📥 Hello, and greetings from the Central Office!
One of our commitments is sharing not only what went well, but also what we're still working on.
What We're Focused On Next
While June included significant security and product wins, a few important items remain in progress.
We're actively working on a PHP 8.1+ compatibility issue affecting some WordPress admin dashboards, collaborating with Stripe to resolve payment blocks that impacted certain renewals, continuing WordPress coding standards improvements across remaining extensions, and preparing upcoming releases for Passwordless Authentication and Contact Forms integrations.
Thank you for trusting us to protect and power your WordPress sites. We look forward to sharing more progress next month.
🎥 Did you know we have a YouTube channel focused on WordPress security?
We share step-by-step tutorials on how to secure your site and protect your content.
⚡️ Watch our latest video:
3 Ways to Protect WordPress Content
👉 Explore the full channel:
youtube/@wpdefenselab
Don’t miss the next one 🚀
Welcome to WP Defense Lab — your weekly brief on the WordPress news that impacts your business.
This week: publishers are adopting llms.txt files and AI crawler bans at record rates, but the traffic data shows most of those defenses barely register with the platforms that actually decide who gets seen.
In WP Radar: why Google won't index commodity pages, why critical WordPress updates can't wait, Yoast's latest AI metadata tools, and why single-use content quietly drains your output.
The AI Blocking Boom Isn't Working.
New traffic data suggests llms.txt files and robots.txt bans rarely change who gets seen or who gets blocked.
AI agent traffic grew 45% quarter over quarter in early 2026, reaching 17.7 billion requests across April through June. June alone accounted for 6.6 billion requests.
At the same time, automated traffic now makes up 57.4% of all web requests, compared with 42.6% from humans. Publishers responded by building defenses. The evidence suggests those defenses rarely change the outcome.
The Files Nobody Reads
Adoption of llms.txt, a markdown standard designed to give AI agents clean access to site content, grew 8.8x in a year. Usage climbed from 4,088 files in June 2025 to 36,120 by May 2026 across 3 million analyzed websites.
The catch is that 97% of those files received zero requests during the month. Publishers are rapidly adopting a standard that most AI agents never appear to read.
The Bans That Don't Ban
Blocking follows the same pattern. Among nearly 11,000 news domains, 56.4% now block at least one AI crawler through robots.txt, compared with just 10.3% across the broader web.
GPTBot alone is blocked by 50.5% of publishers. Yet live testing found that 39.5% of sites declaring a GPTBot ban still served the crawler the page. The lock exists. The door still opens.
Who The System Actually Rewards
Technical defenses do little if your site never earns visibility in the first place.
Across 2,000 companies, the median brand appeared in just 16% of relevant AI answers and received a linked citation only 6% of the time. Top-performing organizations earned 2x more mentions, 60% more citations, and 80% more share of voice.
Meanwhile, Meta's AI crawlers grew faster than any others measured. Training crawler traffic increased 74%, while its RAG crawler grew 163% quarter over quarter.
The Referral Trickle That Remains
One crawler is becoming increasingly important.
ChatGPT-User, which retrieves live pages for real-time answers, visited sites 6% less often than the previous quarter. Yet human click-throughs from ChatGPT increased 17%.
Today, ChatGPT generates more than 80% of all AI referral traffic. For many publishers, the AI referral economy has effectively become a single platform.
None of this means the compliance work is pointless. It means compliance is often mistaken for control.
An llms.txt file signals intent. A robots.txt ban signals preference. Neither changes how Google, Meta, or OpenAI allocate crawl budgets, training pipelines, or citation opportunities.
If you run a WordPress site, the better question isn't whether to add another access-control file. It's whether the handful of agents that still send readers are worth cultivating, and whether everything else is worth the server load.
Which of your "AI visibility" tools are actually changing traffic, and which ones are just paperwork for a decision you don't get to make?
Slack replies in seconds. Not minutes.
Dictate into Slack, email, LinkedIn, or any app and get polished, send-ready text. Wispr Flow strips filler and formats everything. 89% of messages sent with zero edits. Works on Mac, Windows, and iPhone.
WP RADAR
This week in WP Radar: Google raises the bar for indexed content, attackers exploit critical WordPress flaws within hours of disclosure, Yoast adds AI-powered metadata drafting, and one habit change stops your best content from disappearing after a single post.
Why Google Won't Index Your Commodity Pages. Pages stuck in "Crawled, currently not indexed" in Google Search Console usually have one thing in common: rehashed content that adds nothing new. Google says AI has lowered the barrier to publishing, raising the standard for what earns an index. For WordPress site owners, that means auditing thin category pages, tag archives, and AI-assisted content, not just individual posts. If your CMS can generate it automatically, Google may not see it as worth indexing.
Attackers Waste No Time Exploiting Critical WordPress Flaws. Within hours of security updates becoming public, attackers began exploiting two newly patched WordPress core vulnerabilities. Chained together, the flaws allow unauthenticated remote code execution, giving attackers complete control of affected sites. For WordPress owners, it's a reminder that delaying critical updates by even a day can be the difference between staying secure and getting compromised.
Yoast's Bulk Editor Now Drafts Metadata With AI. Yoast SEO Premium's Bulk Editor now generates AI-drafted titles and descriptions, adds focus key phrases and status filters, and separates content by type. WooCommerce stores get the same AI drafting for products and categories, and nothing publishes without manual approval. For WordPress sites managing hundreds of pages, it turns metadata updates from a multi-week project into an afternoon.
Stop Publishing Content That Dies After One Use. Creator Science calls it "single-serving effort": a LinkedIn post, podcast episode, or essay that never gets repurposed beyond its original platform. Each takes real work but creates little long-term value. The better approach is treating every piece of content as source material for your WordPress site, where it can compound through search, internal links, and future updates instead of disappearing after a single post.
AI Overviews Now Appear in 68% of Local Searches
AI Overviews now appear in 68% of local searches, compared to 39% for Google's traditional local pack. As AI increasingly answers local questions directly, businesses have fewer opportunities to earn clicks through conventional rankings.
Rather than optimizing only for keywords, focus on building location pages that demonstrate firsthand expertise, answer common customer questions, and reinforce consistent business information across the web. The shift is another reminder that AI visibility depends on becoming a trusted source, not simply ranking first.
That’s all for this week!
Michael - Operator @WP Folio - now WP Defense Lab. Same Plugins. Different Name.