AstriChat Connector

AstriChat Connector connects WordPress to the AstriChat hosted service. Add a WhatsApp and web-chat widget, sync published content to your assistant’s knowledge base, optionally forward contact-form enquiries, verify your website and access your AstriChat dashboard. Chat processing and AI run on AstriChat’s servers.

An AstriChat account and Site ID are required. Some hosted features require an eligible AstriChat plan. Automatic widget injection, automatic content sync and form lead forwarding are disabled on a new installation; administrators choose which features to enable. See External Services and Privacy below before connecting.

Features:

• Admin settings page under AstriApps → AstriChat (administrators only).
• Configure Site ID, enable/disable the widget, the load script URL, load location, and an optional position override.
• Optional page-visibility rules (all pages, front page only, or exclude specific IDs).
• Asynchronous loading through WordPress’s script queue, in the footer or after <body> for automatic placement.
• Admin connection status, live embed preview, setup instructions, and a link to the AstriChat dashboard.
• One-click website ownership verification through a temporary public proof that AstriChat checks independently.
• WhatsApp Business connection status (read-only) shown in the admin when an API key is configured.
• “AstriChat Widget” Gutenberg block for manual placement (uses your saved Site ID).
• [astrichat] shortcode fallback.
• Optional lead capture from Contact Form 7, WPForms, Gravity Forms, Kadence Form, and Kadence Advanced Form.
• Manual or automatic published-content sync, selected post types, per-post exclusions and removal of synchronized content.
• Optional one-click dashboard sign-in using a dedicated API key and a separate signed WordPress-user assertion.
• Settings-screen service disclosure and suggested text for the WordPress Privacy Policy Guide.
• Proper sanitization, escaping, nonces, and capability checks.

External Services

This plugin depends on the AstriChat service operated by AstriApps. It communicates with https://app.astrichat.com and loads the service’s widget code from https://cdn.astrichat.com/widget.js. These connections provide the configured chat, knowledge, lead and account features; the hosted widget is part of that service.

Service: https://astrichat.com
Account registration: https://app.astrichat.com/signup
Privacy notice: https://astrichat.com/privacy
Terms of service: https://astrichat.com/terms

Widget and domain checks

After an administrator saves a Site ID, connection checks send that Site ID and the WordPress website origin to app.astrichat.com to confirm that the widget is allowed on this hostname. Checks occur when the connector’s administration screens are opened and, when the widget is displayed, through an after-load same-site bootstrap if authorization is not cached. A Site ID is a public identifier, not a password.

Enabling Inject widget automatically, or explicitly placing the AstriChat block or [astrichat] shortcode, allows visitors’ browsers to download the hosted widget from cdn.astrichat.com after domain approval. The widget retrieves its configuration from app.astrichat.com and sends load/open/click events with the Site ID, page URL and referrer. Enabled chat and enquiry features send the visitor’s submitted messages and contact details, page URL and session/conversation identifiers to app.astrichat.com. AI processing takes place in the hosted service. Browser local storage holds session and conversation identifiers for continuity.

Like other HTTP services, these hosts receive the requesting browser’s or server’s IP address, user-agent and ordinary request metadata. CDN requests receive browser headers, including any referrer allowed by the site’s referrer policy. Server-side WordPress requests can include the WordPress website URL and version in the default user-agent. Uploaded/configured widget images may be served from URLs chosen in your AstriChat dashboard.

Published-content synchronization

Saving a Site ID and API key enables authenticated integration requests. Sync now, individual or bulk post sync actions and the administrator-only sync REST endpoint explicitly send selected published WordPress content to app.astrichat.com. A manually queued full sync continues in small WP-Cron batches after the settings screen is closed. Saved progress resumes before any failed post; the settings screen distinguishes submitted content from hosted indexing. Enabling Automatic sync also sends content when selected post types are published or updated. Automatic sync is off by default.

The payload contains the Site ID, WordPress post ID and type, publication status, title, permalink, rendered content, excerpt, modification time, slug, author display name, featured-image URL and available SEO title/description. Supported vehicle listings may also include structured vehicle attributes. Review the content and metadata before syncing; rendered shortcodes or content filters can add information beyond the editor’s raw text.

Unpublishing, deleting or excluding configured content can send its Site ID, post ID and title to remove its synchronized copy. Cleanup requests may occur while an API key remains configured even if Automatic sync is off. This does not synchronize private posts, drafts or revisions through the normal published-content actions.

Optional contact-form lead forwarding

Forwarding is off by default. An administrator must enable Lead capture and select one or more Forms to capture providers. After a supported form submission, WordPress sends the mapped name, email address, telephone number, message, Site ID and referring page URL to https://app.astrichat.com/api/public/lead. At least an email address or phone number is required for forwarding. The website origin is sent for domain authorization. No API key is used for this public endpoint.

The controls apply to submissions handled by the enabled providers. The connector does not add a visitor consent field; configure your form notices and consent controls before enabling forwarding. Disabling the widget does not turn off form forwarding or content sync; their settings are independent.

Administrator integration and sign-in

With a Site ID and API key configured, opening the connector settings or its WordPress dashboard widget requests connection status, analytics summaries and recent leads from app.astrichat.com, using the Site ID, website origin, API key and any selected range/count. Responses may be cached in WordPress transients for 60 seconds, including recent lead data.

Website verification runs when an administrator chooses Verify website. It sends the Site ID, WordPress home URL, connector version and API key. A temporary verification proof is placed in the site’s public HTML so AstriChat can independently fetch the site and confirm ownership.

When an administrator requests one-click dashboard sign-in, the connector sends an authenticated, short-lived signed assertion containing the administrator email address, WordPress user ID, website URL, Site ID, timestamps, a random nonce and the requested dashboard path. The separate SSO secret signs the assertion locally and is not sent as its plaintext value. The browser then POSTs a single-use ticket to the same trusted AstriChat origin. Ordinary dashboard links open AstriChat in the browser.

Optional Google events and WhatsApp

The hosted widget can send configured events to a website’s existing Google Analytics, Google Ads or Google Tag Manager integration only when enabled in AstriChat and allowed by the connected consent controls. The connector does not install Google tags. If you enable those integrations, disclose your use of Google separately: Google privacy policy and Google terms. Following a WhatsApp contact link opens WhatsApp and can include a prefilled message with the current page URL.

Privacy

No external request is made merely by activating a new, unconfigured installation. Saving a Site ID permits the connection checks described above. Displaying the widget, requesting sync/sign-in/verification and enabling lead forwarding permit their respective data transfers. These features are configured independently under AstriApps → AstriChat.

Use Automatic sync, Content to sync, per-post exclusions, Enable lead capture and Forms to capture to control what leaves WordPress. Manual sync actions still send content with Automatic sync off. Removing the API key stops authenticated integration features; it does not stop the public widget or public form-lead endpoint. Disable the relevant features and remove manually placed blocks/shortcodes to stop their requests.

The connector stores its settings and credentials, bounded synchronization logs and short-lived diagnostic/lead caches in WordPress. Chat records and synchronized knowledge are stored by the hosted service; session/conversation identifiers are also stored in the visitor’s browser. Disabling or uninstalling the connector does not delete information already stored in AstriChat. Manage hosted retention, deletion and privacy requests through your AstriChat account and the service’s privacy notice.

The plugin adds suggested text to WordPress’s Settings → Privacy → Privacy Policy Guide. Adapt it to the features you enable and your own practices. It does not publish or modify your site’s privacy policy automatically. Explain your transfers to visitors and provide appropriate form notices and consent choices where required.

API endpoint security

The default and automatically trusted API origin is https://app.astrichat.com. API requests require HTTPS on port 443, reject credentials/paths/query strings/fragments in the configured base URL, use WordPress’s safe HTTP API and do not follow redirects. Existing untrusted API configurations are paused, rather than silently redirected to a different service. The same endpoint check protects the public widget’s API origin.

For a separately operated installation, a server administrator may add its exact public HTTPS origin to the ASTRICHAT_CONNECTOR_TRUSTED_API_ORIGINS array constant in wp-config.php, then select it using the connector’s API endpoint field. Custom hosts must pass WordPress’s safe URL checks; local/private targets and non-standard ports are not supported. Only authorize an operator you trust to receive API credentials, content and submitted leads. If you use a custom API or widget script URL, update your site’s disclosures to identify that operator and its policies.