Hack The SEO – MCP Server for Claude, AI Bot Tracker, llms.txt, GEO Score & Cannibalization

Only if something is missing. If Yoast or Rank Math is doing the job and you have no idea whether ChatGPT reads your pages, install this one for that answer alone: the AI crawler log, the GEO score and the cannibalization report are things the big four do not give you. And you do not have to choose, see the next question.

Yes, and that is the default behaviour. You do not have to choose.

On activation the plugin detects the SEO plugin already in place and stops emitting whatever that plugin handles: meta tags, canonical, schema, sitemap, breadcrumbs, robots, and hreflang when a multilingual plugin owns it. So there are no duplicate title tags, no duplicate canonicals and no duplicate schema. It never deactivates your plugin and never touches its settings.

Meanwhile the three things the big four do not give you keep working, because they produce no front-end output and therefore cannot conflict: the AI crawler log, the GEO score per page, and the keyword cannibalization report.

A dedicated screen lists every overlap and lets you take back any module, one by one. Your choice always wins over the automatic default.

If you would rather replace your current plugin than run both, the migration wizard imports its data first, as a dry run you can review. See “How do I switch from Yoast SEO, Rank Math, All in One SEO or SEOPress?” below.

Activate the plugin and open the AI visibility screen. Every request from GPTBot, ChatGPT-User, OAI-SearchBot, ClaudeBot, Claude-User, Claude-SearchBot, PerplexityBot, Perplexity-User, Applebot, CCBot and eight more is recorded server-side, with the URL and the timestamp, in your own database. Nothing is sent anywhere.

To prove it to yourself in ten seconds: curl -A GPTBot https://your-site.tld/any-page/ , then refresh the screen. The row is there. Use a real post or page URL, not the home page: the detector only reads single pages. On a new site, real crawlers can take weeks to come, and an empty screen is an answer too.

A JavaScript analytics tool cannot do this. AI crawlers do not run JavaScript, so whatever your analytics says about GPTBot, it is guessing.

Your own site sends it, through WordPress, to the administrator email. Once a week: how many times AI crawlers read the site and on how many pages, how many visitors arrived from an AI chat, which new broken links appeared, and how the site score moved. Nothing is sent on a week with nothing to report. It is off by default, switched on from the AI visibility settings, and every email carries an unsubscribe link that works without logging in. No third party is involved and no outbound call was added: it is wp_mail() , the same function WordPress uses for password resets.

Open the AI connection screen and create a connection key: one button, which creates a WordPress application password. Then pick your tool.

• The Claude app, on Mac or Windows : the first tab downloads the Hack The SEO extension for Claude, made for your site with its address already filled in. Double-click it, click Install, and paste the key when Claude asks for it. No terminal and no configuration file.
• Claude Code, Cursor, Windsurf or the ChatGPT desktop app : the screen prints the line or the block for your tool, with three numbered steps and how to tell it worked.

Either way, your client talks to https://your-site.tld/wp-json/htsfree/v1/mcp . No account with us, no OAuth relay, no companion plugin on your site.

Two things are required, and the screen tells you if either is missing: WordPress 6.9 or newer, because that is where the Abilities API entered core, and HTTPS, because WordPress only issues application passwords over a secure connection.

It can read twelve things and change nothing. There is no write among the twelve abilities, and no setting that turns one on.

It reads: AI crawler activity three ways (totals per bot, the detail page by page including the pages no crawler has touched, and the day-by-day timeline), a page’s GEO, on-page and meta scores, the site-wide score distribution, the competing-pages report, your redirect rules, your 404 log, your llms.txt , the Markdown of any page, and the health check.

Every call is made by a signed-in WordPress user and checks a capability: administrator for the site-wide readings, and a user who can edit posts for the four that concern a single page. Unpublished and password-protected content stays out, and no visitor’s IP, referrer or user agent is ever returned. Delete the application password from your user profile and that client is locked out immediately.

The Model Context Protocol is the open standard an AI client uses to read data from a tool, instead of you copying and pasting it. WordPress 6.9 brought the Abilities API into core, and this plugin builds a read-only MCP server on top of it at /wp-json/htsfree/v1/mcp .

Twelve abilities, and all twelve read. Connect the Claude app or Claude Code and ask about your own site: which published pages no AI crawler has read, why an article scores 38 out of 100, which of your pages compete with each other. The connection is inbound, so your client calls your site and no third party is contacted. Below WordPress 6.9 the server simply does not register.

The MCP server sends nothing and contacts no third party. Your AI client calls your site, not the other way round. What you then read inside your client goes wherever that client goes, which is between you and the client you chose, exactly as if you had typed the same figures in by hand.

On the plugin’s side the MCP server changed nothing: it added no wp_remote_ call site of its own, and neither does the bundled library. If another plugin has already loaded the same MCP library in an older version, this server stays off rather than fight over it, and the AI connection screen says so plainly.

That depends on what you need, and anyone giving you a single answer is selling something. Yoast SEO and Rank Math are the two largest and have the biggest ecosystems. All in One SEO is the oldest. SEOPress is the leanest of the big four. Slim SEO is the right answer if you want zero configuration.

Hack The SEO is built for a specific case: you want the whole technical layer (schema, sitemap, redirects, canonical, robots, breadcrumbs) plus keyword cannibalization detection and real AI-crawler measurement, computed locally, with no account and none of it sent to a third party. If cannibalization or GEO measurement is what you are missing, this is the free plugin that has it, and it runs next to whichever of the others you already use. If you mostly want AI-generated content, it is not.

Install Hack The SEO and it generates JSON-LD structured data automatically from what is already on each page: Article, BreadcrumbList, Organization, Person, Product, FAQPage, HowTo, QAPage, VideoObject and 60+ types in total, so your pages qualify for rich snippets. Types that cannot be detected reliably, such as LocalBusiness opening hours, are yours to enable per page in the Schema settings, so nothing is invented. Confirm the result in Google’s Rich Results Test or the Schema Markup Validator.

Open the Redirects screen, enter the old URL and the destination, and choose 301 (permanent). You can also use 302, 307 and 410, add regex rules for bulk migrations, and import or export everything as CSV. When you rename a post, a 301 from the old slug is created for you. Incoming 404s are logged, and any 404 can be turned into a redirect in one click. Redirects are served in PHP, so your .htaccess is never touched and it works identically on Apache, Nginx and LiteSpeed.

It is served automatically at /sitemap.xml : a sitemap index plus one sitemap per content type, with image, video and news extensions and an XSL stylesheet so it is readable by a human. It respects noindex and is cached on disk so it does not rebuild in PHP on every request. Submit /sitemap.xml to Google Search Console. The “First steps” checklist reminds you to.

llms.txt is a plain-text file listing your key content for AI crawlers, in the same spirit as robots.txt for search crawlers. Hack The SEO serves it virtually at /llms.txt , generated from your real content, with no file written to disk. It also serves a Markdown version of every page at /your-page.md , which is the format an LLM parses most reliably and most cheaply. Both are on your own server, both are free, and neither requires an account.

GEO, sometimes called AEO (answer engine optimization), means making your content easy for generative engines (ChatGPT, Claude, Perplexity, Gemini, Google AI Overviews) to read, understand and cite. Classic SEO optimises for a ranked list of links; GEO optimises for being the source quoted inside an answer.

In practice it comes down to: answer the question explicitly and early, keep facts stable and attributable, structure the page so a machine can parse it, expose clean formats (schema, Markdown, llms.txt), and then measure whether the AI crawlers actually come. Hack The SEO does all five, locally, in the free version.

Keyword cannibalization is when two or more of your own pages target the same query, so search engines have to pick between them and both underperform. It is one of the most common causes of a site that has plenty of content and no rankings.

Hack The SEO