SurfacedBy AI Visibility

AI search is eating Google clicks. ChatGPT, Claude, Perplexity, and
Gemini answer questions inline now, and getting your site cited
inside those answers is the new SEO. People call it
Generative Engine Optimization (GEO) or Answer Engine
Optimization (AEO). Same problem either way: an AI has to crawl
you, parse you, and pick you when a user asks. Miss any of that and
you are invisible to the audience driving the next wave of traffic.

SurfacedBy AI Visibility is the WordPress companion for that work.

• AI Bot Analytics. Which AI crawlers are reading your site, what
  they are after (training data, search indexing, or live retrieval),
  and how often. Covers GPTBot, ClaudeBot, PerplexityBot,
  Meta-ExternalAgent, and the long tail.

• AI Referral Tracking. Real visits from chatgpt.com, claude.ai,
  perplexity.ai, gemini.google.com, copilot.microsoft.com, grok.com,
  and meta.ai. Proven referrer hosts only, no behavioural guessing.

• AI Readiness Diagnostics. A one-click check on robots.txt,
  your llms.txt, and the schema types answer engines look for
  (Organization, Article, FAQPage, Product). It tells you what is
  broken.

• llms.txt Generator. Publishes a clean /llms.txt index of
  your posts and pages so AI tools can find your content. Respects
  Yoast, Rank Math, AIOSEO, and SEOPress noindex rules.

• AI Conversion Tracking. Detects WooCommerce and MemberPress
  automatically and credits purchases, renewals, signups, and refunds
  to the AI source that drove the customer. Custom checkouts call
  window.sbAi.track()“ to ship the same data. Attribution holds
  from first visit through to purchase, even days later.

All five are fully functional without an account. Bot logging,
referral tracking, the readiness diagnostics, the llms.txt generator,
and conversion attribution all run locally on your server and store
their data in your own database. Nothing is locked, time-limited, or
reduced until you sign up, and the plugin does not talk to SurfacedBy
at all until you pair it with a Site ID.

Pairing is optional and adds one thing: it syncs the data this plugin
already collected to the SurfacedBy dashboard, where it sits next to
the AI ranking and citation analytics for your domain. Events recorded
before you pair are synced too, so you do not lose the history. The
free plan covers one domain with weekly scans. Paid plans add
competitor benchmarks, prompt tracking, and citation monitoring across
ChatGPT, Claude, Perplexity, and Gemini. Those run on SurfacedBy’s
servers and are not features withheld from this plugin.

External Services

The plugin makes no outbound calls until you save a SurfacedBy Site
ID under SurfacedBy > Connect. If you never pair the plugin, nothing
leaves your server, and every feature still works locally.

Once paired, the plugin contacts SurfacedBy in three places (1-3). All
outbound calls are made by your server; the plugin never loads or executes
code from an external source. Item 4 is listed for completeness because it
is a browser-side feature, but it stays entirely on your own domain.

1. Event forwarding (opportunistic on page-render shutdown, plus a wp-cron
   safety net every hour):
   Endpoint: https://api.surfacedby.com/api/v1/tracker/batch
   Data sent: rows from the local log tables. Three event kinds ship on the
   same batch endpoint:

   • bot rows: bot token, request path, hour of day, count, response
     code, and bot-only requester IP for identity verification.
   • referral rows: AI referrer host, request path, hour of day, count,
     session nonce, and pseudonymous visitor ID.
   • conversion rows (when WooCommerce / MemberPress is detected, or when
     a custom front-end calls window.sbAi.track): event type
     (purchase / renewal / signup / refund / lead / custom), an order or
     subscription identifier, the value, the ISO currency code, the request
     path, the AI referrer host that originally brought the customer in,
     and a small metadata object (item count, country code, refund reason,
     etc., capped at 4 KB), plus the pseudonymous visitor ID when one is
     available. Conversion rows never carry visitor names, emails, billing
     addresses, or payment details.
     The plugin never sends raw User-Agent strings outside the bundled
     registry, never sends human visitor IPs, and never sends cookies.
     Matched bot IPs are used by SurfacedBy only to compute a verified,
     unverified, or unverifiable bot-identity verdict; SurfacedBy stores
     the verdict, not the raw IP. The local queue clears the bot IP after
     the row forwards successfully.
     Purpose: populates your SurfacedBy dashboard for this site.

2. Plugin heartbeat (hourly cron with a 24-hour staleness check, plus a
   best-effort nudge when the plugin notices its last heartbeat is older
   than 20 hours):
   Endpoint: https://api.surfacedby.com/api/v1/integrations/wordpress/heartbeat
   Data sent: your Site ID, plugin version, WordPress version, PHP version,
   and the aggregate event count from the last 24 hours. No personal data.
   Purpose: shows install health in the SurfacedBy admin.

3. Bot registry refresh (daily cron with a 14-day staleness check; a
   conditional GET that returns 304 when nothing has changed):
   Endpoint: https://api.surfacedby.com/api/v1/tracker/registry (HTTP GET)
   Data sent: none, other than standard HTTP request headers.
   Purpose: pulls the latest AI bot user-agent list so newly observed
   crawlers are tracked without waiting for a plugin update.

4. Browser tracker beacon (on by default; switch it off under “Browser
   tracker snippet” in Settings. It needs no account and runs whether or
   not the plugin is paired):
   This step sends nothing to SurfacedBy directly. The beacon script is
   bundled inside the plugin (assets/js/sb-tracker.js) and is served from
   your own site; no external script is ever loaded, and no third-party
   code is downloaded or executed. The script posts same-origin to this
   site’s own admin-ajax handler (admin-ajax.php). Each request carries a
   WordPress security nonce that the page includes, so the handler confirms
   the request came from your own site before recording anything.
   Data sent (to your own server): the AI referrer host, the URL path,
   and – when window.sbAi.track is called from custom front-end code –
   the conversion event_id, value, currency, and a small metadata object
   the site explicitly passes in. It also sends the plugin’s pseudonymous
   visitor ID. The plugin sets only the sb_t and sb_attr cookies described
   in the Cookies section below.
   Those rows are stored in the local log tables and later forwarded to
   SurfacedBy by the server, on the same batch endpoint described in
   item 1 above.
   Purpose: catches AI referrals on pages served from a full-page cache
   where the PHP path never runs.

Cookies

The plugin sets cookies only after a visitor arrives from a confirmed AI
referrer host. Two cookies, both first-party, both opaque:

• sb_t (30 minutes): an anonymous session nonce used to deduplicate
  page views inside one browsing session. No personal identifiers.
• sb_attr (13 months): records a pseudonymous visitor ID, the AI host
  (e.g. chatgpt.com), and the timestamp of the first qualifying visit so a
  later purchase or signup can be credited to the original source. When
  present in an AI-attributed landing URL, it can also retain advertising
  click IDs named gclid, fbclid, msclkid, and ttclid. The browser tracker
  mirrors this value in first-party local storage so attribution can survive
  browser cookie eviction. The identifier is scoped to this site and is not
  used for cross-site tracking.

When paired with SurfacedBy, aggregate bot, referral, and conversion
history is retained with the connected domain. Raw AI visit rows used
for dashboard journey reconstruction follow the server-side plan
window: Free and Starter 90 days, Professional 395 days, Business 760
days. The dashboard journey drawer shows only the 30 days before a
conversion.

The referral cookies are set after a recognised AI referral. The conversion
integrations or a site-initiated window.sbAi.track call can also create the
pseudonymous sb_attr identifier when a conversion needs a stable local
attribution key.

Terms of Service: https://surfacedby.com/terms
Privacy Policy: https://surfacedby.com/privacy