Title: Epkora Live Chat Author: epkora Published: September 17, 2026 Last modified: September 17, 2026 --- Search plugins ![](https://ps.w.org/epkora-live-chat/assets/icon-256x256.png?rev=3700394) # Epkora Live Chat By [epkora](https://profiles.wordpress.org/epkora/) [Download](https://downloads.wordpress.org/plugin/epkora-live-chat.1.0.6.zip) * [Details](https://wordpress.org/plugins/epkora-live-chat/#description) * [Reviews](https://wordpress.org/plugins/epkora-live-chat/#reviews) * [Installation](https://wordpress.org/plugins/epkora-live-chat/#installation) * [Development](https://wordpress.org/plugins/epkora-live-chat/#developers) [Support](https://wordpress.org/support/plugin/epkora-live-chat/) ## Description Epkora Live Chat connects a WordPress website to an Epkora workspace and loads the Epkora Live Chat service on the public site. Epkora is an external Software- as-a-Service customer-support platform; this plugin is not a local WordPress help desk. An Epkora account and workspace are required. After activation, an administrator connects the site to an Epkora workspace and approves it; Live Chat then loads automatically. No API key, copied JavaScript, or theme edit is required. #### What the plugin does * Adds the Epkora Live Chat service to public-facing WordPress pages. * Shows the connection and Live Chat state on a dedicated Epkora settings page. * Checks the installation with Epkora after connection so remote revocation and Live Chat changes are reflected in WordPress. * Lets an administrator disconnect or reconnect the website. * Never loads the chat widget in wp-admin. #### What the plugin does not do * It does not send WordPress posts, pages, comments, users, email addresses, WordPress version, or PHP version to Epkora. * It does not grant Epkora access to WordPress administration. * It does not add analytics, advertising, affiliate links, review prompts, dashboard widgets, or a public-site credit of its own. * It does not make an administrative status request from PHP on every public page load. When connected, each visitor’s browser does contact Epkora to load and use the external Live Chat service, as described below. #### Connection security The explicit administrator connection uses a cryptographically random state value and PKCE S256. WordPress sends the browser to Epkora for sign-in, workspace selection, and approval. Epkora returns a short-lived, single-use authorization code. The WordPress server exchanges that code and the PKCE verifier directly with Epkora. The resulting installation credential is stored in the WordPress Options API, is not autoloaded, and is sent only to the fixed Epkora integration API over HTTPS. Epkora stores a hash of that credential. The credential is limited to installation status and disconnection operations; it does not authorize access to Epkora conversations, contacts, tickets, team settings, or billing. ### External Services This plugin depends on the Epkora SaaS platform. The following requests occur only after a WordPress administrator explicitly starts or has completed a connection. #### www.epkora.com **Authorization.** When an administrator clicks **Connect to Epkora**, their browser opens https://www.epkora.com/integrations/wordpress/authorize. The URL contains a random state value, the WordPress callback URL, the site’s public URL and name, the PKCE S256 challenge, and the plugin version. Epkora receives ordinary connection metadata such as the administrator’s IP address and browser user agent. Sign-in, workspace selection, and approval happen on Epkora. WordPress receives the authorization result and a short-lived code; the administrator’s Epkora password is never sent to WordPress. **Live Chat service.** Once connected and enabled, public pages load https://www. epkora.com/embed/live-chat.js asynchronously. This remote JavaScript is the client for the Epkora SaaS Live Chat service: it creates an Epkora-hosted chat frame and communicates with Epkora for widget configuration, availability, messages, agent replies, and related chat features. It is not a WordPress update mechanism. Ordinary plugin administration CSS and images are packaged locally with the plugin. Loading the service sends the Epkora embed key and the embedding hostname to Epkora, together with normal web-request metadata such as the visitor’s IP address, browser user agent, origin/referrer information made available by the browser, and requested page. Opening Live Chat retrieves the configured widget and team availability. If a visitor starts a conversation, requests contain the message and client message identifier, the current-page value supplied by the service client, and any configured profile or topic fields the visitor chooses to provide, such as name, email address, phone number, or topic. Epkora may derive browser, device, and operating-system details from request headers and uses the IP address for service security and rate limiting. Epkora returns widget configuration, availability, a conversation identifier, conversation history, agent messages, and other chat responses needed to provide the service. A secure Epkora visitor-session cookie is set after a visitor sends their first message so the conversation can continue. Any Epkora branding displayed inside the chat frame is output of the external service, not a link injected into WordPress content by this plugin. #### integrations.epkora.com **Authorization-code exchange.** After approval, the WordPress server sends a JSON POST request to https://integrations.epkora.com/api/integrations/wordpress/exchange. It contains the one-time authorization code, WordPress site URL, fixed callback URL, PKCE verifier, site name, and plugin version. The request user agent also identifies the plugin version and site URL. The response contains the installation credential, embed key, workspace name, approved site URL/domain, Live Chat state, connection time, and validated Epkora script URL. **Installation status.** A status request runs on the Epkora settings page after a short cooldown and approximately daily through WordPress cron. It sends the installation credential in an Authorization header and the plugin version in a JSON body; its user agent identifies the plugin version and site URL. Epkora returns whether the installation is connected or revoked, plus the embed key, workspace name, approved domain, and Live Chat state. Public page requests do not trigger this PHP status call. **Disconnect and uninstall.** Clicking **Disconnect** sends an empty JSON array with the installation credential in an Authorization header. Uninstall sends an empty JSON object to the same endpoint on a best-effort basis with a generic Epkora user agent. In both cases Epkora is asked to revoke the installation. Local Epkora options and scheduled events are removed even if Epkora is unavailable. The Epkora integration API also receives ordinary server connection metadata, including the WordPress server’s public IP address. These requests are operational parts of the user-authorized service connection; the plugin sends no unrelated analytics or telemetry. #### Terms and privacy Epkora processes connection details, site metadata, and live-chat information as described in the following documents: * Privacy Policy: https://www.epkora.com/privacy * Terms of Service: https://www.epkora.com/terms By connecting a site, the administrator confirms that they are authorized to connect it and that their site gives visitors any privacy notice or choice required for the Epkora live-chat widget. ## Installation 1. In WordPress, open **Plugins > Add New Plugin**, search for Epkora Live Chat, then install and activate it. 2. Open **Epkora** in the administration menu and click **Connect to Epkora**. 3. Sign in to Epkora (or create an account), select a workspace you are authorized to manage, and approve the website. 4. Return to WordPress and confirm the settings page shows **Connected**. No API key or copied JavaScript snippet is required. ## FAQ ### Do I need an Epkora account? Yes. Epkora is an external customer-support service. The plugin requires an Epkora account and a workspace that you are authorized to manage. ### How do I disconnect? Open **Epkora** in WordPress and click **Disconnect**. You can also revoke the installation from Epkora. Disconnecting removes the local connection and stops the widget; it does not delete the Epkora workspace or its conversations. ### What happens if Epkora is unavailable? The WordPress website continues to render. Status and disconnect requests fail safely, and uninstall still removes local plugin data. Because Live Chat is an external service, the chat interface may be unavailable until Epkora recovers. ### Why is the widget not appearing? Open the Epkora settings page in WordPress. If Live Chat is switched off, enable it in Epkora. If the installation was revoked, reconnect it. A cache may also need to be refreshed after a connection-state change. ### Does the plugin add a “Powered by Epkora” link to my content? No. The WordPress plugin does not inject a credit or SEO link. Branding may be shown inside the Epkora-hosted widget as part of the external SaaS interface. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “Epkora Live Chat” is open source software. The following people have contributed to this plugin. Contributors * [ epkora ](https://profiles.wordpress.org/epkora/) [Translate “Epkora Live Chat” into your language.](https://translate.wordpress.org/projects/wp-plugins/epkora-live-chat) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/epkora-live-chat/), check out the [SVN repository](https://plugins.svn.wordpress.org/epkora-live-chat/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/epkora-live-chat/) by [RSS](https://plugins.trac.wordpress.org/log/epkora-live-chat/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.0.6 * Loads every administration style through the WordPress style API: wp_add_inline_style() for the admin-menu mark and wp_enqueue_style() for the settings screen. No stylesheet is printed directly any more. * Sanitizes the page and callback query parameters read when Epkora redirects back to the settings screen. Older releases: see changelog.txt. ## Meta * Version **1.0.6** * Last updated **17 hours ago** * Active installations **Fewer than 10** * WordPress version ** 5.8 or higher ** * Tested up to **7.1.1** * PHP version ** 7.4 or higher ** * Tags * [customer service](https://wordpress.org/plugins/tags/customer-service/)[customer support](https://wordpress.org/plugins/tags/customer-support/) [help desk](https://wordpress.org/plugins/tags/help-desk/)[live chat](https://wordpress.org/plugins/tags/live-chat/) * [Advanced View](https://wordpress.org/plugins/epkora-live-chat/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/epkora-live-chat/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/epkora-live-chat/reviews/) ## Contributors * [ epkora ](https://profiles.wordpress.org/epkora/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/epkora-live-chat/)