Title: Index Harmony Author: indexharmony Published: 2026-08-06 Last modified: 2026-08-23 --- Szukaj wtyczek ![](https://ps.w.org/index-harmony/assets/banner-772x250.png?rev=3636304) ![](https://ps.w.org/index-harmony/assets/icon.svg?rev=3636374) # Index Harmony Autor: [indexharmony](https://profiles.wordpress.org/indexharmony/) [Pobierz](https://downloads.wordpress.org/plugin/index-harmony.0.9.41.zip) * [Szczegóły](https://pl.wordpress.org/plugins/index-harmony/#description) * [Recenzje](https://pl.wordpress.org/plugins/index-harmony/#reviews) * [Rozwój](https://pl.wordpress.org/plugins/index-harmony/#developers) [Wsparcie](https://wordpress.org/support/plugin/index-harmony/) ## Opis Install run the setup wizard done. **No key, no account, no paid tier**: every module and every measurement screen in this plugin is free and fully usable. Index Harmony prepares your WordPress site for AI assistants, answer engines and their crawlers (ChatGPT, Claude, Perplexity, Gemini and others) without touching your files or content — and then shows you what actually happened. Every fix is virtual and reversible: turn a module off and it disappears without a trace. **What makes it different:** most plugins in this space stop at generating llms. txt. Index Harmony pairs the output side with a first-party measurement side that no search-console integration can see: its own AI-bot traffic log with real bot verification (official vendor IP lists plus RFC 9421 Web Bot Auth Ed25519 signature checks), daily per-page counters, a per-page evidence panel showing which engine fetched which page on demand, a crawl-freshness funnel, an attention-decay radar, recovery for 404 URLs that assistants invent, a change log that marks every GEO- affecting setting change on your traffic chart, plus an agent-facing Site MCP endpoint and WordPress Abilities/WebMCP surfaces. llms.txt is one of its 19 modules, not the product. **All 19 fix modules (free, no key needed):** * llms.txt + llms-full.txt (virtual endpoints, refreshed daily; hand-pick the highlighted pages or edit the file body yourself) * AI bot manager for robots.txt (explicit allow rules for 25 AI bots; your existing rules are kept intact) * JSON-LD schema injector (Organization / WebSite / Article / FAQ / Breadcrumb / Product) — defers to Yoast, Rank Math, AIOSEO and SEOPress to avoid duplicates * Meta completer (description / Open Graph / Twitter — only when no SEO plugin handles it) * WordPress core sitemap enablement + robots.txt declaration * /.well-known/security.txt * WooCommerce product feed + Product schema completeness * hreflang auditor (reports only — it never writes a file and never emits an hreflang tag) * /AGENTS.md — a site usage guide for agents (virtual) * Markdown negotiation (Accept: text/markdown or ?format=md) * .well-known discovery endpoints (api-catalog RFC 9727; mcp.json and agent-skills only when configured — no fake manifests) * Agent-discovery Link headers + robots.txt Content-Signal declaration * AI bot traffic log (which bot visited when — visits carrying a Web Bot Auth Signature- Agent header are flagged with the signer’s key-directory host, and while bot verification is enabled their Ed25519 request signatures are cryptographically verified against the signer’s published keys) * AI policy publishing (ai.txt + TDMRep + Content-Signal header + IETF Content- Usage directive in robots.txt and as an HTTP header) * RSL content licensing — a virtual RSL 1.0 license.xml derived from your policy axes, plus the robots.txt License pointer (opt-in) * Security headers — six optional response headers (X-Content-Type-Options, Referrer- Policy, Permissions-Policy, HSTS, CSP-Report-Only, X-Frame-Options); all off by default and picked one by one under Settings Advanced * IndexNow instant indexing (Bing/Yandex/Seznam/Naver — opt-in) * WebMCP (in-browser agent surface for your site’s public information) * AI traffic share (opt-in daily channel counters) **Measurement & insights:** * Bot traffic dashboard — a 30-day chart and per-bot breakdown of AI crawler visits * Bot verification (opt-in) — once enabled, downloads public bot IP lists and Web Bot Auth signature key directories once a day to flag spoofed bots and cryptographically verify signed agents (works even behind a proxy/CDN, where IP checks must abstain); no visitor data leaves your site * Bot blocking & spike alerts (opt-in) — pick the bots to watch, then turn blocking on whenever you decide to, behind an explicit confirmation; the panel recommends a 7-day monitoring window first and warns you if you enable it earlier, but nothing is time-locked and you can stop blocking with one click; optional email when traffic spikes * Page analysis — daily per-page counters (GDPR-neutral: no IPs, no user agents) feed a per-page evidence panel showing which engine fetched which page on demand, a crawl-freshness funnel (which pages changed after the last crawl), and a 28- day attention-decay radar for pages AI is losing interest in * AI-404 phantom URL recovery — a report of URLs assistants think exist (404 hits with an AI user-agent or AI-platform referrer), the closest real page suggested by edit distance, and an optional per-row 301 applied ONLY to AI-originated requests * GEO change log — every visibility-affecting setting change is marked on the traffic chart with an honest before/after delta (correlation, not causation) * Bot health alarms — a silence sentinel for regular crawlers that go quiet and a spoof-surge guard with an explicitly confirmed, one-click „403 spoofed-only” switch * Page readiness score + Triage — a per-page content-readiness sub-score with an in-editor meta box and a site-wide triage view * Weekly (or daily) digest email (opt-in) — a summary of bot traffic, fading pages and your weakest pages **Honesty principles** * No files are written — everything is served virtually and switches off without a trace. * No cloaking — humans and bots see the same content; only the _format_ may differ when a client asks for it. * No fake manifests — discovery files are published only when they describe something real. * No upsell surfaces — this plugin never asks you for a key and never stores one. **Languages** The admin panel ships fully translated in 17 languages: English, Türkçe, Deutsch, Español, Français, Italiano, Nederlands, Polski, Português, Русский, 日本語, 한국어, العربية, فارسی, हिन्दी, Bahasa Indonesia, Tiếng Việt. RTL layouts are supported for Arabic and Persian. Translations are bundled with the plugin itself (not delivered as WordPress.org language packs). ### External services This plugin can connect to the third-party/external services listed below. Nothing is contacted on install or silently: every connection either requires an explicit opt-in toggle (off by default) or happens only when you press a button. With all defaults untouched, the plugin makes no outbound calls and collects no telemetry. **1. Index Harmony scan service** (operated by us at indexharmony.com) * What it is / why: the optional site-readiness scan — a 134-check audit of how your site looks to AI crawlers. Scoring that requires fetching your pages from the outside, which cannot be done from inside your own WordPress, so the scan runs on the service’s servers. * What is sent and when: when you press „Scan” in the dashboard, your browser opens the service’s scan page in a new tab with your site’s public address in the URL, and the scan runs there. **The report is shown on the service’s own page — it is not returned to your dashboard, and this plugin performs no follow-up requests, keeps no job id and stores no scan result.** Nothing is sent on install, on a schedule or in the background. * This plugin contains no key entry field, no unlock step, no licence status check and no support call, and it stores no key or token for this service. * [Terms of Service](https://www.indexharmony.com/agentready/terms) · [Privacy Policy](https://www.indexharmony.com/agentready/privacy) **2. AI-crawler IP lists and signature key directories for bot verification** (opt- in, off by default) When you enable „bot verification”, about once a day the plugin downloads the public, read-only crawler IP-range lists each vendor publishes, so genuine AI crawlers can be told apart from spoofed user-agents. Only a plain HTTP GET is made to the fixed URLs below — none of your site content, settings or visitor data is sent to these vendors. The same daily job also fetches Web Bot Auth signature key directories: when a bot visit carries an RFC 9421 Signature-Agent header, the plugin downloads that signer’s public Ed25519 keys from the fixed, standardised path `/.well-known/http-message- signatures-directory` on the key-directory host the signed request itself declares( for example Google’s agent identity or OpenAI’s signing hosts), so later signed requests can be verified locally. This is a plain GET of a public key file — nothing about your site or visitors is sent; hosts are strictly validated, capped at 16, and requests go through WordPress’s safe-URL transport (private and loopback addresses are refused). * OpenAI — openai.com/gptbot.json, /searchbot.json, /chatgpt-user.json · [Terms](https://openai.com/policies/terms-of-use)· [Privacy](https://openai.com/policies/privacy-policy) * Anthropic — claude.com/crawling/bots.json · [Terms](https://www.anthropic.com/legal/consumer-terms)· [Privacy](https://www.anthropic.com/legal/privacy) * Perplexity — perplexity.com/perplexitybot.json, /perplexity-user.json · [Terms](https://www.perplexity.ai/hub/legal/terms-of-service)· [Privacy](https://www.perplexity.ai/hub/legal/privacy-policy) * Amazon — developer.amazon.com/amazonbot/ip-addresses/ · [Conditions of Use](https://www.amazon.com/conditionsofuse)· [Privacy Notice](https://www.amazon.com/privacy) * Mistral — mistral.ai/mistralai-user-ips.json · [Terms](https://legal.mistral.ai/terms)· [Privacy](https://legal.mistral.ai/terms/privacy-policy) * Google — developers.google.com/static/crawling/ipranges/user-triggered-agents. json (Google-Agent) · [Terms](https://policies.google.com/terms) · [Privacy](https://policies.google.com/privacy) * Microsoft Bing — no HTTP request; bingbot is verified with a standard reverse- DNS lookup (PTR must end in search.msn.com) through your server’s resolver · [Microsoft Services Agreement](https://www.microsoft.com/servicesagreement) · [Privacy Statement](https://privacy.microsoft.com/privacystatement) **3. IndexNow** (opt-in module, off by default) * What it is / why: instant-indexing protocol operated by Microsoft Bing and used by participating engines (Bing, Yandex, Seznam, Naver) to hear about new/updated content immediately. * What is sent and when: when you publish or update a public post, its URL, your site host and your site’s IndexNow key are POSTed to api.indexnow.org. Nothing else is transmitted. * [IndexNow Terms of Use](https://www.indexnow.org/terms) · [Microsoft Privacy Statement](https://privacy.microsoft.com/privacystatement) ### Developer #### agrc_bot_visit_post_id Maps a logged bot visit to the WordPress entry that the requested path represents. Sites that serve pages through a custom router (a rewrite or `template_include` handler running after `template_redirect` priority 0) have no queried object at the moment the visit is recorded, so the visit is stored with no entry attached. Those pages then drop out of the entry-based surfaces — readiness correlation, blind spots, content freshness and the crawl funnel — and blind spots may even report them as „not visited by any bot yet”. The router is the only party that knows which entry a path represents, so the decision is delegated to it. The filter is opt-in: with no callback attached, behaviour is unchanged. ``` add_filter( 'agrc_bot_visit_post_id', function ( $post_id, $bot_id, $path ) { if ( 0 === $post_id && 0 === strpos( $path, '/catalog/' ) ) { return my_router_resolve_post_id( $path ); // int, or 0 when unknown } return $post_id; }, 10, 3 ); ``` Parameters: * `int $post_id` — entry ID resolved by WordPress; 0 when the request is not a singular entry (archives, the blog listing, 404s, and genuinely virtual pages). * `string $bot_id` — registry identifier of the matched crawler, e.g. `gptbot`. * `string $path` — request path with the query string removed and truncated to 255 characters; byte-for-byte what is stored in the visit row. Return an integer. Non-numeric returns are ignored and negative values are clamped to 0. The filter runs once per bot visit and never on human traffic. Genuinely virtual pages (those with no WordPress entry at all) cannot be scored, because readiness scores live in post meta. Such paths are listed in a separate section of the „Bot interest x readiness” card so the report stays honest instead of silently dropping them. ## Zrzuty ekranu [⌊Dashboard with module status and self-check badges⌉⌊Dashboard with module status and self-check badges⌉[ Dashboard with module status and self-check badges [⌊Setup wizard (17 languages)⌉⌊Setup wizard (17 languages)⌉[ Setup wizard (17 languages) [⌊Fix modules overview⌉⌊Fix modules overview⌉[ Fix modules overview [⌊Tabbed settings page⌉⌊Tabbed settings page⌉[ Tabbed settings page [⌊Measurement screen — bot traffic and page analysis⌉⌊Measurement screen — bot traffic and page analysis⌉[ Measurement screen — bot traffic and page analysis ## Najczęściej zadawane pytania ### Does it modify my files or content? No. Nothing is written to your files and your post content is never changed. All endpoints (llms.txt, AGENTS.md, the product feed…) are served virtually. Disable a module and it is gone without a trace. ### Do I need a key or an account? No. There is no key field anywhere in this plugin, nothing to activate and nothing to buy. All 19 modules and every measurement screen work as soon as you switch them on. ### Where does the scan result appear? On the service’s own page, in the browser tab that opens when you press „Scan”. The plugin does not fetch the report back into wp-admin and does not store it. ### Does the plugin send data anywhere on its own? With everything at its defaults, no: there is no telemetry and no outbound call happens on its own. If you enable an opt-in module, it makes only the calls described in the „External services” section — IndexNow submits a URL when you publish or update a post, and bot verification downloads public crawler IP lists and signer key directories about once a day. The plugin never phones home. ### Will it conflict with my SEO plugin? No. When Yoast SEO, Rank Math, AIOSEO or SEOPress is detected, Index Harmony defers the overlapping schema/meta output to them and tells you so in the panel. ### Is this cloaking? No. Visitors and bots always receive the same content. Markdown negotiation only changes the _format_ when a client explicitly asks for it. ## Recenzje Wtyczka nie ma jeszcze żadnej recenzji. ## Kontrybutorzy i deweloperzy „Index Harmony” jest oprogramowaniem open source. Poniższe osoby miały wkład w rozwój wtyczki. Zaangażowani * [ indexharmony ](https://profiles.wordpress.org/indexharmony/) Wtyczka „Index Harmony” została przetłumaczona na 3 języki. Podziękuj [tłumaczom](https://translate.wordpress.org/projects/wp-plugins/index-harmony/contributors) za ich wkład. [Przetłumacz wtyczkę “Index Harmony” na swój język.](https://translate.wordpress.org/projects/wp-plugins/index-harmony) ### Interesuje cię rozwój wtyczki? [Przeglądaj kod](https://plugins.trac.wordpress.org/browser/index-harmony/), sprawdź [repozytorium SVN](https://plugins.svn.wordpress.org/index-harmony/) lub czytaj [dziennik rozwoju](https://plugins.trac.wordpress.org/log/index-harmony/) przez [RSS](https://plugins.trac.wordpress.org/log/index-harmony/?limit=100&mode=stop_on_copy&format=rss). ## Rejestr zmian #### 0.9.41 * Hardening (audit round): the `expires` timestamp of a Web Bot Auth signature is now a hard cutoff — an expired signature can no longer earn the verified badge through the clock-skew allowance (the skew tolerance now applies only to `created`, so signers with a slightly fast clock still verify). * Fixed: signer hosts whose key directory could never be fetched used to stay in the cache indefinitely and were re-tried every day forever; failed directories are now dropped after 7 consecutive failed fetches (a signer that comes back simply re-enters through its next signed request), and the cache-size cap now evicts never-successful entries first. * Docs: the privacy descriptions now also disclose the stored 0/1 signature-verification flag and the signer key-directory downloads, and two stale internal counts (2425 known bots, 1112 verifiable bots) were corrected. #### 0.9.40 * New: Web Bot Auth cryptographic verification — while bot verification is enabled, bot visits that carry an RFC 9421 Signature-Agent header are now actually verified: the plugin fetches the signer’s public Ed25519 keys from its standardised `/. well-known/http-message-signatures-directory` (daily, cached, capped) and checks each signed request’s signature locally (tag `web-bot-auth`, JWK-thumbprint key ids, created/expires freshness). Verified visits get a distinct „Signed ✓” badge and a `sig_verified` CSV column; unverified ones keep the neutral presence badge— a failed or unavailable check never accuses anyone. Follows draft-meunier-webbotauth- httpsig-protocol-02 (August 2026), including the current dictionary Signature- Agent form with the legacy string form still accepted. Unlike IP-list checks, signature verification also works when your site sits behind a proxy or CDN. * Improved: the bot-verification toggle description and the External services documentation now spell out the signer key-directory downloads, and the traffic-log signature badge distinguishes „carried a signature” from „signature verified”. * Fixed: the FAQ still said „all 18 modules” — the module count has been 19 since RSL licensing shipped. #### 0.9.39 * New: RSL content licensing (opt-in module) — publishes a machine-readable RSL 1.0 licensing document at /license.xml, derived from your existing Content-Signal policy axes, and adds the matching License pointer line to robots.txt (rslstandard. org — the open standard backed by Reddit, Yahoo and Medium). * New: IETF Content-Usage — the AI policy module now emits the draft-ietf-aipref- attach preference expression (train-ai / search) alongside Content-Signal, both as a robots.txt directive and as an HTTP response header, and mirrors it in ai. txt. * New: Web Bot Auth signature flagging — bot visits that carry an RFC 9421 Signature- Agent header (OpenAI and Google’s agent.bot.goog identity already sign) are flagged in the traffic log and CSV export with the signer’s key-directory host. Presence detection only; this version does not claim cryptographic verification. * New bot: Google-Agent — Google’s user-triggered AI agent fetcher (Gemini agent features and Project Mariner; added to Google’s official crawler list in March 2026) joins the robots.txt manager (25 bots total), the traffic log with Gemini engine attribution, and opt-in IP-list verification via Google’s published ranges. * Docs: the External services list now includes Google’s IP-range list, and the privacy description documents the new signature-host column in the visit log. #### 0.9.38 * First release on WordPress.org: 18 fix modules, setup wizard, tabbed settings, 17-language admin panel, virtual & traceless fix architecture — no key, no account, no paid tier anywhere in the plugin. * Measurement & insights: bot traffic dashboard, opt-in bot verification, bot blocking& spike alerts, page readiness score + Triage, and an opt-in weekly/daily digest. * Page-analysis suite: GDPR-neutral daily per-page counters powering a per-page AI evidence panel, a crawl-freshness funnel, a 28-day attention-decay radar, AI-404 phantom URL recovery with optional AI-only 301s, a GEO change log with before/after impact, and bot health alarms (silence sentinel + spoof-surge guard with an explicitly confirmed spoofed-only 403). * Content scope & curation: opt other plugins’ public content types into your llms. txt, AGENTS.md and page scoring, hand-pick which pages your llms.txt highlights with a live search picker, or edit the published llms.txt body directly. * Security headers now have a selection screen (Settings Advanced): six optional response headers, each off by default and switched on one at a time. * Guideline & hardening pass: this build contains no licensing, unlock or update- check code at all, and nothing in it is limited by time, by usage or by anything you could pay for — bot blocking in particular is never time-locked, it only recommends a monitoring window and warns you if you switch it on early. It also defers sitemaps and Product schema to your SEO plugin and WooCommerce correctly, adds cache invalidation for llms.txt and the product feed, moves audits off visitor requests, and registers a personal-data exporter/eraser for author profile fields. * Polish pass: working Amazonbot IP verification, panel-language number/date formatting on measurement screens, an honest warning (plus withheld advertising) for .well- known endpoints on subdirectory installs (RFC 8615), and Index Harmony-branded public identifiers (REST index-harmony/v1, block index-harmony/nap, index_harmony_* shortcodes). ## Meta * Wersja **0.9.41** * Ostatnia aktualizacja **2 godziny temu** * Włączone instalacje **Mniej niż 10** * Wersja WordPressa ** 6.9 lub nowszej ** * Testowano do **7.1** * Wersja PHP ** 8.1 lub nowszej ** * Języki * [Dutch](https://nl.wordpress.org/plugins/index-harmony/), [English (US)](https://wordpress.org/plugins/index-harmony/), [Russian](https://ru.wordpress.org/plugins/index-harmony/), i [Spanish (Spain)](https://es.wordpress.org/plugins/index-harmony/). * [Przetłumacz na swój język](https://translate.wordpress.org/projects/wp-plugins/index-harmony) * Tagi * [ai agents](https://pl.wordpress.org/plugins/tags/ai-agents/)[llms.txt](https://pl.wordpress.org/plugins/tags/llms-txt/) [robots.txt](https://pl.wordpress.org/plugins/tags/robots-txt/)[schema](https://pl.wordpress.org/plugins/tags/schema/) [structured data](https://pl.wordpress.org/plugins/tags/structured-data/) * [Widok zaawansowany](https://pl.wordpress.org/plugins/index-harmony/advanced/) ## Oceny Nie przesłano jeszcze żadnych recenzji. [Twoja opinia](https://wordpress.org/support/plugin/index-harmony/reviews/#new-post) [Zobacz wszystkierecenzje.](https://wordpress.org/support/plugin/index-harmony/reviews/) ## Zaangażowani * [ indexharmony ](https://profiles.wordpress.org/indexharmony/) ## Wsparcie Masz coś do dodania? Potrzebujesz pomocy? [Zobacz forum wsparcia](https://wordpress.org/support/plugin/index-harmony/)