About this plugin
The companion plugin to the Hafen theme.
Following the principle “theme = presentation, plugin = functionality”, Hafen
org guidelines, does
not belong in a theme: a schema engine, five answer blocks, an AI crawler
txt, a local AI traffic dashboard, Markdown delivery for
agent clients, a citability linter, an under-construction gate and an
txt file. It works with any theme, but it is built and tested as the
functional half of Hafen.
Access rules and measurement in one plugin. Most plugins in this field do
one of the two: they either block AI crawlers, or they report on AI visibility
from an external service. Hafen Core does both in the same place and can
therefore relate them to each other, for example: “Perplexity is not crawling
” Everything runs on your own
installation; no account and no external service are required for it.
No invented scores. This plugin does not calculate a visibility score
and does not promise you a placement in ChatGPT. Where the evidence is thin, it
txt is labeled as speculative, every rule in the citability
linter states its evidence strength and its source, and where a provider
publishes no IP ranges we do not present a user agent as proof. The most honest
sentence first: the strongest documented factor for citations is mentions of
your brand elsewhere. On-page is the smaller lever. Everything this plugin does
works on that smaller lever – but it does so cleanly and verifiably.
Schema engine. Automatically embeds valid JSON-LD without you writing
anything: Organization, WebSite (including the search action), Article (on
posts) and BreadcrumbList. Plus FAQPage and HowTo generated from the answer
blocks. Everything in a single @graph in the document head.
Answer engine blocks. Five blocks that render nicely for humans while
being machine-readable and privacy-friendly:
- Hafen FAQ — emits FAQPage schema.
- Hafen HowTo — emits HowTo schema.
- Hafen TL;DR — highlighted short answer.
- Hafen Definition — a term in what-is-X format.
- Hafen Video (2-click) — privacy-friendly YouTube embed that loads only
com.
Access gate (Under Construction). Protect the whole website with a
password while it is being built – without an extra plugin. Three bundled
templates (light, dark, accent gradient) automatically pick up your logo, your
site name and your accent color. Logged-in users see the website normally, the
gate page sends HTTP 503 + noindex (safe for SEO), and the WordPress logo on
login pages is replaced with your site logo.
AI crawler policy. The whole market treats AI crawlers as a threat to be
locked out. Hafen Core does the opposite: it helps you get found and cited. To
do that, it cleanly separates what almost everyone conflates: training (GPTBot,
ClaudeBot, CCBot), search/index (OAI-SearchBot, Claude-SearchBot,
PerplexityBot, Googlebot) and live retrieval by a human in a chat
(ChatGPT-User, Claude-User, Perplexity-User). Blocking training costs NO
visibility. Blocking search costs all citability. The interface prevents
exactly that mistake, with plain-language warnings instead of fine print.
Default: nothing blocked. This is not a blocker plugin.
AI traffic dashboard, entirely local. Shows which AI bots fetch your
content, which pages they crawl the most, how many visitors come back from AI
e. how many pages a provider
fetches before it sends you one visitor. No account, no cloud, no IP addresses
in the database. If you enable the optional OpenAI bot verification, hits from
GPTBot & Co. are checked against the official IP ranges; where a provider
publishes none (Anthropic, Perplexity, Meta), the dashboard says so openly
instead of presenting a user agent string as proof.
IndexNow. Reports new and changed content immediately to Bing and
participating search engines instead of waiting for the next crawl. Relevant
because ChatGPT’s web answers are backed by the Bing index. Off by default
(opt-in).
Markdown for agents. Agentic clients (Claude Code, Cursor, OpenCode)
request pages with “Accept: text/markdown”. Hafen Core answers with a clean
md
suffix. That saves the model the layout, navigation and script ballast. The
Markdown version is sent with “X-Robots-Tag: noindex”, and “Vary: Accept” is
placed specifically on the responses that can also be served as Markdown, so
no page cache serves the Markdown version to browsers – and on no other
response, so proxy caches do not fragment unnecessarily. Only published,
publicly visible, non-password-protected content is served.
Citability linter in the editor. Checks the post against 15 rules and
shows, per rule, whether it passes and how well it is supported by evidence
(strong / medium / weak), including the source. Deliberately WITHOUT a 0–100
score: nobody knows a citation probability, and we do not pretend to. It also
includes a check for prompt injection and cloaking, because that is a penalty
issue, not an optimization issue. The optional AI deep check uses the AI
assistant and is not a requirement: all rules run without AI as well.
Abilities API and WebMCP. 9+),
Hafen Core registers read-only abilities (page as Markdown, search content) as
well as the AI assistant’s generators; only the read-only ones are exposed to
MCP. On top of that come read-only WebMCP browser tools. Honest framing:
WebMCP is a Chrome experiment and only has an effect while the tab is open.
Crawlers see none of it; it does nothing for visibility. A tiny snippet loads
the script only in browsers that actually have the API; everyone else pays 0
additional requests. Both are pure feature detection, not a dependency.
txt generator. txt (and
txt). txt, and
measurements show AI systems practically never fetch the file. Useful for
coding agents, not for visibility in AI search. We ship it because it costs
nothing, and we promise nothing for it.
Performance status. Speed is a core commitment of the Hafen family. The
dashboard (Settings > AI Traffic) therefore shows honestly what your setup
delivers: page cache detected or not, compression via self-test, the theme’s
font mode (variable/static/system) – each with a plain-language
recommendation. Plus an option to disable the WordPress emoji script (~26 KB
org saved; off by default). Cache and
compression are server matters no plugin can solve from the inside. That is
exactly why we display them instead of making promises.
Everything runs without a build step and is GDPR-friendly. Schema, blocks and
txt work entirely locally. External connections only occur for features
you explicitly enable or trigger: the optional AI assistant (through the
WordPress AI client, provider and key configured under Settings > Connectors,
only on click), the optional OpenAI bot verification (IP ranges, off by
default), IndexNow (opt-in) and the video block (YouTube, only after a
click). Details under “External services”.
External services
The optional AI assistant generates suggestions (meta description, TL;DR,
FAQ) from your post content. All requests run through the WordPress AI
0+): which provider receives the data, and with which
key, is configured centrally under Settings > Connectors. The plugin itself
does not contact any AI provider directly. Data is sent ONLY if you (a)
enable the assistant under Settings > Hafen Core and (b) click a suggestion
button in the editor; the post’s title and text then go to the connector you
configured. The same applies to the optional AI deep check of the citability
linter: only if you explicitly tick “AI deep check” in the editor and start
the check, an excerpt of the post (at most 5,000 characters) is sent to your
configured connector. Without that checkbox the linter runs entirely locally
and rule-based. On installations without a configured WordPress AI client,
both features stay inactive.
The “Hafen Video (2-click)” block embeds YouTube videos in a
privacy-friendly way: before the click, nothing is loaded from YouTube (no
thumbnail, no request). Only when visitors click the play area is an iframe
com; at that point data is
transmitted to Google. The notice text on the play area informs about this.
com/t/terms
com/privacy
IndexNow (Microsoft Bing): if you enable IndexNow under Settings > Hafen Core
(off by default), the plugin reports the affected URL to
org/indexnow when content is published or updated. Sent
are exclusively: the URL of the public content, your hostname, the locally
generated IndexNow key and the location of the key file. No content, no user
data and no visitor data are transmitted. Without this activation nothing is
sent, and nothing is sent while the access gate is active.
org/terms
com/privacystatement
OpenAI IP ranges (bot verification, opt-in): OFF by default. Only if you
explicitly enable the OpenAI bot verification under Settings > AI Traffic
json,
json
weekly via cron, to check whether a hit really comes from OpenAI and does not
merely fake its user agent. This is a pure download; no data of yours is
transmitted in the process. The check itself runs locally. Without this
activation not a single fetch is made.
com/policies/terms-of-use
com/policies/privacy-policy
Privacy
The AI traffic measurement writes to its own table ({prefix}hafen_ai_hits).
It stores exclusively: timestamp, bot or source identifier, purpose
(training, search, live retrieval, referral), the ID of the requested post, a
hash of the path and a yes/no verification field.
Explicitly NOT stored: IP addresses, user agent strings, cookies, session
identifiers or any other personal data. The IP address is checked in memory
against the official provider IP ranges and is not stored. Only if you enable
the optional reverse DNS check (off by default) is the result of that check
(yes or no) cached for 24 hours in a transient whose name is a salted hash of
the IP address (wp_hash), so the same address is not looked up on every hit.
Logged-in users are not recorded at all. Retention is limited to 90 days by
default (configurable between 7 and 365 days); a daily cron run deletes older
entries. No data is transmitted to hafenstudios or third parties.
The access gate (off by default) sets one cookie after the correct password
has been entered: hafen_gate_, HttpOnly, valid for 3 days (filter
hafen_core_gate_cookie_days). It holds a keyed hash of the stored password
hash, no personal data. To limit password guessing, failed attempts are
counted for 10 minutes in a transient whose name is a salted hash of the IP
address (wp_hash); the IP address itself is not stored.
Copyright
Hafen Core, (C) 2026 hafenstudios.
Hafen Core is distributed under the GNU General Public License v2 or later.
All bundled assets are GPL-compatible:
- assets/mascot/captain-*.webp — brand mascot “Kapitän Ahoi”: original work by
hafenstudios, created with AI assistance (OpenAI ChatGPT/DALL·E). No
third-party templates or stock images were used. (C) 2026 hafenstudios,
released under GPLv2 or later.
- All icons are inline SVG, an original set, (C) 2026 hafenstudios, GPLv2 or
later.
- No font files, libraries or third-party assets are bundled.