Tallyrank AI Visibility

When someone asks an AI assistant for “the best dentist in Portland” or “a good web design agency near me”, the assistant names a few businesses. This plugin shows whether yours is one of them, and what on your site keeps assistants from reading it. io, the service it connects to for audits.

Free, on your own server

• AI readiness checks. Can the crawlers ChatGPT, Claude and Perplexity use when they answer questions read your site? Are Google and Bing, whose indexes the assistants search, allowed in? Is “Discourage search engines” still ticked? Is the homepage noindexed? Is there a sitemap, an llms.txt, business markup with links to your profiles on other sites, a descriptive tagline? Each finding says what to do about it. The checks run on your server and send nothing anywhere.

• A free audit, right here. See your AI visibility score, who the assistants named instead of you and which websites they read, without leaving WordPress and with no account. One free audit per site.

io Pro

io”, to:

• see your AI visibility score, overall and for each assistant, with its history;

• run a full audit from the dashboard: which questions were asked, who the assistants named instead of you, and which websites they read to decide;

• get ranked recommendations, a shareable report, and ready-made fix files for the findings (security headers, business markup, sitemap and more), the same Pro fix files the website offers;

• apply the audit’s security-header fixes to this site from the Fixes tab, one at a time. Applied headers are stored on your site, keep working if your subscription ends, and can be removed at any time;

• have the site re-audited automatically every week;

• count the visits ChatGPT, Perplexity, Gemini, Copilot and Claude send to your site (Visits from AI): one switch on the Account tab adds website-auditor.io’s tracking code to your pages, and the counts show on your website-auditor.io Pro dashboard.

Badge

Place [tallyrank_badge] in a footer, page or widget to show your verified AI visibility score. Use [tallyrank_badge theme="light"] on dark backgrounds.

External services

io (Armstrong HoldCo LLC). Nothing is sent to them unless you act as described below.

io)

Used only when an administrator clicks “Run your free audit” on the plugin’s Overview screen. It starts only while the site is not connected (no connection or API key); one already running when the site is connected finishes. The plugin sends this site’s domain name and home path and, in the request’s user agent, this site’s address and the plugin’s version, to start the audit; then reads whether it has finished and reads its report.

io reads it from your site before it starts the audit. It keeps a record of the domain that had its free audit. io.

io)

io API key on the plugin’s Account tab.

0 (authorization code with PKCE). When an administrator clicks it:

• the first time, and again if the site’s admin address changes, the plugin registers this site with https://api.website-auditor.io/oauth/register, sending a name (“Tallyrank AI Visibility” and this site’s host name), that this is the Tallyrank WordPress plugin, and this site’s callback address ( wp-admin/admin-post.php?action=wa_aiv_oauth_callback );

• the administrator’s browser opens https://api.website-auditor.io/oauth/authorize with that registration’s id, the callback address, a one-time state and a PKCE challenge, and, when the site has been audited, the address of its latest website-auditor.io report, so the sign-in page can name it. The administrator signs in or creates an account there and approves the site;

• the plugin then exchanges the one-time code at https://api.website-auditor.io/oauth/token for an access token (valid for an hour) and a refresh token, which it keeps in this site’s database. The access token is refreshed at the same address shortly before it expires, sending the refresh token;

• once a week, a scheduled WordPress task (WP-Cron) refreshes the connection the same way if it has not been refreshed for a week, so it does not expire on a site nobody opens. It stops when the site is disconnected or the plugin deactivated, and resumes when the plugin is activated again;

• the connection is revoked at https://api.website-auditor.io/oauth/revoke, sending its refresh token, when an administrator clicks “Disconnect”, connects again (the old connection is replaced), saves an API key instead, or deletes the plugin. If the service answers a connection without a refresh token, that access token is revoked the same way.

Registration, token and revocation requests send, in their user agent, this site’s address and the plugin’s version.

From then on, with the connection’s access token or the API key, the plugin sends this site’s domain name and, in the request’s user agent, this site’s address and the plugin’s version:

• when the site is connected, or the key is saved, to read the account’s subscription status;

• when an administrator opens the plugin’s Overview screen, to read the account’s subscription status and the site’s stored scores, recommendations and report link (cached for up to six hours);

• when an administrator clicks “Run a new audit”, to audit the site’s public pages;

• when an administrator clicks “Re-check this site automatically every week”, to enroll the domain for weekly audits;

• when an administrator opens the plugin’s Fixes tab, or applies a fix after that read has expired, to read the fixes from the site’s latest audit (cached for up to an hour);

• when an administrator turns Visits from AI on, to enroll the domain for weekly audits if it is not enrolled, read the site’s tracking-code key and settings, and, the first time, save that most of the site’s visitors are in the US; while it is on, every six hours (a scheduled WordPress task), when an administrator opens the Overview screen after that, clicks “Check now”, or activates the plugin, to read them again (and, for a site whose settings were reset at website-auditor.io, to save “most visitors are in the US” again); when an administrator saves the landing-page setting, to save it; and when an administrator turns it off, disconnects, saves another API key, connects the site again, or deactivates the plugin, to say this plugin no longer adds the code (saving another key or connecting turns Visits from AI off, since it may be another account’s; if website-auditor.io can’t be reached when it is turned off, that is tried again hourly, up to six times).

io, the link carries that report’s address, so the portal can name the site.

These requests carry no visitor data, content or personal information. io’s terms and privacy policy apply.

io tracking code (Visits from AI)

js ) to the head of every public page. io; its code doesn’t read, log or keep them. io keeps daily totals only, for 13 months, and shows them to you.

It sets no cookies or identifiers, honours Global Privacy Control, and stops in a visitor’s browser when they click the opt-out link in the text this plugin suggests for your privacy policy (Settings → Privacy → Policy Guide). Turning Visits from AI off removes the code. Same terms and privacy policy.

io badge

svg. Like any image from another site, that request includes the visitor’s IP address and browser details. The plugin’s admin screen also shows a preview of the badge, loaded the same way, once an audit of the site has been recorded.

Same terms and privacy policy.

The readiness checks make requests only to this site’s own address.