WordPress Plugin

SurfacedBy AI Visibility is a free WordPress plugin, listed on WordPress.org as surfacedby-ai-visibility. It records which AI crawlers read your site, which AI platforms send you visitors, and which of those visitors convert. It works on its own inside wp-admin without a SurfacedBy account, and it can be paired with a domain in your workspace to feed the Tracking page.

Requirements: WordPress 6.3 or later and PHP 7.4 or later.

Install

Search for SurfacedBy AI Visibility under Plugins > Add New in wp-admin, or download the ZIP from the WordPress install option on your domain's Tracking page. Activate it, then open SurfacedBy in the wp-admin menu.

If you use a page cache, purge it after activating so cached pages include the plugin's referral script.

What it does without an account

Everything below runs on your server and stores its data in your WordPress database. Until you pair the plugin, it sends nothing to SurfacedBy.

• AI Bots - recorded AI crawler requests with the page, the crawler, and what it was doing (training, search indexing, or live retrieval). Exportable as CSV.
• AI Referrals - visits that arrived from an AI platform, with the platform and the landing page. Exportable as CSV.
• Conversions - appears when WooCommerce, MemberPress, or Easy Digital Downloads is active. Purchases, renewals, and refunds are credited to the AI platform that brought the customer (Easy Digital Downloads reports purchases and refunds). Custom checkouts can report conversions with window.sbAi.track(). See Conversion Tracking.
• Readiness - checks robots.txt access for AI crawlers, your llms.txt, and the structured data AI platforms look for. The plugin reads your robots.txt; it does not change it.
• llms.txt - publishes an llms.txt index of your posts and pages at the root of your site, respecting noindex settings from Yoast, Rank Math, AIOSEO, and SEOPress.
• Schema - results of the structured data check.
• Settings - how long local logs are kept (7 to 365 days, 90 by default), the conversion tracking switch, the browser referral script, and uninstall behavior.

The standalone log identifies crawlers by the name or signature claim they send, which can be imitated. SurfacedBy verifies supported crawlers against published addresses or signed request evidence after the plugin is connected with a private code. A signature claim alone is not proof of identity.

Pair with your dashboard

Pairing sends the plugin's records to your domain's Tracking page, where they sit next to your AI visibility data.

1. In the SurfacedBy dashboard, open the domain's Tracking page and choose the WordPress install option. Copy its private connection code. Setting up tracking requires the Admin role, and the Tracking page requires a paid plan or an active trial.
2. In wp-admin, open SurfacedBy > Connect and paste the connection code. Keep it private: it authenticates this plugin's deliveries. Older public Site ID connections still sync records, but must reconnect with a code to enable crawler verification.
3. Back on the Tracking page, use the connection check to confirm the plugin is reporting.

Records collected before pairing are synced too. Once paired, the plugin sends crawler, referral, and conversion rows and a daily health check. It never sends visitor names, emails, billing details, or human visitors' IP addresses. On version 1.2.8 or later, signed crawler requests also send the original method, URL, and signature headers for verification. The original URL can include signed query parameters; this temporary evidence is separate from the query-free crawl history. It expires after ten minutes before selection, while a selected batch keeps its exact contents until accepted or rejected so a retry cannot count twice. Unpairing stops outgoing data; your local logs stay in WordPress.

Purchases from Google Tag Manager

If your store sends purchases to Google Tag Manager, runs a custom or headless cart, or uses an e-commerce plugin the plugin does not support directly, turn on Forward GTM purchase events in the plugin settings. It is off by default. When it is on, each GA4-style purchase event your site pushes to the data layer is recorded as a conversion, keyed on its transaction ID, so a WooCommerce order that also reaches SurfacedBy directly counts once. Refunds and signups are not forwarded this way. The plugin skips forwarding when a supported consent banner (Cookiebot, Complianz, or Iubenda) reports that marketing consent was declined.

Caching and CDNs

Crawler logging runs in PHP, so requests answered entirely by a page cache or CDN never reach the plugin and are not recorded. The plugin's browser script records AI referrals and, on verified connected installs, anonymous page observations on cached pages. Scripts or networks that block delivery leave gaps; this is partial coverage. WordPress does not emit a second PHP page denominator. If your site sits behind Cloudflare, the Cloudflare edge tracker records requests before they reach WordPress; see Tracking for its setup. The two can run together.