New: your AI Readiness Score is now snapshotted once a day by a background task (wp-cron), so the trend and 7-day delta keep tracking even on days you don’t open wp-admin. Local bookkeeping only — nothing is sent anywhere, no notice, no email.
New: score changes now say why. The Score tab, the Dashboard widget, and the opt-in digest email show which checks moved the number (“Citation bots can crawl you: -20 pts — robots.txt is blocking GPTBot”) instead of a bare “-8 this week”.
Fix: the redirect-form error notice now maps an internal error code to a fixed set of messages instead of echoing text from the URL. The old text was escaped (no injection), but a crafted link could make wp-admin display arbitrary wording — now it can’t.
0.24.0
New: the wp-admin Dashboard widget now shows your live AuditAE scorecard — AI citation rate, Search Console clicks, and GA4 sessions — when the site is paired and linked; unpaired sites see a one-line connect prompt instead.
New: when an AI crawler visits your site for the very first time, the Dashboard widget and the AI Crawlers tab celebrate it (“🎉 ClaudeBot discovered your site”) for a week. Shown only inside the plugin’s own screens — never as an admin notice.
New: every red/amber check on the AI Readiness Score tab now shows the points you win by fixing it (“+8 pts”), so the path to the next grade is concrete.
New: reaching a new best grade shows a one-off “New personal best — Grade B!” banner on the Score tab for a week. It auto-expires; nothing to dismiss.
New: optional score digest email — sign up on the Score tab for a weekly or monthly plain-text summary (score, change, points still on the table, AI crawler activity). Strictly opt-in and off by default; unchecking the box stops it.
Tweak: wp-admin now uses Newsreader, the auditae.app brand serif (bundled locally, no Google Fonts requests), and the real AuditAE logo mark.
Fix: the “Max” number field in the llms.txt Sections editor was too narrow to show its value on some browsers; it’s now sized and styled to be legible.
New: “Settings” (and “Connect to AuditAE” while unpaired) links on the Plugins-list row, so a fresh install can find the plugin’s home.
Fix: IndexNow now correctly skips posts marked noindex in Rank Math — the old check compared against the wrong data shape, so noindexed posts were still submitted (and PHP 8 logged a warning on publish).
Fix: a robots.txt returning a server error (HTTP 5xx) is no longer reported as “All clear” — per the robots standard, crawlers treat a 5xx as “block everything”, and the audit now says exactly that.
Fix: the crawler-log CSV export no longer emits PHP 8.4 deprecation warnings (which could corrupt the downloaded file on debug-enabled sites).
Fix: the Connect tab is now fully translatable; the Activity tab shows friendly “3 hours ago” times; the Redirects tab gained the same pairing hint the other tabs have; translation template regenerated for every new string.
Fix: posts built with Elementor, Divi, WPBakery, Beaver Builder, or Bricks no longer score all-red on the per-post AI Readiness checklist — their content lives outside the raw editor field, so the content-shape checks (opening, headings, depth) are now marked “skipped” instead of failed, and the badge grades only what can actually be analyzed.
Fix: word counts are now Unicode-aware — Chinese, Japanese, Korean, Cyrillic, and Arabic content was counted as ~0 words, permanently failing the depth and answer-first checks on non-Latin sites.
Changed: AI crawler hits now live in a small dedicated table ({prefix}auditae_crawler_hits, 90-day retention, dropped on uninstall) instead of wp_options. The old storage rewrote two large option rows on every bot pageview and could lose counts under concurrent crawls; busy sites get accurate numbers and far less database churn. Existing history migrates automatically on update.
Fix: redirect hit counters are now rate-limited to one bookkeeping write per rule per minute, so bots hammering a dead URL can’t generate a database write per request.
New: one-click robots.txt fix — when the audit finds AI citation bots blocked, an “Unblock AI citation bots” button appends explicit Allow rules to your (virtual) robots.txt, fully reversible; sites with a physical robots.txt file get a copy-paste snippet instead. Respects “discourage search engines”.
New: pairing flow polish — a Copy button on the pairing code, a live countdown on its 10-minute expiry, and the page now detects the moment pairing completes and refreshes itself.
New: AEBOT can now schedule posts (status future with a date) and move posts to the trash via the connected API — trash only, never permanent deletion, and trashing live content requires the publish permission. Unsupported statuses are now rejected instead of silently coerced.
Fix: coexistence detection now also recognizes All in One SEO, SEOPress, and The SEO Framework, so AuditAE defers its Organization/Article/WebSite schema on those sites instead of emitting duplicates.
Fix: renaming a large image now also renames the pristine original (the file WordPress keeps beside the -scaled version), so regenerating thumbnails no longer resurrects the old filename.
Fix: the AI Readiness Score no longer drifts between the neutral “not checked” state and the real robots.txt verdict as the hourly audit cache expires — the last successful audit is now remembered, and score history only starts recording once a real audit has run, so trend deltas reflect actual site changes.
Hardening: the generic post meta parameter now refuses all protected (underscore-prefixed) meta keys — including AuditAE’s own schema/FAQ storage, which must go through its validated, write_seo-gated endpoints.
Hardening: reading a single post over the content API now enforces the same public/REST-exposed post-type rule as listing, creating, and updating, so internal configuration post types of other plugins can’t be read by ID.
Tweak: the scorecard fetch timeout was lowered so a slow AuditAE connection can’t hold up the wp-admin Dashboard.
0.23.1
Fix: /llms.txt and the IndexNow key file now work on subdirectory installs (e.g. example.com/blog) — previously both returned 404, so IndexNow ownership verification silently failed and submissions were discarded.
Fix: renaming a large image (one WordPress scaled down on upload) now renames every generated thumbnail size too, so the descriptive filename actually reaches the URLs embedded in your posts.
Fix: media renames and AEBOT-inserted internal links no longer strip iframes/embeds or backslashes from the posts they touch.
Fix: the per-post Freshness check now reads the last-modified date instead of the publish date, so updating a post clears the “not updated in over a year” warning as the tip promises.
Fix: the AI Readiness Score no longer reports “citation bots allowed” as a full pass when the robots.txt audit itself failed to fetch; it now shows the neutral “not checked” state.
Fix: a redirect whose destination differs from its source only by a trailing slash or query string is now rejected instead of creating an infinite redirect loop; preserved query strings are also inserted before any #fragment in the destination.
Fix: IndexNow auto-ping no longer defaults off because of leftover Rank Math settings when Rank Math itself is deactivated.
Fix: URLs in Schema Autopilot values (url, sameAs, logo) keep their query strings intact — ampersands are no longer entity-encoded into a different URL.
Fix: the Yoast settings endpoint no longer causes a fatal error on sites without Yoast, and rejects malformed (non-text) values instead of storing them.
Hardening: editing a scheduled or private post via the content API now requires the publish capability, matching already-published posts; the update endpoint now refuses internal post types (plugin configuration storage), matching the create endpoint.
Hardening: failed pairing attempts only count toward the brute-force lockout while a pairing code is actually active, so background scanners can’t keep pairing locked.
Cleanup: plugin deletion now also removes the stored AI Readiness Score history.
0.23.0
The AuditAE AI Autopilot dashboard now shows live site intelligence from your paired AuditAE account: AI citation rate, Google Analytics sessions and form-fills/conversions, and Search Console clicks, impressions, average position and top queries — plus a brand-vs-competitor share-of-voice view. Pulled securely over your existing pairing (no extra login) and cached so the dashboard stays fast. Sites that aren’t paired or linked just see a “Connect in AuditAE” prompt; nothing is shown without a connection.
0.22.0
AEBOT can now make instant, in-place edits to pages built on the AuditAE AI Autopilot theme — change a headline, button label, paragraph, brand color, font, or the shared nav/footer from chat, without rebuilding the page. The content API now returns each page’s editable copy fields and design template so the assistant edits the exact slot.
Added support for the theme’s structured content types — services, locations, FAQs, testimonials, and team members — so AEBOT can add and edit those records directly and pages that loop over them update automatically. No new admin UI; groundwork for the AEBOT-driven site engine.
0.21.0
New free feature: rename image files for SEO. A “Rename file” action on each image in the Media library lets you change a generic name (e.g. IMG_4821.jpg) to a descriptive, keyword-bearing slug (red-running-shoes.jpg) — a real image-SEO/AEO signal that engines and image search read. The rename moves the original file plus every generated size, keeps the file type, and rewrites the old URL to the new one inside existing post content so live images and srcset don’t break. Works locally with no account, gated by your normal WordPress permissions.
Paired AuditAE accounts can also do this from AEBOT chat (“rename IMG_4821.jpg to something descriptive”), which proposes slugs and renames in bulk across the posts that matter. AEBOT can now edit every metadata field on an image in one step — alt text, title, caption, and description — not just alt text.
Improved: cleaner llms.txt descriptions. Each entry now prefers your hand-written excerpt, then your SEO plugin’s meta description (Yoast, Rank Math, AIOSEO, SEOPress), and only falls back to page content with shortcodes and block widgets removed first — so embedded buttons, booking forms, and other widget markup no longer leak into the manifest.
0.20.0
New free feature: IndexNow auto-ping. New and updated posts are submitted to the IndexNow API on publish so Bing-fed engines (including ChatGPT and Copilot retrieval) re-crawl them in minutes. Auto-generates and serves the ownership key file, respects Yoast/Rank Math per-post noindex, and adds a one-shot “Submit all published URLs” action. On by default; toggle on the AI Crawlers tab.
AI Readiness Score: added an “Instant indexing (IndexNow)” check so the score reflects whether you’re pushing fresh content to the index.
New free feature: per-post AI Readiness checklist in the editor sidebar. Grades the post you’re editing on an answer-first opening, question-shaped headings, FAQ + structured data, content depth, and freshness — the AI-citation signals, separate from (and complementary to) your SEO plugin’s keyword analysis. Read-only, no account required. An “AI Ready” column on the Posts and Pages lists shows the same score across all your content at a glance.
Yoast / Rank Math coexistence. AuditAE now detects an active SEO plugin and defers wherever they overlap: it stops emitting Organization and Article/Product JSON-LD (so there’s never a duplicate node), skips FAQ schema on posts that already use a Yoast/Rank Math FAQ block, and defaults IndexNow auto-ping off when Rank Math (or a standalone IndexNow plugin) is already submitting. AuditAE keeps the AI-search features they don’t offer. A notice on the settings page explains what’s deferred. AuditAE never touches titles, meta descriptions, or canonicals, so it does not trigger a “second SEO plugin” conflict warning.
0.19.3
Branding: the admin screen now shows the new AuditAE logo and green accent so it matches the WordPress.org listing. No functionality change.
0.19.2
Compliance: changed the text domain to “auditae-ai-search-toolkit” to match the plugin slug, per WordPress.org plugin review. No functionality change.
0.19.1
Compliance: shortened the display name to “AuditAE AI Search Toolkit” per WordPress.org plugin review. No functionality change.
0.19.0
New: AI Readiness Score streak — a 🔥 flame appears once your score has climbed two or more readings in a row, on the Score tab, the wp-admin Dashboard widget, and the Score nav chip. Completes the score + 7-day-delta + streak momentum loop, so the number is worth coming back to.
Improved: the “AI crawlers are reading your site” check is no longer a dead end when no bot has visited yet — it now offers a fix that asks AEBOT for the concrete steps to get discovered (and run a live citation audit on paired sites), so every not-passing check stays actionable.
0.18.1
Compliance: sanitize the Organization-schema sameAs and redirect source/destination admin form inputs at the point of access (WordPress.org Plugin Check). No behavior change — values were already sanitized downstream.
Compliance: bumped “Tested up to” to WordPress 7.0 and trimmed the short description to the 150-character limit.
0.18.0
New: AI Readiness Score — a 0–100 score with a letter grade that summarizes how ready your site is to be read and cited by AI engines, computed entirely from local signals (no account or external call beyond the existing hourly robots.txt fetch). Eight weighted checks: citation bots allowed in robots.txt (20), FAQ schema coverage (16), Organization schema (12), Article/Product schema coverage (12), unresolved AI-bot 404s (12), AI crawlers actually reaching the site (12), llms.txt served (8), and content freshness (8). Each check shows its status, points, a one-line explanation, and a direct “fix” link.
New: the Score is the new default landing tab and shows a 7-day delta (“▲ +6 points in the last 7 days”) plus a “N points to grade B” target, from a bounded daily score history kept locally. The wp-admin Dashboard widget now leads with the score + delta.
New: every not-yet-passing check links to the fix — robots.txt/redirects/schema/llms.txt checks deep-link to the right settings tab; schema, FAQ, and freshness checks offer to hand the work to AEBOT (paired sites) or prompt you to connect (unpaired). On paired sites the AEBOT links carry the exact task, so the assistant opens with the fix already requested.
0.17.0
New: robots.txt audit on the AI Crawlers tab. Fetches your site’s robots.txt and classifies every tracked AI bot as allowed, limited, or blocked — with a red callout when a citation engine (GPTBot, ClaudeBot, PerplexityBot, Bingbot, …) is blocked outright. A stale Disallow aimed at scrapers routinely takes citation bots down with it, and from the outside that looks identical to “AI just doesn’t cite me”. Re-checked hourly; also exposed to paired accounts at GET /auditae/v1/robots-audit (read capability).
New: persistent crawler statistics. The rolling 500-entry log only spans a few days on a busy site, so 30-day totals, by-bot counts, and “since last hit” silently undercounted or went stale once entries were pruned. The tracker now also keeps compact per-day per-bot counters (90 days, one wp_options row) plus an exact per-bot last-seen timestamp that never falls out of the window.
New: the By bot breakdown now shows when each bot last hit (“3 hours ago”), not just a count — and a Daily activity table shows per-day hits for the last 14 days.
New: wp-admin Dashboard widget — 30-day AI hit count, distinct bots, last-hit recency, and the top three bots, without opening Settings → AuditAE.
New: Export log as CSV button on the AI Crawlers tab (timestamp, bot, path, status).
New: the llms.txt tab now edits the Optional links section (enable toggle, title, one link per line as Title | URL | description) — previously this was only reachable via the REST API.
Fix: corrected a stale docblock in the redirect handler that still described the pre-0.15.1 hook ordering.
0.16.0
Security: capability-consent hardening on three REST surfaces. (1) PATCH /media/{id} (alt text + caption) now requires the write_seo capability as documented — it was previously reachable with read-only consent because the action-dispatch permission gate fell through to read on routes with no action param. (2) POST /llms-txt with action=write, action=reset, or no action now requires write_seo; previously reset and a missing action slipped through the read gate, letting a read-only token rewrite or reset the manifest. (3) Updating a post that is already published (PATCH /posts/{id} and POST /posts/{id}/internal-link) now requires the publish capability — draft consent (“create and update draft posts”) no longer allows changing live content. The bearer token still gates everything; this tightens what each granted capability permits.
The Permissions card now labels publish as “Publish posts and edit already-published content” to match the enforced behavior. If AEBOT reports a missing publish capability after this update, grant it from Settings → AuditAE → Connect.
Fix: deleting the plugin now also removes the auditae_redirects option — redirect rules were the one key uninstall.php left behind.
Fix: the “Redirect to” field in the suggested-redirects table rejected relative destinations like /new-path (it was a url-type input, so browsers demanded an absolute URL). Now a text field, matching the manual-add form.
Crawler tracker: added Claude-User and Claude-SearchBot (Anthropic’s current fetcher user-agents — previously only ClaudeBot/Claude-Web were detected), MistralAI-User (Mistral’s Le Chat fetcher), and AI2Bot to the signature list.
0.15.1
Fix: bot hits to URLs that had a matching 404→301 redirect rule were being silently dropped from the AI crawler log. The redirect handler was hooked on template_redirect at priority 0 and called exit before the crawler logger (priority 1) could run, so the AI Crawlers tab’s “since last hit” stat stayed stale while bots actively pinged redirected paths. The logger now runs first (priority 1) and the redirect handler runs after (priority 2). Hits to paths with an active redirect rule are stamped with the rule’s status (301/302) instead of 404, so the suggested-redirects rollup (which keys on status=404) keeps working unchanged.
0.15.0
New REST surface for the 404 → 301 redirect manager: GET /auditae/v1/redirects (list rules) + POST /auditae/v1/redirects (dispatches on action: list | suggest | write | delete). The suggest action wraps the same “AI bots 404’d here” rollup the admin tab uses, so paired AuditAE accounts can ask AEBOT “check my redirect suggestions” and the assistant returns the same one-click proposals the human-facing tab shows. write and delete are gated by the write_seo capability and write to the existing auditae_audit_log so every bot-initiated rule change is auditable from the admin tab.
No behavior change for the human-facing admin tab — same storage, same matcher, same template_redirect hook. Drop-in upgrade from 0.14.x, no re-pair required.
0.14.0
New Redirects admin tab. Wired to the AI crawler log: shows paths that AI bots (GPTBot, ClaudeBot, PerplexityBot, etc.) hit and got a 404, with a one-click form to add a 301 to wherever the content actually lives now. Rules only fire on 404s, so they can never hijack a real page. Also includes a manual add form (301 or 302) and an active-redirects table with per-rule hit counters + “last hit” timestamps. Same wp_options storage pattern as the rest of the plugin — no new tables.
0.13.0
New Schema admin tab: build site-wide Organization JSON-LD from a small form (name, URL, logo, description, sameAs). Renders on every front-end page so AI engines can resolve “what brand is this site?” without an LLM call. Same shape AuditAE’s hosted Schema Generator emits.
0.12.3
Plugin Check follow-up: $_POST[‘sections’] in the llms.txt save handler now flows through map_deep( …, ‘sanitize_text_field’ ) so every leaf value is sanitized before the per-field casts run. No behavior change.
0.12.2
WordPress.org Plugin Check pass: hardened JSON-LD output (JSON_HEX_TAG|JSON_HEX_AMP) so </script> breakouts are impossible, ran every $_SERVER and $_POST field through wp_unslash() + a sanitizer, replaced unlink() with wp_delete_file(), removed the redundant load_plugin_textdomain() call (WP auto-loads since 4.6), and aligned the plugin header with the directory title. No behavior changes.
0.12.1
WordPress.org submission readiness: bundled the Instrument Serif font locally (SIL OFL 1.1) instead of loading it from Google Fonts, so the admin UI makes no third-party requests. Added a translation template at languages/auditae.pot.
0.12.0
New: Media library REST endpoints (GET /media, GET /media/{id}, PATCH /media/{id}, POST /media). Paired AuditAE accounts can audit images with empty alt text, write descriptive alt + caption in bulk (gated by write_seo), and sideload generated hero images from a URL for AEBOT-drafted posts (gated by draft).
New: Internal-link graph endpoints (GET /links/graph, GET /links/post/{id}). Surfaces per-post incoming/outgoing counts and orphan posts so AEBOT can recommend where to weave new internal links.
New: POST /posts/{id}/internal-link — safe text-replace link insertion. Wraps the first unlinked occurrence of an anchor in <a> without rewriting the rest of the post. Refuses external URLs. Returns previous_state for undo. Gated by the same draft/publish rule as wp_update_post.
Fix: /llms.txt Sections editor table layout. The “On” column header was crashing into “Section title” because the table inherited the activity-log fixed layout.
0.11.0
New: /llms.txt generator. Serves a markdown manifest at the site root following the llmstxt.org spec. Defaults are auto-built from your public post types; a new admin tab lets you customize the H1, blockquote intro, per-section titles, and an optional links section. Cached in a transient and regenerated on save.
Three matching REST endpoints (GET /llms-txt, POST /llms-txt, POST /llms-txt/reset) so paired AuditAE accounts can curate the manifest from chat. Gated by the write_seo capability.
0.10.0
New: Schema Graph. Per-post JSON-LD (Article, Product, HowTo, BreadcrumbList) stored in _auditae_schema_graph post_meta and emitted in wp_head. Site-wide schema (Organization, WebSite) stored in auditae_organization_schema. All nodes linked by @id so AI engines resolve relationships without guessing. Detects and reuses Yoast/Rank Math @id values when present.
REST endpoints: POST /posts/{id}/schema, POST /organization-schema, GET /probe-schema. Gated by write_seo.
0.9.0
WordPress.org submission prep: uninstall.php cleans up every option, transient, and per-post meta key on plugin delete. load_plugin_textdomain registered on init and visible admin strings wrapped in __() / esc_html__() so translations can ship without code changes.
0.8.0
Reorganized admin into tabs. The AI Crawlers tab is the default landing surface; the AuditAE pairing flow moved to its own tab. Reinforces that the crawler tracker works without an AuditAE account.
0.7.0
New: AI Crawler Tracker. Logs hits from ~27 AI bots on every front-end request and surfaces summary, by-bot counts, and top paths on the admin dashboard. Rolling 500-entry log in wp_options — no custom tables, no telemetry, no external calls.
New REST endpoint GET /auditae/v1/crawler-hits (gated by the existing read capability) so paired AuditAE accounts can ingest the log into AEBOT.
0.6.0
Branded admin UI. Settings → AuditAE uses the AuditAE visual language (terracotta accent, serif headings, card-based layout). CSS is scoped to the AuditAE screen so the rest of wp-admin is untouched.
0.5.0
FAQ JSON-LD schema injection via new POST /posts/{id}/faq-schema endpoint. Stores question/answer pairs in post_meta and emits a schema.org/FAQPage <script type=”application/ld+json”> block in <head> on singular post views. Post content is NOT modified. Capped at 25 Q&A pairs per post; gated by the write_seo capability.
0.4.0
GET /posts — list recent posts with pagination, status filter, search, and post_type. GET /posts/{id} — full post snapshot including per-post SEO meta for Yoast + Rank Math. Both require the read capability.
0.3.0
HTTPS enforced on /pair and every bearer-protected route. Local dev installs can opt out with define(‘AUDITAE_ALLOW_INSECURE’, true).
Drafts now authored by the admin who generated the pairing code, not user 0.
Create + update now accept excerpt, slug, categories, tags, featured_image_id.
0.2.0
Per-post SEO meta editing for Yoast SEO and Rank Math via /posts/{id}/seo. Generic post meta passthrough now rejects SEO-prefixed keys so the write_seo consent boundary holds.
