YUJI AI SEO Suite

YUJI AI SEO Suite generates SEO candidates for eligible public WordPress content and lets authorized users review current values, candidates, destinations, and possible effects before applying changes.

The plugin is fully functional without a paid license, trial period, quota, feature unlock, or upgrade key. Its generic singular-content workflow is available to public post types that are shown in the WordPress administration UI, are viewable on the public site under WordPress rules, and support titles. Standard posts and pages normally meet these conditions. Product entries and other custom post types may also be eligible when they meet the same conditions.

Eligibility means that the plugin can apply its generic WordPress content and metadata workflow. It does not imply complete compatibility with every custom post type, editor, storage model, or third-party plugin. In particular, the plugin does not add WooCommerce-specific product fields, commerce logic, price or availability metadata, or Product structured data.

Main features:

• SEO titles, meta descriptions, focus keywords, and related keywords
• Excerpts and taxonomy-term suggestions where the content type exposes a public tag-like taxonomy
• Social titles and descriptions
• Featured-image ALT overrides scoped to the selected content item
• Related-content and contextual internal-link suggestions
• Single-item and WP-Cron-based bulk optimization
• Theme/plugin conflict detection and public-HTML diagnosis
• Impact explanations and server-validated confirmation checks
• Repair, history, rollback, and supported cache invalidation
• Single-plugin direct OpenAI connection with encrypted local API-key storage and configuration-file/environment alternatives

The plugin is not tied to one theme. It inspects actual public HTML and chooses a standard WordPress output path, a narrowly scoped recognized adapter whose output is validated on the current site, or candidate-generation-only mode. If duplicate tags, an existing SEO owner, or an unreachable public-page probe is detected, the plugin does not start its public output and shows the reason. The plugin does not silently disable other plugins or guess unknown theme settings.

Normal SEO operations do not rewrite the saved body content (post_content), Gutenberg blocks, the WordPress title/H1, permalink, theme, CSS, layout, image files, or the activation state of other plugins. If selected, the standard WordPress excerpt may be updated and new tag-like taxonomy terms may be appended; existing terms are not removed. The separate advanced HTML-repair feature can change saved body content only after diagnosis, a visible diff, a backup, and explicit confirmation.

Administration language

The administration interface follows the current WordPress administration locale. English is the source language. Translations are delivered through WordPress.org language packs. If a translation is unavailable, WordPress displays the English source strings.

The plugin ZIP does not bundle PO, MO, POT, or translation JSON files and does not call load_plugin_textdomain(), in accordance with WordPress.org translation distribution.

External Service

This plugin requires WordPress 7.0 or later and intentionally provides a direct OpenAI integration so the AI-assisted SEO workflow can be configured and used within this single plugin. No separate AI-provider plugin is required. The WordPress site sends requests directly to the OpenAI API; the plugin author does not operate a proxy, licensing server, telemetry service, analytics endpoint, or API-key collection endpoint.

OpenAI is contacted only after an authorized administrator has saved the current external-service and API-key confirmation and an authorized WordPress user explicitly requests model retrieval, a production-format compatibility test, AI candidate generation, or bulk optimization. A user-started bulk job may continue through WP-Cron after that explicit request. OpenAI performs substantive remote AI processing; the service is not used for licensing, payment verification, or unlocking local plugin functionality.

Service: OpenAI API

Data sent during AI candidate generation may include:

• Site name and locale
• Target content title, plain text extracted from the saved body, headings, excerpt, taxonomy names, and existing SEO values
• Existing site tag-like term names used as candidate context
• Featured-image filename, media title, caption, description, and current ALT; the image file itself is not sent
• Titles and short excerpts of candidate internal-link content
• Selected model, output language, and site-specific instructions

Model-list retrieval sends the API key and ordinary HTTPS request metadata but does not send post content or a test prompt. The production-format compatibility test sends a small neutral test prompt and model/output settings, not the selected post body. Candidate generation sends the content categories listed above.

API-key storage and security

When an OpenAI API key is saved through this plugin’s Settings screen:

• The key can be saved only when the WordPress administration request is detected as HTTPS. It is then encrypted and stored in the database used by that WordPress site, as part of the yaiss_settings option.
• The settings option is explicitly marked not to autoload.
• Encryption uses Sodium secretbox when available, otherwise AES-256-GCM through OpenSSL. The encryption key is derived from the WordPress installation’s authentication salts.
• The full saved key is not displayed again. Only a masked indicator is shown to authorized administrators.
• The plugin does not intentionally include the full key in public HTML, localized JavaScript configuration, telemetry, analytics, advertising, or plugin-generated logs.
• The key is decrypted in server memory only when required and is sent directly from the user’s WordPress server to api.openai.com over HTTPS in the Authorization header.
• The plugin author does not receive, collect, or store the key.

A server administrator may instead define YAISS_OPENAI_API_KEY in wp-config.php or provide the OPENAI_API_KEY environment variable. An externally managed key takes precedence and is not copied into the WordPress database by this plugin. If an older database-saved key already exists, it remains stored but unused until an administrator explicitly deletes it in Settings or opts into data removal during uninstall. The Settings screen warns about that stored copy.

Encryption reduces exposure if the database alone is accessed. It cannot guarantee protection if the WordPress installation, hosting account, administrator account, wp-config.php, database, backups, server process, or another installed component is compromised. The site owner is responsible for restricting administrative and hosting access, protecting configuration files and backups, keeping WordPress and installed components updated, monitoring OpenAI usage and charges, setting suitable OpenAI project limits and key permissions, and rotating or revoking a key when compromise is suspected.

The plugin does not claim that an API key can never be exposed. It documents the storage and transmission path and avoids sending the key to the plugin author’s systems, but the plugin author cannot administer or guarantee the security of each user’s WordPress site, server, accounts, database, backups, or OpenAI account. If WordPress authentication salts change, an existing encrypted database key may no longer be decryptable; the plugin reports that condition and requires deletion and re-entry rather than silently treating the key as valid.

The plugin does not send themes, CSS, the full database, WordPress passwords, or image binaries to OpenAI. Site owners are responsible for ensuring that content submitted to OpenAI may lawfully be transmitted and does not contain information they are not authorized to share.

Local data retention and removal

• A database-saved API key remains until an administrator deletes it in Settings or the plugin is uninstalled with “Delete plugin data on uninstall” enabled. Deactivation alone does not remove it.
• Generated candidates, current selections, histories, repair backups, compatibility data, and background-job records may be stored in WordPress options or post metadata until replaced, deleted through plugin controls, or removed during an opted-in uninstall.
• The plugin does not control OpenAI-side retention. OpenAI processing and retention depend on the site owner’s OpenAI account settings and applicable OpenAI agreements.
• Ordinary HTTPS requests disclose technical connection data to OpenAI, including the site server IP address, request time, and a User-Agent identifying the plugin and WordPress versions.

OpenAI terms, privacy, data, security, and pricing information:

• OpenAI Services Agreement (applicable business/API terms): https://openai.com/policies/services-agreement/
• OpenAI Terms of Use (general terms page): https://openai.com/policies/terms-of-use/
• OpenAI Privacy Policy: https://openai.com/policies/privacy-policy/
• OpenAI Service Terms: https://openai.com/policies/service-terms/
• OpenAI Usage Policies: https://openai.com/policies/usage-policies/
• OpenAI Enterprise Privacy: https://openai.com/enterprise-privacy/
• OpenAI Data Processing Addendum: https://openai.com/policies/data-processing-addendum/
• OpenAI API pricing: https://openai.com/api/pricing/
• OpenAI API-key safety guidance: https://help.openai.com/en/articles/5112595-best-practices-for-api-key-safety

OpenAI states that its general Privacy Policy does not apply to content processed on behalf of API customers; that content is governed by the applicable customer agreements. The Privacy Policy is linked for OpenAI’s general personal-data practices, while the Services Agreement, Service Terms, Enterprise Privacy information, and Data Processing Addendum provide the API/business context.

OpenAI API usage may incur charges under the user’s OpenAI account. The plugin author does not collect those charges. The external-service and API-key confirmation must be saved before this plugin initiates an OpenAI request. If this disclosure is materially revised in a future release, confirmation is required again.

Source Code

All PHP, CSS, and JavaScript distributed with this plugin is GPL-compatible and human-readable.

JavaScript source-to-runtime mapping:

• src/js/admin-v5.js -> assets/admin-v5.js
• src/js/admin-legacy.js -> assets/admin-legacy.js

The JavaScript under src/js/ is the editable source. Each corresponding file under assets/ is an exact, byte-for-byte copy used by WordPress at runtime. The JavaScript is not transformed, minified, compressed, transpiled, bundled, obfuscated, or generated by npm, webpack, or any other build system. No package manager or build dependency is required.

POSIX reproduction and verification, run from the plugin directory:

cp src/js/admin-v5.js assets/admin-v5.js
cp src/js/admin-legacy.js assets/admin-legacy.js
cmp src/js/admin-v5.js assets/admin-v5.js
cmp src/js/admin-legacy.js assets/admin-legacy.js
sha256sum src/js/admin-v5.js assets/admin-v5.js src/js/admin-legacy.js assets/admin-legacy.js

PowerShell reproduction and verification, run from the plugin directory:

Copy-Item -LiteralPath src/js/admin-v5.js -Destination assets/admin-v5.js
Copy-Item -LiteralPath src/js/admin-legacy.js -Destination assets/admin-legacy.js
(Get-FileHash src/js/admin-v5.js -Algorithm SHA256).Hash -eq (Get-FileHash assets/admin-v5.js -Algorithm SHA256).Hash
(Get-FileHash src/js/admin-legacy.js -Algorithm SHA256).Hash -eq (Get-FileHash assets/admin-legacy.js -Algorithm SHA256).Hash
Get-FileHash src/js/admin-v5.js,assets/admin-v5.js,src/js/admin-legacy.js,assets/admin-legacy.js -Algorithm SHA256

Known SHA-256 values for this release:

• admin-v5.js source and runtime: f29c13929d138a88696d02fdc051256dcea6f2ab64e51fe3111647cd0f67d06e
• admin-legacy.js source and runtime: 80653bd81c0204edd95adc7bebaf43d55fd6a9291c9dfedc66e062dd73cd7e99

The CSS files in assets/, including admin-v5.css and frontend.css, are directly edited, human-readable runtime source files. They are not generated build artifacts and have no separate preprocessor source or build step.

Languages

The plugin uses English source strings and WordPress internationalization functions. Translations are distributed through translate.wordpress.org and the normal WordPress language-pack system. Translation .po and .mo files are not bundled in the plugin ZIP.

AI-generated SEO content can follow the WordPress site language or be generated in Japanese, English, Simplified Chinese, Traditional Chinese, or Korean. AI output language is independent of administration-screen translation.

Administration Flow

The main administration navigation is limited to five task-oriented screens: Dashboard, Optimize one item, Bulk optimization, Diagnostics and restore, and Settings. The Dashboard shows required, recommended, optional, and first-use actions in dependency order.

Settings follow the same order and use independent save boundaries: OpenAI connection, SEO publishing, AI generation, Related content, and Advanced/data removal. OpenAI connection has four required steps: save an API key, save the external-service confirmation, retrieve and deliberately select and save a model, and run the production-format compatibility test. Blocked actions explain the missing requirement and link directly to it.

Privacy

The plugin does not include analytics, advertising tracking, telemetry, a developer-operated API proxy, or an API-key collection endpoint. It communicates with OpenAI only after the current external-service/API-key confirmation has been saved and an authorized user requests an API operation or starts a bulk job that continues through WP-Cron. When saved through Settings, the encrypted API key remains in the database used by the user’s WordPress site; it is not sent to the plugin author. The data categories, storage path, security limits, site-owner responsibilities, and policy links are disclosed in the External Service section above. WordPress also receives suggested privacy-policy text from the plugin so a site owner can adapt it to the site’s actual use and legal requirements. The suggested text is informational, is not legal advice, and does not guarantee compliance with any law or policy.

Known Limitations

• Eligibility for the generic workflow does not guarantee compatibility with every custom post type, editor, custom-field framework, or third-party storage model.
• WooCommerce product posts are not provided with WooCommerce-specific fields, price or availability metadata, commerce logic, or Product structured data.
• Attachments, archive URLs, and non-public post types are not managed.
• Multisite is not formally supported.
• Automatic public-page diagnosis can fail when loopback requests are blocked or protected by authentication.
• MU plugins, server/CDN injection, JavaScript-added tags, and conditionally emitted tags may not be fully detectable.
• Unsupported theme/plugin storage fields are not guessed or overwritten.
• OpenAI models, pricing, permissions, rate limits, policies, and API behavior can change.
• Search ranking, impressions, click-through rate, and sales are not guaranteed.