=== Engagemii AEO ===
Contributors: engagemii
Tags: ai, seo, schema, json-ld, llms
Requires at least: 5.5
Tested up to: 7.0
Requires PHP: 7.4
Stable tag: 1.4.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

See every AI bot that visits your site and get cited in ChatGPT, Claude, and Perplexity. The fixes install themselves. All of it is free.

== Description ==

Your customers are already asking ChatGPT, Claude, Perplexity, and Gemini for recommendations. If those engines cannot read your site properly, they recommend somebody else - and you never even see it happen, because AI bots do not show up in Google Analytics.

This plugin fixes both problems from inside WordPress, and it starts the moment you activate it. Everything Engagemii offers site owners is free.

**What you get instantly, no account needed:**

* Every AEO file your site should be serving, generated on your own server from your own site data: Organization JSON-LD schema (who you are and how to cite you), FAQ schema, llms.txt, ai.txt, an AI-crawler allow list for robots.txt, plus a clean meta description and Open Graph tags for your homepage. Nothing is sent anywhere.
* **The AI crawler counter.** Your server sees GPTBot, ClaudeBot, PerplexityBot, and the rest every day - your analytics just never told you. This plugin counts those visits server-side and shows you the last 7 days right on the settings page.

**Your free dashboard - one click, no signup form:**

When you want more than the 7-day counter, click "Create my free dashboard" on the settings page. We create your free Engagemii account on the spot and email you a login link that signs you straight in; you pick a password on your first visit. You never leave wp-admin. Inside your dashboard:

* **Your AI crawler traffic** - how many times AI bots visited this week, how that compares to last week, and which bots came, bot by bot. This is the AI traffic no analytics tool shows you.
* **Your AI visibility score** - run the free audit and see how visible your brand is to ChatGPT, Claude, and Perplexity, broken down by category, so you know exactly where you stand.

**Your Customized Fix Kit - free:**

Request your free Customized Fix Kit from your dashboard: we read your actual site and write your schema, llms.txt, FAQs, and metadata for you, tailored to your real content instead of templates. Kits are prepared in a queue and the download link arrives by email once yours is ready. Connect this plugin to your account and it installs the whole kit automatically and keeps it current: change your profile on Engagemii and your site updates within the hour.

**Why is it free?**

Engagemii is free because we license the AI-crawler activity data the tracker collects, including data identified by your domain. You can opt out of domain-identified licensing in Settings. The tracker records bot visits only, never your human visitors.

Activate it, watch the counter, and you will see for yourself how much AI traffic you have been flying blind on.

== External services ==

This plugin connects to the Engagemii API (api.engagemii.com) operated by Engagemii LLC. The connection is required because the plugin's job is to apply your Engagemii AEO configuration (JSON-LD, llms.txt, ai.txt, robots rules, meta tags) to your WordPress site, and those configuration values are stored in your Engagemii account.

The plugin sends data to api.engagemii.com in five cases:

0. **One-click free dashboard creation (only when you click "Create my free dashboard").**
   The plugin POSTs to https://api.engagemii.com/api/wp-plugin/connect-free with:
   * The email address you entered (prefilled with your WordPress admin email; you can change it before submitting)
   * Your site URL (home_url())
   * Your WordPress version and the plugin version
   Engagemii creates a free account for that email, returns the API key (stored by the plugin so the sync below activates), and emails you a login link to your dashboard. Nothing is sent until you click the button.

1. **Plugin registration (one-time, when you paste your API key and click Save & Connect).**
   The plugin POSTs to https://api.engagemii.com/api/wp-plugin/register with:
   * Your site URL (home_url())
   * Your WordPress version
   * Your PHP version
   * The plugin version
   * Your API key (in the x-engagemii-key request header)

2. **Hourly configuration sync (automatic, plus when you click Force Sync Now).**
   The plugin GETs https://api.engagemii.com/api/wp-plugin/config with your API key in the x-engagemii-key request header. The response is the JSON-LD, llms.txt, ai.txt, robots.txt rules, and meta-tag content the plugin should apply on your site. No site content is sent on this request other than the headers.

3. **Sync-result reporting (automatic, fire-and-forget after each successful sync).**
   The plugin POSTs to https://api.engagemii.com/api/wp-plugin/sync-report with:
   * The sync status (ok, error, etc.)
   * The plugin version
   * Daily AI-crawler visit counts observed on your site over the last 14 days (bot name and count per day - for example "GPTBot: 12 visits on 2026-07-01")
   * Per-page AI-crawler visit counts over the same 14 days: the URL path of each page an AI crawler fetched, with the bot name and count per day - for example "/pricing: GPTBot 18 visits on 2026-07-01". Only the path on your own site is sent; no query strings, no IP addresses, and no information about human visitors is included.
   * Your API key (in the x-engagemii-key request header)

4. **Live AI-crawler visit beacon (automatic, once per AI-crawler page request).**
   When an AI crawler requests a page on your site, the plugin POSTs to https://api.engagemii.com/api/tracker/hit with:
   * The crawler's user-agent token (for example "GPTBot"). Only the fixed list of AI crawlers the plugin recognises is reported; ordinary visitors and ordinary search engines are ignored.
   * The URL path of the page it requested on your own site, with query strings removed
   * The IP address the request came from
   * Your API key (in the x-engagemii-key request header)
   The request is non-blocking, so it never slows your page down. The IP address is used only to confirm the crawler is genuine by checking it against the crawler operator's own published address ranges. Engagemii holds it for at most 24 hours for that check, does not show it in your dashboard, and does not include it in any data product. This beacon is what lets your dashboard, and your own Google Analytics if you connect it, show which crawler read which page as it happens rather than once an hour.

**If you never connect an API key, the plugin makes no external requests at all.** The free template fixes are generated locally in PHP, and the AI-crawler counter stores its counts only in your own WordPress database. Connecting an API key is the consent step that enables the requests above.

Engagemii is free because we license the AI-crawler activity data the tracker collects, including data identified by your domain. You can opt out of domain-identified licensing in Settings. The tracker records bot visits only, never your human visitors.

The plugin does not send your site's content, your visitor data, your user data, your post content, your media, or any database content other than the installation environment values listed under (1) and the bot visit data listed under (3) and (4).

Service operator: Engagemii LLC (https://engagemii.com).
Terms of Service: https://engagemii.com/terms
Privacy Policy: https://engagemii.com/privacy

== Installation ==

1. Install the plugin from the WordPress plugin directory, or upload the `engagemii-aeo` folder to `/wp-content/plugins/`
2. Activate it - the free template fixes and the AI crawler counter are live immediately, no setup
3. Go to **Settings &rarr; Engagemii AEO** to see what is installed and which AI bots have visited
4. Optional: click "Create my free dashboard" to get your free Engagemii account and crawler dashboard, one click
5. If you signed up on the Engagemii site first, paste the API key from your dashboard and click "Save & Connect" - the plugin pulls your configuration immediately and re-syncs every hour.

== Frequently Asked Questions ==

= Where do I get the API key? =

You usually do not need one: the "Create my free dashboard" button connects this site automatically. If you signed up on the Engagemii site instead, log in at [app.engagemii.com/brands/login](https://app.engagemii.com/brands/login), open your dashboard, and copy the key from "Auto-install via WordPress."

= Does this conflict with Yoast or Rank Math? =

No. We only inject schema and meta on your homepage by default, and we add - not overwrite - your robots.txt. JSON-LD is additive; multiple JSON-LD scripts on the same page is supported by Google and all AI crawlers.

= Will this slow down my site? =

No. The plugin caches all config in your WordPress options table. The only network call is one hourly cron request to fetch updates.

= What happens if I deactivate the plugin? =

All injected schema, meta tags, llms.txt, ai.txt, and robots.txt additions are removed. Your site returns to its previous state.

= Is the plugin free? =

Yes, all of it. Template schema, llms.txt, ai.txt, robots rules, meta tags, and the AI crawler counter are active on activation, generated locally from your own site data. The free dashboard (one click to create, no signup form) adds AI crawler traffic charts with history and your free AI visibility audit. The free Customized Fix Kit adds AI-written fixes tailored to your content; request it from your dashboard and the download link arrives by email when it is ready. There is nothing to buy.

= How is it free? =

Engagemii is free because we license the AI-crawler activity data the tracker collects, including data identified by your domain. You can opt out of domain-identified licensing in Settings. The tracker records bot visits only, never your human visitors.

= Does the free mode send anything to Engagemii? =

Not until you connect. Without an API key the plugin makes zero external requests. Everything is generated and stored on your own server. Connecting an account (the one-click dashboard button or pasting a key) is the consent step that turns on the sync and the bot-visit reporting described under External services.

== Screenshots ==

1. Plugin settings page with API key field and connection status
2. Live status panel showing brand info, score, and what's installed
3. Engagemii portal dashboard where you copy the API key

== Changelog ==

= 1.4.0 =
* AI-crawler visits now include the crawler's IP so Engagemii can confirm each visit really came from the operator it claims (OpenAI, Anthropic, Perplexity, Google, and others publish their crawler IP ranges). Verified, unverified, and unconfirmed visits are tracked separately, the same way Engagemii verifies traffic on its own site. The IP is sent only for AI-bot requests and only when you have connected a key; it is never stored for your human visitors.

= 1.3.0 =
* AI-crawler visits now report the moment they happen, the same way every other install method does, so a WordPress site behaves identically to a Cloudflare, Next.js, or PHP install. If you connect Google Analytics in your Engagemii dashboard, each AI-bot visit appears in your GA in real time, tagged with the bot and the page it hit. Counting stays server-side and local; nothing is sent until you connect a key.

= 1.2.0 =
* Engagemii is now free for site owners. The Customized Fix Kit no longer costs anything: request it from your dashboard, the download link arrives by email, and connected sites get their full custom configuration installed automatically. The citation tracking add-on has been withdrawn and all purchase prompts are gone from the settings page.
* Every connected site now receives its full configuration on sync; the old "upgrade required" state is retired.
* External services disclosure updated: the hourly sync report includes per-page AI-crawler visit counts (URL path, bot name, count per day) in addition to per-bot daily totals, and the listing now explains the data licensing that keeps Engagemii free.

= 1.1.0 =
* Per-page AI-crawler tracking: the settings page now shows which pages the AI crawlers actually fetched (e.g. /pricing 18 visits, /product 9), not just per-bot totals. Counted server-side and locally, same privacy posture. Connected accounts also see the per-page breakdown in their Engagemii dashboard.

= 1.0.7 =
* Pricing copy updated. No functional changes.

= 1.0.6 =
* One-click free dashboard: enter your email (prefilled) and click once - the plugin creates your free Engagemii account, connects itself, and emails you a magic login link. No password, no leaving wp-admin, no copy-pasting keys.
* Free accounts now stream their AI-crawler counts to their dashboard (previously counts stayed local until a key was connected). Connecting remains the consent step; the new connect-free request is documented under External services.
* "Open my dashboard" button on the settings page once connected.

= 1.0.5 =
* Free mode: the plugin now works with no account and no API key. Template versions of the Organization schema, FAQ schema, meta description, Open Graph tags, llms.txt, ai.txt, and AI-crawler robots.txt rules are generated locally from your site's own data (title, tagline, logo, pages) the moment you activate. Zero external requests in this mode.
* AI crawler counter: server-side counting of AI bot visits (GPTBot, ClaudeBot, PerplexityBot, Google-Extended, and 11 more), with a 7-day summary on the settings page. Counts live only in your own database unless you connect an account.
* Connected sites now include daily bot-visit counts (bot name + count per day, nothing else) in the hourly sync report, so your Engagemii dashboard can show crawler history and alerts. Documented in the External services section.
* Settings page: free protections and crawler counts are shown before any account is connected; connecting is now clearly optional.

= 1.0.4 =
* Author URI fix per plugin review.

= 1.0.3 =
* Move all admin CSS out of inline `<style>` blocks. Admin CSS is now enqueued via `wp_enqueue_style` from `assets/css/admin.css` and loaded only on the plugin's settings screen.
* Fix JSON-LD output escaping. The previous `strtr` replacements were effectively no-ops (the replacement strings were identical to the search strings). Replaced with `JSON_HEX_TAG | JSON_HEX_AMP` flags on `wp_json_encode` (which truly escape `<`, `>`, and `&` in the JSON output) plus an explicit `str_replace` that converts U+2028 and U+2029 to their ` ` / ` ` six-character escape sequences. Forward slashes remain escaped by default. Script-context breakout is no longer possible.
* Add "External services" section to readme covering every request the plugin makes to api.engagemii.com (register, config sync, sync report) including what data is sent, when, and links to Engagemii's Terms of Service and Privacy Policy.

= 1.0.2 =
* Add `wp_unslash()` before `sanitize_text_field()` on settings form `$_POST` reads, per Plugin Check.
* Annotate hardened JSON-LD echo with `phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped` and explanatory comment; output is already script-context safe by construction (manual `<`, `>`, `&`, U+2028, U+2029 escape).
* Trim Short Description to under 150 characters.

= 1.0.1 =
* Harden JSON-LD output: escape `<`, `>`, `&`, U+2028 and U+2029 as unicode sequences so the JSON cannot break out of its `<script>` tag.
* Sanitize `/llms.txt` and `/ai.txt` content with `wp_strip_all_tags` + `esc_html` before output, even though Content-Type is text/plain.
* Settings page status list: route hardcoded HTML through `wp_kses_post` on output, per WP guideline "escape on echo, late."

= 1.0.0 =
* Initial release.

== Upgrade Notice ==

= 1.2.0 =
Engagemii is now free for site owners: free Customized Fix Kit, no purchase prompts, full config for every connected site. External services disclosure updated (per-page bot-visit paths are reported for connected sites).

= 1.0.3 =
WordPress.org review compliance: move admin CSS to wp_enqueue_style, fix JSON-LD escape function (was a no-op), document the api.engagemii.com external service.

= 1.0.2 =
Plugin Check compliance: unslash on settings input, annotate hardened JSON-LD echo, trim short description.

= 1.0.1 =
Security hardening for output escaping per WordPress plugin review.

= 1.0.0 =
First release.
