Crawler Record vs Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)

Crawler Record shows when Google, ChatGPT, Claude, and other top bots last visited pages on your website, so you can be confident your pages are being crawled. This is the first step in ensuring these platforms index your website so they can serve it to visitors. The data covers several top user-agents, including: Google Bing ChatGPT (OpenAI) Claude (Anthropic) Perplexity Meta Apple Amazon DuckDuckGo Common Crawl Site users with manage_options can view this information: Admin page: a grouped list of all crawlers, with last seen time, last page, and robots.txt status for the crawler. Recent Pages: From the admin page, you can select a crawler and see its latest visited pages, the response status WordPress observed, and a destination when WordPress exposes one for a retained 3xx response. Crawler Activity Overview: Review 28-day visit totals, response-code health, crawler mix, a daily activity timeline, and crawler staleness. URL reports use up to the 50 most recent recorded visits per crawler. Crawler Status Overview: Filter the main dashboard and crawler table by crawlers that visited within 28 days, have become stale, or have never visited. The unfiltered dashboard includes the stale-crawler age distribution alongside current activity; the Stale view focuses on that distribution, latest-visit details, and Recent Pages links instead of empty or potentially misleading historical metrics. CSV Reports: Download all retained visits from each 2xx, 3xx, or 4xx report, across pagination. Retained history is limited to up to 50 recent visits per crawler and may include visits older than 28 days. Downloaded reports may contain sensitive URL paths; share them carefully. Header Codes for User-Agents: Did a user-agent successfully visit a page (2xx), receive a 3xx response, or land on a page that was missing or inaccessible (4xx)? Crawler Record will show you. The 3xx report includes every retained 3xx status, including 304 Not Modified; only responses with an observable redirect destination show where the request was sent. Admin Bar (front-end): quick-glance status for all user-agent visits. Per Page/Post: From the edit screen on any page or post, you can see the last time each crawler visited that page. Users with Crawler Record access can also open the main dashboard or an individual crawler’s Recent Pages report from this box. Monthly Report by Email: Designate which admin users recieve a monthly email update. Robots-aware: The plugin checks your robots.txt and evaluates Allow/Disallow rules for a given path. WordPress’s “Discourage search engines” preference is reported separately because it asks compliant search engines to avoid indexing. Response-aware: Recent visits include the final HTTP status WordPress can observe, including ordinary WordPress 404 pages and 3xx responses that occur after tracking begins. The 3xx report groups all retained 3xx statuses together; 304 Not Modified does not redirect and therefore has no destination. Other 3xx rows show a destination only when WordPress/PHP exposes one. Responses served by a CDN, web server, static cache, or security layer before WordPress runs cannot be recorded. Identification note: Crawler identification is based on the supplied user-agent string. User-agent strings can be spoofed, and this plugin does not verify IPs. Learn how to use this plugin. Highlights Supports common user-agent variants for Google, Bing, OpenAI (ChatGPT), Anthropic (Claude), Perplexity, Meta, Apple, Amazon, DuckDuckGo, and Common Crawl. robots.txt status computed from a local physical or WordPress virtual source without outbound requests. Known limitations Can only track crawlers from the time the plugin is installed—it cannot reconstruct earlier visits. Per-post “last seen” timestamp and user-agent metadata update at most once every 10 minutes by default. Separately, rapid same-crawler, same-URL, same-status visits are suppressed for 30 seconds, and a high emergency ceiling retains up to 50 visits per crawler per minute. Concurrent requests matching the same crawler are not coordinated. One database write may replace another, causing a visit to be absent from recent history or daily totals, or causing the latest-visit fields to reflect whichever write finished last. Dashboard totals are therefore approximate retained activity rather than an exact raw access log because of throttling, retention limits, and possible concurrent writes. Response codes are available only for requests that reach WordPress. Responses served earlier by a CDN, web server, static cache, or security layer are outside the plugin’s visibility. The 3xx report includes all retained 3xx statuses, including 304 Not Modified. Redirect destinations are available only when WordPress/PHP exposes a Location header. Redirects issued before WordPress runs cannot be recorded, and a followed destination is retained as a separate visit if it reaches WordPress. Stored source and redirect URLs include scheme, validated host, optional port, and path. Safe numeric WordPress routing parameters (p, page_id, and attachment_id) are retained; all other query parameters are omitted to avoid storing sensitive tokens, personal data, and high-cardinality tracking values. A “Parameters omitted” badge identifies affected URLs without changing their link targets. Reverse-proxy configuration can affect the scheme WordPress observes. Reports treat the configured site host and its www or non-www counterpart as the same site for safe linking. The originally requested address and observed response remain unchanged, so redirects between those hosts still appear in the 3xx report. Other hosts remain unlinked. URLs up to 114 characters are stored normally. URLs from 115 through 1,028 characters retain the visit with a 100-character prefix and an excessive-length marker; they are displayed with an ellipsis and are not linked. URLs longer than 1,028 characters are omitted from URL-level reports. Sitewide tracking for such requests is subject to the 30-second suppression window, while applicable per-post metadata uses its separate 10-minute throttle. Privacy This plugin stores: – Timestamps of crawler visits – Exact matched crawler user-agent strings – Last URL and a bounded 50-visit recent history per crawler – Final HTTP response status observable by WordPress for recent crawler visits – Observable redirect destination, when PHP exposes one for a retained 3xx response other than 304 Not Modified – Last post ID per crawler (for admin performance) Stored source and redirect URLs retain only the safe numeric WordPress routing parameters p, page_id, and attachment_id. All other query parameters and all fragments are omitted. Newly recorded URLs with omitted parameters are identified by a “Parameters omitted” badge; the badge is not part of the stored or linked URL. Incoming hosts are validated and used only for reporting; they are never used for redirects, filesystem access, or outbound requests. Existing URL length limits apply independently to redirect sources and destinations. Optional monthly email reporting additionally stores selected WordPress user IDs and their account email addresses for consent validation, hashed confirmation tokens, short-lived per-user invitation cooldowns, and bounded delivery state. These options are non-autoloaded and isolated per site on multisite. Reports calculate current values from the same bounded data used by the dashboard and retain no month-to-month report history. A failed delivery temporarily stores its bounded report payload for one retry. Only explicitly selected users receive confirmation invitations; reports require their confirmation. Emails leave the site through its configured WordPress email transport and provider, not an analytics service. Confirmation and unsubscribe endpoints are public bearer-link pages exposing no report data. The email provider and recipients can access or forward email contents. The plugin stores requests matching configured crawler patterns, but user-agent strings can be spoofed. It performs no IP verification and transmits no data to third parties. Crawler reports, the front-end admin-bar menu, and the post/page meta box require manage_options. Source URLs with hosts outside the configured WordPress home/site hosts are displayed as non-clickable diagnostic text. Uninstall removes all current and legacy Crawler Record options, transients, and post metadata from each site in a multisite network; WordPress removes the plugin files themselves. License GPLv2 or later. See LICENSE file.

Easily improve site security with WordPress Hardening, Two-Factor Authentication (2FA), Login Protection, Vulnerability Detection and SSL certificate. Really simple, Effective and Performant WordPress Security Really Simple Security is the most lightweight and easy-to-use security plugin for WordPress. It secures your WordPress website with SSL certificate generation, including proper 301 https redirection and SSL enforcement, scanning for possible vulnerabilities, Login Protection and implementing essential WordPress hardening features. We believe that security should have the absolute minimum effect on website performance, user experience and maintainability. Therefore, Really Simple Security is: Lightweight: Every security feature is developed with a modular approach and with performance in mind. Disabled features won’t load any redundant code. Easy-to-use: 1-minute configuration with short onboarding setup. Security Features Easy SSL Migration Migrates your website to HTTPS and enforces SSL in just one click. 301 redirect via PHP or .htaccess Secure cookies Let’s Encrypt: Install an SSL Certificate if your hosting provider supports manual installation. Server Health Check: Your server configuration is every bit as important for your website security. WordPress Hardening Tweak your configuration and keep WordPress fortified and safe by tackling potential weaknesses. Prevent code execution in the uploads folder Prevent login feedback and disable user enumeration Disable XML-RPC Disable directory browsing Username restrictions (block ‘admin’ and public names) and much more.. Vulnerability Detection Get notified when plugins, themes or WP core contain vulnerabilities and need appropriate action. Login Protection Allow or enforce Two-Factor Authentication (2FA) for specific user roles. Users receive a two-factor code via Email. Improve Security with Really Simple Security Pro Protect your site with all essential security features by upgrading to Really Simple Security Pro. Advanced SSL enforcement Mixed Content Scan & Fixer. Detect files that are requested over HTTP and fix them to HTTPS, both Front- and Back-end. Enable HTTP Strict Transport Security and configure your site for the HSTS Preload list. Firewall Really Simple Security Pro includes a performant and efficient WordPress firewall, to stop bots, crawlers and bad actors with IP and username blocks. 404 blocking – Blocks crawlers as they trigger unusual numbers of 404 errors. Region blocking – Only allow/block access to your site from specific regions. Automated and customisable Firewall rules. IP blocklist and allowlist. Security Headers Security headers protect your site visitors against the risk of clickjacking, cross-site-forgery attacks, stealing login credentials and malware. Independent of your Server Configuration, works on Apache, LiteSpeed, NGINX, etc. Protect your website visitors with X-XSS Protection, X-Content-Type-Options, X-Frame-Options, a Referrer Policy and CORS headers. Automatically generate your WordPress-tailored Content Security Policy. Vulnerability Measures When a vulnerability is detected in a plugin, theme or WordPress core you will get notified accordingly. With Vulnerability Measures, you can configure simple but effective measures to make sure that a critical vulnerability won’t remain unattended. Force update: An update process will be tried multiple times until it can be assumed development of a theme or plugin is abandoned. You will be notified during these steps. Quarantine: When a plugin or theme can’t be updated to solve a vulnerability, Really Simple Security can quarantine the plugin. Advanced Site Hardening Choose a custom login URL Automated File Permissions check and fixer Rename and randomize your database prefix Change the debug.log file location to a non-public folder Disable application passwords Control admin creation Disable HTTP methods, reducing HTTP requests Login Protection Secure your website’s login process and user accounts with powerful security measures. Two-Step verification (Email login) 2FA (two factor authentication) with TOTP Passwordless login with passkey login Enforce strong passwords and frequent password change Limit Login Attempts With Limit Login Attempts you can configure a threshold to temporarily or permanently block IP addresses or (non-existing) usernames. You can also throw a CAPTCHA after a failed login (hCaptcha or Google reCaptcha) Access Control Restrict access to your site for specific regions. Add specific IP addresses or IP ranges to the Blocklist or Allowlist. Useful Links Documentation Security Definitions Translate Really Simple Security Issues & pull requests Feature requests Love Really Simple Security? If you want to support the continuing development of this plugin, please consider buying Really Simple Security Pro, which includes some excellent security features and premium support. About Really Simple Plugins Our mission is to make complex WordPress requirements really easy. Really Simple Security is developed by Really Simple Plugins. For generating SSL certificates, Really Simple Security uses the le acme2 PHP Let’s Encrypt client library, thanks to ‘fbett’ for providing it. Vulnerability Detection uses WP Vulnerability, an open-source initiative by Javier Casares. Want to join as a collaborator? We’re on GitHub as well!