SUDS Planner

Description

SUDS Planner is the content planning tool of the SUDS agency. This plugin connects a client’s WordPress site to the Planner:

  • SEO: SEO title, meta description, canonical, robots, Open Graph and Twitter tags, and schema.org JSON-LD (organization or local business, website, web page, article, author and breadcrumbs) for every page.
  • Schema per post type: each public post type can add a product, a service, a local business or an article to the page schema. A product takes its name, images, category, model, price and properties from the post: the featured image and image fields, the terms of each taxonomy of the post type, and the rows of an ACF repeater (custom fields work without ACF too). A local business (LocalBusiness or a subtype such as AutoRepair, HairSalon or MedicalClinic) takes its address, phone, email, profiles, map, coordinates, logo, photos and opening hours from fields, and can be shown as a member of the company’s network offering a service. The post type page can list its posts (ItemList). By default each post type keeps what Rank Math or SEOPress PRO gave it.
  • Switching from Rank Math or SEOPress: when a post has no SEO title or description of its own, the plugin uses the ones saved by the SEO plugin that was active when it took over (including its title templates and variables; data left behind by an older switch between Rank Math and SEOPress is ignored, and the choice can be changed in the settings), and it also keeps their focus keyword, robots and canonical settings, the Search Console and Bing verification codes, the Google Analytics tag they inserted, the “remove /category/ from URLs” and “redirect attachments” settings, and their redirects (imported into the plugin’s own table). The switch never changes or deletes their data, so reactivating them brings everything back. While Rank Math, Yoast SEO, All in One SEO, SEOPress, The SEO Framework or Slim SEO is active, the plugin’s SEO stays off.
  • SEO columns and Quick Edit: “SEO title” and “SEO description” columns in the posts and pages lists (inherited values shown in gray) and both fields in Quick Edit, with a character counter.
  • Sitemap: uses the WordPress core sitemap, without user pages and noindex posts, with last-modified dates. The old sitemap addresses (sitemap_index.xml, sitemaps.xml, post-sitemap.xml…) redirect to it, so the sitemap submitted to Search Console keeps working.
  • Redirects: add redirects by hand in Settings SUDS Planner (from a path of the site to a path or to any address, 301, 302, 307, 308, 410 or 451, with exact, starts with, contains, ends with or regex matching), and edit, turn off or delete them there. Imported ones keep working, and a 301 redirect is created automatically when the address of a published post or page changes.
  • Locations: each location (branch, unit, clinic) with its own page gets a local business in the schema (LocalBusiness, MedicalClinic, Dentist, HairSalon and other types) with name, address, phone, opening hours, coordinates, map and profile links, linked to the site’s organization, and the organization lists its locations on the home page. Each page has a “Location” box; empty fields use what Rank Math PRO saved in the page schema. Locations created with Rank Math PRO’s Local SEO (its own post type, for example /locations/downtown/) keep working with the same address when Rank Math is no longer active.
  • Focus keyword from the Planner: SUDS Planner reads and sets the focus keyword of each page (its keyword pool) with the site token. While Rank Math or SEOPress is active, it uses their own focus keyword field.
  • WebP images: turns the JPG and PNG images of the media library into WebP copies and shows the copies on the site in place of the originals (image tags, srcset, inline backgrounds and the CSS files that page builders such as Elementor save in uploads). Every copy is made from the original upload, resized for each image size, and never from another copy or a resized JPEG, so there is no added quality loss; an image that was already converted is not converted again. Photos use lossy WebP (quality 86 by default, adjustable: as faithful to the original as the JPEG that WordPress creates, and lighter), and so do PNG images that are photos (thousands of colors); logos, graphics with text and screenshots in PNG use lossless WebP, and a size stays on the original whenever its WebP is not smaller. The original files are never changed or moved, and the database is not changed: reverting deletes the copies and the site shows the originals again at once (known page caches are cleared). The screen in Media WebP (SUDS) lists each image with the original and the WebP side by side, with Convert and Revert buttons; SUDS Planner can do the same with the site token. After the first conversion, new uploads are converted automatically. The conversion runs on the site’s own server (Imagick or GD with WebP), with no external service. It stays off while EWWW Image Optimizer, ShortPixel, Imagify, WebP Express, Converter for Media, Optimole or another plugin that serves WebP is active.

  • Light security against SEO spam hacks: comments, pingbacks and trackbacks are turned off by default (existing comments are kept in the database and come back when comments are allowed again; WooCommerce product reviews follow the store settings); failed logins are limited per IP (5 in 15 minutes lock that IP for 30 minutes); XML-RPC is turned off (kept with Jetpack); the user list is hidden from visitors (?author=N, /wp/v2/users and the users sitemap); the dashboard file editor is turned off; PHP is blocked in the uploads folder (an .htaccess block, Apache and LiteSpeed); basic security headers and no WordPress version in the page. Each protection is handed over to another security plugin only when that plugin is active and its own settings confirm it does the same job (for example login limits in Wordfence, All-In-One Security or Solid Security); otherwise the plugin keeps it on, and XML-RPC stays available while Jetpack needs it. Settings SUDS Planner shows which protections are handed over and which could not be confirmed, and the REST route used by SUDS Planner reports the state of each one. Every option can be turned off in Settings SUDS Planner, and none deletes anything.

  • Automatic updates: turns on WordPress’s own automatic updates for plugins (as soon as a new version is out) and for themes (a set number of days after a new version, 7 by default). Both can be turned off.
  • Daily security check: once a day (WP-Cron, in steps of up to 20 seconds) it compares the WordPress core files and the files of plugins from WordPress.org with the official checksums, and looks for PHP files that should not be there (inside wp-admin, wp-includes, plugins, the uploads folder and the site root), malicious code patterns in themes and in plugins without official checksums, plugins hidden from the Plugins screen, mu-plugins and drop-ins, .htaccess rules that redirect only search engine bots, auto_prepend_file, new administrators, posts and options with hidden links, obfuscated scripts or spam terms (up to 300 suspicious posts, plus the 200 newest, and 300 options per check; the check says how many it did not read), many posts published at once, stray HTML pages and backups in the site root, and updates stuck for days. It only reports; it never changes or deletes files. The results are in Settings SUDS Planner, with a “Check now” button.
  • Spam-free forms without a captcha: a hidden field, a minimum time on the page and typical spam content (many links, links in HTML, text almost entirely in Cyrillic or Chinese/Japanese) block spam in Elementor Pro, Contact Form 7, WPForms, Gravity Forms, Fluent Forms and Forminator forms, and in comments when they are allowed. A blocked submission does not send the formulario_enviado event to Google Analytics, so conversions stay clean.

  • Public draft preview: a link with a secret code shows that specific unpublished article (draft, pending or scheduled) to anyone who has the link, with the site’s normal layout (Elementor included), without logging in.

  • Review bar: on that preview, the client selects a passage of the text and comments on it, approves the article or requests changes. Everything goes to the post in the Planner.
  • Comments in the editor: the client’s comments are stored with the article (meta box “Client comments (SUDS Planner)”), visible to whoever edits the text.
  • AI crawler visits: counts the visits of AI crawlers and fetchers (ChatGPT, Claude, Perplexity, Mistral, Meta AI and others, by user agent) per day and page, in its own table. It stores only the day, the crawler name, the page path and the count; nothing about visitors. SUDS Planner reads the counts with the site token for the client’s SEO report.
  • Form submitted event: when a form is submitted successfully (Elementor, Contact Form 7, WPForms, Gravity Forms, Fluent Forms, Forminator), sends the formulario_enviado event to Google Analytics already on the site (gtag, or the Tag Manager dataLayer), with only the form tool and form id. It can be turned off in Settings SUDS Planner.

The plugin does not change content and does not publish anything on its own: scheduled publishing is done by the Planner through the WordPress REST API, with an application password. All SEO features work on any site, with or without a SUDS Planner token.

External service

The review bar is shown only on a draft preview opened with the client’s link (the preview code plus, at the end of the address, #suds_review=...). It sends the reader’s comments and decisions to the SUDS Planner address configured in the plugin (https://planner.suds.com.br). The AI crawler counts stay on the site and are read only by SUDS Planner with the site token. The form event goes only to the Google Analytics the site already uses; it sends nothing that visitors typed. The plugin loads the Google Analytics tag (googletagmanager.com) only when the site owner sets a GA4 ID in the settings or the SEO plugin used before (Rank Math or SEOPress) was inserting it, and never when Site Kit, MonsterInsights, ExactMetrics or GTM4WP is active: Google’s privacy policy is at https://policies.google.com/privacy. The daily security check downloads the official checksums of the WordPress version and of each installed plugin from WordPress.org (api.wordpress.org and downloads.wordpress.org), sending only the version numbers and plugin slugs. Terms: https://suds.com.br.

Installation

  1. Upload the zip file in Plugins Add New Upload Plugin and activate it.
  2. In Settings SUDS Planner, paste the token shown in the client’s record in the Planner (the zip downloaded from that record already includes the token).
  3. In the Planner, under Connected accounts WordPress, click Test connection.

FAQ

Is the preview public to anyone?

Only to whoever has the link with the article’s secret code, and only for that article. Unpublished pages stay invisible to the rest of the site and to search engines (noindex, no cache).

Does the plugin publish the article?

No. Scheduled publishing is done by SUDS Planner through the WordPress REST API, using the application password of the user configured there.

Reviews

There are no reviews for this plugin.

Contributors & Developers

“SUDS Planner” is open source software. The following people have contributed to this plugin.

Contributors

Translate “SUDS Planner” into your language.

Interested in development?

Browse the code, check out the SVN repository, or subscribe to the development log by RSS.

Changelog

1.10.1

  • Redirects: SEOPress redirects imported by version 1.9.1 are rebuilt from SEOPress on update. Regex rules match again, “logged out only” and the PRO query parameter settings are kept, and 410/451 and “logged in only” redirects that 1.9.1 left out are imported. Each rule stays in its row, with its hit count; a rule turned off by hand stays off, and a duplicate created by a later import is merged into it. Rules whose SEOPress post no longer exists are left as they are.
  • Redirects: the database update now runs on init instead of plugins_loaded, so it can read post addresses (the 1.9.2 fix for sites in a subfolder needed them too).
  • Sitemap: publishing, unpublishing or a scheduled post going live updates the sitemap at once. A post marked “Index” in a post type that is noindex by default no longer waits up to 12 hours to appear.
  • Sitemap: a post or term marked “Index” in a post type or taxonomy that is noindex by default no longer comes back to the sitemap when its canonical points to another address or Rank Math excluded it from the sitemap.
  • Security check: when there are more than 300 posts or 300 options with suspicious markers, the check says how many it did not read (the result is “incomplete”) instead of ending as if everything had been read.

1.10

  • Redirects: new form in Settings SUDS Planner to add a redirect by hand. “From” is a path or an address of the site (with ?parameters, an exact rule only matches them); “To” is a path of the site or any address, including another domain. Codes 301 (default), 302, 307, 308, 410 and 451 (the last two without a destination); matching is exact (default), starts with, contains, ends with or regex, with $1, $2… taking the groups to the destination.
  • The form refuses an empty origin, the home page as origin, an address of another site, an invalid regex, a destination that falls back into the same rule (directly or through another redirect) and a second active rule with the same origin. It warns when the origin is the address of a published page (the redirect takes precedence over the page), when the destination redirects again, and when the destination is not a published post or page of the site.
  • Redirects list: shows hand-made, automatic and imported redirects, with Edit for hand-made ones, Turn off / Turn on for all, and Delete for hand-made and automatic ones. A redirect turned off by hand stays off when the redirects of Rank Math or SEOPress are imported again or switched on and off. Rows note when an active redirect covers a published page.
  • Every change clears the cached rules, the sitemap’s list of redirected posts and the known page caches, so a cached page does not keep showing instead of the new redirect.

1.9.2

  • SEO: a password-protected post no longer puts anything from its text in the page head. Its meta description, social descriptions, excerpt and custom-field variables, and the product, service or location schema all stay out. The head is the same for every visitor, with or without the password, so no page cache can serve the unlocked version.
  • SEO: canonical URLs keep their percent-encoding (/a%C3%A7%C3%A3o/ was saved as /ao/). Only http and https are accepted.
  • SEO: title and description templates keep their variables when saved (%category% and %date% were being cut to “tegory%” and “te%”).
  • SEO: robots settings inherited from Rank Math and SEOPress keep nosnippet, noarchive, noimageindex and the max-snippet, max-image-preview and max-video-preview limits from the post, the post type or the whole site. A restriction is no longer replaced by unlimited previews.
  • Sitemap: posts whose canonical points to another URL, and posts whose address redirects, are left out. A post marked “Index” inside a post type that is noindex by default is included, and the same goes for terms.
  • Breadcrumb schema is left out when the trail has a single item, such as on the home page.
  • Redirects: the automatic 301 on a site installed in a subfolder no longer repeats the folder (/blog/blog/new). Existing automatic redirects are fixed once on update.
  • Redirects imported from SEOPress keep regex mode with capture groups, login status, query-parameter handling and 410/451 without a destination. Category and term redirects are now imported too. Rules that cannot be imported are listed in the Redirects box instead of being dropped silently.
  • Security: protections are decided one by one. A security plugin that is merely installed, or active without the matching feature turned on, no longer switches off all the plugin’s protections.
  • Security check: the plugin’s own main file is checked too. In uploads/.htaccess only the plugin’s own block is set aside, and other rules are checked. The All-In-One Security folder in uploads only accepts its own firewall files.
  • Security check: links and redirects are compared by host name, so look-alike domains such as site.com.attacker.example count as external.
  • Security check: each step keeps its place file by file and stops on time, and downloads never wait longer than the time left. Two checks cannot run at once. The result tells finished, incomplete or error apart, and lists what could not be examined (missing official checksums, unreadable folders, very large files) instead of skipping it silently.
  • WebP: the CSS copies of page builders get a new file name whenever their content changes, so a revert or a new conversion never leaves a cached page pointing to a deleted image. Replaced copies and the images they use are kept for 7 days before being removed.
  • WebP: a PNG is only marked lossless when the WebP file really is lossless. On servers without lossless support (GD on PHP before 8.1) the PNG is kept as it is.
  • WebP: WebP files left by another converter are never overwritten or deleted, and revert only removes copies the plugin made itself.
  • Draft review: highlighted passages are found across bold text and links, inside the article rather than the menu, and a passage that cannot be found is reported instead of highlighting the wrong text.

1.9.1

  • Security check: no false alarms for empty index.php files that plugins put in their uploads folders, for .htaccess files that turn PHP off (WPForms), for the firewall files of All-In-One Security, and for large libraries such as phpseclib.
  • “Check now” continues a check that is halfway instead of starting over, so sites where WP-Cron does not run can finish it; 20 seconds per call.

1.9

  • Security: comments turned off by default (existing ones kept), failed logins limited per IP, XML-RPC off, user list hidden from visitors, dashboard file editor off, PHP blocked in uploads, basic security headers. The entry protections stay off while another security plugin is active.
  • Automatic updates for plugins (at once) and themes (after 7 days by default).
  • Daily security check against the traces of SEO spam hacks, with a “Check now” button, and a notice in the dashboard when something serious shows up.
  • Form spam blocked without a captcha in Elementor Pro, Contact Form 7, WPForms, Gravity Forms, Fluent Forms and Forminator; blocked submissions do not count as Google Analytics conversions.
  • REST route suds/v1/seguranca for SUDS Planner (site token).

1.8.1

  • Local business per post type: the country comes from a new “Country field” of the post (name or ISO code, e.g. Argentina or AR), then from the calling code of its phone (+54, +595, +598…), then from the fixed country of the post type, and finally from the company’s country in the settings (BR when empty). A business abroad no longer shows up as Brazilian.
  • Locations: new Country field in the Location box, with the same fallbacks (phone calling code, then the company’s country).
  • Phones are formatted as Brazilian numbers (+55-DD-NUMBER) only for businesses in Brazil; a phone with another calling code (+54 343 490-1971) or of a business abroad stays as written.
  • Product and service: new “Price currency” setting per post type (ISO code such as BRL, USD or EUR; BRL when empty). Prices are read in both formats (1.234,56 and 1,234.56), and a price with only a thousands separator (R$ 1.234) is no longer read as 1.23.
  • Settings screen examples are generic, not tied to a client.
  • Locations: a page with Rank Math’s plain Service schema (a specialty or service page, with no address) is no longer taken as a location, so it no longer gets a local business node nor shows up in the organization’s locations. Subtypes such as ProfessionalService still count.

1.8

  • Schema per post type, in Settings SUDS Planner: none (web page only), Product, Service, LocalBusiness (with a subtype), Article, BlogPosting or NewsArticle. By default, the one Rank Math (default rich snippet of the post type) or SEOPress PRO (automatic schema for the post type) used; without them, posts stay BlogPosting and other types web page only.
  • Product: name (template with the title variables), SEO description, featured image and image fields (ACF or custom fields), brand (the company name or another one), the company as manufacturer, category (terms of a taxonomy or a fixed text), model, one additional property per taxonomy of the post type and one per row of an ACF repeater. Offers only when the price field has a price.
  • Service: name, description, images, the company as provider and category as service type.
  • Local business: subtype, address (street fields joined, city, state, postal code, country), city as area served, phone (Brazilian numbers as +55-DD-NUMBER), email, logo, photos, profiles (sameAs), map link, coordinates, opening hours read from a text field (“Segunda a sexta: 8h às 18h”), the company’s network (memberOf) and the service it offers (makesOffer).
  • Optional field that turns the schema off for a post (unchecked or 0), and a field for the description (the SEO description when empty).
  • ItemList of the published posts of a type on its archive page, or on the page with the same address.
  • suds_planner_seo_schema_proprio() tells a site’s own schema plugin what SUDS Planner already outputs, so it can stay quiet.
  • Works with locations (1.7): a page marked as a location in its Location box keeps the location’s local business, and the schema keeps one node per @id. Opening hours fields also accept the Location box format (“seg-sex 08:00-18:00”).
  • WooCommerce products keep WooCommerce’s own schema; the front page stays web page only.
  • Changing these settings clears the known page caches.

1.7.1

  • WebP: a media library item whose file is missing on the server leaves the pending list (shown with an error) instead of being retried forever; the bulk conversion stops when three batches in a row make no progress.

1.7

  • Locations: local business schema for each location page (type, address, phone, opening hours, coordinates, map and profiles), linked to the organization, which lists its locations on the home page. “Location” box in the page editor; inherits the local business schema saved by Rank Math PRO.
  • Rank Math PRO locations (rank_math_locations) keep their pages and addresses when Rank Math is not active.
  • WebP: PNG images that are photos are converted like photos (lossy), which makes them much lighter; logos, graphics with text and screenshots stay lossless.

1.6

  • WebP images: WebP copies of the JPG and PNG images, made from the original upload (lossy for photos, lossless for PNG, the original kept when the WebP is not smaller), served on the site in place of the originals, which stay untouched. Revert deletes the copies.
  • Media WebP (SUDS) screen with the original and the converted image of each upload, Convert and Revert buttons, quality setting and automatic conversion of new uploads.
  • REST /suds/v1/imagens (with the token or an administrator) so SUDS Planner can list, convert and revert.
  • Inherits only from the SEO plugin that was active when SUDS Planner took over (Rank Math or SEOPress): titles, descriptions, robots, canonical, social tags, focus keyword, settings and redirects left behind by an older switch between them no longer show up. Sites that switched on 1.4 or 1.5 are detected by the plugin deactivated last or the one still installed; it can also be set in Settings SUDS Planner.
  • Custom field variables in inherited templates: %customfield(name)% (Rank Math) and %%_cf_name%% (SEOPress).
  • Only one meta description in the page head: when the theme or another plugin prints its own through wp_head, the plugin keeps just its own (the others stay when the plugin has none).
  • Sitemap and robots follow what Rank Math or SEOPress had: post types and taxonomies they left out of the sitemap, taxonomies set to noindex by default, terms set to noindex and Rank Math’s excluded posts and terms lists.
  • Term template variables %%_category_description%%, %%category_description%%, %%tag_title%% and %%tag_description%%.
  • Focus keyword endpoint for SUDS Planner (REST /suds/v1/seo, with the token): lists the published pages with their focus keyword and sets it. While Rank Math or SEOPress is active, it reads and writes their own focus keyword field (as the first keyword, keeping the others).

1.4

  • SEO: title, meta description, canonical, robots, Open Graph, Twitter and schema.org JSON-LD.
  • Takes over from Rank Math or SEOPress using the data they saved (titles, descriptions, templates, focus keyword, robots, canonical, verification codes, Analytics tag, redirects, category base and attachment settings); off while any SEO plugin is active.
  • SEO title and description columns in the posts and pages lists, editable in Quick Edit.
  • Core sitemap without users and noindex posts; old sitemap addresses redirect to it.
  • Redirects table, with automatic 301 when a published post changes address.
  • The Planner token is kept in the settings (also when it came inside the file) and can be set by an administrator through the REST settings endpoint, so updates never lose it.
  • Requires WordPress 5.7 (wp_robots).

1.3

  • AI crawler visits per day and page (REST /suds/v1/bots, with the token) for the SEO report.
  • Google Analytics event formulario_enviado on successful form submissions (can be turned off in the settings).

1.2

  • Scripts and styles of the review bar moved to files and loaded with wp_enqueue_script / wp_enqueue_style.

1.1

  • Preview restricted to the article of the code; review token kept out of the page address; fixed Planner address.

1.0

  • Public draft preview, review bar and client comments mirrored in the editor.