AI SEO Content Writer SaaS PHP Script — Free Download (SerpGround AI)

SerpGround AI is a self-hosted SurferSEO/Frase-class content platform with one genuinely differentiating trick: it doesn't guess what ranks — it asks Google first. Every campaign runs a two-pass pipeline through Gemini: pass one calls the model with the native google_search grounding tool, pulling live SERP research for your keyword, country and language and returning verified source URLs (groundingChunks) plus the actual queries Google executed; pass two feeds that research brief into a strict responseSchema call that synthesizes the deliverables — a long-form HTML article with a Markdown twin, meta title/description, an SEO score, competitor content gaps, semantic NLP entities with recommended usage counts, 4–6 FAQs, and ready-to-paste JSON-LD Article + FAQPage schema. No Serper/Tavily subscription, no SERP scraping — the grounding is built into the model call.

The SaaS wrapper around it is unusually complete for a 9-minute build, because this one was briefed with the lessons from our previous community builds baked in: real hosted checkout (Stripe Checkout Sessions + PayPal Orders v2 via native cURL, server-side verification on return, idempotent crediting on a UNIQUE transaction_ref — the old client-side crediting endpoint answers HTTP 410 Gone), a zero-dependency socket SMTP mailer with SSL/STARTTLS and an admin "Send SMTP Test" button, editable welcome/purchase-receipt email templates, a full Plans & Packages editor, CSRF enforced with HTTP 419 on every POST, and a DEMO_MODE switch that write-locks the panel for public showcases.

On top of that sits a working content-marketing loop: a built-in Blog CMS in the SuperPanel (create/edit/draft/delete with slugs, categories, per-post meta and view counters), a public blog that injects each post's JSON-LD automatically, latest-posts on the landing page, and a one-click "Publish to SaaS Blog" button inside the SEO Studio — generate a grounded article, review the citations, push it live on your own domain.

Pure PHP 8 + PDO MySQL, Tailwind CDN, zero Composer. Our pre-publish review fixed four small things (detailed in the prompt log); everything else shipped working.

Feature	SerpGround AI (self-hosted)	SurferSEO / Frase / Clearscope
Live SERP data source	Gemini native google_search grounding — verified source URLs in the response	Proprietary crawlers or paid SERP APIs
Cost model	Your server + pay-per-call Gemini usage	Per-seat monthly subscription
Article + Markdown + meta + SEO score	✓ one schema-enforced call	✓
Competitor content gaps & NLP entities with target counts	✓	✓ (core feature)
JSON-LD Article + FAQPage schema	✓ generated and auto-injected on the built-in blog	Varies / manual
Publish pipeline	✓ built-in public blog + CMS + 1-click publish from the studio	Export to CMS integrations
Run it as YOUR SaaS (users, credits, plans, checkout)	✓ Stripe + PayPal hosted checkout, idempotent crediting	N/A — you are the customer
White-label + analytics scripts + SEO meta control	✓ from the SuperPanel	—
Verified citations for every article	✓ groundingChunks listed per campaign	Varies

1. Extract the ZIP to your web directory and edit the MySQL credentials at the top of config.php (DB_HOST, DB_NAME, DB_USER, DB_PASS).

2. Open /install.php: the wizard checks dependencies, creates all six tables (users, plans, settings, seo_projects, blog_posts, email_templates + transactions), seeds three pricing tiers and a sample blog post, and provisions your Master Admin. Paste your Gemini key here or later in the SuperPanel.

3. Sign in — admins land in the SuperPanel (Blog CMS, plans, gateways, SMTP, SEO manager), users in the SEO Studio. Enter a keyword, pick the SERP country/language, and run your first grounded campaign; review the live citations under the "Live SERP Citations" tab, then hit "Publish to SaaS Blog".

4. Going commercial: enable Stripe/PayPal in the SuperPanel (hosted checkout, verified server-side), configure SMTP and fire the test button, set DEMO_MODE=true in config.php if you host a public showcase, and delete install.php.

Community build: built by the site's owner with Google Gemini 3.1 Pro in ~9 minutes. This is the third build in the Gemini series, and the brief deliberately encoded everything the earlier reviews had flagged — real checkout, enforced CSRF, a working mailer — to see whether the model would ship them when asked explicitly. Verdict below. The exact prompt, verbatim:

Build a production-grade, zero-dependency PHP 8+ and MySQL SaaS application called "SerpGround AI" that replaces $79/mo SEO tools like SurferSEO and Frase.io using Google Gemini 2.5 Flash and native Google Search Grounding (google_search).

Architecture & Security Requirements:
1. Two-Pass Gemini Search Grounding Engine (includes/GeminiSeoService.php):
- Pass 1 invokes gemini-2.5-flash with tools: [{"google_search": {}}] to research live Google search results for the target keyword, country, and language, extracting verified groundingChunks (source URLs and titles) and webSearchQueries.
- Pass 2 uses responseMimeType: "application/json" and a strict responseSchema to synthesize a complete HTML and Markdown article, SEO score, Meta Title/Description, Competitor Content Gaps, Semantic NLP Entities with target counts, and valid JSON-LD FAQPage + Article schema.
2. Built-in Public Blog & Admin Blog CMS (blog.php, admin.php, api.php):
- Public SEO blog (blog.php) with clean slugs, categories, view counters, meta tags, and automatic JSON-LD schema injection.
- Full Blog CMS inside admin.php (Create, Edit, Draft/Publish, Delete) plus a 1-click "Publish to SaaS Blog" button inside the SEO Studio (dashboard.php).
3. Real Hosted Checkout & Idempotent Fulfillment (includes/PaymentGateways.php, pricing.php, checkout.php):
- Block insecure client-side credit upgrades with HTTP 410 Gone.
- Create real Stripe Checkout Sessions (/v1/checkout/sessions) and PayPal Orders v2 (/v2/checkout/orders) via native PHP cURL.
- Verify payment status server-side on return in checkout.php and credit accounts idempotently using a UNIQUE transaction_ref constraint.
4. Native Socket SMTP Client & Email Template Editor (includes/Mailer.php):
- Implement a zero-dependency stream_socket_client SMTP mailer supporting SSL (465), STARTTLS (587), and AUTH LOGIN.
- Include editable email_templates (welcome and purchase_receipt) with {name}, {plan}, {amount}, {credits}, {reference} placeholders and a live "Send SMTP Test" button in Admin SuperPanel.
5. Strict Security & Demo Lock (config.php):
- Enforce CSRF token verification (enforceCsrf()) returning HTTP 419 on all POST forms and API actions, plus a DEMO_MODE toggle for public showcase hosting.

Did explicit briefing work? Mostly, yes. Unlike our second Gemini build (where "checkout flows" turned out to be a credit-granting stub), this one genuinely shipped the hard parts: the 410 block is real, checkout runs through actual Stripe/PayPal API calls with server-side verification and a transaction-wrapped idempotent fulfilment, enforceCsrf() is actually called on every POST surface, and the DEMO_MODE guard exists in code, not just in the README.

What the review still caught — four fixes applied with Claude Code before publishing:
1. The code didn't parse. Two files had unescaped quotes inside double-quoted prompt strings (GeminiSeoService.php, twice) and a stray space in a variable name ($ banner in Mailer.php) — fatal parse errors; the app could not have booted anywhere. Fixed and re-linted 17/17 clean.
2. SMTP line endings were bare LF. The mailer embedded raw newlines instead of CRLF in every SMTP command and header — RFC 5321 violation that strict servers (Postfix in strict mode, Outlook) reject. Rewrote all protocol line endings to \r\n with proper dot-stuffing.
3. A vanity metric. The seeded sample blog post shipped with views = 42 baked into the SQL. Zeroed — this series doesn't fake numbers, even tiny ones.

Verification on a throwaway install: installer provisioned six tables + admin in one POST; register granted 3 credits and delivered a real welcome email through a live SMTP sink; token-less POSTs to the API returned 419; purchase_plan returned 410; with a deliberately fake key, Stripe's own API answered "Invalid API Key provided: sk_test_*AKE9" through the checkout path (call chain proven); the Blog CMS round-trip worked end-to-end — created a post in the SuperPanel, saw it slugified, rendered on blog.php with its view counter ticking and listed on the landing page; the plan editor wrote price/credit changes back to the database; and the admin "Send SMTP Test" button delivered a second real SMTP transaction. Real line count: 2,574 across 17 files.

Post-publish hardening & theme pass (Claude Code, same day): the user asked for a security sweep and a proper SaaS-grade landing. Hardening, each verified live: (1) the installer now locks itself once an admin exists — before this, anyone could re-POST install.php and overwrite the admin password (the seeded query used ON DUPLICATE KEY UPDATE password_hash); re-running it now returns 403 "Installer Locked". (2) session_regenerate_id on login and register (session-fixation protection). (3) a 1-second delay on failed logins (measured ~1,070 ms) as cheap brute-force friction. (4) checkout ownership check — a payment reference belonging to a different account no longer renders a success page in your session. The landing page was rebuilt in the same pass: gradient hero with a live two-pass pipeline mock, feature grid, how-it-works, pricing pulled from the plans table, latest-blog strip and CTA — all still reading site name, meta tags and header scripts from the admin panel.

Design pass 2 (Claude): the first replacement landing still read like template output, so it was rebuilt with an actual identity — Space Grotesk display type, a left-copy / right-carousel hero cycling three REAL product screenshots captured from the live demo (SEO Studio, Admin SuperPanel with the Blog CMS, public blog), a feature marquee, an asymmetric bento grid with hand-drawn SVG icons instead of emoji, and editorial how-it-works rows. The screenshots ship in assets/screens/ so buyers can swap in their own. The demo login also gained two clearly-labeled entry points: a subscribed account (Growth plan with credits and a sample transaction) and the Admin SuperPanel.