內容簡介
Hack The SEO 是一款免費的 WordPress 外掛，專注於提供 AI 爬蟲的訪問記錄、GEO 分數及關鍵字競爭報告，幫助網站優化 SEO 表現，並無需更改現有的 SEO 外掛設定。
【主要功能】
• AI 爬蟲日誌：記錄 18 種用戶代理的訪問情況
• GEO 分數：根據六項標準評分每個頁面
• 關鍵字競爭報告：識別競爭頁面並提供解決方案
• JSON-LD 結構化數據：自動生成 60+ 種型別
• 404 監控：記錄 404 錯誤並提供重定向選項
• 自動填充 Alt 文字：為缺少 Alt 文字的圖片自動生成描述
外掛標籤
開發者團隊
② 後台搜尋「Hack The SEO – AI Bot Tracker, GEO Score, JSON-LD Schema & Cannibalization」→ 直接安裝（推薦）
原文外掛簡介
Hack The SEO shows you something no analytics tool can: which AI crawlers read your pages, which pages they read, and when. Then it tells you what to fix so those pages are worth quoting. And it handles the whole technical SEO layer on top, free.
You do not have to choose. Hack The SEO is built to run next to Yoast SEO, Rank Math, All in One SEO and SEOPress. It detects the one you already have and steps aside on everything that plugin already produces, so nothing is emitted twice and you configure nothing. It never deactivates it and never touches its settings. What it adds is what none of them gives you: the AI crawler log, the GEO score, and the cannibalization report.
Why your analytics cannot see this. GPTBot, ClaudeBot and PerplexityBot do not run JavaScript, so a JavaScript analytics tool never sees them. Hack The SEO reads the request on your server, before any script runs, and writes every visit into a table in your own database.
Safe to install today, on the site you already have
Keep your current SEO plugin. Hack The SEO detects Yoast, Rank Math, All in One SEO or SEOPress and steps aside, module by module. No duplicate title tags, no duplicate schema, nothing to configure.
Nothing leaves your site. No account, no API key, no telemetry. Out of the box the plugin makes zero outbound requests.
Nothing breaks if you uninstall. Your redirects, your metadata and your settings stay in the database unless you ask for them to be deleted.
Nothing slows your visitors down. No external call in the front-end path. Scores and audits run in the admin, never on a visitor’s request.
Runs on the hosting your clients actually have. PHP 7.4, WordPress 5.9, MySQL or MariaDB. No Composer, no build step, no cron daemon.
Everything you get, and all of it is free
AI crawler log: 18 user agents from OpenAI, Anthropic, Perplexity, Apple, Google, Meta, Cohere and Common Crawl, recorded server-side.
Weekly report by email: once a week, your own site tells you how many AI crawlers came, on how many pages, how many visitors arrived from an AI chat, and which broken links appeared. Sent by WordPress, from your site, to you. Opt-in.
GEO score per page: scored out of 100 on six criteria, with the failing ones named.
Keyword cannibalization report: which of your pages compete against each other, and what to do about each pair.
A read-only MCP server: connect Claude and ask your site directly. Twelve abilities, and all twelve read.
JSON-LD schema and structured data: 60+ types generated automatically, configurable per page, so your pages are eligible for rich results (rich snippets).
XML sitemaps: sitemap index, per-type sitemaps, human-readable XSL stylesheet.
Redirects and 404 monitor: 301s, regex rules, CSV import and export, a 404 log with one-click 404-to-redirect.
Meta titles and descriptions: templates, variables, live SERP preview.
Open Graph and Twitter Cards: og:title, og:description, og:image, twitter:card and the rest, on every post, page and custom post type.
Alt text auto-fill: images published without alt text get one, derived from the file name, the title or the focus keyword. The audit lists the ones still missing.
Canonicals, breadcrumbs, robots, noindex: per post, per type, per taxonomy.
On-page audit: 21 checks in the editor, a Google score and an AI citability score side by side.
Orphan detection: pages with no inbound internal link are flagged in the global score, because a page nothing links to is a page nothing finds.
IndexNow: ping Bing, Yandex, Naver, Seznam and Yep the moment you publish. Off until you switch it on.
llms.txt: generated from your real content, not a static template. Plus a Markdown version of every page, at /your-page.md, the format an LLM reads most reliably.
WooCommerce: product and category schema, shop-aware sitemaps.
See which AI crawlers read your pages
Detection runs on template_redirect, server-side. No beacon, no tracking script, no external service.
GPTBot, ChatGPT-User, OAI-SearchBot, ClaudeBot, Claude-User, Claude-SearchBot, PerplexityBot, Perplexity-User, Applebot, CCBot, Bytespider and seven more.
Every hit is written to a table in your own database, with the URL and the timestamp.
Human visits arriving from an AI chat are counted through the referrer, so you see the crawler and the click it eventually sent.
Only agents these companies really send. Google-Extended is a robots.txt token, not a crawler, so counting it would count nothing.
Other plugins give you a switch to block AI crawlers. This one tells you whether they came.
Prove it to yourself in ten seconds
Run this in a terminal, then refresh the AI visibility screen:
curl -A GPTBot https://your-site.tld/any-page/
The row is there, with the page and the timestamp. That is the whole mechanism. Everything else on this page is built the same way: if we claim it, you can check it.
Find out which of your pages are worth quoting
GEO, generative engine optimization (also called AEO), is the work of making a page a generative engine can read, understand and quote. Each page is scored out of 100 on six questions:
Does the page answer its question explicitly and early?
Is that answer above the fold, or buried under four paragraphs of preamble?
Are there stable facts that can be quoted and attributed?
Is there a definition block a model can lift as it stands?
Is the structure parseable by a machine?
Is the page fresh enough to be worth citing?
The rules are plain PHP in the plugin. Open the file and read them. No model decides your score, and no API key is involved.
Ask your site directly, from Claude
The plugin ships a read-only MCP server. Connect Claude Code or Claude Desktop, and ask instead of clicking through screens:
Which pages has ClaudeBot never touched?
Why does this article score 38 out of 100?
Which of my pages compete with each other?
What are the most-hit 404s since Monday?
How it stays safe:
Twelve abilities, and all twelve read. There is no write among them, and no setting that turns one on.
It answers a signed-in WordPress user and nobody else. Every call checks a WordPress capability. Unpublished and password-protected content stays out.
The connection is inbound. Your client calls your site. No relay, no third party, no data sent anywhere.
It needs WordPress 6.9, where the Abilities API entered core. Below that it simply does not register, and nothing else changes.
Already running Yoast, Rank Math, All in One SEO or SEOPress?
Keep it. Hack The SEO installs next to it and steps aside on its own.
The usual reason not to run two SEO plugins is duplicate output: two title tags, two canonicals, two sets of schema. This plugin is built to avoid exactly that, without you configuring anything.
It gets out of the way, module by module. On activation it detects the plugin already in place and stops emitting whatever that plugin handles: meta tags, canonical, schema, sitemap, breadcrumbs, robots, and hreflang when a multilingual plugin owns it. Nothing is emitted twice.
It never deactivates your plugin, and never changes its settings. Your existing setup keeps running exactly as it did.
What you came for works from day one. The AI crawler log, the GEO score and the cannibalization report have no front-end output, so there is nothing to overlap. They start measuring the moment you activate.
You stay in charge. A dedicated screen lists every overlap and lets you decide, one by one, which plugin owns what. Your choice always wins over the automatic default.
And if you would rather replace than stack, the migration wizard imports your meta titles and descriptions, your robots and noindex rules, your canonicals, your redirects and your schema settings. It runs as a dry run first, so you see what will be imported, counted per type, before anything is written. It never deletes the source data.
Your data stays yours
AI crawler data, GEO scores and audit results stay in your database. No telemetry, no phone-home, no usage statistics.
The only outbound request is one you switch on yourself: IndexNow pings. The weekly report is your own WordPress writing to you.
Read the privacy policy if you want the long version.
Works with the tools you already use
Tested with Elementor, Divi, Bricks, Oxygen and WPBakery. The plugin reads the rendered content, so scores and schema see what your visitors see.
Works with caching plugins and CDNs. Crawler detection happens before the cache layer can swallow it.
Multisite compatible. Each site keeps its own settings, redirects, sitemap and data.
What this plugin will not do, and will not pretend to
It does not promise you a ranking or a position. Nobody can, and anyone who does is selling something.
It does not write your content for you, suggest internal links, or track your rankings.
It does not make you “visible in ChatGPT” by dropping an llms.txt on your server. That claim has no evidence behind it.
It does not block AI crawlers. It measures them.
Useful links
Documentation
Getting started
SEO and GEO glossary, 100+ terms defined
Free SEO audit
Blog
Support
Contact us
External services
This plugin connects to exactly one external service, and it is disabled by default: IndexNow.
IndexNow
What it is. IndexNow is an open protocol that lets a site notify participating search engines (Bing, Yandex, Naver, Seznam, Yep) that a URL has changed, instead of waiting to be crawled. The endpoint https://api.indexnow.org/indexnow is operated by the IndexNow sponsors: Microsoft Corporation, Yandex N.V. and Seznam.cz, a.s.
When it is used. Only when the IndexNow module is enabled. The option htsfree_indexnow_enabled defaults to 0. While it is 0, no hook is registered and no request is ever made. The plugin never enables it for you, including on activation. Once you enable it, a request is sent when you publish or update a post or page, or when you click the manual ping button in the admin.
What is sent. Only:
the public URL(s) of the content you just published or updated on your own site;
the host name of your site;
an IndexNow key, randomly generated locally and published by design at https://your-site.tld/{key}.txt, which is how the protocol proves you own the domain.
No post content, no personal data, no visitor data, no site credentials and no administrator information are transmitted. Requests are rate-limited to one ping per URL per ten minutes.
Where to read their terms. Terms of use, which also contain the privacy statement for the service: https://www.indexnow.org/terms. Protocol documentation: https://www.indexnow.org/documentation. Microsoft’s privacy statement, as one of the sponsors processing submissions: https://privacy.microsoft.com/privacystatement.
The weekly report (your own site, to you)
When enabled, once a week your WordPress sends its administrator a short email through wp_mail(): AI crawler passages and pages, visitors arriving from AI chats, new broken links, and the movement of the site score. It uses your site’s existing mail configuration and contacts no third party. Nothing is sent on a week with nothing to report. Every email carries a one-click unsubscribe link that works without logging in. It is off by default and controlled from the AI visibility settings.
On-site visitor measurement (no third party)
The content performance module counts views, reading time and scroll depth for your published posts. This is stored in your own database only. Visitor IP addresses are never stored: they are hashed and used solely as a short-lived rate-limit key so the same visitor is not counted twice within thirty minutes. Nothing is sent anywhere. The module can be turned off with the option htsfree_visits_tracking.
For clarity: requests to your own site
Some features (the health check, the sitemap self-test, the schema verification, the redirect probe, page-builder content extraction) load a URL of your own site over HTTP, because that is the only reliable way to see what a visitor or a crawler actually receives. These are loopback requests to your own domain. They are not a third-party service, and nothing leaves your server.
A paid version exists
Hack The SEO also has a commercial version, which adds automated internal linking and semantic cocoons, AI-assisted content workflows, and a hosted dashboard. It is a separate product and is not required for anything described here.
The free version is not a trial and does not expire. If you ever move to the commercial version, the work you did page by page comes with you: your meta titles and descriptions, your canonical and robots choices, your redirects and your scores are stored in shared keys and are read as they are. The free plugin’s own settings, such as which modules you switched on, are stored separately and are set again in the other plugin. Details at hacktheseo.com.
