Major rebuild of both the admin screen and the widget. The settings screen moved to its own top-level "NeccoSpeak" menu, and you must purge your page cache and CDN after updating. Your API key and settings carry over.<\/p>"},"ratings":{"1":0,"2":0,"3":0,"4":0,"5":0},"assets_icons":{"icon-128x128.gif":{"filename":"icon-128x128.gif","revision":3627855,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.gif":{"filename":"icon-256x256.gif","revision":3627855,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3652444,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3652444,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["0.1.0","0.1.1","0.3.0"],"block_files":[],"assets_screenshots":{"screenshot-1-ja.png":{"filename":"screenshot-1-ja.png","revision":3666518,"resolution":"1","location":"assets","locale":"ja","width":1090,"height":1558},"screenshot-1.png":{"filename":"screenshot-1.png","revision":3666518,"resolution":"1","location":"assets","locale":"","width":1002,"height":1618},"screenshot-2-ja.png":{"filename":"screenshot-2-ja.png","revision":3666518,"resolution":"2","location":"assets","locale":"ja","width":2466,"height":1838},"screenshot-2.png":{"filename":"screenshot-2.png","revision":3666518,"resolution":"2","location":"assets","locale":"","width":2472,"height":1830},"screenshot-3-ja.png":{"filename":"screenshot-3-ja.png","revision":3666518,"resolution":"3","location":"assets","locale":"ja","width":2472,"height":2280},"screenshot-3.png":{"filename":"screenshot-3.png","revision":3666518,"resolution":"3","location":"assets","locale":"","width":2468,"height":2266},"screenshot-4-ja.png":{"filename":"screenshot-4-ja.png","revision":3666518,"resolution":"4","location":"assets","locale":"ja","width":2470,"height":1618},"screenshot-4.png":{"filename":"screenshot-4.png","revision":3666518,"resolution":"4","location":"assets","locale":"","width":2460,"height":1642},"screenshot-5-ja.png":{"filename":"screenshot-5-ja.png","revision":3666518,"resolution":"5","location":"assets","locale":"ja","width":2484,"height":2392},"screenshot-5.png":{"filename":"screenshot-5.png","revision":3666518,"resolution":"5","location":"assets","locale":"","width":2452,"height":2390}},"screenshots":{"1":"The AI chatbot widget with its home view and voice chat button \u2014 visitors ask by text, or talk to your site and hear it answer.","2":"The Dashboard tab \u2014 the redesigned admin screen organized into nine tabs.","3":"The AI settings tab \u2014 save your OpenAI API key and define the assistant's role and goals.","4":"The Voice settings tab \u2014 pick the realtime model and voice, and tune how conversations flow.","5":"The Preview tab \u2014 check the widget live inside the admin screen before publishing changes."}},"plugin_section":[],"plugin_tags":[2353,191735,2364,194533,63792],"plugin_category":[41],"plugin_contributors":[271624],"plugin_business_model":[],"class_list":["post-332521","plugin","type-plugin","status-publish","hentry","plugin_tags-ai","plugin_tags-ai-chatbot","plugin_tags-chatbot","plugin_tags-openai","plugin_tags-voice-chat","plugin_category-communication","plugin_contributors-neccos","plugin_committers-neccos"],"banners":{"banner":"https:\/\/ps.w.org\/neccospeak\/assets\/banner-772x250.png?rev=3652444","banner_2x":"https:\/\/ps.w.org\/neccospeak\/assets\/banner-1544x500.png?rev=3652444","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/neccospeak\/assets\/icon-128x128.gif?rev=3627855","icon_2x":"https:\/\/ps.w.org\/neccospeak\/assets\/icon-256x256.gif?rev=3627855","generated":false},"screenshots":[{"src":"https:\/\/ps.w.org\/neccospeak\/assets\/screenshot-1.png?rev=3666518","caption":"The AI chatbot widget with its home view and voice chat button \u2014 visitors ask by text, or talk to your site and hear it answer."},{"src":"https:\/\/ps.w.org\/neccospeak\/assets\/screenshot-2.png?rev=3666518","caption":"The Dashboard tab \u2014 the redesigned admin screen organized into nine tabs."},{"src":"https:\/\/ps.w.org\/neccospeak\/assets\/screenshot-3.png?rev=3666518","caption":"The AI settings tab \u2014 save your OpenAI API key and define the assistant's role and goals."},{"src":"https:\/\/ps.w.org\/neccospeak\/assets\/screenshot-4.png?rev=3666518","caption":"The Voice settings tab \u2014 pick the realtime model and voice, and tune how conversations flow."},{"src":"https:\/\/ps.w.org\/neccospeak\/assets\/screenshot-5.png?rev=3666518","caption":"The Preview tab \u2014 check the widget live inside the admin screen before publishing changes."}],"raw_content":"\n
NeccoSpeak turns your WordPress site into something visitors can simply talk to: an AI agent that answers questions 24\/7 by text or voice, guides people to the right page, and runs entirely on your own OpenAI API key.<\/p>\n\n
No SaaS, no extra account, no monthly fee, and no server run by us. It needs nothing but WordPress and your own OpenAI API key. You pay OpenAI directly and stay in control of your costs and your data.<\/p>\n\n
AI voice chat sets NeccoSpeak apart, and it is on by default. Visitors ask questions hands-free and hear the answer spoken back \u2014 in effect, your website gains a voice assistant \u2014 a natural fit for accessibility, mobile users, and anyone who would rather speak than type. Under the hood, the visitor's browser connects directly to the OpenAI Realtime API over WebRTC using a short-lived token issued by your server; your real API key never reaches the browser. Voice requires HTTPS and browser microphone permission.<\/p>\n\n
You decide who the chatbot is: describe your business, opening hours, policies, and tone in the system prompt, and it answers accordingly.<\/p>\n\n
Visitors' chat usage is billed to your own OpenAI account, so NeccoSpeak ships with brakes built in: a per-IP, per-minute limit plus site-wide caps (hourly and daily for text chat, daily for voice sessions). When a cap is hit, further requests are declined with a temporary error until the limit window resets \u2014 so your bill stops growing.\nDefaults: chat 10\/min per IP plus 200\/hour and 1,000\/day site-wide; voice 3\/min per IP plus 200\/day site-wide.<\/p>\n\n
The Content sync card on the AI settings tab lets you choose how much of your own site the assistant can work with.<\/p>\n\n
The two optional features (page directory and site content search) stay off until you turn them on, and none of these features contact any additional external service.<\/p>\n\n
This plugin communicates with the external service OpenAI API<\/strong> (api.openai.com) to generate AI responses. This is a core feature of the plugin, and communication occurs when the AI chat \/ voice features are used. Voice conversation is a direct connection (WebRTC) to the OpenAI Realtime API, and this plugin does not use a STUN\/TURN server by default (no additional communication to third-party servers occurs).<\/p>\n\n When the optional \"Link check\" setting is on, the plugin also makes a request to this site's own host<\/strong> \u2014 never to any third party \u2014 solely to confirm that a link the assistant produced actually points to a real page before showing it to a visitor. Every outbound request (to OpenAI or to this site's own host) passes through a single allow-list that rejects private and link-local IP addresses after DNS resolution; a request to this site's own host is exempt from that IP check only, so sites behind Docker, a reverse proxy, or on an intranet keep working. The optional site content search, the optional tools, and the optional Contact Form 7 hand-off contact no external service at all \u2014 they run entirely on your own server and inside the visitor's own browser tab.<\/p>\n\n Data sent to OpenAI is subject to OpenAI's terms and policies. Please be sure to review them before use.<\/p>\n\n The Additional CSS box on the Widget settings tab (requires the \"unfiltered_html\" capability to edit) intentionally allows When \"Restore conversation\" is enabled, the conversation is temporarily saved in the visitor's own browser (sessionStorage) so it survives a page navigation within the same tab; it is cleared when the tab is closed. When the \"First-open modal\" disclaimer is enabled, only a true\/false \"acknowledged\" flag is saved (in localStorage or sessionStorage, depending on the setting). Neither of these is sent to any server, and neither stores any information that identifies the visitor.<\/p>\n\n In your own WordPress database.<\/strong> The plugin can also keep operational records in four of its own database tables on your server. Nothing here is ever transmitted anywhere \u2014 not to the developer, not to OpenAI, not to any third party \u2014 and every table is dropped when you uninstall the plugin.<\/p>\n\n No IP addresses, no cookies, no visitor identifiers are ever stored<\/strong> in any of these tables. Usage events are grouped by a random value that lives only in the visitor's own tab (sessionStorage) and disappears when that tab is closed \u2014 it cannot be used to recognise the same person again, on a later visit or in another tab.<\/p>\n\n Per-page settings<\/strong>: the optional per-page instructions, welcome-message override, widget show\/hide choice, and content-search exclusion flag are stored as WordPress post meta on the page itself \u2014 editing them requires a publishing-level role, not just the ability to edit that page.<\/p>\n\n Contact Form 7 hand-off<\/strong> (on by default; nothing is loaded on sites where Contact Form 7 is not installed, or until you add a \"Contact Form 7 (prefill)\" CTA button): clicking that CTA stores the name\/email\/message prefill values entirely inside the visitor's own browser tab (sessionStorage) \u2014 never on your server. It expires automatically after five minutes and is deleted as soon as the form page reads it.<\/p>\n\n From 0.3.0, the widget frame document (the same-origin While the configuration is incomplete, the widget is not loaded and no external communication is triggered.<\/p>\n\n\n No. NeccoSpeak is self-contained: it needs only WordPress and your own OpenAI API key.<\/p><\/dd>\n The plugin: yes \u2014 free and open source (GPL). The AI usage: billed by OpenAI to your own account (your own key), at OpenAI's rates. Check OpenAI's official pricing for details.<\/p><\/dd>\n By default it answers from the AI model plus the system prompt you write \u2014 put your key business facts (hours, prices, policies) in the system prompt and it will use them. If you turn on the optional site content search and page directory (both off by default, on the AI settings tab's Content sync card), it can also quote excerpts from your own published posts and pages and point visitors to the right one.<\/p><\/dd>\n The key is stored encrypted in the database with AES-256-CBC. It is never output to the front end (browser) and is masked in the admin screen.<\/p><\/dd>\n The chat endpoint has per-IP, per-minute rate limiting plus site-wide hourly and daily caps; voice token issuance has per-IP and site-wide daily caps. When a cap is exceeded, responses are temporarily limited (503). Beyond that, display rules let you reduce exposure to abuse by limiting which pages show the widget. The chat API also refuses requests that do not come from a page on your own site (a same-origin check), but since origins can be forged, the rate limits remain the real line of defense.<\/p><\/dd>\n Voice chat is on by default (the \"Enable voice conversation\" toggle in Voice settings) \u2014 just serve your site over HTTPS (SSL)<\/strong>. Browser microphone permission is requested when it is used. Audio goes from the browser directly to OpenAI over WebRTC using a short-lived token \u2014 your API key is never handed to the browser.<\/p><\/dd>\n While the plugin is unconfigured (disabled or no key), nothing is loaded on the front end at all. Once active, it loads a small widget only on the pages your display rules match.<\/p><\/dd>\n No. The model name is free-form, and \"Fetch available models\" retrieves the list of models currently available to your API key so you can pick one (metadata only \u2014 no token billing).<\/p><\/dd>\n Yes. Replies appear progressively, typewriter-style, instead of all at once. The reply your browser has already received is revealed a bit at a time, so nothing extra is needed from your server. The effect also respects the operating system's \"reduce motion\" setting.<\/p><\/dd>\n No \u2014 the search itself runs entirely on your own server, against your own database. Only the excerpts actually selected as relevant to a visitor's question are sent to OpenAI, the same way any other part of the prompt is.<\/p><\/dd>\n No. Both tools (site search, page lookup) are read-only \u2014 the assistant can look things up but can never create, edit, or delete anything. The current date and time is supplied automatically and is not a tool at all, so it cannot change anything either.<\/p><\/dd>\n Voice connects the browser directly to OpenAI (WebRTC). Because OpenAI's Realtime API does not require STUN\/TURN, this plugin does not use a STUN\/TURN server by default. On a few highly restrictive networks (UDP blocked, symmetric NAT, etc.), voice may fail to connect; please use text chat there. Advanced users can set their own STUN\/TURN servers via window.NECCOSPEAK_RTC_ICE_SERVERS (in that case, that destination becomes something you must disclose).<\/p><\/dd>\n This is a Chrome-for-Android behavior, not something this plugin controls: while a voice call is active, the call's audio is tied to the device's in-call volume control, and Android will not let that be lowered all the way to silent. To fully silence the assistant's voice during a call, use the widget's own speaker-mute button in the voice control bar instead of the device volume buttons \u2014 that mutes the assistant completely, on any device.<\/p><\/dd>\n After updating, purge any caching plugin (page cache and, if it has one, a separate \"minify\/combine JS\" cache) and any CDN sitting in front of your site, then hard-reload the page. The widget's front-end JavaScript is loaded from several nested files that browsers and CDNs are free to cache independently of the main plugin file's version number, so a stale copy of just one of those files can outlive the update. If the browser's developer console shows a \"Version mismatch\" warning, that confirms this is exactly what happened.<\/p><\/dd>\n\n<\/dl>\n\n\nOpenAI API<\/h4>\n\n
\n
\n
\n
Additional CSS box (optional)<\/h4>\n\n
url(https:\/\/\u2026)<\/code> and @font-face { src: url(https:\/\/\u2026) }<\/code> so administrators can reference their own hosted images\/fonts. As a result, if an administrator adds such a rule, every front-end page view may cause the visitor's browser to fetch that resource from the third-party host referenced in the CSS. This is entirely administrator-controlled: the plugin ships with no Additional CSS by default and reaches no third-party host unless an admin explicitly adds one.<\/p>\n\nData stored on your site (no external service)<\/h4>\n\n
\n
Third-party resources<\/h3>\n\n
?neccospeak_frame=1<\/code> page the front-end launcher opens inside an iframe) bundles the following third-party asset. It is served entirely from your own site \u2014 nothing here is fetched from a CDN or any other external host.<\/p>\n\nBootstrap Icons<\/h4>\n\n
\n
assets\/widget-frame\/vendor\/bootstrap-icons\/bootstrap-icons.css<\/code> (the complete upstream stylesheet; the only changes are the @font-face<\/code> rule reduced to the bundled woff2 file and an added explanatory comment \u2014 no selector or property value is modified), assets\/widget-frame\/vendor\/bootstrap-icons\/fonts\/bootstrap-icons.woff2<\/code> (the upstream v1.13.1 icon font, unmodified), assets\/widget-frame\/vendor\/bootstrap-icons\/LICENSE<\/code> (the upstream MIT license text, unmodified).<\/li>\n<\/ul>\n\n\n\n
\n
Do I need an account with you, or your server?<\/h3><\/dt>\n
Is it really free?<\/h3><\/dt>\n
Does the chatbot know my site content?<\/h3><\/dt>\n
Is the API key handled securely?<\/h3><\/dt>\n
Can visitors run up my OpenAI bill?<\/h3><\/dt>\n
What do I need for voice chat?<\/h3><\/dt>\n
Will it slow down my site?<\/h3><\/dt>\n
Do I need to update the plugin when a new model is released?<\/h3><\/dt>\n
Are responses displayed as a stream?<\/h3><\/dt>\n
Does the content search send my pages to OpenAI?<\/h3><\/dt>\n
Are the optional tools able to change anything on my site?<\/h3><\/dt>\n
Why does voice not connect on my network?<\/h3><\/dt>\n
Why can I not turn the voice volume all the way down on Android?<\/h3><\/dt>\n
I updated the plugin but the widget still looks\/behaves like the old version<\/h3><\/dt>\n
0.3.0<\/h4>\n\n
\n
?neccospeak_frame=1<\/code>) that the launcher opens inside an iframe, with its own dedicated Content-Security-Policy \u2014 script execution is restricted to same-origin plus a per-request nonce, and network access is restricted to this site and api.openai.com<\/code> only.<\/li>\n\n
assets\/widget.js<\/code> \/ assets\/widget.css<\/code> front end will 404 until the cache is cleared.<\/li>\n0.1.1<\/h4>\n\n
\n
0.1.0<\/h4>\n\n
\n