATA variants. Known exploit probes do not trigger crawler DNS lookups. Google, Bing, and Apple search crawler identities use cached reverse and forward DNS verification. Automatic crawler and user-agent allowances apply to GET and HEAD requests. POST and other write methods receive behavioral scoring unless a safe endpoint or an explicit path/IP allowance applies. Scoring watches request velocity, repeated paths, rotating user agents, suspicious POST requests, and rotating HEAD/OPTIONS probe bursts. Activity logs and CSV exports retain decisions, scores, matched rules, crawler classifications, request body types, and observed response status. Request body contents are not stored. The rule simulator supports exploit paths and PHP-CGI query probes. Cache-aware browser beacons remain available, with aggregate totals shown separately from PHP-visible bot/human percentages. Protection applies to requests reaching WordPress; files served directly by the web server or CDN require server-level protection. A declared crawler User-Agent is not proof of crawler identity, and logged requests do not represent all cached traffic. Local and entity SEO The Local SEO Schema module now supports a layered entity workflow:

• Define the business with a stable Organization or LocalBusiness ID.
• Connect a principal or founder to the organization with Person and ProfilePage schema.
• Map core services to Service entities and optional service page URLs.
• List software, tools, places, and other known-about entities.
• Track human-readable entity pages such as About, services, industries, and location pages.

This keeps the schema aligned with the pages real visitors can read, which is the foundation for stronger local SEO and entity understanding. Why use Site-First SEO?

• Works inside WordPress without external API keys.
• Focuses on on-site fixes you can make immediately.
• Combines traditional SEO, local SEO, and AI-search readiness signals.
• Keeps modules optional so each site can stay lean.
• Provides reporting-friendly diagnostics without turning every workflow into an upsell.

1.1.14

• Expanded Bot Block protection for ALFA shell paths, PHP-CGI argument injection, cloud credentials, and encoded Windows alternate-data-stream probes before allowlisting.
• Avoided crawler DNS lookups for known exploit probes and retained existing request logging and verified search crawler handling.
• Restricted user-agent allowlisting to GET/HEAD requests and strengthened scoring for rotating HEAD/OPTIONS probe bursts.

1.1.13

• Added a cache-aware browser beacon for Bot Block so full-page caching does not hide normal browser page views from the dashboard.
• Added aggregate cache-aware beacon totals and top-path reporting alongside PHP-visible Bot Block bot/human metrics.
• Kept Bot Block percentages based on PHP-visible request logs while showing browser beacons separately to avoid double-counting cached and uncached page views.

1.1.12

• Updated Article schema author output to use the selected Author Box profile when available.
• Added optional Person / ProfilePage URLs for saved Author Box profiles.
• Redesigned the Settings screen with grouped option cells, icons, and profile cards.

1.1.11

• Added ProfilePage schema for configured principal/founder pages in Local SEO Schema.
• Added Profile Page as a page-level schema mode in the editor, posts list, and Titles and Meta screen.
• Connected LocalBusiness principal Person output to the matching ProfilePage entity.

1.1.10

• Expanded the Author Box module with three saved author profiles.
• Added a post-level author profile dropdown so each post can use the site default author or select a specific profile.
• Preserved legacy per-post author box content as a fallback for existing posts.

1.1.9

• Added an Author Box module with site-wide defaults and per-post display controls.
• Added dashboard health charts for SEO title coverage, meta description coverage, indexability, and image alt text coverage.
• Improved dashboard layout constraints to prevent horizontal scrolling on narrower admin screens.

1.1.8

• Added an API-free AI Readiness module for page-level and site-level answer-system readiness checks.
• Added llms.txt support with a local generator, admin controls, and preview.

1.1.7

• Improved Bot Block safety around WooCommerce cart, checkout, account, and payment callback endpoints.
• Reduced Bot Block database logging checks during shutdown so it does not add noise when another request has already put MySQL in an error state.

1.1.6

• Expanded Local SEO Schema with principal/founder ProfilePage, service, software/tool, and entity page mapping.
• Connected LocalBusiness output to the canonical organization @id and added richer Person and Service relationships.
• Rewrote the readme to reflect the current module scope.

1.1.5

• Expanded Bot Block with common exploit protection, IP velocity and repeated-path scoring, rotating user-agent and suspicious request detection, and verified search crawler identities.
• Added HTTP response metadata, matched-rule and request-body classification fields to Bot Block activity logs and CSV exports.
• Added configurable log retention, automatic cleanup, manual log clearing, activity filters, a rule simulator, and WordPress privacy-policy suggested text.

1.1.4

• Improved Headings and Images analysis by treating the post title as the page H1, flagging extra content H1s, adding issue filters, and expanding image alt reporting.

1.1.3

• Added schema type selection to the native Posts list and the Titles and Meta listing page.

1.1.0

• Added Indexation Monitor, Content Decay, Internal Link Manager, and Local SEO Schema tooling.
• Added tips for using each module.

1.0.10

• Added Bot Block-style IP blocking actions to the Redirects and 404s 404 log.
• Added module enable/disable controls to Settings.
• Moved the Settings menu item below UTM Builder for a cleaner admin menu.

1.0.9

• Confirmed compatibility with WordPress 6.9 and PHP 8.5 beta; no functional changes.

1.0.8

• Improved Titles and Meta module.

1.0.7

• Fixed Save All behavior for Titles and Meta.

1.0.6

• Improved Bot Block functionality.
• Moved exports into supporting modules.
• Improved redirect management.
• Added dashboard widget support.

1.0.5

• Fixed reset button behavior on the Visits dashboard.

1.0.4

• Added stability fixes for legacy plugins.

1.0.3

• Added Bot Block module.

1.0.2

• Stable public release.
• Improved Content Audit with GEO readiness checks.
• Enhanced dashboard performance.

1.0.1

• Added Redirect Manager and 404 monitoring.
• Added image alt and broken link auditing.

1.0.0

• Initial release with content audits, internal links, visits tracker, and sitemap generator.