Description
Aiwend adds an AI chatbot to your WordPress site that answers visitors’ questions from the pages, posts and text files you choose, shows which sources it used, and stops when the limits you set are reached. You bring your own AI account (“bring your own key”) from OpenAI, Anthropic or Google Gemini. Aiwend has no server and no subscription, sends nothing to its author, and does not host or resell AI models. Developed by Erfan Teymouri.
Besides the chatbot, Aiwend includes tools for drafting content, improving WooCommerce product text, collecting inquiries, and letting an AI app you authorise read a few facts from your site. All six modules are free, and all are switched off after activation, so you turn on only what you need.
This is a beta release (0.8.1). The connections to OpenAI, Anthropic and Google Gemini were checked end to end once with real provider accounts using sample content only, and are otherwise tested with recorded sample responses. Providers change their services without notice, so expect rough edges, try Aiwend on a staging site first, and set a spending limit at your AI provider as well as in Aiwend.
The six modules
- Answer visitor questions from your own content (Chat and Knowledge). Create an assistant with its own name, instructions, look and AI model. Add knowledge from published posts and pages, or from uploaded TXT or Markdown files. The assistant answers only from sources you attach and mark Public, and each answer lists the sources it used. If the sources do not contain the answer, it says so. Show it inline with the “Aiwend Chat” block or the
[aiwend_chat bot="ID"]shortcode, or as a floating launcher. - Draft posts and pages (Content Studio). Write a brief, review the proposed draft, edit it, and save it as a WordPress draft. Nothing is published for you.
- Improve WooCommerce product text (WooCommerce AI, needs WooCommerce). Pick a simple product, choose which fields to send as reference and which fields to replace, and review the proposal. Price, SKU, stock, status and other fields are never changed.
- Collect inquiries (AI Forms). Add an inquiry form with
[aiwend_form id="N"]. Messages stay on your site for administrators. Nothing goes to an AI provider unless an administrator presses Analyze on one message, and Aiwend sends no emails. - Connect an AI app, read-only (MCP). An optional endpoint for AI apps that you connect with an application password. It offers nothing until you tick a tool, and it cannot change anything.
- Stay in control of cost. A site usage limit (assistants do not answer until you set one), per-conversation and per-visitor daily limits, a pause switch, and an administrator view of conversations with export and delete. Limits count “units” (an estimate of text size), not money; your provider’s invoice can differ.
How it works with your own API key
You create an API key at OpenAI, Anthropic or Google AI Studio, add it under Aiwend > AI Connections, and press Check access. The key is stored encrypted on your site. Answers and their cost go through your own provider account; Aiwend does not provide free AI usage. Usage is charged by the provider, separately from any ChatGPT, Claude or Gemini app subscription.
Not available
Meaning-based (embedding) search, human handoff, order or customer assistants, automatic emails, tools that change the site through MCP, and OAuth for MCP are not part of this plugin. Aiwend works with OpenAI, Anthropic and Google Gemini only.
This edition does not read PDF files; add that content as a post, a page or a text file.
Deactivation and uninstall
- Deactivating stops scheduled jobs and removes the chat widget and routes; all Aiwend data stays in the database.
- Deleting the plugin keeps all data by default (tables wp_aiwend_*, options aiwend_*), so reinstalling restores everything.
- To remove everything on delete, turn on Aiwend > Settings > Privacy > “When the plugin is deleted” > permanently delete (you must type DELETE). It then removes, for that site, the tables, options, capabilities and scheduled job, and the key file when no site on the installation keeps its data (saved provider keys then become unrecoverable). It cannot be undone.
- Your posts, pages, media and users are never deleted. AI providers keep their own records.
Requirements
Minimums: PHP 8.2 with the json, sodium and mbstring extensions; WordPress 7.0 or newer (tested on 7.0.7 and 7.1.3); InnoDB. Tested with PHP 8.2 and 8.3 and WordPress 7.0.7 and 7.1.3, on Linux (Apache and nginx) and Windows. PHP 8.4 or newer has not been tested.
Database versions: Aiwend supports MySQL 8.0 or newer and MariaDB 10.11 or newer. The suites were run on MySQL 8.0.46 and 8.4.11 and MariaDB 10.11.14 and 11.4.13 (unit tests with real-database variants, the integration suite, and install and uninstall checks); other patch versions of those series are expected to work. Newer series (for example MySQL 9 or MariaDB 11.8) were not individually verified; no problem is known and Aiwend shows no warning for them. Servers older than the minimum are not supported and Aiwend then shows a notice. MySQL 8.0 reached upstream end of life in April 2026: keep it patched through your host or move to 8.4. Aiwend never blocks activation because of the database version.
Other requirements: You need an API key from OpenAI, Anthropic or Google AI Studio with billing set up at the provider; usage is charged by the provider to your account, separately from any ChatGPT, Claude or Gemini app subscription.
External services
Aiwend contacts an AI provider only after an administrator connects their OWN account, and only for the actions below. Nothing is sent when settings are opened or saved, no provider is contacted by default, and Aiwend never switches to another provider on its own. Aiwend has no server and sends nothing to its author. It loads no scripts, styles, fonts or images from other servers.
- OpenAI (https://api.openai.com). “Check access” sends your API key to the model list endpoint. A chat answer sends the assistant’s instructions, the visitor’s conversation and the text excerpts of the sources used. “Send test message” sends one fixed test message. API customer terms (Services Agreement): https://openai.com/policies/services-agreement/ How API data is handled (Data controls in the OpenAI platform): https://developers.openai.com/api/docs/guides/your-data OpenAI’s general privacy policy, which covers its websites and consumer services and does not govern API customer content: https://openai.com/policies/privacy-policy/
- Anthropic (https://api.anthropic.com): the same purposes. Terms: https://www.anthropic.com/legal/commercial-terms Privacy: https://www.anthropic.com/legal/privacy
- Google Gemini API (https://generativelanguage.googleapis.com): the same purposes (Google AI Studio keys; Vertex AI is not supported). Terms: https://ai.google.dev/gemini-api/terms Privacy: https://policies.google.com/privacy
- Content Studio and WooCommerce AI send your brief or the selected product fields and the instructions to your connected provider only when someone starts a generation. AI Forms sends one stored message only when an administrator presses Analyze; visitors’ submissions never reach a provider by themselves.
- MCP makes no outbound request. It lets an application that you authorise with an application password read the data described below from your site; that application and its AI service are not controlled by Aiwend.
- Your provider may charge your account for these requests and may keep its own records; providers may handle data differently on free and paid plans. Aiwend’s unit budget limits what Aiwend sends; it is not your provider’s invoice, and local deletion cannot erase a provider’s copy.
- Answers are streamed through the WordPress HTTP API (wp_remote_post). These requests are HTTPS only, verify certificates, do not follow redirects, contact only the hosts above, and obey WP_HTTP_BLOCK_EXTERNAL, WP_ACCESSIBLE_HOSTS, the WordPress proxy constants and the
pre_http_requestfilter. Theaiwend_streaming_enabledfilter (return false) switches streaming off. Stop: when a visitor presses Stop, Aiwend immediately stops showing and processing the answer, keeps the part already received and closes the connection to the AI provider (through the WordPress http_api_curl action). Whether the provider stops generating or billing once its client has gone is up to the provider, so Aiwend records a stopped answer as “usage unknown” and holds its reservation as uncertain instead of settling it. - Code for an OpenAI embeddings request exists but is switched off and cannot run in this build; meaning-based search sends nothing.
Privacy
- Consent and visitor notice. Nothing leaves your site until an administrator connects their own provider account and turns on a module. The chat shows visitors a short notice under the message box that answers can be wrong and that messages and selected source excerpts are sent to the configured AI provider. As the site owner you decide whether that is enough for your visitors and your local law, and you should mention the provider in your own privacy policy.
- What is stored. Chat messages and sessions are kept in your database and deleted after 30 days by default (Aiwend > Settings > Privacy). Audit events record actions and outcomes, not message content (30 days by default). Usage records (request IDs and unit counts, no message content) are kept for spending control. Knowledge text and its index are kept until you delete the source; uploaded files are stored as text in the database, not in the uploads folder.
- Cookie. A visitor’s chat uses a random cookie (aiwend_chat_, HttpOnly, SameSite=Strict, up to 24 hours); only a hash of it is stored.
- Abuse limits. Aiwend uses a keyed hash of the visitor’s network address (an IPv6 address as its /64 network), never the address itself, for message and conversation limits (kept for minutes) and for the daily limit (a hash that changes every day, kept for about two days). Signed-in visitors are counted by account number. Administrators see only counts.
- Providers. When an assistant answers, the data described under “External services” leaves your site. The
store:falsesetting on OpenAI requests disables response storage but does not promise zero retention. Closing the stream does not prove that remote processing or billing stopped. - AI Forms. A submission stores the optional name, email address, topic and message, a creation and expiry time and, if analysed, the administrator’s AI result. Submissions are deleted after 30 days by default (1 to 365 days) and an administrator can delete any message at once. No IP address, user agent or user ID is stored.
- MCP. Requests are logged as tool name and outcome only, never arguments, results or credentials. Tools return the site name and language, a list of published pages or posts, and the text of one published, public, non-password-protected page or post; text you do not want an AI service to read should not be published.
- Aiwend adds text to the WordPress privacy policy guide and supports the WordPress personal data export and erasure tools (conversations of signed-in users, AI Forms by email address). Guests can delete their own conversation in the chat. These controls alone do not make a site compliant with any privacy law.
Source code
All PHP, JavaScript and CSS in this plugin is shipped as written: nothing is minified, compiled or generated, and there is no build step for it. The only bundled library, symfony/polyfill-mbstring, is installed with Composer from composer.json (composer install –no-dev) and its unmodified source is in the vendor folder.
License
Aiwend’s own code and the Aiwend symbol images (assets/brand/aiwend-symbol-64.png, -128.png, -256.png) are licensed under the GNU General Public License, version 3 or (at your option) any later version (SPDX: GPL-3.0-or-later); the full text is in the LICENSE file. Third-party components keep their own licenses and notices, listed in THIRD-PARTY-NOTICES.txt (symfony/polyfill-mbstring is MIT).
Third-party notices
See THIRD-PARTY-NOTICES.txt.
Screenshots
Blocks
This plugin provides 1 block.
- Aiwend Chat Shows an AI assistant that answers visitors' questions.
Installation
- Install and activate Aiwend (Plugins > Add New, or Upload Plugin). All modules are off after activation.
- Open Aiwend > Overview and follow its checklist; it shows what is still missing.
- In Aiwend > Settings > Modules turn on Chat and Knowledge. Create an assistant, add knowledge (a page, post or text file), mark it Public and attach it to the assistant.
- Nothing to set up for the encryption key: Aiwend derives it from the secret keys and salts in your wp-config.php. If those are missing or still the sample text, the AI Connections screen says so and tells you to add an AIWEND_SECRET_KEY line to wp-config.php (see OPERATIONS.txt in the plugin folder). Aiwend creates no key file.
- Add a connection (name and API key from OpenAI, Anthropic or Google AI Studio) and press Check access. It asks the provider for its model list (no text is generated); after it succeeds, choose a model.
- Set a site usage limit, test the assistant privately, then add it to a page.
- On low-traffic sites add a server cron job so background jobs (indexing, clean-up) run on time.
Back up the database and the encryption key together. Without the key, saved provider keys cannot be decrypted after a restore and must be entered again. Backups, key moves, proxies, limits and other advanced topics are in OPERATIONS.txt, in the plugin folder (wp-content/plugins/aiwend).
FAQ
-
Is Aiwend free?
-
Yes. All six modules are included at no charge, with no paid tier and no licence key. You pay your AI provider directly for the requests your site makes, so set a spending limit there as well as in Aiwend.
-
Do I need an AI account?
-
Yes. You need an API key from OpenAI, Anthropic or Google AI Studio with billing set up at the provider. Aiwend does not include AI usage. A ChatGPT, Claude or Gemini app subscription is a different product and does not provide an API key.
-
What happens to my visitors’ messages?
-
Chat messages are stored in your database (30 days by default) and, to produce an answer, sent to the AI provider you connected together with the assistant’s instructions and the text excerpts of the sources used. The chat shows visitors a short notice about this. See “External services” and “Privacy” below, and mention your provider in your own privacy policy.
-
How is Aiwend different from a hosted chatbot service?
-
Aiwend runs inside your WordPress site and has no server of its own. Your content, conversations and settings are stored in your own database, you choose the provider and the model, and the spending limits are enforced by your site. The text needed to produce an answer (the visitor’s message, the assistant’s instructions and the relevant excerpts of your sources) is sent to the AI provider you connected; see “External services” and “Privacy” below. The trade-off: you manage your own provider account, and Aiwend does not offer features that need a central service, such as human handoff.
-
Does it work with WooCommerce?
-
Yes, for product text only. WooCommerce AI proposes a title and descriptions for simple products and replaces only the fields you tick. It does not answer questions about orders or customers, and it never changes price, stock, SKU or status.
-
Can I use it as an FAQ or knowledge base chatbot?
-
Yes. Add your FAQ pages, posts or text files as knowledge, mark them Public and attach them to the assistant. Search matches words rather than meaning, so keep the content visitors need in the language they ask in.
-
What is MCP, and is it safe to turn on?
-
MCP (Model Context Protocol) lets an AI app that you authorise read data from a service. Aiwend’s MCP endpoint is optional, off by default, read-only, and offers nothing until you tick a tool. It needs an application password and refuses browser sessions. See “How do I use MCP safely?” below.
-
The assistant does not answer.
-
Open Aiwend > Overview: the checklist and “System readiness” show what is missing (Chat and Knowledge turned on, an active public assistant, an AI connection whose access check passed, knowledge attached, and a site usage limit). Usage-limit messages mean one of the limits on the Usage page was reached.
-
“Check access” fails.
-
The provider could not be reached or rejected the key. Check the key and the provider’s billing, that your server can make outgoing HTTPS requests, and that WP_HTTP_BLOCK_EXTERNAL or a firewall is not blocking the provider host (list it in WP_ACCESSIBLE_HOSTS). No answer is sent to a connection that has not passed the check.
-
Anthropic says my key is not tied to a workspace.
-
Anthropic keys can be tied to a workspace or not, depending on how they were created, and Anthropic may refuse a key that is not when no workspace is named. Aiwend does not send a workspace header. If Check access reports this, create a new key inside a workspace in the Claude Console (choose the workspace when you create the key) and use that key.
-
How do the limits work?
-
Aiwend counts text in “units” (an estimate of tokens, about one unit per three characters). Units are not money and your provider’s invoice can differ. Before each answer Aiwend reserves an upper estimate against every limit at once; if any limit is reached, nothing is sent to the provider. There is a site limit (you set it), a per-conversation limit, a per-visitor daily limit, a pause switch and message-rate limits. They protect against one heavy visitor, not against many visitors together: the site limit and a spending limit at your provider are your real protection. Defaults and developer filters are in OPERATIONS.txt.
-
Who can change what?
-
Administrators manage everything. Editors can manage the knowledge library by default, but new knowledge starts private and only administrators can approve a source for answers (the
aiwend_publish_knowledgecapability). Other roles have no access. -
Why does the assistant say it cannot find the answer in another language?
-
Finding the right passage is done by matching words, not by translating, so a question in a language other than your source text has no words in common with it and the assistant says it could not find that information. Nothing is sent to the provider in that case. Keep the content visitors need in the language they ask in.
-
Why are some of my page’s contents missing from answers?
-
Aiwend reads the content WordPress stores for the post, with shortcodes removed. Text that a theme, dynamic block or page builder produces only when the page is displayed is not included. Use Knowledge > Inspect text to see what was indexed, or upload the text as a TXT or Markdown file.
-
Where is the provider key stored?
-
Encrypted in your database. The encryption key is not in the database: it is AIWEND_SECRET_KEY in wp-config.php or, when that is not set, a key derived from the secret keys and salts in wp-config.php. Aiwend writes no key file. It protects saved provider keys if only a copy of the database leaks; it does not protect them from anyone who can read your site files.
-
How do I use MCP safely?
-
Turn MCP on under Aiwend > Settings > Modules, tick only the tools you need under Aiwend > MCP, use HTTPS, and create a separate application password for each app so you can revoke it. Browser sessions are refused, and the user needs the
aiwend_use_mcpcapability (administrators have it by default). The MCP endpoint was tested with the official TypeScript MCP SDK client; compatibility with other AI apps has not been verified, and apps that need OAuth, streaming or older protocol revisions cannot connect. More in OPERATIONS.txt. -
Does AI Forms email me when someone writes?
-
No. Messages wait in Aiwend > AI Forms. There is no email, webhook or automatic AI reply.
-
Can I upload PDF files?
-
Not in this edition. PDF parsing is the riskiest step of a knowledge base, so it is not part of the WordPress.org package; a PDF upload is refused with an explanation, and TXT, Markdown, posts and pages work as usual.
-
Does Aiwend include logo images?
-
Yes, one: the Aiwend symbol (three small PNG sizes in assets/brand), shown beside the name in Aiwend’s own admin screens and as the admin menu icon. It is artwork created with an AI image tool for this project, and the developer licenses it, like the rest of the plugin, under the GPL-3.0-or-later. The name and logo are not a registered trademark, and no exclusive rights in the design are claimed. The public chat never shows it: the avatar defaults to the first letter of the assistant’s display name, or an image you choose.
-
Where do I get help?
-
Please use the plugin’s support forum on WordPress.org. Never post an API key or the contents of wp-config.php in a public forum.
-
Who develops Aiwend?
-
Aiwend is developed by Erfan Teymouri, an individual developer. It is not a product of OpenAI, Anthropic or Google, which are independent companies; their names are used only to say which services you can connect.
Aiwend is free to use. If it helps your website, you can optionally support its ongoing development and maintenance through the link at the bottom of Aiwend > Overview. Contributions do not unlock features or provide priority support, and the plugin itself never contacts the donation page; it is only a link you can choose to open.
Reviews
There are no reviews for this plugin.
Contributors & Developers
“Aiwend” is open source software. The following people have contributed to this plugin.
Contributors
Translate “Aiwend” into your language.
Interested in development?
Browse the code, check out the SVN repository, or subscribe to the development log by RSS.
Changelog
0.8.1
- Directory presentation only: clearer description, FAQ, tags and screenshot captions in the readme, and the version number. No change to the plugin’s code, database schema, providers or behaviour.
0.8.0
- Beta release. Chat and Knowledge modules, plus Content Studio, WooCommerce AI, AI Forms and a read-only MCP endpoint (all off by default; new database table for AI Forms, added automatically on update); provider connections for OpenAI, Anthropic and Google Gemini (checked once with real accounts and sample content, otherwise tested with recorded responses); a stopped answer is labelled “Stopped by you” and keeps the text already shown; encrypted provider keys with an optional key file and re-encryption; site, conversation and per-visitor daily usage limits with administrator notices; opt-in permanent deletion on uninstall; word-matching knowledge search with cited sources; GPL-3.0-or-later license.