Hafen Core: Schema, llms.txt and Answer Blocks
The companion plugin for the Hafen theme. JSON-LD schema, answer blocks, AI crawler policy, local AI traffic stats, Markdown delivery and llms.txt.
Use with caution
Hafen Core: Schema, llms.txt an… works, but test it on a staging site before relying on it in 2026. Was last updated 1 month ago, and scores 60/100 on our health check.
- Tested with the latest WordPress (7.1)
- Small user base (<10 active installs)
- Very few reviews so far
How does it stack up?
Side-by-side on installs, updates, ratings & support
Daily downloads
Download spikes usually follow a new release — each site that auto-updates counts as a download.
Rankings
Where Hafen Core: Schema, llms.tx… stands todayWordPress.org search rankings
Live position in the plugin search, top 100| Keyword | Position |
|---|---|
| AI | >100 |
| ai-crawler | >100 |
| blocks | >100 |
| schema | >100 |
| structured data | >100 |
About Hafen Core: Schema, llms.txt and Answer…
From the official readme · v1.0.1Description
The companion plugin to the Hafen theme.
Following the principle “theme = presentation, plugin = functionality”, Hafen
Core carries the functionality that, per the WordPress.org guidelines, does
not belong in a theme: a schema engine, five answer blocks, an AI crawler
policy for robots.txt, a local AI traffic dashboard, Markdown delivery for
agent clients, a citability linter, an under-construction gate and an
llms.txt file. It works with any theme, but it is built and tested as the
functional half of Hafen.
Access rules and measurement in one plugin. Most plugins in this field do
one of the two: they either block AI crawlers, or they report on AI visibility
from an external service. Hafen Core does both in the same place and can
therefore relate them to each other, for example: “Perplexity is not crawling
you, and PerplexityBot is on your block list.” Everything runs on your own
installation; no account and no external service are required for it.
No invented scores. This plugin does not calculate a visibility score
and does not promise you a placement in ChatGPT. Where the evidence is thin, it
says so: llms.txt is labeled as speculative, every rule in the citability
linter states its evidence strength and its source, and where a provider
publishes no IP ranges we do not present a user agent as proof. The most honest
sentence first: the strongest documented factor for citations is mentions of
your brand elsewhere. On-page is the smaller lever. Everything this plugin does
works on that smaller lever – but it does so cleanly and verifiably.
Schema engine. Automatically embeds valid JSON-LD without you writing
anything: Organization, WebSite (including the search action), Article (on
posts) and BreadcrumbList. Plus FAQPage and HowTo generated from the answer
blocks. Everything in a single @graph in the document head.
Answer engine blocks. Five blocks that render nicely for humans while
being machine-readable and privacy-friendly:
- Hafen FAQ — emits FAQPage schema.
- Hafen HowTo — emits HowTo schema.
- Hafen TL;DR — highlighted short answer.
- Hafen Definition — a term in what-is-X format.
- Hafen Video (2-click) — privacy-friendly YouTube embed that loads only
after a click, via youtube-nocookie.com.
Access gate (Under Construction). Protect the whole website with a
password while it is being built – without an extra plugin. Three bundled
templates (light, dark, accent gradient) automatically pick up your logo, your
site name and your accent color. Logged-in users see the website normally, the
gate page sends HTTP 503 + noindex (safe for SEO), and the WordPress logo on
login pages is replaced with your site logo.
AI crawler policy. The whole market treats AI crawlers as a threat to be
locked out. Hafen Core does the opposite: it helps you get found and cited. To
do that, it cleanly separates what almost everyone conflates: training (GPTBot,
ClaudeBot, CCBot), search/index (OAI-SearchBot, Claude-SearchBot,
PerplexityBot, Googlebot) and live retrieval by a human in a chat
(ChatGPT-User, Claude-User, Perplexity-User). Blocking training costs NO
visibility. Blocking search costs all citability. The interface prevents
exactly that mistake, with plain-language warnings instead of fine print.
Default: nothing blocked. This is not a blocker plugin.
AI traffic dashboard, entirely local. Shows which AI bots fetch your
content, which pages they crawl the most, how many visitors come back from AI
answers, and the key figure: crawl-to-refer, i.e. how many pages a provider
fetches before it sends you one visitor. No account, no cloud, no IP addresses
in the database. If you enable the optional OpenAI bot verification, hits from
GPTBot & Co. are checked against the official IP ranges; where a provider
publishes none (Anthropic, Perplexity, Meta), the dashboard says so openly
instead of presenting a user agent string as proof.
IndexNow. Reports new and changed content immediately to Bing and
participating search engines instead of waiting for the next crawl. Relevant
because ChatGPT’s web answers are backed by the Bing index. Off by default
(opt-in).
Markdown for agents. Agentic clients (Claude Code, Cursor, OpenCode)
request pages with “Accept: text/markdown”. Hafen Core answers with a clean
Markdown version of your content, alternatively via ?format=md or the .md
suffix. That saves the model the layout, navigation and script ballast. The
Markdown version is sent with “X-Robots-Tag: noindex”, and “Vary: Accept” is
placed specifically on the responses that can also be served as Markdown, so
no page cache serves the Markdown version to browsers – and on no other
response, so proxy caches do not fragment unnecessarily. Only published,
publicly visible, non-password-protected content is served.
Citability linter in the editor. Checks the post against 15 rules and
shows, per rule, whether it passes and how well it is supported by evidence
(strong / medium / weak), including the source. Deliberately WITHOUT a 0–100
score: nobody knows a citation probability, and we do not pretend to. It also
includes a check for prompt injection and cloaking, because that is a penalty
issue, not an optimization issue. The optional AI deep check uses the AI
assistant and is not a requirement: all rules run without AI as well.
Abilities API and WebMCP. Where WordPress ships the Abilities API (6.9+),
Hafen Core registers read-only abilities (page as Markdown, search content) as
well as the AI assistant’s generators; only the read-only ones are exposed to
MCP. On top of that come read-only WebMCP browser tools. Honest framing:
WebMCP is a Chrome experiment and only has an effect while the tab is open.
Crawlers see none of it; it does nothing for visibility. A tiny snippet loads
the script only in browsers that actually have the API; everyone else pays 0
additional requests. Both are pure feature detection, not a dependency.
llms.txt generator. Publishes a curated content map at /llms.txt (and
/llms-full.txt). Honest framing: Google states that it ignores llms.txt, and
measurements show AI systems practically never fetch the file. Useful for
coding agents, not for visibility in AI search. We ship it because it costs
nothing, and we promise nothing for it.
Performance status. Speed is a core commitment of the Hafen family. The
dashboard (Settings > AI Traffic) therefore shows honestly what your setup
delivers: page cache detected or not, compression via self-test, the theme’s
font mode (variable/static/system) – each with a plain-language
recommendation. Plus an option to disable the WordPress emoji script (~26 KB
and one external request to s.w.org saved; off by default). Cache and
compression are server matters no plugin can solve from the inside. That is
exactly why we display them instead of making promises.
Everything runs without a build step and is GDPR-friendly. Schema, blocks and
llms.txt work entirely locally. External connections only occur for features
you explicitly enable or trigger: the optional AI assistant (through the
WordPress AI client, provider and key configured under Settings > Connectors,
only on click), the optional OpenAI bot verification (IP ranges, off by
default), IndexNow (opt-in) and the video block (YouTube, only after a
click). Details under “External services”.
External services
The optional AI assistant generates suggestions (meta description, TL;DR,
FAQ) from your post content. All requests run through the WordPress AI
client (WordPress 7.0+): which provider receives the data, and with which
key, is configured centrally under Settings > Connectors. The plugin itself
does not contact any AI provider directly. Data is sent ONLY if you (a)
enable the assistant under Settings > Hafen Core and (b) click a suggestion
button in the editor; the post’s title and text then go to the connector you
configured. The same applies to the optional AI deep check of the citability
linter: only if you explicitly tick “AI deep check” in the editor and start
the check, an excerpt of the post (at most 5,000 characters) is sent to your
configured connector. Without that checkbox the linter runs entirely locally
and rule-based. On installations without a configured WordPress AI client,
both features stay inactive.
The “Hafen Video (2-click)” block embeds YouTube videos in a
privacy-friendly way: before the click, nothing is loaded from YouTube (no
thumbnail, no request). Only when visitors click the play area is an iframe
loaded from https://www.youtube-nocookie.com; at that point data is
transmitted to Google. The notice text on the play area informs about this.
YouTube terms of service: https://www.youtube.com/t/terms
Google privacy policy: https://policies.google.com/privacy
IndexNow (Microsoft Bing): if you enable IndexNow under Settings > Hafen Core
(off by default), the plugin reports the affected URL to
https://api.indexnow.org/indexnow when content is published or updated. Sent
are exclusively: the URL of the public content, your hostname, the locally
generated IndexNow key and the location of the key file. No content, no user
data and no visitor data are transmitted. Without this activation nothing is
sent.
IndexNow terms of use: https://www.indexnow.org/terms
Microsoft privacy statement: https://privacy.microsoft.com/privacystatement
OpenAI IP ranges (bot verification, opt-in): OFF by default. Only if you
explicitly enable the OpenAI bot verification under Settings > AI Traffic
does the plugin fetch the public IP lists https://openai.com/gptbot.json,
https://openai.com/searchbot.json and https://openai.com/chatgpt-user.json
weekly via cron, to check whether a hit really comes from OpenAI and does not
merely fake its user agent. This is a pure download; no data of yours is
transmitted in the process. The check itself runs locally. Without this
activation not a single fetch is made.
OpenAI terms of use: https://openai.com/policies/terms-of-use
OpenAI privacy policy: https://openai.com/policies/privacy-policy
Privacy
The AI traffic measurement writes to its own table ({prefix}hafen_ai_hits).
It stores exclusively: timestamp, bot or source identifier, purpose
(training, search, live retrieval, referral), the ID of the requested post, a
hash of the path and a yes/no verification field.
Explicitly NOT stored: IP addresses, user agent strings, cookies, session
identifiers or any other personal data. The IP address is only checked in
memory against the official provider IP ranges and discarded afterwards.
Logged-in users are not recorded at all. Retention is limited to 90 days by
default (configurable between 7 and 365 days); a daily cron run deletes older
entries. No data is transmitted to hafenstudios or third parties.
Copyright
Hafen Core, (C) 2026 hafenstudios.
Hafen Core is distributed under the GNU General Public License v2 or later.
All bundled assets are GPL-compatible:
- assets/mascot/captain-*.webp — brand mascot “Kapitän Ahoi”: original work by
hafenstudios, created with AI assistance (OpenAI ChatGPT/DALL·E). No
third-party templates or stock images were used. (C) 2026 hafenstudios,
released under GPLv2 or later. - All icons are inline SVG, an original set, (C) 2026 hafenstudios, GPLv2 or
later. - No font files, libraries or third-party assets are bundled.
Installation
- Upload and activate the plugin (Plugins > Add New > Upload).
- After activation, /llms.txt is immediately available and the schema is active.
- Under Settings > Hafen Core, adjust the organization name, logo and the
switches for schema, llms.txt, traffic measurement and IndexNow. - Under Settings > AI Crawler Policy, define which AI bots are allowed.
Recommended: “Do not train, but cite”. Default: everything allowed. - Under Settings > AI Traffic, see who fetches your content and who sends
visitors back in return.
Frequently asked questions
Do I need the Hafen theme?
No. The blocks, the schema and llms.txt work with any theme. With the Hafen theme they share design tokens and look like one consistent whole.
Does the schema collide with an SEO plugin?
No. In auto mode (default), Hafen Core detects common SEO plugins (Yoast, Rank Math, SEOPress, All in One SEO, The SEO Framework, Slim SEO, Squirrly) and steps back where schema overlaps: it leaves Organization, WebSite, Article and Breadcrumb to the SEO plugin and only outputs FAQPage/HowTo generated from the Hafen answer blocks. The mode can be changed under Settings > Hafen Core (Auto / Full / Answer schema only / Off). Fine-grained control via the hafen_core_schema_nodes filter.
Are external services contacted?
Schema, llms.txt, crawler policy, Markdown delivery, the citability linter (without the deep check) and the traffic dashboard work entirely locally. External connections only occur for features you explicitly enable: the AI assistant including the linter’s optional AI deep check (through the WordPress AI client and the connector you configured), IndexNow (opt-in), the optional OpenAI bot verification (Settings > AI Traffic; when enabled it fetches OpenAI’s public IP ranges weekly) and the video block (YouTube, only after a click). Without these consents the plugin makes not a single external…
Does the plugin block AI bots?
Only if you explicitly configure it to. The default blocks nothing. Recommended is “Do not train, but cite”: turn away training bots, leave search and retrieval bots open. And the honest limitation right away: robots.txt is a request, not a lock. Whoever ignores it is not stopped by it; real protection requires a WAF or a CDN. Agentic browsers (ChatGPT Agent, Perplexity Comet, Claude for Chrome) send no bot token at all and cannot be addressed via robots.txt in principle.
Does Google-Extended prevent the AI Overviews?
No, and this is the most widespread misconception in this field. Google-Extended is purely an opt-out token for Gemini training. The AI Overviews draw from the regular Googlebot index.
Why are my bot numbers lower than in my server logs?
Because a full-page cache (WP Rocket, LiteSpeed, W3 Total Cache, WP Super Cache, Varnish, Nginx FastCGI, Cloudflare APO) serves the finished page without PHP running. No WordPress plugin sees those hits, not even a mu-plugin. The dashboard detects common cache plugins, displays the measurement quality openly (three states, including “INCOMPLETE”) and sets up the required user agent exception – automatically for WP Rocket, otherwise with a ready-made list to paste. The only gap-free method remains analyzing the server access logs; this plugin cannot and does not try to do that.
Changelog
Maintenance release: the agent abilities now actually register on WordPress 6.9 and newer, the block editor is English instead of German, no more deprecation warnings from the editor sidebars, safer table name binding on uninstall, and the full plugin name. Nothing to reconfigure.
1.0.1
Maintenance release. Nothing to reconfigure.
- Fix: The abilities for AI agents (page as Markdown, search content, and
the three AI suggestions) were not registered at all on WordPress 6.9 and
newer. They were announced too early and rejected by WordPress, which
logged a notice for each of them. They now register at the point
WordPress expects, under their own “Hafen” ability category, and are
available to agent clients as intended. - Fix: The block editor showed the Hafen blocks with German labels on
English sites: field placeholders, the “Remove” links, “+ Add question”
and “+ Add step”, the block descriptions, and the default label of the
TL;DR block. Everything in the editor is now English and translatable
through translate.wordpress.org. The frontend was not affected. - Fix: The editor sidebars (AI assistant and citability linter) no longer
write deprecation warnings into the browser console. They now take
PluginSidebar from the current editor package (WordPress 6.6 and newer)
and fall back to the old one only on WordPress 6.4 and 6.5. - Fix: Uninstalling the plugin now binds every table name safely instead of
writing it into the query text. This affects the cleanup of leftover
transients and, on multisite, the list of sites to clean up. - The plugin now shows its full name, “Hafen Core: Schema, llms.txt and
Answer Blocks”. Slug and text domain (hafen-core) are unchanged, and no
setting is affected.
1.0.0
The WordPress.org release.
- The AI assistant now runs exclusively through the WordPress AI client
(Settings > Connectors, WordPress 7.0+). The former bring-your-own-key
path with direct provider requests has been removed. - English is now the source language: all admin and frontend strings, the
readme, and the block metadata. Translations will be provided through
translate.wordpress.org. - Setup wizard no longer replaces an existing static homepage. If one is
configured, it is kept and the wizard says so; switching remains a
deliberate step under Settings > Reading. - llms.txt: tags no longer glue words together, leftovers of unregistered
shortcodes are removed, untitled posts fall back to their URL, and
llms-full.txt now carries real content sections (up to 800 words per
entry, filterable via hafen_core_llms_full_words) instead of the same
24-word excerpts as llms.txt. - robots.txt: the Content-Signal line now joins the existing
“User-agent: *” group instead of opening a second one, which some
parsers discard. - Schema: no more BreadcrumbList on the front page, where position 1 and
the last entry were identical. - AI assistant prompts follow the site language instead of being
hard-coded German. - New: a review link in the plugin row and a one-time review request
after the first recorded AI visit or the first served llms.txt — one
link for everyone, no rating filter. - Third-party admin notices are removed on the plugin’s own screens.
- The wizard’s plugin step now offers only extensions that actually
resolve in the WordPress.org directory (hafenstudios-ads today;
others appear as they are approved).
0.9.0
WordPress.org submission: opt-in instead of automatism where it matters.
* Fix: The weekly fetch of the public OpenAI IP ranges (for bot verification)
previously ran automatically as soon as AI traffic measurement was active
(default: on) – an external call without explicit consent. New switch
“OpenAI bot verification” under Settings > AI Traffic, OFF by default. The
associated cron is only registered while the switch is active and is
cleanly removed when it is turned off.
* New: The logo plate in the access gate now derives its color from the logo
instead of hard-coding white (F10). Opaque near-white logos (e.g.
Canva/Office exports with a background like #F5F5F1) previously produced a
visible edge on the white plate. The color is sampled once per logo and
cached; the fallback remains white (no image access possible or the logo is
transparent). Filterable via hafen_core_gate_logo_plate_color.
* Updated: The AI assistant’s model list (Claude Opus 5, Claude Sonnet 5,
Claude Haiku 4.5); the default is now the lowest-cost model (Haiku 4.5)
instead of the most expensive one, so a freshly enabled assistant does not
cause high costs unasked.
* Cleanup: The remaining inline outputs (login logo, access gate,
accent color/footer credit in the frontend) now go through
wp_add_inline_style() instead of a hand-built tag; the access gate
page loads its CSS from assets/gate.css. Table names in the plugin’s own
$wpdb queries are now bound via %i instead of interpolated.
* Display name shortened; slug and text domain (hafen-core) unchanged.
* New: languages/hafen-core.pot regenerated.
0.8.1
Security fix: the access gate only applied to normal page views. Everything
WordPress serves through other routes remained reachable unprotected, even
though the actual page correctly showed the under-construction page with
HTTP 503.
* Fix: The REST API (e.g. /wp-json/wp/v2/pages) served the full content of
gated pages unchanged. A new latch using REST’s own authentication signal
now rejects REST requests with HTTP 503 while the access gate is active and
the visitor has not yet passed it. Logged-in users and visitors with a
valid access cookie are exempt, so nothing breaks in normal operation.
* Fix: llms.txt/llms-full.txt as well as the optional IndexNow key file ran
ahead of the access gate in execution order and were therefore served
before it could take effect. The access gate now checks first of all.
* Fix: The Markdown delivery for AI agents (Accept: text/markdown,
?format=md, .md suffix) had the same flaw for the same reason and served
the complete page content despite the active access gate.
* Fix: /wp-json/wp/v2/users (and the plain ?rest_route= variant) exposed
usernames. This route now stays closed additionally, even for visitors
with a valid access cookie, while the access gate is active.
* New: Emergency off switch for the access gate, independent of the stored
setting – constant HAFEN_CORE_GATE_DISABLED in wp-config.php or filter
hafen_core_gate_disabled.
* Checked and unchanged: normal pages, RSS/Atom feeds, robots.txt,
wp-sitemap.xml and the classic ?author=1 redirect were already correctly
gated (they run only AFTER the branch point where the access gate ends the
request).
0.8.0
First impressions: no more error message, no empty pages, no bare
“No data yet.” lines.
* Fix: The assistant step “Recommended extensions” offered plugins that do
not yet exist in the WordPress.org directory. The result was the same for
every user: click, error message. The assistant now queries the directory
first (response cached for 12 hours) and only shows what can actually be
installed. If nothing is available, the step is skipped entirely; progress
bar and step counter adjust automatically.
* Improvement: The starter pages are now built from the theme’s real
patterns. “Contact” previously got a bare heading and nothing else; now it
contains the complete contact section with address, phone, e-mail and
opening hours. The markup is inserted inline, not as a pattern reference:
that way it can be edited normally in the editor and survives a theme
switch.
* Improvement: The empty states in the AI traffic dashboard now explain what
is measured, name a realistic time horizon and say that an empty report is
normal for new sites. Previously the page showed “No data yet.” three times
in a row.
* Improvement: The reporting period (30 days) is now stated in the headings.
Without it, no number on the page could be put into context.
* Improvement: New shared admin styles (assets/admin-tokens.css) group the
sections into cards. They style exclusively the plugin’s own Hafen classes,
without overriding WordPress core elements.
* languages/hafen-core.pot regenerated: the strings from the access gate
(class-access-gate.php) and the login logo (class-login-logo.php) had not
been extracted before and were therefore not translatable.
0.7.2
Performance package (together with Hafen theme 0.3.1: variable font and
system font variation “Stapellauf”).
* New: Performance status in the AI traffic dashboard. Shows honestly what
the setup delivers: page cache detected/not detected, compression via
self-test (gzip/Brotli, result cached for 12 h, never runs in the
frontend) and the active theme’s font mode (variable/static/system). With
a plain-language recommendation per item, because cache and compression
are server matters no plugin can solve from the inside.
* New: Option “Disable WordPress emoji script” (Settings > Hafen Core >
Performance, also via REST). Saves ~26 KB and the external request to
s.w.org. OFF by default, so WordPress behaves as usual.
* Performance: webmcp.js is no longer loaded unconditionally. An inline
snippet (under 300 bytes) loads the script only in browsers that actually
have the WebMCP API. For everyone else: 0 additional requests.
* Fix: The “Vary: Accept” header is now only sent on responses that can also
serve the same URL as Markdown (servable single views) instead of on every
frontend response. Vary on everything fragments LiteSpeed/proxy caches
with no benefit. At the same time, moved from the too-early send_headers
hook to template_redirect (priority 0).
Screenshots
For developers
Is this your plugin? Show off the numbers.
Add a live badge to your site, docs or GitHub README. It updates on its own — no account needed.
Best Hafen Core: Schema, llms.txt… alternatives
All AI plugins →
FAQ
Hafen Core: Schema, llms.txt and An…: quick answers
Straight answers, pulled from live WordPress.org data.
Live data from WordPress.org · checked Oct 6, 2026
Is Hafen Core: Schema, llms.txt an… free?
Yes. Hafen Core: Schema, llms.txt an… is free to download and use from the official WordPress.org plugin directory.
Is Hafen Core: Schema, llms.txt an… safe to use in 2026?
Hafen Core: Schema, llms.txt an… works, but test it on a staging site before relying on it in 2026. Was last updated 1 month ago, and scores 60/100 on our health check.
How many websites use Hafen Core: Schema, llms.txt an…?
Hafen Core: Schema, llms.txt an… is active on <10 WordPress websites and has been downloaded 223 times since it launched in August 2026. It was downloaded 141 times in the last 30 days.
Does Hafen Core: Schema, llms.txt an… work with WordPress 7.1?
Yes. The developer has tested Hafen Core: Schema, llms.txt an… up to WordPress 7.1.2, the latest release. It requires WordPress 6.4 or newer.
What PHP version does Hafen Core: Schema, llms.txt an… need?
Hafen Core: Schema, llms.txt an… requires PHP 7.4 or higher. Most hosts run PHP 8.x today, so it works on any modern WordPress hosting.
When was Hafen Core: Schema, llms.txt an… last updated?
The latest version, 1.0.1, was released on September 4, 2026 (1 month ago).
Who makes Hafen Core: Schema, llms.txt an…?
Hafen Core: Schema, llms.txt an… is developed and maintained by hafenstudios.
What are the best alternatives to Hafen Core: Schema, llms.txt an…?
The most popular alternatives to Hafen Core: Schema, llms.txt an… are Elementor Website Builder (10M+ installs), All in One SEO (2M+ installs) and AI Agent by SiteGround (1M+ installs).
Powered by PageForge
Want thousands of pages that rank like these? Build them in an afternoon.
This directory runs on the same engine as PageForge. Turn any spreadsheet, CSV or API into thousands of fast, SEO-ready WordPress pages — with schema, internal links and AI-written copy baked in.
- CSV, Google Sheets & API data sources
- AI content, schema & internal links per page
- Works with Elementor, Gutenberg, Yoast & Rank Math
- Free on WordPress.org — no credit card
