WordPress.org

Català (Valencià)

Get WordPress
WordPress.org

Plugin Directory

WinaltChat for WooCommerce

WinaltChat for WooCommerce

Per Winalt Technologies
Baixar

Descripció

WinaltChat adds a fast, intelligent chat widget to your
WooCommerce store. Customers can search your product catalogue,
get instant answers about shipping and returns, and — when they
need a real person — connect to your support team through a built-in
live chat system, all without leaving your store.

AI Shopping Assistant

  • Dual AI Modes — Use your own API key from Groq — LLaMA
    (Free Tier), ChatGPT (OpenAI), Claude (Anthropic), or Gemini
    (Google) for full conversational AI. No key? The built-in
    Basic AI mode runs entirely on your server with zero external
    calls and zero ongoing cost.
  • Smart Product Search — Intent-aware search across your
    WooCommerce catalogue. Handles typos, synonyms, multilingual and mixed-language
    queries, and follow-up questions naturally.
  • Product Comparisons — Customers can ask “which is better, the Sony or the
    Samsung?” and get a clear side-by-side comparison
    with prices and key specs from your own catalogue.
  • Store Knowledge Base — Reads your shipping, returns, contact,
    and about pages to answer policy questions accurately and
    dynamically — no hardcoded answers that break for other stores.
  • Conversation Context — Remembers context within a session so
    follow-up questions (“does it come in blue?”) work naturally.
  • Amazon Affiliate Fallback — When a product is out of stock,
    optionally suggest an Amazon affiliate link so you still earn a
    commission.

Live Human Chat

  • Human Handoff — When a customer types phrases like “I want
    to talk to a human”, “customer service”, “live agent”, or dozens
    of natural variants, the plugin detects the request and connects
    them to a real person on your team.
  • Admin Live Chats Dashboard — A dedicated Live Chats screen
    in your WordPress admin shows all active, waiting, and closed
    conversations in a two-panel interface. Keep the tab open to stay
    marked online for visitors.
  • Visitor Name Prompt — Before connecting, the visitor is
    optionally asked for their name. If skipped, they are identified
    as “Visitor #ID” so you can tell conversations apart.
  • Full Conversation Context for Agents — When a customer is
    handed off, the admin sees the complete prior AI conversation so
    there is no need to ask “how can I help?” twice.
  • Visitor Presence Dot — A green dot shows the visitor is
    active. It turns grey within 30 seconds if they close the tab.
  • Two-Tier Timeout — If your team does not respond within
    90 seconds, the visitor sees a friendly patience message. After
    5 minutes of no reply, the chat gracefully falls back to the AI
    assistant with an optional email capture.
  • Intelligent Offline Handling — When no admin is online the AI
    keeps helping. Visitors can optionally leave their email for a
    follow-up. Leads appear in the admin Live Chats list with a
    dedicated Leads section and unread badge.
  • Session Management — Close chats when resolved, or delete
    them permanently. Closed and lead sessions stay visible in
    their own sections until manually removed.
  • Zero External Dependencies — Live chat runs entirely within
    your WordPress site using secure AJAX polling over the REST API.
    No Pusher, no third-party service, no extra cost.
  • Email Notifications — Get an email when a customer starts a
    live chat or leaves their contact details while you are offline.

Privacy & Security

  • All live chat data is stored in your own WordPress database.
    Nothing is sent to an external service.
  • Session tokens are 32-character cryptographically random strings
    — not sequential IDs — so sessions cannot be enumerated.
  • All endpoints enforce nonces, capability checks, input
    sanitization, output escaping, and rate limiting.
  • Message content is sanitized server-side, and rich chat HTML
    (product cards, links, images) is additionally sanitized
    client-side via a bundled copy of DOMPurify before being
    rendered — see “Bundled Libraries” below.

Bundled Libraries

  • DOMPurify 3.1.6 — client-side HTML sanitizer, used to safely
    render rich chat content (product cards, links, images).
    Vendored locally at assets/js/vendor/purify.min.js; not loaded
    from a CDN. © Cure53 and other contributors. Dual-licensed under
    the Apache License 2.0 and Mozilla Public License 2.0, both
    GPL-compatible. github.com/cure53/DOMPurify

Requirements

  • WordPress 6.2 or later
  • WooCommerce 7.0 or later (must be installed and active)
  • PHP 7.4 or later
  • An API key from Groq, OpenAI, Anthropic, or Google (optional —
    Basic AI and Live Chat both work without one)

Support

We aim to respond to all support requests within 48 hours.

External Services

This plugin connects to third-party AI providers only when you
configure an external AI mode and enter your own API key. In Basic
AI mode and during live human chat, no external AI service is used.

AI Providers (optional — only when an API key is configured)

Customer messages, recent conversation context, and relevant store
and product context are sent to the AI provider you select so it
can generate a response. No data is sent to these providers when
using Basic AI mode.

Amazon Associate Program (optional — only when a tag is configured)

When the Amazon fallback is enabled and no matching product is
found in your store, the plugin generates an Amazon search link
with your Associate tag. No customer data is transmitted to Amazon
by the plugin — the link simply directs the visitor’s browser.

Instal·lació

  1. Upload the winaltchat-for-woocommerce folder to
    /wp-content/plugins/, or install directly via the WordPress
    Plugins screen.
  2. Activate the plugin through the Plugins screen in WordPress.
  3. Make sure WooCommerce is installed and active.
  4. Navigate to WinaltChat Settings in the WordPress admin.
  5. AI Mode (optional): Choose your preferred AI provider and
    enter your API key, or leave blank to use the built-in Basic AI
    mode at zero cost.
  6. Live Human Chat (optional): Scroll to the Live Human Chat
    section, enable the toggle, set a notification email and agent
    display name. A Live Chats item will appear in the sidebar.
  7. Keep the Live Chats tab open in your browser while you work
    to appear online to visitors requesting a human.
  8. Customise the chat appearance under the Chat Appearance tab.

PMF

Do I need an API key to use this plugin?

No. The built-in Basic AI mode handles product search, comparisons,
policy questions, and conversation without any API key or external
service. Real AI mode (Groq, OpenAI, Claude, Gemini) is optional
and improves response quality for complex queries.

Does Live Human Chat require any external service?

No. It runs entirely within your WordPress site using the WordPress
REST API. No Pusher, no LiveChat subscription, no third-party
accounts needed.

How does the admin know a customer is waiting?

Two ways: a browser notification fires in the Live Chats tab (if
you grant notification permission), and an email is sent to your
configured notify address. Keep the Live Chats tab open while
you work to stay marked as online.

What happens if no admin is online when a customer asks for help?

The AI assistant keeps helping the customer seamlessly. A message
explains the team is unavailable, and the customer is offered an
optional email field so you can follow up. No dead ends.

How long before an unanswered live chat falls back to the AI?

At 90 seconds of no response, the visitor sees a friendly
“thanks for your patience” message. At 5 minutes, the chat
gracefully returns to AI mode with an email capture option. Both
thresholds are configurable in the Live Human Chat settings.

Can multiple admins handle chats at the same time?

Currently any admin with the manage_options capability can see and
reply to all live chats. Multi-agent role management is planned for
a future release.

How do I remove all plugin data on uninstall?

Deleting the plugin via the WordPress Plugins screen automatically
removes all WinaltChat settings, options, and live chat database
tables from your site.

Does it work with my theme?

Yes. The chat widget is injected into the page footer and uses its
own scoped CSS so it does not conflict with theme styles.

Will it slow down my site?

The AI chat widget loads asynchronously and does not block page
rendering. Live chat polling only runs while an active live session
is in progress — normal AI chat and idle pages make zero polling
requests.

Ressenyes

No hi ha ressenyes per a este complement.

Col·laboradors i desenvolupadors

«WinaltChat for WooCommerce» és programari de codi obert. La següent gent ha col·laborat en este complement.

Col·laboradors

Traduïx «WinaltChat for WooCommerce» a la teua llengua.

T’interessa el desenvolupament?

Revisa el codi , dona una ullada al repositori SVN o subscriu-te al registre de desenvolupament per RSS.

Registre de canvis

1.10.5

  • Fix: The previous 1.10.4 rate-limiter fix wrapped the two $_SERVER accesses in wp_unslash() only, which satisfies the “unslashed” half of the WordPress.Security.ValidatedSanitizedInput sniff but not the “sanitized” half — the sniff separately requires a sanitizing function call (e.g. sanitize_text_field()) at the same point. Both call sites now use sanitize_text_field( wp_unslash( $_SERVER[...] ) ), matching the pattern already used two lines below for REMOTE_ADDR. No functional change (first_valid_ip_from_header() already sanitized internally).

1.10.4

  • Fix (F1): Provider logos on the API settings page were loaded from https://www.google.com/s2/favicons?domain=... — an undisclosed external request to Google every time an admin opened the settings page, a WordPress.org guideline violation. Replaced with the four provider logos bundled locally at assets/images/providers/, referenced via WINALT_URL + esc_url(). Added assets/images/index.php and assets/images/providers/index.php silence stubs matching the existing pattern.
  • Fix (F2): Tested up to listed 7.0, a WordPress version that has never been released. Corrected to 6.8.
  • Fix: Removed two internal dev-note files (assets/css/css_readme.txt, assets/js/js_readme.txt) that had no runtime purpose and weren’t excluded from the SVN push; also added them to .distignore/.gitattributes as a backstop.
  • Improve: Added a translation template (languages/winaltchat-for-woocommerce.pot, generated via wp i18n make-pot) so translators can contribute — none previously shipped.
  • Fix: resolved input-sanitization coding-standards warnings in the rate limiter.

1.10.3

  • Improve: Live Chats admin console layout ported from Pro to match — session list footer combines status+tag on one line, tag/pin controls moved to the conversation header as an always-visible tag pill and icon-only pin button.

1.10.2

  • Fix (R7): PROXY_HEADER_PRIORITY in class-winalt-rate-limiter.php was tagged @since 1.8.2, a version that never shipped (Free went 1.8.1 1.9.0 directly). Corrected to @since 1.10.0, the version that actually introduced it (verified via git log -S). All other @since tags in the file checked out correctly.
  • Improve (L1): Converted the 11 var declarations in chat-config.js (added after the last varlet pass) to const.
  • Improve (L2): Gated the two remaining unconditional console.error() calls (chat-api.js, chat-ui.js) behind winaltConfig.debug, matching the existing pattern in chat-core.js.
  • Verified (P-H1): verify_nonce() in Winalt_Live_Chat_REST has neither the cookie-absence bypass nor any Application-Password exemption — confirmed correct, matches the “do NOT port Pro’s bypass” comment. No change needed.
  • Verified: M1 (wp_safe_remote_post() in all AI calls) and P-M2 (Pro’s tracking-stats query, no InterpolatedNotPrepared suppressions) both already correctly fixed; no changes needed.

1.10.1

  • Fix: The Live Chats admin search box did nothing when typed into. sessionRow() creates each conversation row with class winalt-session-item, but the search filter’s querySelectorAll() looked for .winalt-live-session-item (an extra, non-existent “live-“) — so it always matched zero elements and silently filtered nothing. This mismatch was introduced when Pro’s search feature was ported to Free; Pro’s own implementation was unaffected (self-consistent naming throughout). Verified against the pre-fix and post-fix file with a DOM simulation using real session data — confirmed the bug reproduces exactly as reported (no filtering, no console errors) and is resolved by the fix.

1.9.0 – 1.10.0

  • Consolidated dual HTML sanitizers onto bundled DOMPurify (R3); changed rate-limiter default to trust CDN/proxy headers without strict IP-range verification, added winalt_rate_limit_strict_cloudflare_verify and winalt_proxy_header_priority filters. Full details on GitHub.

1.7.3 – 1.8.1

  • Added CDN-aware rate limiting (Cloudflare + private-network auto-detection), cache-safe nonce refresh for /chat and live-chat routes, and repo hygiene fixes. Full details on GitHub.

1.7.2 and earlier

  • For the full version history, see the plugin’s GitHub repository.

Meta

Valoracions

No reviews have been submitted yet.

Your review

See all reviews

Suport

Tens alguna cosa a dir? Necessites ajuda?

Vore els fòrums de suport