DB SEO Manager

GDPR-first SEO plugin for WordPress. No external services, no telemetry, no nag screens. Analytics scripts only load after explicit consent.

Most SEO plugins are bloated with upsells and quietly ship third-party trackers. This one ships nothing you didn't ask for.

Features

SEO core

• On-page SEO — meta titles, descriptions, robots directives, canonical URLs, OpenGraph, Twitter Cards
• Schema.org JSON-LD — unified @graph with WebSite, Organization/Person, WebPage, Article, BreadcrumbList
• XML sitemap — extended index + per-type/taxonomy sub-sitemaps with image extension, paginated at 1000 URLs/file, transient-cached
• Virtual robots.txt — editable rules with automatic sitemap reference
• Redirect manager — 301/302/307/410, regex support with capture groups, anonymous aggregated hit counters (no IP, no user-agent), optional zero-counting mode
• Anonymous 404 monitor — URL + count + last_seen only. No IP. No user-agent. Auto-cleanup via WP-Cron.
• Breadcrumbs — accessible <nav> markup, shortcode, Gutenberg block, template tag, JSON-LD BreadcrumbList
• Content analyzer — word count, heading structure, link analysis, image alt audit, focus keyword density, readability (Gulpease for Italian, Flesch for English) — runs entirely on your server, no external API
• Live SERP preview — real-time Google-style preview in the post editor with character counters
• IndexNow — server-to-server URL submission to Bing/Yandex on publish/update. No user data involved.
• Importer — batch migration from Yoast SEO, Rank Math, All in One SEO with preserve/replace modes
• Term SEO — per-term title, meta description, canonical and noindex for categories, tags and custom taxonomies
• Hreflang — manual per-post language alternates with automatic self-reference, plus a filter for Polylang/WPML integration
• Duplicate content report — site-wide detection of duplicate SEO titles, meta descriptions and post titles
• FAQ & HowTo schema — [dbseo_faq] / [dbseo_howto] shortcodes with accessible markup and automatic JSON-LD
• Redirect CSV import/export — bulk migration of redirect rules, inline rule editing, one-click redirect creation from the 404 log
• GitHub auto-updates — receive updates in the WordPress admin like any wp.org plugin

GDPR & privacy

• Consent-gated analytics — GA4, GTM, Matomo, Plausible, Umami, Meta Pixel. All scripts require explicit consent.
• WP Consent API full registration — declares plugin, services, and per-cookie metadata to compatible consent managers (Complianz, Real Cookie Banner, GDPR Cookie Compliance). Falls back to direct cookie detection for DB Cookie Manager, Cookiebot, Complianz.
• Google Consent Mode v2 — emits denied defaults as the first script on the page when GA4/GTM is enabled
• Hard Privacy mode — global toggle that suppresses all external integrations and applies anti-fingerprinting hardening: emoji script strip, oEmbed strip, DNS prefetch strip, Gravatar replacement with inline SVG, optional Google Fonts strip, XML-RPC disable, REST users endpoint protection
• Third-party audit — on-demand homepage scan that identifies external resources by category (analytics, advertising, fonts, embeds, captchas, CDNs) and consent requirement, against a catalog of 30+ known hosts
• Scheduled audit with alerts — weekly automatic scan with email notification when a new external host appears (privacy regression monitoring; one alert per host)
• AI crawler control — selectively block known AI crawlers (GPTBot, ClaudeBot, Google-Extended, PerplexityBot, CCBot, Bytespider and more) via robots.txt; nothing blocked by default
• llms.txt — optional virtual llms.txt (llmstxt.org spec) with site info, key pages and custom Markdown
• GDPR status dashboard — synthetic 0-100 score with breakdown of contributing factors and live module status
• Auto-generated privacy register — dynamic list of active technical processings with legal basis, retention, extra-EU transfer notes
• Register export — JSON for compliance tooling, print-ready HTML for browser-native PDF (no embedded library)
• WP Privacy Tools integration — exporter and eraser for user-attached SEO meta (GDPR Art. 15 & 17)

Privacy by Design

This plugin's defaults are deliberately conservative:

• All external integrations (analytics, pixels, IndexNow) are off out of the box
• The 404 monitor never logs IP addresses or user-agents
• The redirect log only stores aggregated hit counters — and can be switched to zero-counting if even aggregates are unwanted
• No phone-home for licensing or telemetry — updates pull from GitHub Releases only
• No Google Fonts, no remote CDN for core functionality, no avatar fetching from the plugin itself
• Uninstall removes all stored data (tables, options, post meta, transients)

The "Privacy SEO" admin page generates a real-time register of active technical processings with suggested legal basis, retention period, and extra-EU transfer notes — ready to copy into your privacy policy or export as JSON / print-ready HTML.

For sites that want to go further, the Hard Privacy mode acts as a global kill-switch for external integrations and adds optional anti-fingerprinting hardening (emoji script strip, oEmbed removal, DNS prefetch filtering, Gravatar replacement, XML-RPC disable, REST users protection). It is opt-in and modular — every sub-option can be turned on or off independently.

The GDPR status dashboard (Stato GDPR) gives a synthetic 0-100 score and a third-party audit that scans the site's homepage to identify which external resources are actually being loaded by the theme, other plugins, or content embeds — independent of what this plugin manages.

Installation

1. Download the latest release ZIP from Releases
2. In WordPress, go to Plugins → Add New → Upload Plugin
3. Upload the ZIP file and click Install Now
4. Activate the plugin

The plugin auto-updates from GitHub — you'll receive update notifications directly in your WordPress dashboard.

Requirements

• WordPress 5.8+
• PHP 7.4+

Tech Stack

PHP JavaScript WordPress API WP-Cron Schema.org JSON-LD IndexNow protocol Google Consent Mode v2

How It Works

The plugin is built around a single bootstrap singleton (DBSEO_Core) that lazy-loads modules from inc/. Each module is independent and can be deactivated via settings without breaking the others.

The frontend output (<head> tags, JSON-LD, sitemap) is fully server-rendered with zero external HTTP calls for core functionality. Analytics scripts pass through DBSEO_Consent_Gate, which evaluates consent in this order: dbseo_consent_granted filter → WP Consent API → DB Cookie Manager cookie → Cookiebot/Complianz cookies → default DENIED.

The sitemap uses transient caching with automatic invalidation on save_post/edited_term. The 404 monitor and redirect logger use INSERT ... ON DUPLICATE KEY UPDATE with hash-based primary keys for O(1) lookups and atomic increments.

Configuration

The admin UI is split into 13 tabs under DB SEO in the sidebar:

Each post/page/CPT also gets a metabox with four tabs (General, Advanced, Social, Analysis) including live SERP preview and on-demand content analysis.

Integration with DB Cookie Manager

When DB Cookie Manager 3.0.2+ is installed alongside SEO Manager, the two plugins automatically wire together — no configuration needed. The integration follows a producer-consumer pattern: the Cookie Manager produces consent and cookie scan data, the SEO Manager consumes them.

What you get out of the box:

• The consent gate uses the Cookie Manager as authoritative consent source via DBCM_Consent_API::has_consent(), with WP Consent API as the primary path when installed.
• The JS consent listener propagates user choices to Google Consent Mode v2 in real time via gtag('consent','update', ...).
• The Cookie Manager declares its own three processing activities (consent collection, consent log, cookie scanner) into the SEO Manager's privacy register via the dbseo_processing_register filter. They appear in Privacy SEO with a "🔌 Plugin esterno" badge.
• The audit page enriches each external host finding with the cookies actually observed by the Cookie Manager scanner, shown in a "🍪 Cookie scritti" column.
• The GDPR Status dashboard recognizes the Cookie Manager and awards a +5 bonus, plus a −15 penalty if external integrations are active without any consent manager at all.

Without the Cookie Manager, none of this is broken: the consent gate falls back to Cookiebot/Complianz detection, the audit table omits the cookie column, and the privacy register shows only the SEO Manager's own activities.

Public Filters & Actions

// Filter the generated meta title
add_filter( 'dbseo_meta_title', function( $title, $meta ) {
    return $title;
}, 10, 2 );

// Force consent for a specific service (e.g., from your custom consent system)
add_filter( 'dbseo_consent_granted', function( $default, $service, $category ) {
    return my_custom_consent_check( $category );
}, 10, 3 );

// Add custom JSON-LD nodes
add_filter( 'dbseo_schema_data', function( $graph, $context ) {
    if ( $context['is_singular'] && get_post_type() === 'product' ) {
        $graph[] = array( '@type' => 'Product', /* ... */ );
    }
    return $graph;
}, 10, 2 );

// Hreflang for multilingual setups
add_filter( 'dbseo_hreflang_alternatives', function( $alts, $meta ) {
    return array( 'en' => 'https://example.com/en/page' );
}, 10, 2 );

// Declare your plugin's own processing activities into the SEO Manager's
// privacy register (DB ecosystem pattern, used by DB Cookie Manager 3.0.1+).
add_filter( 'dbseo_processing_register', function( $register ) {
    $register[] = array(
        'id'             => 'myplugin_form_submissions',
        'label'          => __( 'Form submissions', 'myplugin' ),
        'status'         => 'active',
        'purpose'        => __( 'Save contact form data.', 'myplugin' ),
        'legal_basis'    => __( 'Consent (GDPR art. 7).', 'myplugin' ),
        'data_collected' => __( 'Name, email, message.', 'myplugin' ),
        'retention'      => __( '365 days, then deletion.', 'myplugin' ),
        'transfers'      => __( 'None.', 'myplugin' ),
    );
    return $register;
} );

// Customize the WP Consent API → Google Consent Mode v2 signal map (1.2.0+)
add_filter( 'dbseo_consent_mode_signal_map', function( $map ) {
    $map['statistics-anonymous'] = array( 'analytics_storage' );
    return $map;
} );

Other filters: dbseo_canonical_url, dbseo_robots_directives, dbseo_sitemap_post_types, dbseo_sitemap_exclude_ids, dbseo_breadcrumb_items, dbseo_404_should_ignore, dbseo_consent_mode_defaults, dbseo_consent_mode_signal_map, dbseo_processing_register.

Actions: dbseo_redirect_before, dbseo_redirect_after, dbseo_404_logged, dbseo_meta_saved, dbseo_indexnow_flushed.

JS events on document:

• dbseo:consent_updated — re-emitted after consent propagation. Detail: { type, consent, signals }.

Shortcodes & Blocks

[dbseo_breadcrumbs separator="/" class="my-class"]

Or in your theme:

<?php if ( function_exists( 'dbseo_breadcrumbs' ) ) dbseo_breadcrumbs(); ?>

Or in the block editor: DB SEO → Breadcrumbs.

Changelog

1.3.0 — Privacy moved to DB Privacy Hub (2026) ⚠️ Breaking change

The privacy register and the unified processing UI have been extracted into a dedicated plugin: DB Privacy Hub. This plugin focuses on its core responsibility (SEO).

Migration:

• The "Privacy SEO" admin page has been removed (now: Privacy → Registro trattamenti in DB Privacy Hub)
• The legacy filter dbseo_processing_register is no longer emitted by SEO Manager but DB Privacy Hub still listens to it for retro-compat with third-party plugins
• The class DBSEO_Privacy has been removed
• WP Privacy Tools integration retained: the exporter and eraser for SEO post meta (15 keys: _dbseo_title, _dbseo_description, OpenGraph, Twitter, robots, focus keyword, score, cornerstone, schema type) live in the new isolated module DBSEO_WP_Privacy_Tools. They register through DB Privacy Hub's dbph_user_data_exporters / dbph_user_data_erasers filters when the Hub is installed, and fall back to the WordPress core filters when standalone — no loss of GDPR compliance either way.
• Existing dashboards/cards referencing "Privacy SEO" have been removed
• An admin notice suggests installing DB Privacy Hub on first load after upgrade

What's NOT removed: the Hard Privacy page and the Stato GDPR page — both belong to SEO concerns (anti-fingerprinting, third-party audit) and stay where they are.