Safe actions.<\/strong> The assistant can act \u2014 search content, draft\nposts, check a customer's own order, update stock \u2014 always with the\nsigned-in user's own WordPress capabilities, and any change only\nafter an explicit preview card and an Apply click. Deletions need a\nsecond confirmation and go to the trash, never permanent removal.<\/li>\n<\/ul>\n\nThe heavy lifting (models, retrieval, orchestration) runs on a Context\nAssistant server; this plugin connects your site to it. Your secret API\nkey is encrypted at rest and never enters browser code. Public chat uses a\npublic identifier and temporary guest tokens. Private integrations keep\nusing WordPress-issued sessions and permissions.<\/p>\n\n
WooCommerce:<\/strong> with WooCommerce active, the assistant additionally\nsearches the catalog with live prices and stock, shows a signed-in\ncustomer the status of their own orders, and lets shop managers update\nstock through the preview\/Apply flow.<\/p>\n\nFor developers:<\/strong> add your own assistant tools with the\n context_assistant_tools filter, extend the page context with\n context_assistant_page_context, and control widget visibility with\n context_assistant_should_render. WP-CLI: wp context-assistant sync<\/code>.<\/p>\n\nExternal services<\/h3>\n\n
This plugin does not work on its own: the models, retrieval and\norchestration run on a Context Assistant server<\/strong> that you configure\nin Settings \u2192 Context Assistant<\/strong> (the API URL). That server is\nthe hosted Context Assistant service.<\/p>\n\nWhat the plugin sends to that server, and when:<\/p>\n\n
\n- On pages where the configured widget is enabled<\/strong> \u2014 the browser loads\nhttps:\/\/contextassistant.io\/assets\/embed.js over HTTPS. This service request\nexposes normal connection information such as IP address and user agent.\nThe script request uses a no-referrer policy; no API key or chat token is\nincluded in its URL. The widget is not loaded on unconfigured\/disabled pages.<\/li>\n
- When the widget loads<\/strong> \u2014 a short-lived embed token is minted for\nthe browser to fetch widget settings and restore conversation history.\nThe page context you allowed (page URL,\ntitles, public taxonomy terms; each behind its own privacy toggle,\nnever the page body or form input) is attached to the conversation.<\/li>\n
- On each message<\/strong> \u2014 the visitor's message text and that page\ncontext, so the assistant can answer. Public chat uses a random guest\nidentity, not a caller-supplied user ID. A signed session credential is\nstored in browser local storage for up to 30 days between renewals.\nExisting private integrations keep their WordPress identity handling.<\/li>\n
- When knowledge sync is enabled<\/strong> \u2014 the text of your published<\/em>\nposts, pages and products (never drafts or private content), so the\nassistant can answer from your own content.<\/li>\n
- When the Remote Tools bridge is enabled<\/strong> \u2014 the server calls back\ninto your site to run tools under the signed-in user's own WordPress\ncapabilities; your secret API key stays encrypted on your server and\nis never sent to the browser.<\/li>\n<\/ul>\n\n
Conversation transcripts are stored on that server and can be exported\nor deleted (see the FAQ). The service processes messages according to\nits privacy policy. The widget uses browser local storage to remember\nwhether a visitor has dismissed or engaged with its automatic greeting.<\/p>\n\n
If you use the hosted<\/strong> Context Assistant service, it is operated\nunder its own terms of service and privacy policy:\nTerms: https:\/\/contextassistant.io\/terms\/\nPrivacy: https:\/\/contextassistant.io\/privacy\/<\/p>\n\n\n\n- Install and activate the plugin.<\/li>\n
- Open Settings \u2192 Context Assistant<\/strong>.<\/li>\n
- Get both keys in the Context Assistant setup wizard. Paste the Public\nchat key (
ca_pk_\u2026<\/code>), Secret synchronization key (ca_sk_\u2026<\/code>) and Assistant\nID. The API URL is pre-filled as https:\/\/api.contextassistant.io\/.\nAllow-list the exact origin of your site on the assistant.<\/li>\n- Save, press Check connection<\/strong>, then open the chat on your site.<\/li>\n
- Enable Knowledge base sync<\/strong> to import published content. Public\nchat answers from this knowledge; it does not execute Remote Tools.<\/li>\n<\/ol>\n\n
Existing integrations do not need new keys. Keep the public field empty\nto continue using server-issued tokens, private data and permitted tools.\nSaved custom and legacy API addresses are preserved.<\/p>\n\n\n
\nWhich key goes into the settings?<\/h3><\/dt>\nFor a new public integration, use both keys from assistant setup: the\npublic key opens guest chat; the secret synchronization key imports and\nupdates knowledge. Paste them into their separate plugin settings fields.\nDo not publish the secret or share it in AI conversations. The public key\nis intentionally visible in website code. For non-WordPress projects,\nsave the values in .env and exclude that file from git.<\/p>\n\n
The AI provider key (e.g. an OpenAI sk-\u2026<\/code> key) is configured on the\nContext Assistant server and never enters WordPress.<\/p><\/dd>\nWhat data does the widget send?<\/h3><\/dt>\nPer message: the page URL, titles and public taxonomy terms \u2014 each\nbehind its own toggle, and never the page body. The knowledge base\nsync sends only published content. Public chat remembers a signed guest\nsession in browser local storage for up to 30 days between renewals.\nLegacy integrations use the existing anonymous WordPress cookie.<\/p><\/dd>\n
Does it work with page caching?<\/h3><\/dt>\nYes. Anonymous pages carry nothing user-specific \u2014 tokens are fetched\nby the browser after the page loads, so full-page caches keep working.<\/p><\/dd>\n
Can visitors change my site through the assistant?<\/h3><\/dt>\nNo. Public-key chat does not call Remote Tools. In existing private\nintegrations, guests only see read-only tools over already-public content.\nMutating tools exist only for signed-in users with the matching\nWordPress capabilities, and every mutation requires an explicit\nconfirmation in the chat.<\/p><\/dd>\n
Can I export or delete the conversation history?<\/h3><\/dt>\nYes. Transcripts are stored on the Context Assistant server, not in\nyour WordPress database. The server exposes an export of all\nconversations and deletion of any single conversation, so a visitor's\ndata can be handed over or erased on request.<\/p><\/dd>\n
Where are the widget's readable sources?<\/h3><\/dt>\nThe widget loads from https:\/\/contextassistant.io\/assets\/embed.js.\nReadable source: https:\/\/contextassistant.io\/assets\/embed.src.js.\nThe plugin retains assets\/embed.js<\/code> for old cached pages that reference it,\nwith its readable source beside it in assets\/embed.src.js<\/code>.<\/p><\/dd>\nDo widget updates require a plugin update?<\/h3><\/dt>\nCompatible hosted widget updates do not require a new plugin release.\nChanges to WordPress integration, token handling or synchronization still do.\nThe widget is connected directly with a script tag, without a separate loader\nor automatic fallback. If the script is unavailable, the chat does not appear.<\/p><\/dd>\n\n<\/dl>\n\n\n
0.5.0<\/h4>\n\n\n- Optional public chat key: guest sessions are issued by Context Assistant without a WordPress token endpoint.<\/li>\n
- Separate secret synchronization key; existing integrations without a public key keep the server-token flow.<\/li>\n
- API URL defaults to https:\/\/api.contextassistant.io\/ without overwriting saved addresses.<\/li>\n
- Public-key validation and preflight; synchronization secrets remain server-side.<\/li>\n<\/ul>\n\n
0.4.0<\/h4>\n\n\n- Load the shared widget directly from the Context Assistant website using\na script tag, without a separate SDK loader or automatic fallback.<\/li>\n
- Preserve page context, theme customization and the existing token flow.<\/li>\n
- Sync optional knowledge-card metadata without requiring Remote Tools.<\/li>\n<\/ul>\n\n
0.3.0<\/h4>\n\n\n- Updated the bundled widget to the current shared Context Assistant SDK.<\/li>\n
- Lite and Advanced layouts follow the assistant's settings in the console.<\/li>\n
- Optional automatic greeting opens after two seconds, without taking\nkeyboard focus; invitations stop after five dismissals or a sent message.<\/li>\n
- Includes product previews, follow-up choices, conversation restoration,\naccessible keyboard controls and reduced-motion support.<\/li>\n
- Site themes can customize the widget through CSS variables and parts.<\/li>\n<\/ul>\n\n
0.2.0<\/h4>\n\n\n- Read tools that return navigable objects (products, posts, pages, media,\nmenu links) now include a
display<\/code> list, so the widget shows them as\nframed preview cards with an image and a link that opens in a new tab\ninstead of a plain text list.<\/li>\n- The assistant can offer follow-up suggestions as one-tap chips, so a\nvisitor picks a next step without retyping it.<\/li>\n<\/ul>\n\n
0.1.0<\/h4>\n\n\n- Initial release: chat widget with page context, embed-token security,\nknowledge base sync (RAG), 25 capability-scoped WordPress and\nWooCommerce tools, and a WP-CLI sync command.<\/li>\n<\/ul>","raw_excerpt":"A context-aware AI assistant that answers from your site content and performs confirmed WordPress and WooCommerce actions.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/en-gb.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/348187","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/en-gb.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/en-gb.wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/en-gb.wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=348187"}],"author":[{"embeddable":true,"href":"https:\/\/en-gb.wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/contextassistant"}],"wp:attachment":[{"href":"https:\/\/en-gb.wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=348187"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/en-gb.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=348187"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/en-gb.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=348187"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/en-gb.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=348187"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/en-gb.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=348187"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/en-gb.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=348187"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}