Description
WinaltChat adds a fast, intelligent chat widget to your
WooCommerce store. Customers can search your product catalogue,
get instant answers about shipping and returns, and — when they
need a real person — connect to your support team through a built-in
live chat system, all without leaving your store.
AI Shopping Assistant
- Dual AI Modes — Use your own API key from Groq — LLaMA
(Free Tier), ChatGPT (OpenAI), Claude (Anthropic), or Gemini
(Google) for full conversational AI. No key? The built-in
Basic AI mode runs entirely on your server with zero external
calls and zero ongoing cost. - Smart Product Search — Intent-aware search across your
WooCommerce catalogue. Handles typos, synonyms, multilingual and mixed-language
queries, and follow-up questions naturally. - Product Comparisons — Customers can ask “which is better, the Sony or the
Samsung?” and get a clear side-by-side comparison
with prices and key specs from your own catalogue. - Store Knowledge Base — Reads your shipping, returns, contact,
and about pages to answer policy questions accurately and
dynamically — no hardcoded answers that break for other stores. - Conversation Context — Remembers context within a session so
follow-up questions (“does it come in blue?”) work naturally. - Amazon Affiliate Fallback — When a product is out of stock,
optionally suggest an Amazon affiliate link so you still earn a
commission.
Live Human Chat
- Human Handoff — When a customer types phrases like “I want
to talk to a human”, “customer service”, “live agent”, or dozens
of natural variants, the plugin detects the request and connects
them to a real person on your team. - Admin Live Chats Dashboard — A dedicated Live Chats screen
in your WordPress admin shows all active, waiting, and closed
conversations in a two-panel interface. Keep the tab open to stay
marked online for visitors. - Visitor Name Prompt — Before connecting, the visitor is
optionally asked for their name. If skipped, they are identified
as “Visitor #ID” so you can tell conversations apart. - Full Conversation Context for Agents — When a customer is
handed off, the admin sees the complete prior AI conversation so
there is no need to ask “how can I help?” twice. - Visitor Presence Dot — A green dot shows the visitor is
active. It turns grey within 30 seconds if they close the tab. - Two-Tier Timeout — If your team does not respond within
90 seconds, the visitor sees a friendly patience message. After
5 minutes of no reply, the chat gracefully falls back to the AI
assistant with an optional email capture. - Intelligent Offline Handling — When no admin is online the AI
keeps helping. Visitors can optionally leave their email for a
follow-up. Leads appear in the admin Live Chats list with a
dedicated Leads section and unread badge. - Session Management — Close chats when resolved, or delete
them permanently. Closed and lead sessions stay visible in
their own sections until manually removed. - Zero External Dependencies — Live chat runs entirely within
your WordPress site using secure AJAX polling over the REST API.
No Pusher, no third-party service, no extra cost. - Email Notifications — Get an email when a customer starts a
live chat or leaves their contact details while you are offline.
Privacy & Security
- All live chat data is stored in your own WordPress database.
Nothing is sent to an external service. - Session tokens are 32-character cryptographically random strings
— not sequential IDs — so sessions cannot be enumerated. - All endpoints enforce nonces, capability checks, input
sanitization, output escaping, and rate limiting. - Message content is sanitized server-side, and rich chat HTML
(product cards, links, images) is additionally sanitized
client-side via a bundled copy of DOMPurify before being
rendered — see “Bundled Libraries” below.
Bundled Libraries
- DOMPurify 3.1.6 — client-side HTML sanitizer, used to safely
render rich chat content (product cards, links, images).
Vendored locally atassets/js/vendor/purify.min.js; not loaded
from a CDN. © Cure53 and other contributors. Dual-licensed under
the Apache License 2.0 and Mozilla Public License 2.0, both
GPL-compatible. github.com/cure53/DOMPurify
Requirements
- WordPress 6.2 or later
- WooCommerce 7.0 or later (must be installed and active)
- PHP 7.4 or later
- An API key from Groq, OpenAI, Anthropic, or Google (optional —
Basic AI and Live Chat both work without one)
Support
- Support Forum: wordpress.org/support/plugin/winaltchat-for-woocommerce
- Email: support@winalttechnologies.com
We aim to respond to all support requests within 48 hours.
External Services
This plugin connects to third-party AI providers only when you
configure an external AI mode and enter your own API key. In Basic
AI mode and during live human chat, no external AI service is used.
AI Providers (optional — only when an API key is configured)
Customer messages, recent conversation context, and relevant store
and product context are sent to the AI provider you select so it
can generate a response. No data is sent to these providers when
using Basic AI mode.
- Groq — groq.com | Privacy Policy | Terms of Service
- OpenAI — openai.com | Privacy Policy | Terms of Use
- Anthropic Claude — anthropic.com | Privacy Policy | Terms of Service
- Google Gemini — ai.google.dev | Privacy Policy | Terms of Service
Amazon Associate Program (optional — only when a tag is configured)
When the Amazon fallback is enabled and no matching product is
found in your store, the plugin generates an Amazon search link
with your Associate tag. No customer data is transmitted to Amazon
by the plugin — the link simply directs the visitor’s browser.
- Amazon — amazon.com | Privacy Notice
Deactivation Feedback (optional — only sent if you respond to the deactivation survey)
When you deactivate this plugin, an optional short survey asks why.
If you respond (or skip), your site URL, the plugin/WordPress/PHP
version, and whatever you entered in the survey are sent to
Winalt Technologies to help improve the plugin. No personal data is
collected beyond this unless you choose to type it into the free-text
field yourself.
- Winalt Technologies — aisalesmanchatpro.com | Privacy Policy
Anonymous Usage Tracking (optional — off by default, only sent if you click “Allow”)
On first use, a notice asks permission to send anonymous “still
active” pings to help us understand real-world installs. Nothing is
sent unless you click “Allow” — you can also decline, or change your
choice later from the plugin’s General Settings tab. When enabled,
your site URL and the plugin/WordPress/PHP version are sent to Winalt
Technologies once immediately and then roughly once a day for as long
as it stays enabled. No personal or customer data is ever included.
- Winalt Technologies — aisalesmanchatpro.com | Privacy Policy
Screenshots
Installation
- Upload the
winaltchat-for-woocommercefolder to /wp-content/plugins/, or install directly via the WordPress Plugins screen. - Activate the plugin through the Plugins screen in WordPress.
- Make sure WooCommerce is installed and active.
- Navigate to WinaltChat Settings in the WordPress admin.
- AI Mode (optional): Choose your preferred AI provider and enter your API key, or leave blank to use the built-in Basic AI mode at zero cost.
- Live Human Chat (optional): Scroll to the Live Human Chat section, enable the toggle, set a notification email and agent display name. A Live Chats item will appear in the sidebar.
- Keep the Live Chats tab open in your browser while you work to appear online to visitors requesting a human.
- Customise the chat appearance under the Chat Appearance tab.
FAQ
-
Do I need an API key to use this plugin?
-
No. The built-in Basic AI mode handles product search, comparisons,
policy questions, and conversation without any API key or external
service. Real AI mode (Groq, OpenAI, Claude, Gemini) is optional
and improves response quality for complex queries. -
Does Live Human Chat require any external service?
-
No. It runs entirely within your WordPress site using the WordPress
REST API. No Pusher, no LiveChat subscription, no third-party
accounts needed. -
How does the admin know a customer is waiting?
-
Two ways: a browser notification fires in the Live Chats tab (if
you grant notification permission), and an email is sent to your
configured notify address. Keep the Live Chats tab open while
you work to stay marked as online. -
What happens if no admin is online when a customer asks for help?
-
The AI assistant keeps helping the customer seamlessly. A message
explains the team is unavailable, and the customer is offered an
optional email field so you can follow up. No dead ends. -
How long before an unanswered live chat falls back to the AI?
-
At 90 seconds of no response, the visitor sees a friendly
“thanks for your patience” message. At 5 minutes, the chat
gracefully returns to AI mode with an email capture option. Both
thresholds are configurable in the Live Human Chat settings. -
Can multiple admins handle chats at the same time?
-
Currently any admin with the manage_options capability can see and
reply to all live chats. Multi-agent role management is planned for
a future release. -
How do I remove all plugin data on uninstall?
-
Deleting the plugin via the WordPress Plugins screen automatically
removes all WinaltChat settings, options, and live chat database
tables from your site. -
Does it work with my theme?
-
Yes. The chat widget is injected into the page footer and uses its
own scoped CSS so it does not conflict with theme styles. -
Will it slow down my site?
-
The AI chat widget loads asynchronously and does not block page
rendering. Live chat polling only runs while an active live session
is in progress — normal AI chat and idle pages make zero polling
requests.
Reviews
Contributors & Developers
“WinaltChat for WooCommerce” is open source software. The following people have contributed to this plugin.
Contributors
Translate “WinaltChat for WooCommerce” into your language.
Interested in development?
Browse the code, check out the SVN repository, or subscribe to the development log by RSS.
Changelog
1.18.1
- Security: Updated
composer.lockto pull insquizlabs/php_codesniffer3.13.6, patching GHSA-hmqg-cxww-wqhq (CVE-2026-67434) — an OS command injection vulnerability in versions before 3.13.6. Dev-only dependency (require-dev), never shipped to production sites. - Fix: Two Plugin Check/PHPCS ERROR-level findings (a missing docblock and a missing
@paramentry, both introduced by v1.18.0’s cart-awareness and comparison-answer changes) and a Yoda-condition violation — no behavior change.
1.18.0
- New: Basic AI can now answer “what’s in my cart right now?” using the customer’s real WooCommerce session cart — previously it had no cart-awareness at all and gave a generic “what specifically are you looking for?” non-answer even with real items in the cart. Lists each item with its quantity and the cart subtotal, or says the cart is empty; falls back to a graceful “check the cart icon” reply if the session genuinely isn’t available.
- Fix: A clearly angry message (“this is ridiculous, I’m extremely frustrated and angry with your service”) got a good empathetic reply, but whether it also proactively offered a live-agent handoff (with Live Human Chat enabled) was decided by a coin flip between two response variants — only one of them included the offer. Both variants now offer the handoff, matching how service complaints already behave.
1.17.12
- Security: A “for bulk orders/special pricing, reach out to us at…” message could surface the store owner’s personal address instead of a deliberate public contact — the fallback (
woocommerce_email_from_address) is often never customized away from the site’s ownadmin_emailby store owners, so it silently mirrored a private inbox. That fallback is now skipped whenever it’s identical toadmin_email. - Fix: In Basic AI mode, “I want to buy the washing machine right now” (after the bot had just shown a washing machine) failed to connect the request to that product — “right now”/”asap”/”immediately”/”today” survived into the extracted search query, and WordPress’s default search requires every term to appear in a product’s title/content, so the filler words alone made the search find nothing.
- Fix: Accepting an offer to “show me sale items” ignored what the conversation had actually been about, returning whatever happened to be on sale storewide (a chest freezer, a dishwasher) instead of staying on-topic. Sale items now prefer the category of whatever was just shown in context, falling back to storewide only when nothing in that category is on sale.
- Fix: “Show me laptops” surfaced “Laptop Backpack” ahead of the actual “13-inch Laptop” — both title-match “laptop” equally, so results kept whatever order the underlying query happened to return. A keyword matching a title’s head noun (its final significant word) now ranks above one that only appears as an earlier modifier.
- Fix: “Which one is cheaper?” correctly retained context (the two products just shown) but the response was a generic side-by-side listing that never actually stated an answer. Now states which product is cheaper (or more expensive) and its price before the breakdown.
- Fix: “Is that waterproof?” wasn’t recognized as a follow-up about the product just shown at all, and triggered an unrelated fresh catalog search for the word “waterproof”. Bare attribute follow-up questions (“is it/that X?”, “does it have/come with X?”) are now recognized and answered honestly (Basic AI has no per-product spec data — that needs Real AI) instead of searching the whole catalog for the literal word.
1.17.11
- Security: Overrode the
js-yamltransitive dev dependency (pulled in via@wordpress/env‘s E2E test tooling) to 3.15.1, patching GHSA-5p4m-2wfm-xmqj (CVE-2026-59870) — quadratic CPU consumption when resolving a crafted!!omapYAML tag in versions 3.0.0-3.15.0, which could hang the parser on attacker-controlled YAML input. Dev/test-only tooling dependency, never shipped to production sites.