Title: AstriChat Connector
Author: astriapps
Published: <strong>November 7, 2026</strong>
Last modified: November 7, 2026

---

Search plugins

![](https://ps.w.org/astrichat-connector/assets/banner-772x250.png?rev=3789184)

![](https://ps.w.org/astrichat-connector/assets/icon.svg?rev=3789184)

# AstriChat Connector

 By [astriapps](https://profiles.wordpress.org/astriapps/)

[Download](https://downloads.wordpress.org/plugin/astrichat-connector.1.11.2.zip)

 * [Details](https://wordpress.org/plugins/astrichat-connector/#description)
 * [Reviews](https://wordpress.org/plugins/astrichat-connector/#reviews)
 *  [Installation](https://wordpress.org/plugins/astrichat-connector/#installation)
 * [Development](https://wordpress.org/plugins/astrichat-connector/#developers)

 [Support](https://wordpress.org/support/plugin/astrichat-connector/)

## Description

AstriChat Connector connects WordPress to the [AstriChat hosted service](https://astrichat.com).
Add a WhatsApp and web-chat widget, sync published content to your assistant’s knowledge
base, optionally forward contact-form enquiries, verify your website and access 
your AstriChat dashboard. Chat processing and AI run on AstriChat’s servers.

An AstriChat account and Site ID are required. Some hosted features require an eligible
AstriChat plan. Automatic widget injection, automatic content sync and form lead
forwarding are disabled on a new installation; administrators choose which features
to enable. See **External Services** and **Privacy** below before connecting.

Features:

 * Admin settings page under **AstriApps  AstriChat** (administrators only).
 * Configure Site ID, enable/disable the widget, the load script URL, load location,
   and an optional position override.
 * Optional page-visibility rules (all pages, front page only, or exclude specific
   IDs).
 * Asynchronous loading through WordPress’s script queue, in the footer or after`
   <body>` for automatic placement.
 * Admin connection status, live embed preview, setup instructions, and a link to
   the AstriChat dashboard.
 * One-click website ownership verification through a temporary public proof that
   AstriChat checks independently.
 * WhatsApp Business connection status (read-only) shown in the admin when an API
   key is configured.
 * “AstriChat Widget” Gutenberg block for manual placement (uses your saved Site
   ID).
 * `[astrichat]` shortcode fallback.
 * Optional lead capture from Contact Form 7, WPForms, Gravity Forms, Kadence Form,
   and Kadence Advanced Form.
 * Manual or automatic published-content sync, selected post types, per-post exclusions
   and removal of synchronized content.
 * Optional one-click dashboard sign-in using a dedicated API key and a separate
   signed WordPress-user assertion.
 * Settings-screen service disclosure and suggested text for the WordPress Privacy
   Policy Guide.
 * Proper sanitization, escaping, nonces, and capability checks.

### External Services

This plugin depends on the AstriChat service operated by AstriApps. It communicates
with **https://app.astrichat.com** and loads the service’s widget code from **https://
cdn.astrichat.com/widget.js**. These connections provide the configured chat, knowledge,
lead and account features; the hosted widget is part of that service.

Service: https://astrichat.com
 Account registration: https://licenses.astriapps.
com Privacy notice: https://astrichat.com/privacy Terms of service: https://astrichat.
com/terms

#### Widget and domain checks

After an administrator saves a Site ID, connection checks send that Site ID and 
the WordPress website origin to app.astrichat.com to confirm that the widget is 
allowed on this hostname. Checks occur when the connector’s administration screens
are opened and, when the widget is displayed, through an after-load same-site bootstrap
if authorization is not cached. A Site ID is a public identifier, not a password.

Enabling **Inject widget automatically**, or explicitly placing the AstriChat block
or [astrichat] shortcode, allows visitors’ browsers to download the hosted widget
from cdn.astrichat.com after domain approval. The widget retrieves its configuration
from app.astrichat.com and sends load/open/click events with the Site ID, page URL
and referrer. Enabled chat and enquiry features send the visitor’s submitted messages
and contact details, page URL and session/conversation identifiers to app.astrichat.
com. AI processing takes place in the hosted service. Browser local storage holds
session and conversation identifiers for continuity.

Like other HTTP services, these hosts receive the requesting browser’s or server’s
IP address, user-agent and ordinary request metadata. CDN requests receive browser
headers, including any referrer allowed by the site’s referrer policy. Server-side
WordPress requests can include the WordPress website URL and version in the default
user-agent. Uploaded/configured widget images may be served from URLs chosen in 
your AstriChat dashboard.

#### Published-content synchronization

Saving a Site ID and API key enables authenticated integration requests. **Sync 
now**, individual or bulk post sync actions and the administrator-only sync REST
endpoint explicitly send selected published WordPress content to app.astrichat.com.
A manually queued full sync continues in small WP-Cron batches after the settings
screen is closed. Saved progress resumes before any failed post; the settings screen
distinguishes submitted content from hosted indexing. Enabling **Automatic sync**
also sends content when selected post types are published or updated. Automatic 
sync is off by default.

The payload contains the Site ID, WordPress post ID and type, publication status,
title, permalink, rendered content, excerpt, modification time, slug, author display
name, featured-image URL and available SEO title/description. Supported vehicle 
listings may also include structured vehicle attributes. Review the content and 
metadata before syncing; rendered shortcodes or content filters can add information
beyond the editor’s raw text.

Unpublishing, deleting or excluding configured content can send its Site ID, post
ID and title to remove its synchronized copy. Cleanup requests may occur while an
API key remains configured even if Automatic sync is off. This does not synchronize
private posts, drafts or revisions through the normal published-content actions.

#### Optional contact-form lead forwarding

Forwarding is off by default. An administrator must enable **Lead capture** and 
select one or more **Forms to capture** providers. After a supported form submission,
WordPress sends the mapped name, email address, telephone number, message, Site 
ID and referring page URL to **https://app.astrichat.com/api/public/lead**. At least
an email address or phone number is required for forwarding. The website origin 
is sent for domain authorization. No API key is used for this public endpoint.

The controls apply to submissions handled by the enabled providers. The connector
does not add a visitor consent field; configure your form notices and consent controls
before enabling forwarding. Disabling the widget does not turn off form forwarding
or content sync; their settings are independent.

#### Administrator integration and sign-in

With a Site ID and API key configured, opening the connector settings or its WordPress
dashboard widget requests connection status, analytics summaries and recent leads
from app.astrichat.com, using the Site ID, website origin, API key and any selected
range/count. Responses may be cached in WordPress transients for 60 seconds, including
recent lead data.

Website verification runs when an administrator chooses **Verify website**. It sends
the Site ID, WordPress home URL, connector version and API key. A temporary verification
proof is placed in the site’s public HTML so AstriChat can independently fetch the
site and confirm ownership.

When an administrator requests one-click dashboard sign-in, the connector sends 
an authenticated, short-lived signed assertion containing the administrator email
address, WordPress user ID, website URL, Site ID, timestamps, a random nonce and
the requested dashboard path. The separate SSO secret signs the assertion locally
and is not sent as its plaintext value. The browser then POSTs a single-use ticket
to the same trusted AstriChat origin. Ordinary dashboard links open AstriChat in
the browser.

#### Optional Google events and WhatsApp

The hosted widget can send configured events to a website’s existing Google Analytics,
Google Ads or Google Tag Manager integration only when enabled in AstriChat and 
allowed by the connected consent controls. The connector does not install Google
tags. If you enable those integrations, disclose your use of Google separately: 
[Google privacy policy](https://policies.google.com/privacy) and [Google terms](https://policies.google.com/terms).
Following a WhatsApp contact link opens WhatsApp and can include a prefilled message
with the current page URL.

### Privacy

No external request is made merely by activating a new, unconfigured installation.
Saving a Site ID permits the connection checks described above. Displaying the widget,
requesting sync/sign-in/verification and enabling lead forwarding permit their respective
data transfers. These features are configured independently under **AstriApps  AstriChat**.

Use **Automatic sync**, **Content to sync**, per-post exclusions, **Enable lead 
capture** and **Forms to capture** to control what leaves WordPress. Manual sync
actions still send content with Automatic sync off. Removing the API key stops authenticated
integration features; it does not stop the public widget or public form-lead endpoint.
Disable the relevant features and remove manually placed blocks/shortcodes to stop
their requests.

The connector stores its settings and credentials, bounded synchronization logs 
and short-lived diagnostic/lead caches in WordPress. Chat records and synchronized
knowledge are stored by the hosted service; session/conversation identifiers are
also stored in the visitor’s browser. Disabling or uninstalling the connector does**
not** delete information already stored in AstriChat. Manage hosted retention, deletion
and privacy requests through your AstriChat account and the service’s privacy notice.

The plugin adds suggested text to WordPress’s **Settings  Privacy  Privacy Policy
Guide**. Adapt it to the features you enable and your own practices. It does not
publish or modify your site’s privacy policy automatically. Explain your transfers
to visitors and provide appropriate form notices and consent choices where required.

### API endpoint security

The default and automatically trusted API origin is **https://app.astrichat.com**.
API requests require HTTPS on port 443, reject credentials/paths/query strings/fragments
in the configured base URL, use WordPress’s safe HTTP API and do not follow redirects.
Existing untrusted API configurations are paused, rather than silently redirected
to a different service. The same endpoint check protects the public widget’s API
origin.

For a separately operated installation, a server administrator may add its exact
public HTTPS origin to the `ASTRICHAT_CONNECTOR_TRUSTED_API_ORIGINS` array constant
in wp-config.php, then select it using the connector’s **API endpoint** field. Custom
hosts must pass WordPress’s safe URL checks; local/private targets and non-standard
ports are not supported. Only authorize an operator you trust to receive API credentials,
content and submitted leads. If you use a custom API or widget script URL, update
your site’s disclosures to identify that operator and its policies.

## Blocks

This plugin provides 1 block.

 *   AstriChat Widget Insert the hosted AstriChat chat widget on this page.

## Installation

 1. Install and activate AstriChat Connector, then click its **Settings** link on the
    Plugins page or open **AstriApps  AstriChat**.
 2. Click **Create account** to register at https://licenses.astriapps.com, or **Sign
    in** if you already have an account. Keep the WordPress tab open.
 3. Verify your email, then add your website under **Sites** in AstriChat. Open the
    site and copy its **Site ID**.
 4. Return to WordPress, paste your Site ID, turn on **Inject widget automatically**,
    and click **Save settings**. Use the block / `[astrichat]` shortcode for manual
    placement instead.

The widget requires an AstriChat account. An integration API key is optional for
the widget, but is required for content sync, administrator diagnostics, website
ownership verification and one-click dashboard sign-in. One-click sign-in also requires
a separate WordPress SSO secret. Form lead forwarding uses the public lead endpoint
and does not need an API key.

## FAQ

### Do I need an AstriChat account?

Yes. Use **Create account** in the plugin’s welcome panel to register, or visit 
https://licenses.astriapps.com. After registering, add your website under **Sites**
and copy its Site ID back into WordPress. Existing users can choose **Sign in**.
Registration opens in a separate tab so you can return to finish setup.

### How do I remove a saved API key or SSO secret?

In Knowledge base and content sync, select **Remove saved API key** and/or **Remove
saved SSO secret**, then click **Save settings**. Leaving a password field blank
keeps its existing value unless its removal option is selected. Removal takes priority
over a replacement entered at the same time. These controls remove the credentials
stored in WordPress; revoke an API key in the AstriChat dashboard if you also want
to invalidate it.

### Does this plugin run AI or store chat data?

AI and chat processing run in the hosted AstriChat platform. The connector loads
the widget and also supports optional content sync, form lead forwarding, domain
verification and dashboard access. It stores settings, sync logs and short-lived
diagnostic/lead caches in WordPress; the widget stores session/conversation identifiers
in the browser. See External Services and Privacy for the data flows.

### The widget appears twice. Why?

It will not. The script is printed at most once per page, regardless of whether 
the footer injection, block, and shortcode are all present.

### How do I capture Kadence form submissions?

Activate Kadence Blocks, save your AstriChat Site ID, and open the connector’s Lead
capture settings. Enable lead capture and select Kadence Form and/or Kadence Advanced
Form, then save. These are separate opt-in controls; Kadence Blocks Pro is not required
for the connector integration. Submitted name, email, phone, and message fields 
are mapped to AstriChat leads. At least one email or phone field is required. Your
AstriChat plan must include lead capture, and the WordPress site domain must be 
allowed in AstriChat.

Name fields use common labels (Name, First name, Last name). Email, telephone, and
message fields can also be detected by their Kadence field types, even with translated
labels. Files, passwords, hidden fields, and unrelated form data are not forwarded.
No Kadence webhook action or separate integration API key is needed. Forwarding 
is best-effort and does not wait for AstriChat to respond; test a published form
and confirm the lead arrives in your dashboard.

## Reviews

There are no reviews for this plugin.

## Contributors & Developers

“AstriChat Connector” is open source software. The following people have contributed
to this plugin.

Contributors

 *   [ astriapps ](https://profiles.wordpress.org/astriapps/)

[Translate “AstriChat Connector” into your language.](https://translate.wordpress.org/projects/wp-plugins/astrichat-connector)

### Interested in development?

[Browse the code](https://plugins.trac.wordpress.org/browser/astrichat-connector/),
check out the [SVN repository](https://plugins.svn.wordpress.org/astrichat-connector/),
or subscribe to the [development log](https://plugins.trac.wordpress.org/log/astrichat-connector/)
by [RSS](https://plugins.trac.wordpress.org/log/astrichat-connector/?limit=100&mode=stop_on_copy&format=rss).

## Changelog

#### 1.11.2

 * Create account in the setup panel now opens AstriApps licensing (licenses.astriapps.
   com) to register and choose a plan, instead of the dashboard sign-up page.
 * Updates the setup step and readme registration links to match.

#### 1.11.1

 * Enqueues the bundled AstriApps hub stylesheet only on its own admin screen.
 * Enqueues a local one-click sign-in helper and explicitly prints that handle on
   the standalone POST handoff page; preserves the manual Continue button and token
   escaping.
 * Removes the inline sign-in script and its unsafe-inline script policy.
 * Replaces the recurring setup notice with an administrator-only Settings action
   link on the Plugins screen.
 * Limits manual content-sync notices to supported content screens and users with
   editing permission.
 * Adds the submitting WordPress.org account astriapps to Contributors.

#### 1.11.0

 * Queues full content sync in durable, bounded WP-Cron batches with ID checkpoints,
   retries, interruption recovery and visible submission status.
 * Preserves exclusions and source authorization; destination changes invalidate
   queued scans. Removes job state and scheduled events on uninstall.

#### 1.10.3

 * Uses WordPress enqueue and script-tag APIs for the widget, deferred authorization
   loader and explicit block/shortcode placements.
 * Preserves asynchronous loading, low fetch priority, domain checks, existing script
   nonces and single-widget output, including optional body placement.
 * Renames the connector settings helper to avoid confusion with WordPress’s deprecated
   get_settings function.
 * Fixes translator comments, an excluded-ID escaping warning, shared-menu text 
   domains and uninstall variable prefixes.
 * Documents narrowly scoped analyzer exceptions for the core content filter, a 
   widget visibility value and the bounded administrator content-sync query.
 * Verifies native behavior on WordPress 7.1.4/PHP 8.3 and updates Tested up to 
   to 7.1.

#### 1.10.2

 * Corrects the plugin description to cover chat, content sync, optional form forwarding,
   domain verification and dashboard access.
 * Documents external services, request triggers, transferred data, feature controls
   and privacy/terms links.
 * Adds a settings-screen external service notice and suggested WordPress privacy
   policy text.
 * Restricts all API requests and the widget API origin to explicitly trusted public
   HTTPS origins, using safe HTTP requests with TLS verification and redirects disabled.
 * Adds an API endpoint field for the hosted service or a custom deployment explicitly
   authorized by the server administrator. Existing untrusted endpoints are paused.

#### 1.10.1

 * Aligns the connector and hosted widget URL with AstriChat 1.10.1. Deploy the 
   rebuilt hosted widget to apply its startup, history and image-loading improvements.
 * Removes blocking remote domain checks from visitor-page rendering. Cold-cache
   authorization runs after page load through a same-site loader; the hosted widget
   is injected only after explicit domain approval.
 * Loads widget scripts at low priority. Cached approval still uses the direct async
   embed.

#### 1.10.0

 * Aligns the connector and hosted widget URL with AstriChat 1.10.0.
 * The hosted widget adds optional Google Analytics 4 events, Google Ads conversions
   and Google Tag Manager events, configured per site in the dashboard.
 * Google tracking is off by default and requires the website’s existing Google 
   tag or Tag Manager setup and a connection to its consent manager.
 * Adds consent-controlled campaign attribution to saved widget enquiries, visible
   in the dashboard. Ordinary WordPress form forwarding is unchanged.
 * Fixes the mobile contact bar to use the selected chat button icon, including 
   custom images, in the widget and dashboard preview.
 * Includes clearer marketing copy and fixes the marketing site’s security policy
   so its hosted widget can load and contact the API.
 * Requires the matching dashboard release and lead-attribution database migration.
   Rebuild and upload widget.js to the public widget CDN, then clear cached website
   pages as needed.

#### 1.9.7

 * Adds a welcome panel with Create account and Sign in links for new installations.
 * Guides users through registering, adding their website, and connecting its Site
   ID.
 * Adds a Get started shortcut and setup notice on the Plugins page until a Site
   ID is saved.
 * Clarifies that integration API credentials are optional and updates the Site 
   ID help.

#### 1.9.6

 * Separates public widget readiness from the optional WordPress integration API
   connection.
 * Shows Not checked when WordPress cannot read website ownership status, rather
   than incorrectly reporting Unverified.
 * Aligns the widget URL with credential-free installation tracking and accurate
   event-write failure responses.

#### 1.9.5

 * Aligns the widget URL with the release that fixes public uploaded image headers
   and header image error handling.

#### 1.9.4

 * Stops emitting the widget script unless this WordPress website has explicit domain
   approval.
 * Applies the approval guard to automatic injection, shortcodes, Gutenberg blocks,
   and the block render fallback.
 * Pauses output when the dashboard is outdated, the check is unavailable, or a 
   different website origin was approved.
 * After updating, clear WordPress page/CDN caches so previously cached HTML no 
   longer loads an unapproved widget.

#### 1.9.3

 * Requires an explicit, origin-matched domain-policy result before displaying Domain
   allowed.
 * Shows Dashboard update required when an older dashboard returns widget configuration
   without confirming domain authorization.
 * Discards cached domain status from earlier connector releases.

#### 1.9.2

 * Checks widget domain permission even when no API key is saved, and flags copied
   Site IDs on unrelated websites.
 * Replaces the misleading Widget live label with Domain allowed, Domain blocked,
   or Installation not checked.
 * Sends the WordPress website origin with integration requests and isolates cached
   diagnostics when a site is cloned to another domain.
 * Requires the matching AstriChat dashboard update, which restricts widgets to 
   the primary domain and explicitly approved aliases and checks WordPress content
   sync against its primary website.

#### 1.9.1

 * Adds separate controls to remove the saved API key and WordPress SSO secret when
   saving settings.
 * Simplifies settings with borderless cards, soft background tones, and clearer
   secondary actions.

#### 1.9.0

 * Adds separate lead capture controls for Kadence Form and Kadence Advanced Form.
 * Maps validated Kadence contact fields, including split names and typed email/
   telephone/message fields.
 * Includes the WordPress site’s origin when forwarding leads so allowed-domain 
   checks can succeed.

#### 1.8.1

 * Restores the dark admin button background so the sync action label remains visible.
 * Refreshes cached admin styles whenever the bundled stylesheet changes.

#### 1.8.0

 * Adds one-click website ownership verification using a temporary public meta tag.
 * Keeps authoritative verification in AstriChat, which independently fetches the
   exact configured hostname through the hardened DNS-pinned transport.
 * Refreshes the settings dashboard while preserving existing connector options 
   and security controls.

#### 1.7.0

 * Uses a separate WordPress SSO assertion secret so the integration API key alone
   cannot forge a user assertion.
 * Signs a short-lived, site-bound assertion for the current WordPress administrator
   before requesting dashboard SSO.
 * Removes the query-string login fallback and uses the protected POST handoff exclusively.
 * Carries a stable WordPress user ID while leaving AstriChat membership, role, 
   tenant, and MFA enforcement authoritative in the dashboard.

#### 1.6.0

 * Vehicle-listing sources (e.g. Vehica car listings) now include the source
    plugin’s
   own structured attributes (make, model, year, price, status, …) when syncing 
   to the knowledge base, so pricing and specs can be answered even when they only
   appear in custom fields rather than the post body. Ordinary page/post content
   sync is unchanged.

#### 1.5.2

 * Version-stamps the hosted widget URL so browsers immediately download layout 
   and behaviour updates instead of retaining an older cached bundle.

#### 1.5.1

 * Prevents WordPress optimization plugins from copying or delaying the hosted widget
   bundle, so CDN releases are picked up on their normal cache schedule.

#### 1.5.0

 * Moves the hosted widget to cdn.astrichat.com and the dashboard/API to app.astrichat.
   com.
 * Automatically migrates former first-party defaults while preserving custom script
   and API hosts.

#### 1.4.1

 * Serves the widget bundle from cdn.astriapps.com by default.
 * Keeps widget API requests pinned to chat.astriapps.com when the script is served
   from the CDN.

#### 1.4.0

 * Adds identity-bound, API-key-scoped one-click dashboard sign-in.
 * Sends one-time SSO credentials using a protected POST handoff instead of URL 
   query parameters.
 * Adds content synchronization, lead-form integration, connection status, and dashboard
   diagnostics.

#### 1.0.0

 * Initial release.

## Meta

 *  Version **1.11.2**
 *  Last updated **8 hours ago**
 *  Active installations **Fewer than 10**
 *  WordPress version ** 6.9 or higher **
 *  Tested up to **7.1.4**
 *  PHP version ** 8.2 or higher **
 * Tags
 * [chat](https://wordpress.org/plugins/tags/chat/)[customer support](https://wordpress.org/plugins/tags/customer-support/)
   [whatsapp](https://wordpress.org/plugins/tags/whatsapp/)[widget](https://wordpress.org/plugins/tags/widget/)
 *  [Advanced View](https://wordpress.org/plugins/astrichat-connector/advanced/)

## Ratings

No reviews have been submitted yet.

[Your review](https://wordpress.org/support/plugin/astrichat-connector/reviews/#new-post)

[See all reviews](https://wordpress.org/support/plugin/astrichat-connector/reviews/)

## Contributors

 *   [ astriapps ](https://profiles.wordpress.org/astriapps/)

## Support

Got something to say? Need help?

 [View support forum](https://wordpress.org/support/plugin/astrichat-connector/)