SEO & GEO Toolkit

The SEO & GEO Toolkit extension regularly checks your own websites for classic SEO signals and for Generative Engine Optimization (GEO) — findability and citability by AI answer engines such as ChatGPT, Perplexity, or Google AI Overviews. It's installed as an opt-in extension via the marketplace and reaches external websites exclusively through a secured HTTP(S) fetch — never through internal panel or server data.

Installation & enabling

1. Enable the extension (marketplace).
2. Panel API key (optional, for the 24h fleet scan) — the admin sets a panel API key of an admin account (Settings → API Access) under Extensions → SEO & GEO Toolkit → Settings. Without this key, on-demand scans keep working normally, but the automatic 24h run across the whole customer fleet stays off.
3. Package permission — in the package, the admin sets Allow SEO & GEO Toolkit (perm_seo_geo_toolkit) to control which customers see the toolkit. For admin accounts it's always visible, regardless of package.

Check catalog

Every scan fetches the homepage, robots.txt, sitemap.xml and llms.txt of the website and evaluates them against a fixed catalog. Every finding comes with severity (critical/warning/info), evidence and a fix suggestion.

SEO checks: homepage reachability, title tag (presence + length), meta description (presence + length), H1 (exactly one), canonical tag, HTTPS enforcement, robots.txt (presence, blocking everything), sitemap.xml, image alt text, Open Graph tags, mobile viewport meta tag.

GEO checks (Generative Engine Optimization): crawl access for known AI bots (GPTBot, ClaudeBot, Google-Extended, PerplexityBot, anthropic-ai) in robots.txt, FAQ/HowTo structured data (JSON-LD) as a citation-friendly format, a clean heading hierarchy, Organization/Person structured data for author/owner attribution, llms.txt as an optional curated entry point for AI crawlers, hreflang consistency.

Ranking & backlink data (DataForSEO, optional)

Every customer can set their own DataForSEO key under SEO & GEO Toolkit → DataForSEO key (format login:password). The key is stored AES-256-GCM encrypted in the extension's own SQLite database and never returned in plaintext in an API response — the UI only shows whether a key is configured.

Without a key, the ranking/backlink part stays inactive — the rest of the extension (SEO and GEO checks) keeps working regardless.

Scan cadence

• 24h ticker — every website is automatically re-checked once a day (requires a configured panel API key, see above).
• On-demand rescan — via the Scan now button on the website list, with a 5-minute cooldown per website against accidental repeated clicks.

Security model

• SSRF protection — every fetch of a customer domain goes through a dedicated HTTP client that refuses the connection at the actually resolved target if it falls into a private, internal, or loopback address range (RFC1918, loopback, link-local including the cloud metadata endpoint 169.254.169.254, IPv6 equivalents, NAT64/6to4-embedded addresses). The check sits in the net.Dialer callback, i.e. after DNS resolution — that also protects against DNS rebinding.
• Every authorization decision re-verifies against the real panel API, never against locally decoded JWT claims alone. extractScope only reads role/customer ID from the token payload, without checking the signature — that isn't enough, because this same extension is also reachable through the deliberately unauthenticated webhook proxy (/api/v1/ext-webhook/seo-geo-toolkit/*, meant for GitHub/GitLab-style delivery). requirePermission therefore calls the real panel's /api/v1/my/permissions first on every request — which verifies the signature — and only then relies on the locally decoded claims.
• The DataForSEO key (never global, only per customer) is stored encrypted in the extension's own SQLite database.
• The package permission is enforced by the extension itself, server-side (the generic extension proxy does not check it).
• The website list comes exclusively from the panel's existing sites API — the extension has no access of its own to the sites table.

Not yet included

• Additional search-engine APIs besides DataForSEO.
• Multi-page scans — currently only the homepage of each website is checked, not the full page structure.