V7 AI Chatbot

Description

V7 AI Chatbot adds a support assistant to your site that answers questions using only your published website content — your pages, posts and WooCommerce products. It is built to stay on-topic and to avoid disclosing anything private.

You choose the AI provider and model. API keys are encrypted before being stored in your database, and the plugin never ships with or requires any hardcoded key.

Supported AI providers

• WordPress AI Client (uses whatever provider WordPress itself is configured with)
• Anthropic Claude
• OpenAI GPT
• Google Gemini
• Groq (ultra-fast LPU inference)
• xAI Grok
• Mistral AI
• Cohere
• Meta Llama (via Together.ai)
• Ollama (self-hosted, no third-party service)

Model list stays current

Providers retire and rename models regularly. Instead of relying on a bundled list that goes stale, the settings screen can fetch the exact models your own API key is allowed to use, directly from the provider. If a configured model is retired, the plugin detects it, switches to a working model automatically and tells you it did so — so your chatbot does not go down.

Privacy and data protection

The plugin is deliberately conservative about what leaves your server:

• Only published, publicly visible content is used. Password-protected posts, private posts, drafts and products hidden from your catalog are excluded.
• Post meta, user accounts, customer records and WooCommerce orders are never read, so sales counts, revenue, stock levels and customer details cannot be sent anywhere.
• Before any prompt is sent, a scrubbing pass redacts anything resembling an email address, API key, access token, labelled password or long card-like number.
• The assistant is instructed to refuse requests for credentials, login or admin URLs, staff details, customer or order information, and to ignore visitor attempts to override those rules.
• Internal error details are shown only to administrators; visitors receive a neutral message.

Security

• API keys are encrypted at rest using AES-256-CBC with a key derived from your site’s own WordPress salts. No static or shared key is used.
• Saved keys are never redisplayed in the admin screen, and browser password managers are blocked from auto-filling the key fields.
• Keys are format-validated before saving, so pasting the wrong provider’s key (or an auto-filled password) is rejected with a clear message instead of failing silently later.
• All AJAX endpoints are nonce-verified, and administrative actions require the manage_options capability.
• All database queries use prepared statements; all output is escaped.

Source Code

All JavaScript and CSS is shipped unminified and human-readable under the assets/ directory. Development happens publicly at:
https://github.com/TheVaibhaw/v7-ai-chatbot

External services

This plugin sends data to a third-party AI provider only when you configure one and a visitor uses the chatbot. You choose which provider; only the one you select is contacted.

What is sent: the visitor’s chat message, plus context assembled from your published pages, posts and/or products (whichever you enable), plus your site name and description. Password-protected and private content, post meta, user data and WooCommerce order data are never included, and likely secrets or contact details are redacted before sending.

Depending on your selection, requests go to one of:

• Anthropic — https://api.anthropic.com — Terms / Privacy
• OpenAI — https://api.openai.com — Terms / Privacy
• Google Gemini — https://generativelanguage.googleapis.com — Terms / Privacy
• Groq — https://api.groq.com — Terms / Privacy
• xAI — https://api.x.ai — Terms / Privacy
• Mistral AI — https://api.mistral.ai — Terms / Privacy
• Cohere — https://api.cohere.com — Terms / Privacy
• Together.ai (for Meta Llama models) — https://api.together.xyz — Terms / Privacy
• Ollama — your own self-hosted URL. No third-party service is contacted.

The plugin also contacts your selected provider’s model-list endpoint when you click “Test Selected Provider” or “Load models from my account” in the admin screen. Those requests send only your API key for authentication.

Privacy

With conversation logging enabled (default, and switchable under Security & Privacy), this plugin creates database tables in your own site and stores:

• chat messages and the assistant’s replies
• the visitor’s IP address
• timestamps and per-conversation message counts

This data stays in your database and is not transmitted anywhere by the plugin. IP addresses are masked when displayed in the admin. You can set an automatic retention period in days, and disable logging entirely. All tables and settings are removed when the plugin is uninstalled.