Hafen Core

The companion plugin to the Hafen theme. Following the principle ���theme = presentation, plugin = functionality”, Hafen Core carries the functionality that, per the WordPress.org guidelines, does not belong in a theme: a schema engine, five answer blocks, an AI crawler policy for robots.txt, a local AI traffic dashboard, Markdown delivery for agent clients, a citability linter, an under-construction gate and an llms.txt file. It works with any theme, but it is built and tested as the functional half of Hafen.

Access rules and measurement in one plugin. Most plugins in this field do one of the two: they either block AI crawlers, or they report on AI visibility from an external service. Hafen Core does both in the same place and can therefore relate them to each other, for example: “Perplexity is not crawling you, and PerplexityBot is on your block list.” Everything runs on your own installation; no account and no external service are required for it.

No invented scores. This plugin does not calculate a visibility score and does not promise you a placement in ChatGPT. Where the evidence is thin, it says so: llms.txt is labeled as speculative, every rule in the citability linter states its evidence strength and its source, and where a provider publishes no IP ranges we do not present a user agent as proof. The most honest sentence first: the strongest documented factor for citations is mentions of your brand elsewhere. On-page is the smaller lever. Everything this plugin does works on that smaller lever – but it does so cleanly and verifiably.

Schema engine. Automatically embeds valid JSON-LD without you writing anything: Organization, WebSite (including the search action), Article (on posts) and BreadcrumbList. Plus FAQPage and HowTo generated from the answer blocks. Everything in a single @graph in the document head.

Answer engine blocks. Five blocks that render nicely for humans while being machine-readable and privacy-friendly:

• Hafen FAQ — emits FAQPage schema.
• Hafen HowTo — emits HowTo schema.
• Hafen TL;DR — highlighted short answer.
• Hafen Definition — a term in what-is-X format.
• Hafen Video (2-click) — privacy-friendly YouTube embed that loads only after a click, via youtube-nocookie.com.

Access gate (Under Construction). Protect the whole website with a password while it is being built – without an extra plugin. Three bundled templates (light, dark, accent gradient) automatically pick up your logo, your site name and your accent color. Logged-in users see the website normally, the gate page sends HTTP 503 + noindex (safe for SEO), and the WordPress logo on login pages is replaced with your site logo.

AI crawler policy. The whole market treats AI crawlers as a threat to be locked out. Hafen Core does the opposite: it helps you get found and cited. To do that, it cleanly separates what almost everyone conflates: training (GPTBot, ClaudeBot, CCBot), search/index (OAI-SearchBot, Claude-SearchBot, PerplexityBot, Googlebot) and live retrieval by a human in a chat (ChatGPT-User, Claude-User, Perplexity-User). Blocking training costs NO visibility. Blocking search costs all citability. The interface prevents exactly that mistake, with plain-language warnings instead of fine print. Default: nothing blocked. This is not a blocker plugin.

AI traffic dashboard, entirely local. Shows which AI bots fetch your content, which pages they crawl the most, how many visitors come back from AI answers, and the key figure: crawl-to-refer, i.e. how many pages a provider fetches before it sends you one visitor. No account, no cloud, no IP addresses in the database. If you enable the optional OpenAI bot verification, hits from GPTBot & Co. are checked against the official IP ranges; where a provider publishes none (Anthropic, Perplexity, Meta), the dashboard says so openly instead of presenting a user agent string as proof.

IndexNow. Reports new and changed content immediately to Bing and participating search engines instead of waiting for the next crawl. Relevant because ChatGPT’s web answers are backed by the Bing index. Off by default (opt-in).

Markdown for agents. Agentic clients (Claude Code, Cursor, OpenCode) request pages with “Accept: text/markdown”. Hafen Core answers with a clean Markdown version of your content, alternatively via ?format=md or the .md suffix. That saves the model the layout, navigation and script ballast. The Markdown version is sent with “X-Robots-Tag: noindex”, and “Vary: Accept” is placed specifically on the responses that can also be served as Markdown, so no page cache serves the Markdown version to browsers – and on no other response, so proxy caches do not fragment unnecessarily. Only published, publicly visible, non-password-protected content is served.

Citability linter in the editor. Checks the post against 15 rules and shows, per rule, whether it passes and how well it is supported by evidence (strong / medium / weak), including the source. Deliberately WITHOUT a 0–100 score: nobody knows a citation probability, and we do not pretend to. It also includes a check for prompt injection and cloaking, because that is a penalty issue, not an optimization issue. The optional AI deep check uses the AI assistant and is not a requirement: all rules run without AI as well.

Abilities API and WebMCP. Where WordPress ships the Abilities API (6.9+), Hafen Core registers read-only abilities (page as Markdown, search content) as well as the AI assistant’s generators; only the read-only ones are exposed to MCP. On top of that come read-only WebMCP browser tools. Honest framing: WebMCP is a Chrome experiment and only has an effect while the tab is open. Crawlers see none of it; it does nothing for visibility. A tiny snippet loads the script only in browsers that actually have the API; everyone else pays 0 additional requests. Both are pure feature detection, not a dependency.

llms.txt generator. Publishes a curated content map at /llms.txt (and /llms-full.txt). Honest framing: Google states that it ignores llms.txt, and measurements show AI systems practically never fetch the file. Useful for coding agents, not for visibility in AI search. We ship it because it costs nothing, and we promise nothing for it.

Performance status. Speed is a core commitment of the Hafen family. The dashboard (Settings > AI Traffic) therefore shows honestly what your setup delivers: page cache detected or not, compression via self-test, the theme’s font mode (variable/static/system) – each with a plain-language recommendation. Plus an option to disable the WordPress emoji script (~26 KB and one external request to s.w.org saved; off by default). Cache and compression are server matters no plugin can solve from the inside. That is exactly why we display them instead of making promises.

Everything runs without a build step and is GDPR-friendly. Schema, blocks and llms.txt work entirely locally. External connections only occur for features you explicitly enable or trigger: the optional AI assistant (through the WordPress AI client, provider and key configured under Settings > Connectors, only on click), the optional OpenAI bot verification (IP ranges, off by default), IndexNow (opt-in) and the video block (YouTube, only after a click). Details under “External services”.

External services

The optional AI assistant generates suggestions (meta description, TL;DR, FAQ) from your post content. All requests run through the WordPress AI client (WordPress 7.0+): which provider receives the data, and with which key, is configured centrally under Settings > Connectors. The plugin itself does not contact any AI provider directly. Data is sent ONLY if you (a) enable the assistant under Settings > Hafen Core and (b) click a suggestion button in the editor; the post’s title and text then go to the connector you configured. The same applies to the optional AI deep check of the citability linter: only if you explicitly tick “AI deep check” in the editor and start the check, an excerpt of the post (at most 5,000 characters) is sent to your configured connector. Without that checkbox the linter runs entirely locally and rule-based. On installations without a configured WordPress AI client, both features stay inactive.

The “Hafen Video (2-click)” block embeds YouTube videos in a privacy-friendly way: before the click, nothing is loaded from YouTube (no thumbnail, no request). Only when visitors click the play area is an iframe loaded from https://www.youtube-nocookie.com; at that point data is transmitted to Google. The notice text on the play area informs about this.

YouTube terms of service: https://www.youtube.com/t/terms Google privacy policy: https://policies.google.com/privacy

IndexNow (Microsoft Bing): if you enable IndexNow under Settings > Hafen Core (off by default), the plugin reports the affected URL to https://api.indexnow.org/indexnow when content is published or updated. Sent are exclusively: the URL of the public content, your hostname, the locally generated IndexNow key and the location of the key file. No content, no user data and no visitor data are transmitted. Without this activation nothing is sent.

IndexNow terms of use: https://www.indexnow.org/terms Microsoft privacy statement: https://privacy.microsoft.com/privacystatement

OpenAI IP ranges (bot verification, opt-in): OFF by default. Only if you explicitly enable the OpenAI bot verification under Settings > AI Traffic does the plugin fetch the public IP lists https://openai.com/gptbot.json, https://openai.com/searchbot.json and https://openai.com/chatgpt-user.json weekly via cron, to check whether a hit really comes from OpenAI and does not merely fake its user agent. This is a pure download; no data of yours is transmitted in the process. The check itself runs locally. Without this activation not a single fetch is made.

OpenAI terms of use: https://openai.com/policies/terms-of-use OpenAI privacy policy: https://openai.com/policies/privacy-policy

Privacy

The AI traffic measurement writes to its own table ({prefix}hafen_ai_hits). It stores exclusively: timestamp, bot or source identifier, purpose (training, search, live retrieval, referral), the ID of the requested post, a hash of the path and a yes/no verification field.

Explicitly NOT stored: IP addresses, user agent strings, cookies, session identifiers or any other personal data. The IP address is only checked in memory against the official provider IP ranges and discarded afterwards. Logged-in users are not recorded at all. Retention is limited to 90 days by default (configurable between 7 and 365 days); a daily cron run deletes older entries. No data is transmitted to hafenstudios or third parties.

Copyright

Hafen Core, (C) 2026 hafenstudios. Hafen Core is distributed under the GNU General Public License v2 or later.

All bundled assets are GPL-compatible:

• assets/mascot/captain-*.webp — brand mascot “Kapitän Ahoi”: original work by hafenstudios, created with AI assistance (OpenAI ChatGPT/DALL·E). No third-party templates or stock images were used. (C) 2026 hafenstudios, released under GPLv2 or later.
• All icons are inline SVG, an original set, (C) 2026 hafenstudios, GPLv2 or later.
• No font files, libraries or third-party assets are bundled.