SUDS Planner

SUDS Planner is the content planning tool of the SUDS agency. This plugin connects a client’s WordPress site to the Planner:

• SEO: SEO title, meta description, canonical, robots, Open Graph and Twitter tags, and schema.org JSON-LD (organization or local business, website, web page, article, author and breadcrumbs) for every page.
• Schema per post type: each public post type can add a product, a service, a local business or an article to the page schema. A product takes its name, images, category, model, price and properties from the post: the featured image and image fields, the terms of each taxonomy of the post type, and the rows of an ACF repeater (custom fields work without ACF too). A local business (LocalBusiness or a subtype such as AutoRepair, HairSalon or MedicalClinic) takes its address, phone, email, profiles, map, coordinates, logo, photos and opening hours from fields, and can be shown as a member of the company’s network offering a service. The post type page can list its posts (ItemList). By default each post type keeps what Rank Math or SEOPress PRO gave it.
• Switching from Rank Math or SEOPress: when a post has no SEO title or description of its own, the plugin uses the ones saved by the SEO plugin that was active when it took over (including its title templates and variables; data left behind by an older switch between Rank Math and SEOPress is ignored, and the choice can be changed in the settings), and it also keeps their focus keyword, robots and canonical settings, the Search Console and Bing verification codes, the Google Analytics tag they inserted, the “remove /category/ from URLs” and “redirect attachments” settings, and their redirects (imported into the plugin’s own table). The switch never changes or deletes their data, so reactivating them brings everything back. While Rank Math, Yoast SEO, All in One SEO, SEOPress, The SEO Framework or Slim SEO is active, the plugin’s SEO stays off.
• SEO columns and Quick Edit: “SEO title” and “SEO description” columns in the posts and pages lists (inherited values shown in gray) and both fields in Quick Edit, with a character counter.
• Sitemap: uses the WordPress core sitemap, without user pages and noindex posts, with last-modified dates. The old sitemap addresses (sitemap_index.xml, sitemaps.xml, post-sitemap.xml…) redirect to it, so the sitemap submitted to Search Console keeps working.
• Redirects: add redirects by hand in Settings → SUDS Planner (from a path of the site to a path or to any address, 301, 302, 307, 308, 410 or 451, with exact, starts with, contains, ends with or regex matching), and edit, turn off or delete them there. Imported ones keep working, and a 301 redirect is created automatically when the address of a published post or page changes.
• Locations: each location (branch, unit, clinic) with its own page gets a local business in the schema (LocalBusiness, MedicalClinic, Dentist, HairSalon and other types) with name, address, phone, opening hours, coordinates, map and profile links, linked to the site’s organization, and the organization lists its locations on the home page. Each page has a “Location” box; empty fields use what Rank Math PRO saved in the page schema. Locations created with Rank Math PRO’s Local SEO (its own post type, for example /locations/downtown/) keep working with the same address when Rank Math is no longer active.
• Focus keyword from the Planner: SUDS Planner reads and sets the focus keyword of each page (its keyword pool) with the site token. While Rank Math or SEOPress is active, it uses their own focus keyword field.

• WebP images: turns the JPG and PNG images of the media library into WebP copies and shows the copies on the site in place of the originals (image tags, srcset, inline backgrounds and the CSS files that page builders such as Elementor save in uploads). Every copy is made from the original upload, resized for each image size, and never from another copy or a resized JPEG, so there is no added quality loss; an image that was already converted is not converted again. Photos use lossy WebP (quality 86 by default, adjustable: as faithful to the original as the JPEG that WordPress creates, and lighter), and so do PNG images that are photos (thousands of colors); logos, graphics with text and screenshots in PNG use lossless WebP, and a size stays on the original whenever its WebP is not smaller. The original files are never changed or moved, and the database is not changed: reverting deletes the copies and the site shows the originals again at once (known page caches are cleared). The screen in Media → WebP (SUDS) lists each image with the original and the WebP side by side, with Convert and Revert buttons; SUDS Planner can do the same with the site token. After the first conversion, new uploads are converted automatically. The conversion runs on the site’s own server (Imagick or GD with WebP), with no external service. It stays off while EWWW Image Optimizer, ShortPixel, Imagify, WebP Express, Converter for Media, Optimole or another plugin that serves WebP is active.

• Light security against SEO spam hacks: comments, pingbacks and trackbacks are turned off by default (existing comments are kept in the database and come back when comments are allowed again; WooCommerce product reviews follow the store settings); failed logins are limited per IP (5 in 15 minutes lock that IP for 30 minutes); XML-RPC is turned off (kept with Jetpack); the user list is hidden from visitors (?author=N, /wp/v2/users and the users sitemap); the dashboard file editor is turned off; PHP is blocked in the uploads folder (an .htaccess block, Apache and LiteSpeed); basic security headers and no WordPress version in the page. Each protection is handed over to another security plugin only when that plugin is active and its own settings confirm it does the same job (for example login limits in Wordfence, All-In-One Security or Solid Security); otherwise the plugin keeps it on, and XML-RPC stays available while Jetpack needs it. Settings → SUDS Planner shows which protections are handed over and which could not be confirmed, and the REST route used by SUDS Planner reports the state of each one. Every option can be turned off in Settings → SUDS Planner, and none deletes anything.

• Automatic updates: turns on WordPress’s own automatic updates for plugins (as soon as a new version is out) and for themes (a set number of days after a new version, 7 by default). Both can be turned off.
• Daily security check: once a day (WP-Cron, in steps of up to 20 seconds) it compares the WordPress core files and the files of plugins from WordPress.org with the official checksums, and looks for PHP files that should not be there (inside wp-admin, wp-includes, plugins, the uploads folder and the site root), malicious code patterns in themes and in plugins without official checksums, plugins hidden from the Plugins screen, mu-plugins and drop-ins, .htaccess rules that redirect only search engine bots, auto_prepend_file, new administrators, posts and options with hidden links, obfuscated scripts or spam terms (up to 300 suspicious posts, plus the 200 newest, and 300 options per check; the check says how many it did not read), many posts published at once, stray HTML pages and backups in the site root, and updates stuck for days. It only reports; it never changes or deletes files. The results are in Settings → SUDS Planner, with a “Check now” button.

• Spam-free forms without a captcha: a hidden field, a minimum time on the page and typical spam content (many links, links in HTML, text almost entirely in Cyrillic or Chinese/Japanese) block spam in Elementor Pro, Contact Form 7, WPForms, Gravity Forms, Fluent Forms and Forminator forms, and in comments when they are allowed. A blocked submission does not send the formulario_enviado event to Google Analytics, so conversions stay clean.

• Public draft preview: a link with a secret code shows that specific unpublished article (draft, pending or scheduled) to anyone who has the link, with the site’s normal layout (Elementor included), without logging in.

• Review bar: on that preview, the client selects a passage of the text and comments on it, approves the article or requests changes. Everything goes to the post in the Planner.
• Comments in the editor: the client’s comments are stored with the article (meta box “Client comments (SUDS Planner)”), visible to whoever edits the text.
• AI crawler visits: counts the visits of AI crawlers and fetchers (ChatGPT, Claude, Perplexity, Mistral, Meta AI and others, by user agent) per day and page, in its own table. It stores only the day, the crawler name, the page path and the count; nothing about visitors. SUDS Planner reads the counts with the site token for the client’s SEO report.
• Form submitted event: when a form is submitted successfully (Elementor, Contact Form 7, WPForms, Gravity Forms, Fluent Forms, Forminator), sends the formulario_enviado event to Google Analytics already on the site (gtag, or the Tag Manager dataLayer), with only the form tool and form id. It can be turned off in Settings → SUDS Planner.

The plugin does not change content and does not publish anything on its own: scheduled publishing is done by the Planner through the WordPress REST API, with an application password. All SEO features work on any site, with or without a SUDS Planner token.

External service

The review bar is shown only on a draft preview opened with the client’s link (the preview code plus, at the end of the address, #suds_review=...). It sends the reader’s comments and decisions to the SUDS Planner address configured in the plugin (https://planner.suds.com.br). The AI crawler counts stay on the site and are read only by SUDS Planner with the site token. The form event goes only to the Google Analytics the site already uses; it sends nothing that visitors typed. The plugin loads the Google Analytics tag (googletagmanager.com) only when the site owner sets a GA4 ID in the settings or the SEO plugin used before (Rank Math or SEOPress) was inserting it, and never when Site Kit, MonsterInsights, ExactMetrics or GTM4WP is active: Google’s privacy policy is at https://policies.google.com/privacy. The daily security check downloads the official checksums of the WordPress version and of each installed plugin from WordPress.org (api.wordpress.org and downloads.wordpress.org), sending only the version numbers and plugin slugs. Terms: https://suds.com.br.