Crawlune – AI Crawler Controls

Crawlune audits how easily your published content can be extracted, controls AI
crawler access, and publishes machine-readable summaries. These features run
locally and do not require an account or license. It does not measure or promise
citations by answer engines.

Implemented:

• Per-agent AI crawler controls for GPTBot, OAI-SearchBot, ClaudeBot, Claude-SearchBot, PerplexityBot and Google-Extended, distinguishing training crawlers from retrieval crawlers
• Three named positions to start from — Open, “Answers yes, training no”, Closed — each setting every crawler and the matching content signals in one go
• robots.txt directives generated from those rules
• Optional refusal (403) for a crawler you blocked that requests pages anyway — off by default, and the requests keep being counted
• A count of people arriving from ChatGPT, Claude, Perplexity, Gemini and Copilot — click-throughs, which is a floor under citations rather than a measure of them
• Content signals (search, ai-input, ai-train) in robots.txt, which state what a page may be used for rather than who may fetch it — off until you set them, and a declaration rather than an enforcement
• The same refusal of AI training repeated as a noai response header, a robots meta tag and a W3C TDM reservation at /.well-known/tdmrep.json
• Markdown for agents: every page also available at its own address with .md on the end, and on request via Accept: text/markdown — off by default, and honouring the same exclusions as llms.txt
• IndexNow submission when you publish or update a page — off by default, and honouring the same exclusions as llms.txt
• An extractability audit scoring content on liftable answer blocks, question-shaped headings, external citations, quotable statistics, modification dates and thin content
• A site-wide visibility report aggregating that across all published content, worst pages first
• /llms.txt and /llms-full.txt, generated from your real content and refreshed when you publish
• Admin screens for the report, a per-page work-list behind every number, crawler controls, llms.txt and licensing, plus REST routes for the same
• Background analysis of your content, so none of the above is computed while you wait for a page to load
• Structured data for your pages when no SEO plugin is already providing it
• AI rewriting of a page’s opening into a liftable answer block, reviewed as a word-level diff before anything is applied
• AI rewriting of section headings toward the question they answer, keeping each heading’s level and its existing link address
• Generated FAQ data for pages that answer questions they never ask, where every proposed answer has to be text already on the page — anything else is discarded before you see it
• Applying a rewrite without disturbing surrounding block markup, and reverting a run from a journal
• License activation against the WP Shelf licensing service

Hosted rewriting requires a WP Shelf license and an enabled generation service.
Hosted rewriting is enabled for activated licenses. Public licensing enrollment
is not yet open. Local audits and crawler tools do not
depend on it.

Not included:

• Citation tracking — whether a given engine actually quoted you. Counting people who click through from an assistant is implemented and is a different thing: it is a floor under citations, not a measure of them

Crawlune does not claim it will get your site cited by ChatGPT, Perplexity, Claude
or Google AI Overviews. That is not measurable from inside WordPress and will not
be claimed. What it reports is what it measured about your content.

External services

The content audit, crawler controls, structured-data checks and generated
llms.txt files run on your site. External requests occur only for the optional
features described below. Activating the plugin alone does not opt you into
usage reporting or start generation.

1. IndexNow. With “Submit a page to IndexNow” on, publishing or updating a
page sends that page’s address to https://api.indexnow.org/indexnow, together
with your site’s host name and a verification key this site publishes at its own
root. Nothing else goes with it — no content, no e-mail address, no license key.
IndexNow is a shared endpoint operated by Microsoft on behalf of Bing, Yandex,
Seznam and Naver; the same URL is submitted to all of them once. At most one
submission per address per hour. Service information and terms:
https://www.indexnow.org/faq
Privacy information: https://www.microsoft.com/privacy/privacystatement

2. WP Shelf licensing and generation. A WP Shelf account and a
product-specific license are required to use the hosted generation service;
the local features above remain free without one.

• Service host: https://gloty-api.wp-shelf.com, operated by WP Shelf. A developer can override it with CITELY_SERVICE_URL for a self-hosted service.
• Licensing requests send the license key, site URL, product identifier and, on activation, plugin version. They occur when you activate or deactivate a license and when cached license status is refreshed. These requests are separate from starting a rewrite.
• Starting a rewrite sends the original passage or heading, the page title, URL and post type, language, other headings, bounded body or section text, available audit signals, rewrite constraints, item identifiers and a batch identifier, together with the site URL and license key. A developer can change context through the citely_rewrite_context filter.
• The plugin sends batches after you start a run and polls for results while it is running. If enabled on the service, results may also arrive through an authenticated callback. Merely reading an audit or serving a page does not send its content for generation.
• The generation implementation uses OpenAI to process content. The plugin calls WP Shelf, not OpenAI directly. License keys are for WP Shelf authentication, not part of the provider’s generation prompt.
• WP Shelf terms: https://wp-shelf.com/terms
• WP Shelf privacy policy: https://wp-shelf.com/privacy
• OpenAI terms: https://openai.com/policies/terms-of-use/
• OpenAI privacy policy: https://openai.com/policies/privacy-policy/

3. Optional usage reporting. Only after you enable usage reporting in
Settings, a weekly background request sends the payload below to
https://gloty-api.wp-shelf.com/v1/telemetry (or your configured service host).
It is operated by WP Shelf under the same terms and privacy policy. Turning it
off stops future reports. It is independent of license activation and rewriting.

What the optional report sends

No usage report is sent unless you enable it in Settings. Its JSON payload
contains the product identifier and the following data:

• How many AI crawlers you block, and how many of those are search crawlers —
  as counts. Which crawlers you chose is your editorial decision and is never
  sent
• Whether WordPress’s “discourage search engines” setting is on
• Whether you publish an llms.txt
• Once you have run an audit: how many pages were analysed, the median score,
  and the component counts behind it. A site that has never run one sends no
  scores at all rather than zeroes — an unmeasured site is not a badly
  structured one
• Your WordPress, PHP and Crawlune versions, your site’s locale, and whether
  WordPress considers the site production, staging or local
• A one-way hash identifying this installation, salted with a random value
  generated on your site and never sent. It lets one site’s weekly reports be
  counted as one site; it cannot be turned back into an address

Not included in the usage-report payload: your site address, any e-mail address, any user account, any page,
heading, answer or other content, any URL of yours, which specific crawlers you
block, and your license key. Turning the setting off stops the weekly job
immediately; uninstalling deletes the salt, so a later reinstall is a different
installation as far as we can tell. As with any HTTPS request, the receiving
server can see your server’s network address; the payload does not make the
connection anonymous.

E-mailed reports: the separate scheduled content report uses your site’s
WordPress mail configuration and the recipient you choose. Its delivery may use
your hosting or SMTP provider; Crawlune does not send that mail through WP Shelf.

Why we ask: how many real sites arrive with a search crawler blocked decides
whether the crawler screen is the front door of this plugin or a footnote in it,
and the median score in the wild is the only honest basis for saying what a
typical site’s gap is. Both are currently guesses.

Full documentation, including every component of the extractability score and what this plugin cannot measure: https://wp-shelf.com/crawlune/docs

Keeping your data when you uninstall

Deleting the plugin removes everything it stored, which is the right default — a
plugin you have deleted should not leave rows behind. But it also removes your score history, which is a measurement series that cannot be recreated for months already past.

If you are deleting the plugin to troubleshoot and intend to reinstall, add this
to wp-config.php first:

define( 'CITELY_KEEP_DATA', true );

Uninstalling then leaves your data in place, and a reinstall picks it up where it
left off. Remove the line when you want a genuine clean removal.

Security

Found a security issue? Please email [email protected] rather than opening a
public support thread — a forum post is world-readable the moment you send it,
on a plugin installed on other people’s sites. You will get an acknowledgement
within 72 hours, and credit in the changelog unless you would rather not have it.

Source code

Readable JavaScript source is included in src/ and shared-js/, including the shared
WP Shelf packages compiled into build/. The ZIP includes package.json and
webpack.config.js. See shared-js/README.md for rebuilding with Node.js and npm;
no private repository or workspace checkout is required. WordPress supplies the
React and WordPress browser libraries used by the compiled admin interface.