Tallyrank AI Visibility

ཞིབ་བརྗོད།

When someone asks an AI assistant for “the best dentist in Portland” or “a good web design agency near me”, the assistant names a few businesses. This plugin shows whether yours is one of them, and what on your site keeps assistants from reading it. Tallyrank is made by website-auditor.io, the service it connects to for audits.

Free, on your own server

• AI readiness checks. Can the crawlers ChatGPT, Claude and Perplexity use when they answer questions read your site? Are Google and Bing, whose indexes the assistants search, allowed in? Is “Discourage search engines” still ticked? Is the homepage noindexed? Is there a sitemap, an llms.txt, business markup with links to your profiles on other sites, a descriptive tagline? Each finding says what to do about it. The checks run on your server and send nothing anywhere.
• A free audit, right here. See your AI visibility score, who the assistants named instead of you and which websites they read, without leaving WordPress and with no account. One free audit per site.

With website-auditor.io Pro

Connect a website-auditor.io Pro account ($49/month for new subscriptions; eligible new customers get a 7-day free trial, with a payment method required and no charge until the trial ends) with one click, “Connect to website-auditor.io”, to:

• see your AI visibility score, overall and for each assistant, with its history;
• run a full audit from the dashboard: which questions were asked, who the assistants named instead of you, and which websites they read to decide;
• get ranked recommendations, a shareable report, and ready-made fix files for the findings (security headers, business markup, sitemap and more), the same Pro fix files the website offers;
• apply the audit’s security-header fixes to this site from the Fixes tab, one at a time. Applied headers are stored on your site, keep working if your subscription ends, and can be removed at any time;
• have the site re-audited automatically every week.

Badge

Place [tallyrank_badge] in a footer, page or widget to show your verified AI visibility score. Use [tallyrank_badge theme="light"] on dark backgrounds.

External services

This plugin can connect to services run by website-auditor.io (Armstrong HoldCo LLC). Nothing is sent to them unless you act as described below.

website-auditor.io free audit (website-auditor.io)

Used only when an administrator clicks “Run your free audit” on the plugin’s Overview screen. It starts only while the site is not connected (no connection or API key); one already running when the site is connected finishes. The plugin sends this site’s domain name and home path and, in the request’s user agent, this site’s address and the plugin’s version, to start the audit; then reads whether it has finished and reads its report.

website-auditor.io allows one free audit per domain, and only to the site itself: it answers the first request with a one-time code, which this plugin shows at your site’s address with ?wa_aiv_verify= and the code’s reference added, for up to ten minutes; website-auditor.io reads it from your site before it starts the audit. It keeps a record of the domain that had its free audit. The report is stored at website-auditor.io and can be opened by anyone with its link, as for any audit run on website-auditor.io.

website-auditor.io API (api.website-auditor.io)

Used only after an administrator connects the site, with the “Connect to website-auditor.io” button or by saving a website-auditor.io API key on the plugin’s Account tab.

Connecting with the button uses OAuth 2.0 (authorization code with PKCE). When an administrator clicks it:

• the first time, and again if the site’s admin address changes, the plugin registers this site with https://api.website-auditor.io/oauth/register, sending a name (“Tallyrank AI Visibility” and this site’s host name), that this is the Tallyrank WordPress plugin, and this site’s callback address (wp-admin/admin-post.php?action=wa_aiv_oauth_callback);
• the administrator’s browser opens https://api.website-auditor.io/oauth/authorize with that registration’s id, the callback address, a one-time state and a PKCE challenge, and, when the site has been audited, the address of its latest website-auditor.io report, so the sign-in page can name it. The administrator signs in or creates an account there and approves the site;
• the plugin then exchanges the one-time code at https://api.website-auditor.io/oauth/token for an access token (valid for an hour) and a refresh token, which it keeps in this site’s database. The access token is refreshed at the same address shortly before it expires, sending the refresh token;
• once a week, a scheduled WordPress task (WP-Cron) refreshes the connection the same way if it has not been refreshed for a week, so it does not expire on a site nobody opens. It stops when the site is disconnected or the plugin deactivated, and resumes when the plugin is activated again;
• the connection is revoked at https://api.website-auditor.io/oauth/revoke, sending its refresh token, when an administrator clicks “Disconnect”, connects again (the old connection is replaced), saves an API key instead, or deletes the plugin. If the service answers a connection without a refresh token, that access token is revoked the same way.

Registration, token and revocation requests send, in their user agent, this site’s address and the plugin’s version.

From then on, with the connection’s access token or the API key, the plugin sends this site’s domain name and, in the request’s user agent, this site’s address and the plugin’s version:

• when the site is connected, or the key is saved, to read the account’s subscription status;
• when an administrator opens the plugin’s Overview screen, to read the account’s subscription status and the site’s stored scores, recommendations and report link (cached for up to six hours);
• when an administrator clicks “Run a new audit”, to audit the site’s public pages;
• when an administrator clicks “Re-check this site automatically every week”, to enroll the domain for weekly audits;
• when an administrator opens the plugin’s Fixes tab, or applies a fix after that read has expired, to read the fixes from the site’s latest audit (cached for up to an hour).

The plugin’s “Start 7-day free trial”, “Subscribe to Pro” and fix-file links open website-auditor.io’s account portal (https://api.website-auditor.io/admin_portal/) in the administrator’s browser; when the site has a report on website-auditor.io, the link carries that report’s address, so the portal can name the site.

No visitor data, content or personal information is sent. website-auditor.io’s terms and privacy policy apply.

website-auditor.io badge

Only if the [tallyrank_badge] shortcode is placed on a page, visitors’ browsers load the badge image from https://website-auditor.io/badge/<your-domain>.svg. Like any image from another site, that request includes the visitor’s IP address and browser details. The plugin’s admin screen also shows a preview of the badge, loaded the same way, once an audit of the site has been recorded. Same terms and privacy policy.

The readiness checks make requests only to this site’s own address.