Hack The SEO – AI SEO for Google and AI Search

Hack The SEO handles the whole technical SEO job: schema, XML sitemap, redirects, canonicals and meta. It also records which AI crawlers fetch your pages, so you can tell whether ChatGPT, Claude, Perplexity and Google’s AI are reading you. All of it is free, and it works without an account and without sending anything off your server.

Half of what a page is worth now depends on whether a generative engine can read it and is willing to quote it. That is measured, fixed and proven differently from a blue link. Most plugins bolted an “AI” tab onto a product designed in 2010.

Why your analytics tool never shows you an AI crawler

• AI crawlers do not run JavaScript. A JavaScript analytics tool is structurally incapable of seeing them, so whatever it tells you about GPTBot, it is guessing.
• Hack The SEO reads the User-Agent on template_redirect, server-side. There is no beacon, no tracking script and no external service involved.
• GPTBot, ChatGPT-User, OAI-SearchBot, ClaudeBot, Claude-User, Claude-SearchBot, PerplexityBot, Perplexity-User, Applebot, CCBot and eight more: 18 user agents in total, from OpenAI, Anthropic, Perplexity, Apple, Google, Meta, Cohere and Common Crawl.
• Every passage is logged into a table in your own database, with the URL and the timestamp.
• Human visits arriving from an AI chat are counted too, through the referrer, so you see the crawler and the click it eventually sent.
• Only agents these companies really send. Google-Extended is a robots.txt token, not a crawler, so counting it would count nothing.
• Verify the method in one line: curl -A GPTBot https://your-site.tld/your-article/ produces a row in the table.

Other plugins give you a switch to block AI crawlers. This one tells you whether they came.

Then make the page worth quoting

A GEO score, per page, computed on your own server. GEO, generative engine optimization (sometimes called AEO), covers the work of making a page that a generative engine can read, understand and quote. Scored out of 100 on six criteria, with the failing ones named. Among the questions it asks:

• Does the page answer its question explicitly and early?
• Is that answer above the fold, or buried under four paragraphs of preamble?
• Are there stable facts that can be quoted and attributed?
• Is there a definition block a model can lift as it stands?
• Is the structure parseable by a machine?

The rules are plain PHP in the plugin. Open the file and read them. No model decides your score. No API key, no account.

Then serve the formats a language model actually parses.

• A Markdown version of every page, at /your-page.md: no theme, no navigation, no scripts. Almost no other SEO plugin serves this.
• A virtual /llms.txt, generated from what you really publish, never written to disk.
• Valid JSON-LD schema, which a generative engine reads the same way Google does.

Without the crawler log, the rest of this is guesswork.

Keyword cannibalization, free and actually computed

Two of your own pages targeting the same keyword compete with each other in the results, and that is very hard to notice by reading your own site.

• Finds the pages competing against each other, by focus keyword and title similarity, then measures how much their content genuinely diverges.
• Recommends an action for each pair: merge, differentiate, redirect, or leave alone because the intents really differ.
• Runs in PHP on your server. It uses no embeddings and no external API, and none of your content leaves the site.
• Most plugins either do not detect it at all, or put it behind a paid plan.

The complete technical layer, in the free version

This is the part most people end up assembling from three or four separate plugins.

An answer engine reads the same schema and the same clean HTML that Google does, so the fundamentals are all here, and none of them is a trial, a teaser or a greyed-out button.

• Meta titles and descriptions, Open Graph and Twitter Cards on every post, page and custom post type, with a live Google result preview in the editor.
• Alt text fallback for images that have none, dynamic variables for archives, and category and tag meta edited on the term screen.
• JSON-LD schema, 60+ types: Article, Product, Offer, FAQPage, HowTo, QAPage, Recipe, Event, VideoObject, LocalBusiness, JobPosting and more.
• Generated from what is actually on the page, not from what you typed in a box. What cannot be detected reliably is yours to enable per page rather than guessed.
• XML sitemap: an index plus one sitemap per content type, with image, video and news extensions, and an XSL stylesheet so a human can read it.
• Cached on disk so a cold request does not rebuild it in PHP. Respects noindex, and handles large sites without exhausting memory.
• 301, 302, 307 and 410 redirects, with a full admin table, regex rules for migrations, CSV import and export, and an automatic 301 when a post slug changes.
• Incoming 404s logged with hit counts, so you see what is really broken. Turn any 404 into a redirect in one click. The log is capped and self-cleaning.
• Redirects are served in PHP, never written into your .htaccess. One malformed line there takes a whole site down with a 500. Identical behaviour on Apache, Nginx and LiteSpeed.
• Breadcrumbs built from your real category hierarchy, with matching BreadcrumbList JSON-LD so the trail can appear in Google’s results. Shortcode, Gutenberg block and PHP function.
• Per-post noindex and nofollow, custom canonicals, and conflict detection so you never emit two canonical tags on one page.
• A virtual robots.txt, served through WordPress core’s own filter. Nothing written to disk.
• Permalink cleanup: drop the /category/, /tag/ and /product-category/ bases, with an automatic 301 from the old URL so you keep what you already ranked.
• A 21-check on-page score covering basic SEO, content, meta and result preview, citability and readability, plus a global score and a freshness column in the posts list.
• Table of contents from your H2 and H3 headings, with anchors. IndexNow to notify Bing, Yandex, Naver, Seznam and Yep the moment you publish, off until you switch it on.
• 9 modules you switch on or off one by one, across 12 admin screens.
• A “First steps” checklist that adapts to what your site still needs, and disappears once you are done.

Moving in without losing what you already rank for

Switching SEO plugins is where people lose rankings, so the migration wizard reads the other plugin’s actual data.

• Imports meta titles and descriptions, robots directives, canonicals, focus keywords, cornerstone flags, redirects and Open Graph fields from Yoast SEO, Rank Math, All in One SEO and SEOPress.
• When the previous plugin injected its schema through the theme or a page builder instead of storing it, the wizard parses your rendered homepage to recover Organization and LocalBusiness data.
• It never deletes the original data, so the move is always reversible.
• Import first, deactivate second, in that order. Coexistence detection warns you while a competing SEO plugin is still active, so you never emit duplicate titles and duplicate schema.

Nothing leaves your site

The plugin makes no outbound requests at all. There is no anonymised telemetry, and nothing to opt out of. If you install the same plugin across client sites, this is the section you will be asked to justify.

• Everything is computed in PHP, on your server, in your own database.
• Exactly one feature can ever contact anything outside your site: IndexNow, and it ships off. While it is off, no hook is even registered, and it never turns itself on.
• There is nothing to opt out of, because nothing is sent. The plugin sets no cookie, loads no third-party script and collects no personal data.
• Visitor IPs are never stored, only hashed into a short-lived rate-limit key, and that module can be switched off entirely.
• Some features do load pages of your own site over HTTP: the health check, the sitemap self-test, the schema verification. Loopback requests to your own domain, not a third party.
• Check it yourself: grep the plugin for wp_remote_ and read the nine call sites. Two are IndexNow. The seven others load a page of your own site.

You never create an account or paste an API key, and no feature stops working because a server somewhere is down.

Built for the hosting your clients are actually on

Older sites are often the ones that need this work most, so the requirements are kept deliberately low.

• Hack The SEO requires WordPress 5.9 and PHP 7.4. As of August 2026, Yoast SEO requires WordPress 6.9 and Rank Math requires 6.7. Their own directory pages say so, in the sidebar.
• The site that pays you the most is rarely the site on the newest stack. A plugin you cannot install on a client’s shared host is not a plugin you can standardise on.
• Thirty client sites, one plugin, and no licences to count.
• Detects Elementor, Divi, Bricks, Beaver Builder, Oxygen and WPBakery, and reads the rendered content rather than the raw post_content.
• So the score, the schema and the Markdown all see the same text your visitors see.
• WooCommerce: product schema built from the real product data, and an exempt state for product rows instead of an editorial score that would mean nothing.
• A health check that verifies your sitemap answers, your schema is really in the rendered HTML, and your canonicals are valid.
• It tells you when your host blocks internal requests, instead of blaming your configuration.
• It writes one file of its own: the cached XML sitemap, under wp-content/uploads/.
• Front-end output is built during the normal page render, so it caches like the rest of your site. Nothing in that path calls a remote API, so no third-party latency lands in your render.
• Works on multisite, each site with its own settings, redirects, sitemap and data.
• Uninstalling deletes nothing by default. Someone who reinstalls should not lose the 301s holding their site together.
• Five languages included: French, Spanish, German, Italian and Brazilian Portuguese, with translate.wordpress.org open for the rest.

What this plugin does not do

• It does not promise, imply or guarantee any ranking, position or traffic result. No plugin can, and you should be suspicious of any that says otherwise.
• It gives you correct technical output and honest measurement. The rest is your content.
• It does not include AI content generation, automated internal linking, or a rank tracker.

External services

This plugin connects to exactly one external service, and it is disabled by default: IndexNow.

IndexNow

What it is. IndexNow is an open protocol that lets a site notify participating search engines (Bing, Yandex, Naver, Seznam, Yep) that a URL has changed, instead of waiting to be crawled. The endpoint https://api.indexnow.org/indexnow is operated by the IndexNow sponsors: Microsoft Corporation, Yandex N.V. and Seznam.cz, a.s.

When it is used. Only when the IndexNow module is enabled. The option htsfree_indexnow_enabled defaults to 0. While it is 0, no hook is registered and no request is ever made. The plugin never enables it for you, including on activation. Once you enable it, a request is sent when you publish or update a post or page, or when you click the manual ping button in the admin.

What is sent. Only:

• the public URL(s) of the content you just published or updated on your own site;
• the host name of your site;
• an IndexNow key, randomly generated locally and published by design at https://your-site.tld/{key}.txt, which is how the protocol proves you own the domain.

No post content, no personal data, no visitor data, no site credentials and no administrator information are transmitted. Requests are rate-limited to one ping per URL per ten minutes.

Where to read their terms. Terms of use, which also contain the privacy statement for the service: https://www.indexnow.org/terms. Protocol documentation: https://www.indexnow.org/documentation. Microsoft’s privacy statement, as one of the sponsors processing submissions: https://privacy.microsoft.com/privacystatement.

On-site visitor measurement (no third party)

The content performance module counts views, reading time and scroll depth for your published posts. This is stored in your own database only. Visitor IP addresses are never stored: they are hashed and used solely as a short-lived rate-limit key so the same visitor is not counted twice within thirty minutes. Nothing is sent anywhere. The module can be turned off with the option htsfree_visits_tracking.

For clarity: requests to your own site

Some features (the health check, the sitemap self-test, the schema verification, the redirect probe, page-builder content extraction) load a URL of your own site over HTTP, because that is the only reliable way to see what a visitor or a crawler actually receives. These are loopback requests to your own domain. They are not a third-party service, and nothing leaves your server.

A paid version exists

Hack The SEO also has a commercial version, which adds automated internal linking and semantic cocoons, AI-assisted content workflows, and a hosted dashboard. It is a separate product and is not required for anything described here.

The free version is not a trial and does not expire. It stores its data under the same keys as the commercial version, so if you ever move up, your metadata, redirects and scores are picked up exactly as they are. Details at hacktheseo.com.