Title: TWT Chat Author: twtchat Published: September 20, 2026 Last modified: September 20, 2026 --- Search plugins ![](https://ps.w.org/twt-chat/assets/banner-772x250.png?rev=3703963) ![](https://ps.w.org/twt-chat/assets/icon-256x256.png?rev=3703963) # TWT Chat By [twtchat](https://profiles.wordpress.org/twtchat/) [Download](https://downloads.wordpress.org/plugin/twt-chat.1.0.1.zip) * [Details](https://wordpress.org/plugins/twt-chat/#description) * [Reviews](https://wordpress.org/plugins/twt-chat/#reviews) * [Installation](https://wordpress.org/plugins/twt-chat/#installation) * [Development](https://wordpress.org/plugins/twt-chat/#developers) [Support](https://wordpress.org/support/plugin/twt-chat/) ## Description TWT Chat is a small WordPress integration for the TWT Chat external SaaS. The plugin is disabled after activation. An administrator with the `manage_options` capability clicks the **TWT Chat** menu and is sent directly to the Accounts address baked into the installed package to sign in. The external Chat Console recognizes the WordPress source, shows the restricted project-list view, and returns the selected` app_id`, normalized `address`, and per-binding `sign_key` through a one-time callback. The plugin does not contain the chat interface, iframe runtime, HTTP API, WebSocket implementation, or browser persistence. It loads the visitor-next loader for the installed build environment only when the setting is enabled and the appid passes the strict ASCII validation contract. ### Settings The plugin stores one site-wide appid, normalized site address, per-binding sign_key, and an enabled flag in the `twt_chat_options` WordPress option. Valid appids contain only ASCII letters, numbers, underscores, and hyphens and are 1 to 128 characters long. There is no editable App ID field and no legacy migration path. A successful binding writes `enabled=true`; **Disconnect your account** first calls the same- environment `/console/site/wordpress_unbind` endpoint with a signed request, then clears all local binding fields only after `code=1`, without deleting the TWT project. The successful project binding authorizes this site to load the external TWT Chat service. It does not replace any visitor consent that the site or a completed TWT Chat privacy assessment may require. ### External Services When a project has been successfully bound and enabled on a front-end page, the plugin loads this fixed HTTPS visitor-next loader: * `https://visitorchat.twt.com/install/core.js?version=v1.2` The loader can create the default launcher and panel and may connect the browser to TWT Chat runtime services. The plugin provides the bound `appid`; the runtime may also process the current page URL and title, visitor session data, chat messages, and cookies, Local Storage, or other browser storage needed to keep chat state. The processing purpose is to provide the requested chat experience and maintain its session. For the production package, the widget frame is served from `https://visitorchat. twt.com/widget-frame/` and its HTTPS API base is `https://visitorchat.twt.com/api/`. Verified runtime requests include `GET /api/fk/user/get_domain_bmd` during widget bootstrap, `POST /api/fk/user/login` when visitor authentication starts, and `/api/ fk/chat/*`, `/api/fk/msg/*`, or `/api/fk/common/*` requests only when the visitor uses the corresponding chat features. After visitor authentication and session initialization, the runtime opens `wss://apichat.twt.com/ws`. No widget iframe, API, or WebSocket request is made while the plugin is unbound or disabled. The plugin does not store a TWT token. It generates a 32-byte random state for each start request, stores only the SHA-256 state digest in a 1-hour (3600-second) transient, and deletes that transient on callback success or failure. The callback accepts ` state`, a strictly validated public `app_id`, a normalized HTTP(S) `address`, and a non-empty opaque `sign_key`. The key is not displayed and is used only to sign the later disconnect request. The confirmed policy links are: * Terms of Service: [https://www.twt.chat/a/agreement](https://www.twt.chat/a/agreement) * Privacy Policy and deletion requests: [https://www.twt.chat/a/privacy](https://www.twt.chat/a/privacy) The production service endpoints, request timing, data-processing terms, consent responsibilities, and loader release controls have been verified for this version. Responsibility for visitor consent remains with the site owner. Administrator enablement authorizes the external service load but is not itself visitor consent. Sites that require opt-in must delay enablement until their consent mechanism allows the service. TWT Chat’s current service documentation and Privacy Policy govern retention, deletion requests, controller/processor roles, subprocessors, and cross-border processing. The `v1.2` loader is immutable for this release, version-pinned in the package, and managed through reviewed compatibility, release, audit, and rollback controls. Uninstalling this plugin retains the local `twt_chat_options` binding data and sets its enabled flag to false. Reactivating a complete retained binding on the same site origin enables the integration without another authorization flow. **Uninstalling the plugin does not delete TWT Chat server-side history**. Use the TWT Chat Privacy Policy and its deletion-request route for service-side data requests. ### Privacy The plugin registers suggested text with the WordPress Privacy Policy guide. Site owners must review that text, their own consent tooling, and the current TWT Chat Privacy Policy before enabling the service for visitors. ### Support Support and documentation are available at [https://www.twt.com/](https://www.twt.com/). ### Release readiness The WordPress.org author, contributor, Plugin URI, Author URI, support channel, and directory assets have been verified and completed for this release. The directory icon, banner, and screenshots are licensed for use with TWT Chat and are supplied through the WordPress.org directory asset channel. ## Installation 1. Install `twt-chat.zip` from the WordPress Plugins screen, or place its `twt-chat` directory under `wp-content/plugins/`. 2. Activate **TWT Chat** for the individual site. Network activation is not supported in this release. 3. In the left admin menu open **TWT Chat** (or **Settings**). The unbound entry creates a one-time state valid for 1 hour (3600 seconds) and redirects directly to the package’s Accounts address with `appName=chat`, `channel=wordpress`, and the callback origin `domain` and site `title` in the Accounts login query. The nested Console redirect contains only `source=wordpress`; the separate `wordpress_return_url` parameter carries the callback URL with the state. 4. Sign in or register. The Accounts service then opens the same-environment Chat Console. 5. In the Console, `source=wordpress` selects the WordPress source mode. Click **Bind/ Authorize** on an eligible project. The Console validates the callback URL and appends the selected `app_id`, normalized `address`, and binding `sign_key`; the callback’s existing state is preserved. 6. The plugin validates the current administrator, consumes the state, stores `appid`,` address`, `sign_key`, and `enabled=true`, and returns to the connected Settings page. Open a front-end page to verify the floating launcher. The plugin makes no front-end TWT Chat loader request while unbound or disabled, during activation, during deactivation, or during uninstall. A formal uninstall disables the local binding without deleting it; reactivation on the same site origin restores a complete valid binding automatically. The administrator click starts the external Accounts login redirect only when no complete binding is retained for the current site; the Console performs project authorization and the plugin accepts only the final validated binding callback result. The environment is fixed at build time and is not configurable. The published package is the production environment: Accounts `https://accounts.twt.com/`, website `https:// www.twt.com/`, Chat Console `https://chat-console.twt.com/`, and customer-service client `https://chat.twt.com/`. Runtime `wp-config.php` values and URL filters do not override the package environment. In the WordPress admin menu, **Resources** opens the matching environment website and **Go to TWT Chat** opens the matching customer-service client. The Console address remains reserved for authorization and project management. The connected Settings page provides external-browser shortcuts to the client conversation list (`/workspace/ chat`), team members (`/workspace/settings/team/service`), and widget customization(`/ workspace/settings/install/custom`). The Settings page language selector supports Simplified Chinese, English, and Traditional Chinese for the current administrator. The selected language applies immediately without changing the WordPress site-wide language. The Accounts login query includes `channel=wordpress`, `domain` (the WordPress callback’s protocol, host and port without a path/query/fragment; normally the same as the site origin), `title` (the WordPress site title, limited to 200 characters), and a separate `wordpress_return_url` callback parameter. Accounts validates and forwards these fields for the login flow. The backend sets the login token on the shared parent-domain cookie; Accounts does not append a token to the Console URL. The nested Console URL retains only the trusted `source=wordpress`. After the project bind response supplies the validated callback URL, Console appends the one-time callback result and redirects back to WordPress. Accounts, Chat Console, and the visitor loader use HTTPS in every package environment. The WordPress site itself may use HTTP or HTTPS; that protocol is retained only in the callback site origin. The visitor loader URL is selected at build time and cannot be changed at runtime. ## FAQ ### Why is the launcher not visible? A fresh installation is off by default. Open **TWT Chat > Settings**, sign in through Accounts, choose an eligible project in the Console, and complete the callback. After a complete uninstall/reinstall cycle, the retained binding is enabled automatically. The loader starts only after a valid appid is saved with `enabled=true`. ### Does deactivation delete chat history? No. Deactivation stops new loader requests and retains local plugin settings. Uninstall also retains the local binding, disables it during removal, and re-enables it after a complete reinstall on the same site origin. It does not delete data held by TWT Chat. Follow the deletion-request guidance in the TWT Chat Privacy Policy. ### Can I configure an API or WebSocket URL? The plugin does not expose arbitrary URLs in the WordPress UI. The Accounts address is fixed at build time, and each address selects its matching Console automatically. The Console receives only the plugin-generated `wordpress_return_url`; its callback URL already carries the one-time state, and Console must append only the validated` app_id`, `address`, and `sign_key` when returning to WordPress. ### Can I activate this on a Multisite network? No. Network activation is intentionally blocked; configure the plugin separately for each site. ## Reviews ![](https://secure.gravatar.com/avatar/276c8d9f29a467f39b6263a0ac1c72b4492037d34377e19d4da1e4b29acef281? s=60&d=retro&r=g) ### 󠀁[A Simple and Reliable Chat Plugin](https://wordpress.org/support/topic/a-simple-and-reliable-chat-plugin/)󠁿 [kai](https://profiles.wordpress.org/twt202412/) September 20, 2026 Easy to install and configure, with a clean interface and reliable chat functionality. It provides a smooth overall experience and is a great choice for adding live chat to a WordPress site. [ Read all 1 review ](https://wordpress.org/support/plugin/twt-chat/reviews/) ## Contributors & Developers “TWT Chat” is open source software. The following people have contributed to this plugin. Contributors * [ twtchat ](https://profiles.wordpress.org/twtchat/) [Translate “TWT Chat” into your language.](https://translate.wordpress.org/projects/wp-plugins/twt-chat) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/twt-chat/), check out the [SVN repository](https://plugins.svn.wordpress.org/twt-chat/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/twt-chat/) by [RSS](https://plugins.trac.wordpress.org/log/twt-chat/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.0.1 * Removed internal environment host names from the distributed package and the plugin description. #### 1.0.0 * Initial disabled-by-default TWT Chat integration with direct Accounts-to-Console login redirect and the WordPress Privacy API. * Uninstall now disables and retains local binding data so a reinstall can restore a complete binding automatically. ## Meta * Version **1.0.1** * Last updated **3 days ago** * Active installations **Fewer than 10** * WordPress version ** 6.0 or higher ** * Tested up to **7.1.2** * PHP version ** 7.4 or higher ** * Tags * [chat](https://wordpress.org/plugins/tags/chat/)[customer support](https://wordpress.org/plugins/tags/customer-support/) [live chat](https://wordpress.org/plugins/tags/live-chat/) * [Advanced View](https://wordpress.org/plugins/twt-chat/advanced/) ## Ratings 5 out of 5 stars. * [ 1 5-star review ](https://wordpress.org/support/plugin/twt-chat/reviews/?filter=5) * [ 0 4-star reviews ](https://wordpress.org/support/plugin/twt-chat/reviews/?filter=4) * [ 0 3-star reviews ](https://wordpress.org/support/plugin/twt-chat/reviews/?filter=3) * [ 0 2-star reviews ](https://wordpress.org/support/plugin/twt-chat/reviews/?filter=2) * [ 0 1-star reviews ](https://wordpress.org/support/plugin/twt-chat/reviews/?filter=1) [Your review](https://wordpress.org/support/plugin/twt-chat/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/twt-chat/reviews/) ## Contributors * [ twtchat ](https://profiles.wordpress.org/twtchat/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/twt-chat/)