Everything you need to run AIScanner.

Installation

AIScanner requires WordPress 6.7+ and PHP 7.4+.

1. Upload the aiscaner folder to /wp-content/plugins/, or install it through Plugins → Add New.
2. Activate the plugin through the Plugins screen.
3. Open AIScanner in the admin menu and click Scan to grade your site.
4. Apply a fix from any failing check, then click Verify to confirm the change over a real HTTP request.

Quick start

The core workflow is a three-beat loop you can repeat any time your site changes:

1. Scan. AIScanner fetches your live URLs and grades five dimensions against the rubric, producing an overall 0–100 score and a readiness level.
2. Fix. Each failing check offers a one-click fix. Applying one writes plugin settings only — it never edits your theme or rewrites posts.
3. Verify. Re-fetch over a real request to confirm the score moved. A scheduled re-scan then watches for drift.

Because every check is an HTTP request against your own site, the score reflects what a crawler actually sees — including cases where a CDN or a physical robots.txt is overriding WordPress.

The rubric

Scoring is driven entirely by a versioned rubric (rubric-v1) — the single source of truth for what gets scored and how much it’s worth. Each check earns points toward its dimension; dimensions roll up to the overall score using a weighted average. Info-tier results (“couldn’t verify”) and inapplicable dimensions (Commerce, unless WooCommerce is active) are excluded from the denominator.

The overall score maps to one of six readiness levels:

Dimensions & checks

Fifteen checks across five dimensions. Each is graded independently over HTTP.

Discoverability — 13 pts

Content — 18 pts

Bot Access — 15 pts

Capabilities — 12 pts

Commerce — 10 pts · WooCommerce only

Fixes & reversibility

This is the part that sets AIScanner apart from a stateless scanner: it doesn’t just tell you what’s wrong, it fixes it — safely.

• Settings only. Every fix writes plugin settings and nothing else. No theme files are edited, and no posts are rewritten.
• Genuinely reversible. Because state lives in settings, “Turn off” restores the exact prior behavior. Applying the C3 fix, for example, derives the meta description at render time rather than rewriting excerpts.
• Non-destructive exports. Static export refuses to overwrite a robots.txt or llms.txt it didn’t create, so a hand-maintained file is never clobbered.

Agent (MCP) server

AIScanner ships an optional MCP server that exposes scan, fix, verify, and revert as tools an AI agent can call directly. It is off by default and requires a bearer token you generate yourself.

1. Go to AIScanner → Settings, tick Enable the MCP server, and click Save Changes.
2. Copy the bearer token shown. It is stored hashed and cannot be displayed again — regenerate it if you lose it.
3. Add it to your agent:

# Register AIScanner with your agent
$ claude mcp add --transport http aiscanner \
    https://your-site.com/wp-json/aiscaner/mcp \
    --header "Authorization: Bearer <token>"

✓ connected · tools: scan  fix  verify  revert

Privacy

AIScanner makes HTTP requests to your own site only. It sends nothing to any third party and has no telemetry.

/llms.txt, the Markdown output, and the JSON-LD graph are built exclusively from public content: password-protected, private, draft, and per-entity excluded posts are never included.

Security

• The MCP bearer token is stored as a SHA-256 hash. Its raw value is displayed exactly once, when generated, and cannot be recovered — regenerate it if lost.
• The token is never included in a settings export, and a settings import can never set or enable it.
• Failed MCP authentication attempts are rate-limited per IP, and cross-origin requests to the MCP endpoint are rejected.
• All dashboard REST routes require manage_options; per-entity routes require edit_post for that specific post.

FAQ

Does it conflict with Yoast, Rank Math, or AIOSEO?

No. AIScanner detects them and defers per feature, so you don’t get two sitemaps, two meta descriptions, or two JSON-LD graphs.

Why does a check say “couldn’t verify”?

Some hosts block a site from making HTTP requests to itself. When that happens AIScanner reports an informational result rather than guessing, so a blocked loopback never becomes a misleading pass or fail.

I enabled static export and nothing happened.

Static export refuses to overwrite a robots.txt or llms.txt it did not create, so a hand-maintained file is never clobbered. Remove or rename the existing file if you want the plugin to manage it.

What happens when I uninstall?

Uninstalling removes the custom table, all options and transients, the scheduled re-scan, and any files the plugin exported.

Changelog

0.1.0 — initial release

• Initial release of the scan → fix → verify loop across five dimensions.
• Security: password-protected content excluded from Markdown output, /llms.txt, and JSON-LD descriptions.
• Security: the MCP bearer token is stored hashed, shown once, excluded from settings export, and cannot be set by settings import.
• Security: MCP endpoint validates Origin and rate-limits failed authentication.
• Fixed: *.md and .well-known/* URLs return a real 404 instead of the front page when a feature is off.
• Fixed: applying the C3 fix no longer rewrites post excerpts — the meta description is derived at render time.
• Fixed: scan history is capped per scope instead of growing without bound.