KOZ Site Bridge

KOZ Site Bridge is an independently installable WordPress plugin developed and maintained by Tony Kozyriev. It grew from production tooling used on the UA FREE charitable foundation website.

Part of the KOZ Suite

KOZ Site Bridge is one focused module of the broader KOZ Suite, a family of independent WordPress plugins that share a common KOZ administration experience and visual identity.

Each KOZ plugin remains independently installable, so site owners can use only the modules they need or combine several modules into one toolkit.

Current public KOZ plugins:

• KOZ SEO Core — technical SEO, schema, sitemaps, AI discovery and OpenAI Vision image ALT.

• KOZ Copy Actions — accessible copy-to-clipboard actions for selected WordPress content.

• KOZ URL-Only Comment Spam — privacy-first local moderation for URL-only comment spam.

• KOZ Static Translate — AI-powered multilingual translation with Microsoft Azure AI Translator and static language routes.

• KOZ Translate Diagnostics — read-only health checks and privacy-safe diagnostic reports for KOZ Static Translate.

• KOZ 404 Guard & URL Intelligence — privacy-safe 404/410 diagnostics, controlled same-site redirects and URL intelligence.

• KOZ Consent Manager — privacy-first visitor consent, optional script control and Google Consent Mode v2 synchronization.

• KOZ Donate Stats & Conversions — local donation-journey analytics and consent-aware conversion events for WordPress.

• KOZ Site Bridge — secure read-only WordPress diagnostics, controlled same-site probes and authenticated REST automation.

Main features

• authenticated read-only REST diagnostics;

• several API keys, each with a label, access scopes (basic, content, audits, 404 log, PHP error log), last-used date and optional expiry;

• “Try it” console in the admin: run any endpoint as an administrator without a key and see the JSON;

• WordPress 6.9+ Abilities API: read-only abilities for administrators that AI clients can use through the MCP Adapter;

• sitemaps from robots.txt (for example multilingual sitemaps) are included in the inventory and audits, with counts per language;

• KOZ 404 Guard 2.2+ log with paths (when the log stores them), query keys and same-site referrers;

• security headers, page/CDN cache and response-time, and consent (trackers, embeds, Consent Mode) checks;

• status of KOZ plugins: 404 Guard, Donate Stats, Static Translate (with monthly Azure usage) and Consent Manager;

• Site Health test for HTTPS, old non-expiring keys and error-log access;

• canonical KOZ REST namespace and X-KOZ-Key authentication;

• backward-compatible legacy endpoint and header during migration;

• HMAC API keys with one-time display;

• no persistent API request log, IP storage or User-Agent storage;

• safe same-site public frontend HTTP probes without query strings;

• allowlisted Googlebot and AdsBot User-Agent profiles;

• redirect-chain and selected Cloudflare/server headers;

• rendered public-page audit for title, description, canonical, robots, hreflang, headings, image alt state, links, schema and document language;

• sitemap inventory and batched sitemap audit with concrete per-URL findings;

• privacy-safe KOZ 404 Guard integration;

• KOZ Suite inventory and navigation;

• multilingual administration with English fallback;

• no arbitrary URL input and no content, plugin, theme or user modifications.

Existing Site Bridge API keys are preserved. The old REST namespace and X-UAFree-Key header remain accepted during migration, while new integrations should use /wp-json/kozbridge/v1 and X-KOZ-Key. The previous /wp-json/koz-site-bridge/v1 route also remains available.

Access and security

• The X-KOZ-Key is generated locally by the site administrator and is used only to authenticate the read-only REST API. It does not control feature availability.

• Every built-in plugin feature is available to every installation.

• Each key can be limited to the scopes it needs; reading the PHP error log is off for new keys. The key created before 0.6.0 is kept as “Legacy key” with full access until you revoke it.

• Abilities and the “Try it” console require the manage_options capability and never use or show API keys.

• The authenticated API has a security/abuse throttle of 120 successful requests per hour per key. This protects the WordPress site and applies equally to all authenticated clients.

• The OpenAPI schema endpoint is intentionally public so an administrator can import the schema into a REST client. It exposes only the API contract and does not return private site data, credentials, settings, content, or logs. All diagnostic data endpoints require X-KOZ-Key authentication.

• KOZ Site Bridge does not connect to an external processing service. Its HTTP probes are restricted to the current WordPress site. External REST clients or automation tools are optional and chosen by the site administrator.