Crater Stack: Four In-House Plugins That Fix What Breaks on Global Sites

Bottom line first: The problem with global sites isn’t a “missing feature” — it’s “information breaking down across systems”— translation and SEO live apart, forms and attribution don’t talk, security rules block AI crawlers along with everyone else, and content assets can’t be loaded into the site in bulk.Crater Stack patches each broken link with four in-house plugins, plus CraterHub for centralized licensing and updates.

1. The Four Breaks on Global Sites

When we audit client sites, what keeps coming up isn’t a “missing feature” but the same information scattered across three or four places, out of sync with each other. The four most common breaks:

Break	Performance	Real cost
Language break	Translation plugins handle translation only, not hreflang or multilingual URLs	Translation is done, but nobody can find it in the target language
Lead break	Form plugins, analytics tools and CRM each run on their own	Inquiries come in, but you don’t know from where, so you can’t optimize
Security break	Either you’re wide open, or a security plugin blocks everything	AI crawlers get blocked by mistake, and the GEO channel goes dead
Content break	Content assets (technical docs, case studies) can’t enter the site in bulk	The content team’s budget goes to manual copy-paste

What all four breaks share: each step looks fine on its own, but put them together and things fall apart.

Take the language break: the translation feature itself works well, but it doesn’t connect to the SEO layer, so it generates German pages with no matching hreflang or German URL —the page exists, but search engines don’t know it does.

So the stack isn’t designed to “pile on features” but to connect every link end to end.

2. LinguaSEO: The Language Layer

The break it fixes: Translation and SEO kept separate.

Core capability

Capabilities	Specific content	What it solves
Automatic translation	Content Translation + Language Switching	Make it readable for your customers
Multilingual URLs	A separate URL structure for each language	Get your pages found in the target language
Automatic hreflang generation	Automatically outputs reciprocal links + x-default	Solves “multilingual sites flagged as duplicate content”
Multilingual sitemaps	A separate sitemap for each language	Let search engines fully discover every language version
Translation status management	Mark as untranslated / translated / needs update	Avoid “the specs were updated but the German page is still old”
Admin menu control	Hide and reorder items in the left-hand admin menu	Give your customers a cleaner admin interface

Design philosophy

“Translation is SEO”— Translation and SEO aren’t two steps; they’re two outputs of the same action. Every page you translate also produces: target-language content, a dedicated URL, hreflang tags, and a sitemap entry.All four must come from the same operation, or one of them will inevitably be missed.

What it doesn’t do

Not included	Why
No human translation service	The plugin handles the engineering pipeline; translation quality is up to the translator or the client
No rewriting of product specs	Specs are facts; the plugin doesn’t generate or modify facts
No forced glossary replacement	Terminology consistency comes from the translator following the glossary, not from automatic replacement (which causes false matches)

3. crater LeadPulse: Lead Layer

The break it fixes: Forms, tracking, and attribution each run on their own.

Three core modules

Modules	Features	Key design decisions
Form conversion	22 field types, including international phone codes, IM contact details, and multiple currencies	Conditional display, multi-column widths, field-level validation
Button conversion	Impressions / clicks / conversion rate stats + click details	Not limited to forms — any CTA can be tracked
Traffic stats	Daily UV/PV, 7/14/30-day trends, top 100 core pages	Humans and crawlers counted separately

Three design decisions worth explaining

① Every conversion carries 26 data points on source and device.

Including channel, visit environment, country/region, device type, Click ID, and more. The goal is clear:give you a basis for judging whether a lead is worth pursuing, not just “we got a lead.”

② AI crawler detection (50+ crawlers, in 5 categories).

Crawlers don’t execute JavaScript, so they’re collected via server-side hooks and counted separately from human visitors. Among them,the activity of AI crawlers (GPTBot, ClaudeBot, PerplexityBot, etc.) is a leading signal for GEO— as we discussed in another article, being read is the prerequisite; being cited is the result.

③ Attribution follows the “comparable” principle.

First Touch is only recorded when a real referrer is present (direct visits don’t take the first-touch slot)
Last Touch overwrites every time; the default model is last_non_direct
12 Click IDs stored separately, retained for 90 days
Same-domain referrers excluded
WeChat stored as a “visit environment” dimension, orthogonal to “channel”

What it doesn’t do

Not included	Why
No email notification service	Notifications and SMTP are handled by the client or a third party (to avoid conflicts with the client’s existing systems)
We don’t judge lead quality for the client	We only provide the data; judging and following up is up to the client’s business team
No visitor-level personal profiling	Statistics and attribution only, no personal profiles (compliance)

4. CraterGuard: The Security Layer

The break it fixes: Security policies and business channels conflict with each other.

Core capability

Capabilities	Content
Security baseline hardening	Login protection, file permissions, closing off common vulnerability surfaces
REST API management	Locked by default (returns 401`cg_rest_locked`), opened on demand when needed
Abnormal access protection	Detects high-frequency requests, unusual user agents, and scanning behavior
Security audit and remediation	Provides scanning and remediation workflows, with minimal calls using domain + credentials

One key stance: no “blanket blocking”

The most common side effect of security plugins is blocking AI crawlers and search engine crawlers alike. In a GEO context this is fatal:the site’s GEO channel is shut down by its own security policy, and nobody knows.

So CraterGuard’s design principle is tiered access:

Type	Policy
Search engine crawlers (Googlebot / Bingbot)	Allow (and verify authenticity)
AI retrieval crawlers	allowing(GEO channel)
AI training crawlers	May allow (per policy)
Scanning / attack behavior	Block

Division of labor with robots.txt: robots.txt is a “declaration” (telling crawlers not to come); CraterGuard is “enforcement” (actually blocking or allowing at the application layer).The two must be consistent— if robots.txt allows GPTBot but CraterGuard blocks it at the application layer, that allowance is meaningless. This is one of the most commonly found configuration conflicts in audits.

5. CraterInflux: The Content Intake Layer

The break it fixes: Content assets can’t enter the site safely and in bulk.

Three-stage design

Stage	What we do	Why it’s designed this way
① Dry run	Parses the package and gives you numbers (will add / update / skip / conflict)	Nothing is written to the database; see exactly what will happen first
② Preview	Light preview (no database write, only verifies body rendering) / full preview (writes a temporary draft, auto-cleaned after 30 minutes)	Lets authors actually see the page before publishing
③ Publish	Writes to the database and outputs a URL list (copyable as plain links / Markdown / CSV)	After publishing, you can verify and distribute

Package format and idempotency

Item	Design
Package structure	`manifest.json`(root directory) +`content/*.html`+`media/`
Body format	HTML fragments (no front-matter)
Idempotency key	`pack_id`+`external_id`(Not inferred from title or slug)
Categories and tags	Auto-created if they don’t exist, or ignored per configuration
Media	Bitmaps go to the media library;SVG is embedded by default, with zero upload risk

Why can’t the idempotency key use the title or slug? Because if a title changes by one character or a slug is manually adjusted once, guessing will create duplicate content that is extremely hard to clean up afterward.Only by using an identifier that is “stable on the source side” as the key can repeated imports be safe.

Secure defaults (none configurable)

Default	Description
Default status is draft	Import does not equal publish
No executables allowed in the package	`.php`/`.js`/`.phar` and similar files cause the whole package to be rejected
Size limits	2 MB per file / 50 MB unpacked per package / 500 KB per entry body
Zip bomb protection	Read the central directory before unpacking; reject anything over the limit
SVG sanitization allowlist	Strip `script`/ event attributes / external references (using DOM parsing, not regex)

6. CraterHub: Licensing and Distribution Layer

Above the four business plugins sits one more component: the management layer.CraterHub handles licensing, distribution, and online updates.

Role	Deployment location	Responsibility
Master	Vendor side (domain-locked)	Manage license items, generate licenses
Agent	Client site	Validate licenses, report status
Version repository	Distribution server	Serve package manifests and files

License items are registered centrally: there are currently 6, one for the theme and one for each plugin.The point of this design is to make “what happens when a license expires” a matter of clear rules, rather than something handled ad hoc on the day it expires:

Tier	Meaning
A	Stop new additions only (existing items and the front end stay unchanged; updates stop, fixes don’t)
B	Keep existing, stop new
C	Graduated rollback (security baseline is kept permanently)

One important design principle: without CraterHub installed, each plugin degrades to “allow/silent”, behaving byte-for-byte the same as before installation. This ensures plugins can be used independently and won’t fail entirely because you “forgot to install the management side”.

One exception is worth explaining: without CraterHub installed, CraterFlow runs in “read-only degraded” mode— it can parse, dry-run, and preview, but cannot publish. The reason is that “bulk writing to the site” is a high-impact action, so the default is conservative.

7. Why We Build In-House Instead of Assembling

The public WordPress plugin ecosystem is rich, and ready-made solutions exist for most features. The reason we build in-house isn’t that “we do it better”, but three specific problems:

Issue	The assembled approach	The in-house approach
Inconsistent definitions	Each plugin has its own attribution/SEO definitions, so data can’t be merged	The whole suite shares one set of data definitions and field definitions
Broken pipelines	Translation and SEO, forms and attribution all need glue code between them	The pipeline is end-to-end by design
Uncontrollable security and compliance	The code quality and data handling of third-party plugins can’t be audited	We own the code, so it can be audited, modified, and explained to clients

There’s also a practical reason: the long-term maintainability of client sites. Problems with the assembled approach often surface two years later — a plugin stops getting updates, an update introduces an incompatibility, or a data definition changes somewhere and makes historical data incomparable.The cost of building in-house is the upfront investment; the payoff is predictable long-term maintenance.

One clear boundary

This tech stack does not replace the client’s business systems:

does not replace	Description
ERP / CRM	The plugins output lead data that can be integrated; they don’t handle customer relationship management
Email marketing platforms	Notifications and sequence emails handled by a dedicated platform
Design system	Provides structure and component specs; the theme controls the visuals

Positioned as “the engineering foundation for going global”— it makes the four core pipelines of the site itself solid: language, leads, security, and content, so that business systems on top don’t have to deal with these underlying problems.

FAQ

Scenario	Recommended combinations
Single-language site, lead-focused	crater + crater Shield
Multilingual site	crater Language + crater + crater Shield
High content volume, needs bulk publishing	Add crater Hub
Needs unified licensing and online updates	Add crater Core

Can the four plugins be used separately? Do I have to install the whole set?

They can be used separately and each works independently.The recommended combinations are on-demand:There is no “must install the whole set” requirement. One thing to note: crater Language and crater share the same content import engine, so when both are installed they reuse it and won’t conflict.

Dimension	Common setups	crater Tech Stack
Data conventions	Each plugin defines its own	Unified across the whole suite (consistent channel, environment, and source fields)
Security and AI access	The security plugin blocks non-human traffic by default	Tiered access with an explicit AI retrieval channel
Bulk writes	Write directly to the database, save first and review later	Dry run → preview → publish, drafts by default
Idempotency strategy	Mostly based on slug or title	`pack_id`+`external_id`, with stable identifiers on the source side

How is this different from similar popular plugins on the market?

We don’t compare feature counts, only differences in design approach:The most valuable one is the “AI channel”: GEO is one of the core tasks for going global right now, and many sites block AI crawlers at the security layer without even knowing it.

layer	How to do it
Resource loading	Front-end assets load on demand; admin styles never reach the front end
Query	Data tables are indexed, and statistical queries use aggregate caching
External request	Visitor attribution uses “lightweight mode” by default (reads CDN headers + timezone inference) instead of per-request IP lookups

Will the plugins slow down my site?

The design controls this in three ways:Actual performance impact depends on site size and configuration. We recommend a before-and-after test (TTFB and LCP) before launch, and making it a standard acceptance item.

Where is the data stored? Are there compliance risks?

Data is stored in the customer’s own site database, and never passes through our servers. This matters for regulations like GDPR —the customer is the data controller; we provide the tool. Also: the default visitor attribution mode makes zero external requests; no visitor-level personal profiles are built; technical data and personal data are stored in separate tables. Scenarios involving cross-border data (such as a customer using an overseas host) require the customer’s own assessment; the plugins do not add any extra cross-border transfer.

What if the customer’s site isn’t built on WordPress?

This stack is built for the WordPress ecosystem (themes + plugins). If you’re on a different stack (headless, Shopify, a custom-built system),the methodology still applies, but the tools don’t—you’ll need to implement it yourself along the same lines, or pick a solution built for that ecosystem.What carries over from the methodology: the diagnostic framework for the four breaks, the attribution model (first touch / last touch / Click ID / environment dimensions), the tiered crawl policy for AI bots, and the three-stage “rehearse → preview → publish” flow for getting content onto the site. None of these depend on a specific stack.

Does this create vendor lock-in?

Your data isn’t locked in, and the tools can be swapped out. Specifically: all data lives in your own database and can be exported at any time, in standard formats such as CSV and JSON. If you deactivate the plugin, the historical data stays in the database.The only thing you’re tied to is “online updates and licensing” This part depends on the crater Core system, but it only affects the update channel, not how your site runs.

Final thoughts

Technical work for going global easily slips into “install a plugin, configure a feature” mode—each one solves a specific problem, but the whole remains fragmented.

The question you actually need to answer first is:Which links in my site are broken?

Is the language layer broken (are translation and SEO working together)? Is the lead layer broken (can you trace an inquiry back to its source)? Is the security layer broken (are AI crawlers being blocked by mistake)? Is the content layer broken (can content get onto the site efficiently)?

Only when all four links are connected does your site have a usable foundation; once that foundation is solid, the work on top—SEO, GEO, paid campaigns, content—starts to compound. That’s why this stack exists—not to give your site “more features,” but to keep every link from breaking halfway.