Documentation

1. In WordPress, go to Plugins → Add New Plugin and search for getReport (or open the plugin on WordPress.org).
2. Click Install Now, then Activate. Updates then arrive in Dashboard → Updates like any other plugin; your settings and fixes stay.
3. Open getReport in the left menu (near the bottom, below Settings) and click Run site audit.

No access to the plugin directory (some managed hosts turn it off)? Download the zip from WordPress.org and upload it under Plugins → Add New Plugin → Upload Plugin.

It needs WordPress 6.2 or newer and PHP 7.4 or newer, and is tested up to WordPress 7.1. Try it on a staging copy first if your host offers one: that is good practice for any plugin that changes settings.

The plugin adds a getReport menu, a getReport box on the Dashboard, an AI score column in Posts and Pages, a Check with getReport link under each post, and a panel in the block editor. Nothing changes on your public site until you apply a fix or turn on referral tracking.

The first screen sums up the rest: the site score (how ready your posts are for AI assistants, from 0 to 100, with five sub-scores), AI crawler visits and AI referrals over the last 14 days, the top fixes and your weakest posts.

Top fixes are ranked by how many posts they affect, their weight and how strong the evidence is. Apply means the plugin can do it for you (with Undo); Review opens the posts to change in the editor; How to explains a setting outside WordPress, such as a firewall rule.

The audit reads every published post and page of the types you choose (Settings → General) from your database, renders it the way your theme would, and scores it with the same checks as getReport’s AI module. A few pages, 5 % and at most 20, are also fetched through your site’s address the way a crawler sees them, without JavaScript: that is how the audit knows whether your text needs JavaScript to appear, and whether your theme shows a date and an author.

It runs in small batches in the background, and faster while the AI audit screen is open. After that, each post is scored again whenever you update it. The AI score column in Posts and Pages shows the result.

Every check carries an evidence label. Strong means published studies of AI answers back it; mixed means it helps sometimes; weak means there is little proof (llms.txt, for example) and it can lower your score by 2 points at most. Fix the strong ones first.

In the block editor, click the getReport icon (a dial) at the top right. The panel scores the post as you type, about a second and a half after you stop:

• Target question: the question this post answers, as a customer would ask it. Empty means the title is used. The checks look for the answer to it.
• Quotability: how likely an AI assistant is to quote the post’s best paragraphs. A dot beside each paragraph shows its own score: green is ready to quote, orange could be better, red needs work. Select a paragraph to see what to change.
• The open checks for the post, with what to do about each.

It all runs in your browser: your text is not sent anywhere. The Classic editor shows the last saved score in a box beside the post instead.

The plugin notes every visit from a known AI crawler (and from Googlebot, Bingbot and Applebot, for comparison) and checks the visitor’s address against the IP lists OpenAI, Perplexity, Google, Microsoft and Apple publish.

• Verified visits came from the company’s own addresses.
• Fake visits used a bot’s name from somewhere else. They are left out of every chart.
• Visits marked * are from companies that publish no IP list (Anthropic, Meta, Amazon and others): counted, but they can’t be verified.

Only the visitor’s network is stored (the first three parts of an IPv4 address), never the full address. Individual visits are kept 90 days, daily totals 24 months.

Your rule sets, per bot, whether robots.txt lets it in. Keep the search and user bots allowed (they fetch pages to answer questions and cite you); blocking training bots is your choice. If your site has a real robots.txt file, the plugin can’t change it and says so.

Test access now fetches your home page through its public address as each AI bot and as a browser, and compares the answers, to catch a firewall or CDN that turns AI bots away. It also lists where to look in Cloudflare, Wordfence and other security tools.

Page caches (LiteSpeed Cache, WP Rocket and others) answer many visits without running WordPress, so those never reach the plugin. Import your server’s access log (the combined format most hosts use, plain or .gz) to fill the gap; importing the same days again replaces them.

Off until you turn it on. Then a script under 1 KB runs only for visitors who come from an AI assistant (ChatGPT, Perplexity, Gemini, Copilot, Claude, DeepSeek, Meta AI, Le Chat, You.com, Grok), recognised by the page they came from or by utm_source. It records the assistant and the page they landed on, nothing else: no cookies, no IP address, no user id, so it needs no consent banner. The screen also gives you a ready-made sentence for your privacy policy and a regular expression for an “AI assistants” channel in Google Analytics 4.

The Fixes screen lists the fixes that apply to your site, grouped by area, each with why it matters and its evidence label. Apply turns a fix on; Undo turns it off and puts back what was there before. A fix that doesn’t fit your site (for example XML-RPC while Jetpack is active) is not offered at all.

Every fix is a WordPress setting the plugin stores, or a filter it adds while the fix is on. No fix edits your theme, .htaccess, wp-config.php or another plugin’s settings. Every Apply and Undo is listed under History with the date and who did it. When you are connected, each change also starts a re-test on getreport.app, so you see the score before and after.

AI visibility

• Choose which AI bots may crawl (robots.txt): adds your per-bot rules from the AI crawlers screen to the robots.txt WordPress serves. Offered only when your site has no real robots.txt file. Undo removes the rules.
• Show “Updated” dates on posts: adds “Updated {date}” under the title of the post types in Settings → General, and the date in the page’s markup when no SEO plugin prints it. Undo removes both.
• Add an author box to posts: a short box after each post with the author’s name, bio (from their WordPress profile) and a link to their posts, plus Person markup when no SEO plugin adds it. Undo removes it.
• Tell Bing about new and updated posts (IndexNow): creates a random key, serves it at your site’s root, and sends a post’s address to api.indexnow.org when you publish or update it. Undo stops the pings and the key file.
• Publish an llms.txt: a short list of your main pages at /llms.txt. Weak evidence, so do the others first. Offered only when no llms.txt file exists. Undo removes it.

Structured data

• Add Organization and WebSite schema: prints your name, logo and the facts from Settings → Organisation facts (founding year, address, phone, profiles) on the home page. Offered only when Yoast, Rank Math, All in One SEO, SEOPress or The SEO Framework isn’t active, since they print it already. Undo removes it.

Security

• Add security headers: HTTPS only (HSTS, without includeSubDomains or preload, so other sites on your domain are not affected), no file-type guessing, a stricter referrer policy, and camera, microphone and location off. Headers your server already sends are left alone. Undo stops sending them.
• Turn off XML-RPC: refuses requests to xmlrpc.php and drops the pingback header. Not offered while Jetpack is active. Undo turns it back on.
• Hide the user list from visitors: removes the user endpoints from the REST API for visitors who are not logged in. Logged-in users still see them. Undo restores them.

SEO, speed and housekeeping

• Keep attachment pages out of Google: asks search engines not to index the page WordPress makes for each upload. Undo removes the request.
• Let search engines see this site: unticks “Discourage search engines” in Settings → Reading. Offered only while it is ticked. Undo ticks it again.
• Remove “Hello world!” and “Sample Page”: moves the demo post and page to the Trash (it asks first). Undo restores them from the Trash, so don’t empty it if you might want them back.
• Stop WooCommerce cart fragments outside the cart: keeps the cart-count request on the cart and checkout pages only. Offered only with WooCommerce. Undo loads it everywhere again.

Deleting the plugin undoes every fix first, so your site is as it was. Deactivating it pauses the fixes that work while the plugin runs (all but the search setting and the demo content, which stay as you set them); activating it again brings them back.

getreport.app checks your site from the outside: speed, SEO, security, accessibility, structured data, social previews and best practices. Connect (getReport → Website report) shows those scores in WordPress and gets your site a free key, so you can run checks from WordPress, get a re-test after each fix, and a weekly email.

When you click Connect:

1. The plugin asks getreport.app for a short code for your domain.
2. It publishes the code at /.well-known/getreport.txt and in a meta tag on your home page.
3. getreport.app reads the code from your site, confirms the site is yours, and gives the plugin a key.

The key can only check your own site (with or without www.), 20 new checks a day. Connecting again replaces it; Disconnect deletes it and stops publishing the code. If getreport.app can’t confirm the site, the plugin still shows your scores and tells you why; see troubleshooting.

• General: which post types the audit and editor panel cover, where the date and author fixes show, and after how many months content counts as stale.
• Organisation facts: name, founding year, address, phone, email and official profiles, used by the structured-data fix and the audit.
• Crawlers: crawler tracking on or off, how long individual visits are kept, trusted proxies (only for a load balancer other than Cloudflare), and “Keep bot lists up to date”.
• Referrals, Privacy (what happens on uninstall, delete collected data now) and Advanced (versions, for support).

Nothing, unless you turn it on. Your post content, your visitors’ data and personal data never leave WordPress.

• Connect: your domain name to getreport.app, which then reads the code the plugin publishes. Afterwards, your domain when the getReport screens load your scores (at most every 10 minutes), and your home page address when you run a check, apply or undo a fix, or the weekly email runs.
• Keep bot lists up to date: WordPress downloads the IP lists the companies publish, once a day. Nothing about your site is sent.
• The IndexNow fix: the address of a post you publish or update, to api.indexnow.org.

The full list, with every address, is in the plugin’s readme under “External services”. getreport.app’s own privacy policy covers what it does with a check.

Deactivating removes nothing: it only stops the scheduled tasks.

Deleting the plugin always undoes every fix first, so your site is as it was, and removes the connection, the key and the scheduled tasks. The collected data (crawler visits, referrals, audit results, fix history) and the settings are deleted too only if you tick “Also delete the collected data” in Settings → Privacy, which is off by default.

• “getreport.app could not confirm this site”: a security plugin, firewall or cache in front of your site hid the code. Open /.well-known/getreport.txt on your site in a private window: it should show a short code. If it doesn’t, allow that address in your security plugin or CDN (or exclude it from caching), then click Get the key automatically.
• No AI crawler visits yet: they arrive over days, not minutes. If a page cache is active, import your server log (AI crawlers → Import a server log).
• The audit seems stuck: it continues in the background with WP-Cron, which runs when your site has visitors. Keep the AI audit screen open to finish it faster.
• The “Updated” date or author box doesn’t show: check the post types in Settings → General, and clear your page cache.
• A fix changed something you don’t want: click Undo next to it on the Fixes screen. Deleting the plugin also undoes every fix.

Ask in the getReport support forum on WordPress.org and include your plugin and WordPress versions (getReport → Settings → Advanced) and what you see. Help and support lists every way to reach us, including for private questions and security reports.

See what changed in each version.