✨ feat: site scoping, DB-backed redirects/logs, SEO Pro import & rename to seo-and-geo

Author: YarnoLapin

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,36 @@
+name: Bug report
+description: Something does not work as documented
+labels: [bug]
+body:
+  - type: textarea
+    id: what-happened
+    attributes:
+      label: What happened
+      description: What you expected, and what happened instead.
+    validations:
+      required: true
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: Steps to reproduce
+      description: The smallest set of steps, or a failing test.
+    validations:
+      required: true
+  - type: input
+    id: versions
+    attributes:
+      label: Versions
+      description: Addon, Statamic and PHP versions.
+      placeholder: "vulpo/seo 1.4.0, Statamic 6.2, PHP 8.4"
+    validations:
+      required: true
+  - type: dropdown
+    id: storage
+    attributes:
+      label: Storage
+      options:
+        - Flat file
+        - Database (statamic/eloquent-driver)
+        - Not sure
+    validations:
+      required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: true
+contact_links:
+  - name: Security issue
+    url: https://github.com/vulpo-be/vulpo-seo/security/policy
+    about: Report vulnerabilities privately by email instead of opening an issue.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,22 @@
+name: Feature request
+description: Suggest something the addon should do
+labels: [enhancement]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: The problem
+      description: What are you trying to achieve, and what stops you today?
+    validations:
+      required: true
+  - type: textarea
+    id: idea
+    attributes:
+      label: What you have in mind
+      description: A rough shape is fine. Mention any addon or spec that does this well.
+  - type: checkboxes
+    id: scope
+    attributes:
+      label: Scope
+      options:
+        - label: This belongs in an SEO addon rather than in a site's own templates

CHANGELOG.md

@@ -1,5 +1,29 @@
 # Changelog
 
+## Unreleased
+
+- The **SEO** entry in the control panel sidebar no longer doubles up: core's own entry for the addon, nested under Tools → Addons, is removed since this addon already links to the same settings screen.
+- Per-site overrides are a collapsible replicator rather than a stacked grid, so a site's seven fields fold away into one row.
+- Migrates from `statamic/seo-pro`: its per-entry `seo` array and its site defaults are translated to this addon's handles and settings, and are read at render time until you migrate. Values pointing at another field (`@seo:content/title`) and values containing Antlers are dropped rather than rendered literally.
+- `php please vulpo:seo:import-redirects file.csv` imports redirects in bulk, with an optional header row, column aliases and a dry run.
+- Every string ships in `lang/en.json`, publishable with the `vulpo-seo-translations` tag, so the addon can be translated.
+- `/sitemap.xml`, `/robots.txt` and `/llms.txt` send `Cache-Control` with `stale-while-revalidate`, built from their `cache_minutes` config.
+- Canonical URLs keep the pagination parameter so page 2 points at itself, and `seo.canonical.trailing_slash` can force a trailing slash on or off.
+- Fixed: entries that only redirect somewhere else (Statamic's `redirect` field, including `redirect: 404`) were listed in the sitemap and llms.txt. Because `absoluteUrl()` returns the destination for such an entry, the sitemap advertised the redirect target as one of the site's own pages.
+- Fixed: a value on a legacy handle was masked by the new field's untouched toggle, which augments to `false` rather than to nothing.
+
+## 1.4.0
+
+- Redirects and the 404 log are scoped to a site. A rule can apply to one site or to all of them, automatic redirects belong to the entry's site, and the same path on two sites no longer overwrites itself. Existing rules keep working: no site means every site.
+- Redirects match query strings, so legacy URLs like `/index.php?id=42` can be redirected. A rule that matched on the query string no longer has it appended to the destination again.
+- The sitemap emits `xhtml:link` hreflang alternates on a multisite install, and turns into a sitemap index once the URLs pass the per-file limit instead of silently dropping the overflow.
+- Open Graph article properties (`article:published_time`, `article:modified_time`, `article:author`) and an optional `twitter:creator`.
+- Structured data gains Product and Event types, plus a raw JSON-LD field for anything the addon does not model. Invalid JSON is ignored rather than breaking the page.
+- The 404 log is searchable and paginated.
+- `view vulpo seo` and `edit vulpo seo` are separate permissions, so a role can be read-only.
+- `php please vulpo:seo:export-to-files` mirrors the import command.
+- Fixed: `routes/web.php` still read the old `vulpo-seo.*` config keys, so the sitemap, robots and llms.txt routes ignored the published config and used their defaults.
+
 ## 1.3.0
 
 - Works with statamic/eloquent-driver. Redirects, the 404 log, the AI crawler log and the URL index move to database tables on a site that keeps its content in the database, and stay in flat files on one that does not. Detection follows the eloquent driver's own configuration and can be overridden with `seo.storage.driver`.

CONTRIBUTING.md

@@ -0,0 +1,34 @@
+# Contributing
+
+Thanks for helping out.
+
+## Getting set up
+
+```bash
+composer install
+vendor/bin/pest
+vendor/bin/pint
+```
+
+The suite runs against flat-file storage by default. To run it against the database driver:
+
+```bash
+VULPO_SEO_STORAGE_DRIVER=eloquent vendor/bin/pest
+```
+
+CI runs both, so a change to storage needs to pass both.
+
+## Pull requests
+
+- One change per pull request.
+- Add a test. Bugs get a test that fails before the fix; features get a test for the behaviour, not the implementation.
+- Run `vendor/bin/pint` before pushing.
+- Note anything user-visible in `CHANGELOG.md` under "Unreleased".
+
+## Reporting a bug
+
+Include the Statamic and PHP version, whether the site uses `statamic/eloquent-driver`, and the smallest reproduction you can manage. A failing test is the fastest possible bug report.
+
+## Adding a schema type or a crawler
+
+New `@type` handling belongs in `src/Seo/Schema.php` with fields in `resources/blueprints/`, and both need a case in `tests/SchemaTest.php`. New AI crawlers are a line in the `ai_crawlers.agents` config; the user agent pattern is matched case-insensitively.

README.md

@@ -10,13 +10,13 @@ It replaces the stack many Statamic sites run today — `alt-design/alt-seo`, `a
 
 **Meta tags** — title, description, canonical, robots, Open Graph, Twitter cards, hreflang and search console verification from one tag. Per-page fields override site-wide defaults, and each site can override the defaults again.
 
-**Sitemap** — `/sitemap.xml`, built from published, routable entries (and optionally taxonomy terms), with per-page "leave out of the sitemap" and collection exclusions. Cached, and flushed when content changes.
+**Sitemap** — `/sitemap.xml`, built from published, routable entries (and optionally taxonomy terms), with per-page "leave out of the sitemap" and collection exclusions. Emits `xhtml:link` hreflang alternates on a multisite install, and becomes a sitemap index (`/sitemap-1.xml`, …) once the URLs no longer fit one file. Cached, and flushed when content changes.
 
-**Redirects** — a CP screen with exact, wildcard and regex rules (301, 302, 410). Redirects are checked only when a URL would otherwise 404, so normal page loads pay nothing. When a page's URL changes — renamed slug, moved in the structure, changed date — a redirect is created automatically, plus a wildcard rule for its children.
+**Redirects** — a CP screen with exact, wildcard and regex rules (301, 302, 410), each scoped to one site or to all of them. Query strings are supported, so legacy `/index.php?id=42` URLs can be matched. Redirects are checked only when a URL would otherwise 404, so normal page loads pay nothing. When a page's URL changes — renamed slug, moved in the structure, changed date — a redirect is created automatically for that site, plus a wildcard rule for its children.
 
-**404 log** — every miss is logged with hit counts and referrer, and can be turned into a redirect in one click.
+**404 log** — every miss is logged per site with hit counts and referrer, searchable and paginated, and can be turned into a redirect in one click.
 
-**Structured data (JSON-LD)** — Organization or LocalBusiness, WebSite, BreadcrumbList, and a per-page FAQ, Article, Service or Person node. Coordinates are geocoded from the address for free through OpenStreetMap and cached.
+**Structured data (JSON-LD)** — Organization or LocalBusiness, WebSite, BreadcrumbList, and a per-page FAQ, Article, Service, Person, Product or Event node, plus a raw JSON-LD field for anything else. Coordinates are geocoded from the address for free through OpenStreetMap and cached.
 
 **llms.txt** — `/llms.txt` describing the site and its pages for AI assistants, with an editable summary.
 
@@ -79,7 +79,7 @@ In Blade:
 {!! Statamic::tag('vulpo_seo') !!}
 ```
 
-## Migrating from alt-seo, alt-sitemap, alt-redirects or vulpo/geo
+## Migrating from SEO Pro, alt-seo, alt-sitemap, alt-redirects or vulpo/geo
 
 ```bash
 php please vulpo:seo:migrate --dry-run   # see what would change
@@ -88,9 +88,20 @@ php please vulpo:seo:migrate
 
 The command renames legacy field handles on every entry and term (`alt_seo_meta_title` → `seo_title`, `geo_faqs` → `seo_schema_faqs`, …), copies the old global settings into the addon settings, and imports any redirects it finds.
 
-Until you run it, legacy handles are still read at render time, so nothing breaks the moment you swap addons. Set `legacy_fallbacks` to `false` in the config once you have migrated.
+SEO Pro keeps everything in one `seo` array per entry, so it is translated rather than renamed: `title`, `description`, `canonical_url`, `image`, `robots_indexing`/`robots_following`, `sitemap`, `priority`, `change_frequency` and `json_ld_schema` all find a home, and its site defaults are read from `resources/addons/seo-pro.yaml`. Two things do not travel, because they would render literally in a meta tag: values pointing at another field (`@seo:content/title`) and values containing Antlers. The `seo` array itself is left in place, so SEO Pro keeps working if you have not removed it yet.
 
-Replace `{{ alt_seo:meta }}` and `{{ structured_data }}` in your layout with `{{ vulpo_seo }}`, then remove the old addons from `composer.json`.
+Until you run it, legacy handles — including SEO Pro's `seo` array — are still read at render time, so nothing breaks the moment you swap addons. Set `legacy_fallbacks` to `false` in the config once you have migrated.
+
+Replace `{{ alt_seo:meta }}`, `{{ seo_pro:meta }}` and `{{ structured_data }}` in your layout with `{{ vulpo_seo }}`, then remove the old addons from `composer.json`.
+
+### Bulk redirects from a CSV
+
+```bash
+php please vulpo:seo:import-redirects redirects.csv --dry-run
+php please vulpo:seo:import-redirects redirects.csv
+```
+
+Columns are `from,to,status,site`; a header row is optional and `source`/`destination`/`code` are accepted as aliases. A `*` in the source path makes it a wildcard rule. Rows missing a source or destination are skipped and counted rather than failing the import.
 
 ## Configuration
 
@@ -116,6 +127,7 @@ Published blueprints in `resources/blueprints/vendor/vulpo-seo/` win over the ad
 | `seo_canonical`, `seo_noindex`, `seo_nofollow` | Indexing |
 | `seo_sitemap_exclude` | Leave the page out of the sitemap |
 | `seo_schema_type` + `seo_schema_*` | Per-page structured data |
+| `seo_schema_custom` | Raw JSON-LD, merged in as its own node |
 | `seo_preview` | The live Google and social preview (stores nothing) |
 
 ## Where data lives
@@ -154,6 +166,8 @@ php please vulpo:seo:import-to-database   # optional, brings existing flat file
 php please statamic:eloquent:import-addon-settings  # Statamic's own, for the settings
 ```
 
+Going the other way, `php please vulpo:seo:export-to-files` writes the database rows back out as YAML.
+
 `import-to-database` leaves the flat files alone, so switching back is a config
 change. Re-running it updates rather than duplicating.
 
@@ -183,8 +197,29 @@ the same block.
 - Automatic redirects react to entry saves. Statamic rewrites child URLs without saving each child, which is why a parent change also adds a `parent/*` wildcard rule.
 - Control panel screens use Statamic's own UI components. Every export of the CP's `@ui` package is registered globally as a `ui-<kebab-name>` Vue component, and the CP compiles a Blade view's output as an in-DOM template, so `<ui-card-panel>`, `<ui-table>` and friends work straight from Blade and the screens match the CP. Two things not to try instead: a `<style>` block in a CP view (the Vue app drops it) and Tailwind variants the CP bundle never compiled (`sm:grid-cols-2` and the like are absent, plain utilities are fine).
 - The config file is `config/seo.php`, not `config/vulpo-seo.php`. Statamic derives an addon's slug from the package name, and a custom `extra.statamic.slug` breaks core's settings lookup: settings are written to `resources/addons/{slug}.yaml` but read from `resources/addons/{package-name}.yaml`.
+- Canonical URLs drop the query string, except the pagination parameter (`?page=2` points at itself, so page 2 is not read as a duplicate of page 1). `seo.canonical.trailing_slash` forces a trailing slash on or off; null leaves URLs alone.
+- Entries that only redirect — Statamic's `redirect` field, including `redirect: 404` — are left out of the sitemap and llms.txt. Their `absoluteUrl()` returns the destination, so listing them would advertise another page's URL as one of yours.
+- `/sitemap.xml`, `/robots.txt` and `/llms.txt` send `Cache-Control` built from their `cache_minutes` config, with `stale-while-revalidate` so a CDN never makes a crawler wait for a rebuild. Setting `cache_minutes` to 0 sends `no-store`.
+- The redirects screen is a grid holding every rule at once. It is comfortable into the hundreds; past that, edit `content/vulpo-seo/redirects.yaml` (or the table) directly and use the CSV import for bulk work.
 - Geocoding uses OpenStreetMap Nominatim, whose usage policy requires a descriptive User-Agent; set `VULPO_SEO_GEOCODER_USER_AGENT` for production.
 
+## Translations
+
+Every string the addon renders goes through `__()`, and English lives in `lang/en.json`. To translate it, publish that file and drop your own locale next to it:
+
+```bash
+php artisan vendor:publish --tag=vulpo-seo-translations
+```
+
+## Permissions
+
+| Permission | Allows |
+| --- | --- |
+| `view vulpo seo` | Opening the settings, redirects, 404 log and crawler screens |
+| `edit vulpo seo` | Saving redirects, dismissing 404s, clearing logs |
+
+A role with only the view permission sees the data and no write controls.
+
 ## Extending
 
 The preview field is a normal fieldtype, so you can move it, drop it, or add it to a blueprint of your own by publishing the blueprints and editing them.

SECURITY.md

@@ -0,0 +1,15 @@
+# Security Policy
+
+## Supported versions
+
+The latest minor release receives security fixes.
+
+## Reporting a vulnerability
+
+Email **security@vulpo.be** rather than opening a public issue. Include the affected version, what an attacker can do, and a reproduction if you have one. You will get an acknowledgement within three working days.
+
+Please do not test against sites you do not own.
+
+## Scope notes
+
+The addon serves public text routes (`/robots.txt`, `/llms.txt`, `/sitemap.xml`) built from control panel settings, and logs 404s and AI crawler visits including the requesting path and referer. Reports about data reachable through those routes, about the control panel screens honouring the `view`/`edit vulpo seo` permissions, or about redirect rules being used to reach somewhere unintended are all in scope.

composer.json

@@ -1,5 +1,5 @@
 {
-    "name": "vulpo/seo",
+    "name": "vulpo/seo-and-geo",
     "description": "All-in-one SEO toolkit for Statamic: meta tags, sitemap, redirects, structured data, robots.txt and llms.txt.",
     "type": "statamic-addon",
     "license": "MIT",
@@ -12,7 +12,7 @@
         "json-ld",
         "llms-txt"
     ],
-    "homepage": "https://github.com/vulpo-be/vulpo-seo",
+    "homepage": "https://github.com/vulpoweb/statamic-seo-and-geo",
     "authors": [
         {
             "name": "Vulpo",
@@ -21,8 +21,8 @@
         }
     ],
     "support": {
-        "issues": "https://github.com/vulpo-be/vulpo-seo/issues",
-        "source": "https://github.com/vulpo-be/vulpo-seo"
+        "issues": "https://github.com/vulpoweb/statamic-seo-and-geo/issues",
+        "source": "https://github.com/vulpoweb/statamic-seo-and-geo"
     },
     "require": {
         "php": "^8.3",
@@ -51,7 +51,7 @@
     },
     "extra": {
         "statamic": {
-            "name": "Vulpo SEO",
+            "name": "SEO & GEO",
             "description": "Meta tags, sitemap, redirects, structured data, robots.txt and llms.txt in one addon."
         },
         "laravel": {

config/seo.php

@@ -91,6 +91,26 @@
         'uri_ledger_path' => 'vulpo-seo/uris.yaml',
     ],
 
+    /*
+    |--------------------------------------------------------------------------
+    | Canonical URLs
+    |--------------------------------------------------------------------------
+    |
+    | A page's canonical URL is its own address without the query string, so
+    | tracking parameters never split a page in two. Pagination is the exception:
+    | page 2 should point at itself, not at page 1, or its content looks like a
+    | duplicate of the first page and drops out of the index.
+    |
+    | "trailing_slash" can force a trailing slash on or off, so a site served
+    | both ways still advertises one address. Null leaves the URL as it is.
+    |
+    */
+
+    'canonical' => [
+        'pagination_query' => 'page',
+        'trailing_slash' => null,
+    ],
+
     /*
     |--------------------------------------------------------------------------
     | robots.txt
@@ -105,6 +125,7 @@
     'robots' => [
         'enabled' => true,
         'route' => 'robots.txt',
+        'cache_minutes' => 60,
     ],
 
     /*

database/migrations/2026_08_18_100000_add_site_to_vulpo_seo_tables.php

@@ -0,0 +1,49 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+/**
+ * Scopes redirects and the 404 log to a site, so a rule for one site does not
+ * fire on the others. Null means "every site", which is what a single-site
+ * install keeps using.
+ */
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table($this->table('redirects'), function (Blueprint $table) {
+            $table->string('site')->nullable()->after('from_path');
+            $table->index(['from_path', 'site']);
+        });
+
+        Schema::table($this->table('not_found'), function (Blueprint $table) {
+            $table->string('site')->nullable()->after('path');
+        });
+
+        Schema::table($this->table('not_found'), function (Blueprint $table) {
+            $table->dropUnique(['path']);
+            $table->unique(['path', 'site']);
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table($this->table('not_found'), function (Blueprint $table) {
+            $table->dropUnique(['path', 'site']);
+            $table->unique(['path']);
+            $table->dropColumn('site');
+        });
+
+        Schema::table($this->table('redirects'), function (Blueprint $table) {
+            $table->dropIndex(['from_path', 'site']);
+            $table->dropColumn('site');
+        });
+    }
+
+    private function table(string $set): string
+    {
+        return (string) config("seo.storage.tables.{$set}", 'vulpo_seo_'.$set);
+    }
+};